Driesnote

By Dries Buytaert
Track: Drupal + Technology
Recording and slides

This year, Dries Buytaert focuses on improvements made for Drupal users such as content creators, evaluators and developers.

Compared to last year, Drupal 8 contributions increased by 10% and stable modules released by 46%. Moreover, a steady progress is noticeable. Especially in many core initiatives like the last version of Drupal 8 which is shipped with features and improvements created from 4 core initiatives.

Content creators are the key-decision makers in the selection of a CMS now. Their expectations have changed: they need flexibility but also simpler tools to edit contents. The layout_builder core module gives some solutions by enabling to edit a content inline and drag-and-dropping elements in different sections. The management of medias has been improved too and there is a possibility to prepare different “states” of contents using workspaces module. But the progress doesn’t stop here. The next step is to modernize the administrative UI with a refresh of the Seven administration theme based on React. Using this modern framework makes it familiar to Javascript (JS) developers and is building a bridge with the JS community.

Drupal took a big step forward for evaluators as it provides a demo profile called “Umami” now. Evaluators have a clear understanding of what kind of websites can be produced by Drupal and how it works by navigating through the demo website.
The online documentation on drupal.org has also been reorganized with a clear separation of Drupal 7 and Drupal 8. It provides some getting-started guides too. Finally, a quick-install link is available to have a website running within 3 clicks and 1 minute 27 seconds!

Developers experience has been improved as well: minor releases are now supported for 12 months instead of the former 4 weeks. Teams will have more time to plan their updates efficiently. Moreover, Gitlab will be adopted within the next months to manage the code contributions. This modern collaborative tool will encourage more people to participate to projects.

Regarding the support of the current Drupal versions, Dries shares that Symfony 3, the base component of Drupal 8 will be end-of-life by 2021. To keep the CMS secure, it implies to be end-of-life by November 2021 and Drupal 9 should be released in 2020. The upgrade from Drupal 8 to Drupal 9 should be smooth as long as you stay current with the minor releases and don’t use modules with deprecated APIs.
The support of Drupal 7 has been extended to November 2021 as the migration path from Drupal 7 to Drupal 8 is not stable with multilingualism yet.

Last but not least, DrupalCon is coming back next year and will be held in Amsterdam!

JavaScript modernisation initiative

By Cristina Chumillas, Lauri Eskola, Matthew Grill, Daniel Wehner and Sally Young
Track: Drupal + Technology
Recording and slides

After a lot of discussions on which JS framework will be used to build the new Drupal administrative experience, React was finally chosen for its popularity.

The initiative members wanted to focus on the content editing experience. This affects a big group of Drupal users. The goal was to simplify and modernize the current interface. Furthermore, embracing practices that are familiar to JS developers so they can easier join the Drupal community.
On one hand, a UX team ran some user tests. Those showed that users like the flexibility they have with Drupal interface but dislike its complexity usually. A comparative study was ran to know what has been used in other tools or CMSs too. On the other hand, the User Interface (UI) team worked on the redesign of the administrative interface and built a design system based on components. The refreshment of the Seven administration theme is ongoing.
Another group worked on prototyping the User Experience (UX) and User Interface (UI) changes with React. For instance, if an editor quits a page without saving they's last changes, a popup appears to restore the last changes. This is possible due to contents stored to the state of the application.

You can see a demo of the new administrative UI in the video (go to 20 minutes 48 seconds):

If you are interested, you can install the demo and of course join the initiative!

Drupal Diversity & Inclusion: Building a stronger community

By Tara King and Elli Ludwigson
Track: Drupal Community
Recording

Diversity in gender, race, ethnicity, immigration status, disability, religion etc. helps a lot. Proven it makes a team more creative, collaborative and effective.

Tara King and Elli Ludwigson who are part of the Drupal Diversity and Inclusion team presented how Drupal is building a stronger and smarter community. The initial need was to make Drupal a safer place for all. Especially for the less visible ones at community events such as women, minorities and people with disabilities.
The group addressed several issues, such as racism, sexism, homophobia, language barriers etc. with different efforts and initiatives. For example, diversity is highlighted and supported in Drupal events: pronoun stickers are distributed, #WeAreDrupal hashtag is used on Twitter and social events are organized for underrepresented people as well. Moreover, the group has released an online resource library, which collects articles about diversity. All of this is ongoing and new initiatives were created. Helping people finding jobs or attracting more diverse people as recruiters are only two to name.

If you are interested in the subject and would like to be involved, there are weekly meetings in #diversity-inclusion Drupal Slack channel. You can join the contrib team or work on the issue queue too.

Willy Wonka and the Secure Container Factory

By Dave Hall
Track: DevOps + Infrastructure
Recording

Docker is a tool that is designed to create, deploy and run applications easily by using containers. It is also about “running random code downloaded from the internet and running it as root”. This quote points out how it is important to maintain secure containers. David Hall illustrates this with practical advice and images from the “Willy Wonka and the chocolate factory” movie. Here is a little recap:

• Have a light image: big images will slow down deployments and also increase the attack surface. Install an Alpine distribution rather than a Debian which is about 20 times lighter;
• Check downloaded sources very carefully: for instance, you can use wget command and validate checksum for a file. Plus you can scan your images to check vulnerabilities using tools like Microscanner or Clair;
• Use continuous development workflows: build a plan to maintain your Docker images, using a good Continous Integration / Continous Delivery (CI/CD) system and document it;
• Specify a user in your dockerfile: running root on a container is the same as running root on the host. You need to reduce the actions of a potential attacker;
• Measure your uptime in hours/days: it is important to rebuild and redeploy often to potentially avoid having a compromised system for a long time.

Now you are able to incorporate these advice into your dockerfiles in order to build a safer factory than Willy Wonka’s.

Decoupled Drupal: Implications, risks and changes from a business perspective

By Michael Schmid
Track: Agency + Business
Recording

Before 2016, Michael Schmid and his team worked on fully Drupal projects. Ever since they are working on progressive and fully decoupled projects.
A fully decoupled website means that frontend is not handled with Drupal but with a JS framework such as React. This framework is “talking” to Drupal via an API such as GraphQL. It also means, that all interactions from Drupal are gone: views with filters, webforms, comments etc. If a module provides frontend, it is not useable anymore and needs to be somehow re-implemented.
When it comes to progressive decoupled websites, frontend stack is still built with Drupal. But some parts are implemented with a JS framework. You can have data provided by APIs or injected from Drupal too. The advantage is that you can benefit from Drupal components and don’t need to re-implement everything. A downside of it are conflicts with CSS styling and build systems handled on both sides. Therefore you need to have a clear understanding of what does what.

To be able to run such projects successfully, it is important to train every developer in new technologies: JS has evolved and parts of the logic can be built with it. We can say that backenders can do frontend now. In terms of hiring it means, you can hire full stack developers but also JS engineers. Attracting more developers as they love working with JS frameworks such as React on a global level.

Projects are investments which continue over time and expect failures at the beginning. These kinds of projects are more complex than regular Drupal ones, they can fail or go over budget. Learn from your mistakes and share them with your team in retrospectives. It is also very important to celebrate successes!
Clients request decoupled projects to have a faster and cooler experience for users. They need to understand that this is an investment that will pay off in the future.

Finally, fully decoupled Drupal is a trend for big projects and other CMSs are already using decoupled out of the box. Drupal needs to focus on a better editor experience and a better API. There might also be projects that require simple backend edition instead of Drupal.

Hackers automate but the Drupal Community still downloads updates on drupal.org or: Why we need to talk about Auto Updates

By Joe Noll and Hernani Borges de Freitas
Track: Drupal + Technology
Recording and slides

In 2017, 59% of Drupal users were still downloading modules from drupal.org. In other words, more than half of the users didn’t have any automatisation processes to install modules. Knowing that critical security updates were released in the past months and it is only a matter of hours until a website gets potentially hacked, it comes crucial to have a process to automate these updates.
The update can be quite complex and may take time: installing the update, reviewing the changes, deploying on a test environment, testing either automatically or manually and deploying on production. However this process can be simplify with automation in place.

There is a core initiative to support small-to-medium sites owners that usually are not taking care of security updates. The idea is a process to download the code and update sources in the Drupal directory.
For more complex websites, automating the composer workflow with a CI pipeline is recommended. Everytime a security update is released, the developer pushes it manually in the pipeline. The CI system builds an installation containing the security fix within a new branch. This will be deployed automatically to a non-productive environment where tests can be done and build approved. Changes can be merged and deployed on production afterwards.

To go further, the update_runner module focuses on automatizing the first part by detecting an update and firing up a push for an update job.

Conclusion

We are back with fresh ideas, things we are curious to try and learnings from great talks! We joined social events in the evenings too. Therefore we exchanged with other drupalists, in particular with the Swiss Drupal community! This week went so fast. Thank you Drupal Europe organizers for making this event possible!

Header image credits: Official Group Photo Drupal Europe Darmstadt 2018 by Josef Dabernig, license CC BY-NC-SA 2.0.

Photo group of the attendees (Photo: (link: https://www.flickr.com/photos/drupalassoc/ text: Drupal Association))

We were 11 Liipers gathered to learn more about Drupal 8 and all its related topics. Three of us held sessions: if you want to learn more about testing, serialization with Symfony or self-managing organizations, check out the videos online !

The sessions started with an awesome prenote given by Jeff McGuire a.k.a. “Jam” and Robert Douglass, both respectively dressed up with fancy traditional Spanish clothes and cow-suit. This prenote was a really good way to start the sessions with learning a bit of Catalan culture, traditions, architecture and its similarities with the Drupal community. We also learned the most useful sentence in Catalan of the week  “Si us plau pots revisar el meu pegat?” which could be translated by “Please review my patch.”. Even if you have to wake up early, it's worth it !

Then, the Driesnote started. Dries chose to face uncomfortable questions like “Is Drupal losing momentum?” or “Why is Drupal 8 not released?”.

Based on the lessons learned during the long development cycle of Drupal 8, he is proposing that the development process changes with time-based releases. Whenever a feature is shippable, it will be merged to finally get a shippable main branch. He announced that the first release candidate should be ready on the 7th of October 2015 and we now know that it is ready !

Then he tackled the market position of Drupal compared to other CMS such as WordPress. In reality, Drupal is the dominant platform for large and complex websites due to its scalability and flexibility. But Drupal has to improve user experience for non coders to get realized its full potential.

Finally, he talked about progressive decoupling that can achieve both traditional CMS and client-side apps advantages. Drupal 8 will offer the option of progressive decoupling through page-building tools and decoupled by feeding Drupal data to client-side apps.

The three-day sessions covered various topics such as business and strategy, development, core conversations, devops, content strategy, site building, front-end, project management etc. and about ten sessions were held at the same time. It was sometimes hard to pick one among all of these interesting subjects ! And the day always started with keynotes about web psychology, mental health and community contribution. DrupalCon is not only for developers but relies on all the fields related to Drupal projects. I made a selection of talks for you… Don't hesitate to watch the videos of the sessions to learn more about each subject !

Drupal 8 multilingual site building hacks

Site building – video – slides

Gábor Hojtsy and Vijayachandran Mani demonstrated how the translation system works now in Drupal 8. They took all the contrib modules that handled translation from Drupal 7 such as entity translation, i18n, title, localization update etc. and included them into core.

English is now available for interface translation as an option and blocks are translatable so we can have different menu blocks depending on language. We also learned that every listing from the administration interface is built with the views module and can be overridden.

Drupal 8 theming

Front-end – video – slides

The class soup and div soup are features in Drupal. This is one of the statements Drupal 8 theming system is going to kill (and all the theme functions with it) by introducing Twig, a modern template language used in Symfony framework.

Morten Birch Heide-Jørgensen, maintainer of the “ classy” theme, showed how we have complete control over the markup with several demonstrations on how to edit templates. For instance, there are now template files for menus and pagers ! We also can extend templates and override individual blocks easily avoiding duplicating markup. On the topic of theming debugging, there is a cool feature where the names of the templates used for the page are mentioned as HTML comments.

Making Drupal fly

Coding and development – video – slides

Fabian Franz and Wim Leers told us a little bit more about the caching system built in Drupal 8. It is all about tracking dependencies to know how we can invalidate cache and Drupal 8 manages to do this with cache tags (data dependencies), cache contexts (context dependencies) and cache max-age (time dependencies). But the cacheability was still not good enough as a page can contain static parts as also dynamic parts and these dynamic parts slow the page down. The solution that Drupal 8 core provides is placeholders and auto-placeholdering. Each dynamic block can automatically be a placeholder that has an independent lazy builder which is able to render elements in isolation. Auto-placeholdering allows to defer rendering to a later time and it is configurable. You can also define your own placeholder render strategy.

Self management organisations : teal is the new orange

Business and strategy – video

Our two Liipers, Lukas and Tonio presented what are self-managing organizations and how Liip is getting closer to become a teal company. According to Frederic Laloux, author of Reinventing organizations book, there are different organization color-levels from impulsive-red which represents an organization driven by one authority and division of labour, to evolutionary-teal which represents complete self-management without any hierarchy.

Liip is coming closer to teal as we have currently no middle management, partners are willing to let it go and every Liiper can easily take initiatives to empower business and technology. Plus, each team are cross-functional and self-organized: it produces its projects, maintains them, does innovation and is able to hire new people. In fact, each team takes responsibilities for its decisions. But there are still some missing points to reach teal… For instance, we still need management for big budget decisions, dealing with conflicts or salary topics. To become teal, we can find our own solutions or using existing ones such as “ holocracy” which is a framework to implement self-management. We don't know yet which solution to choose but teal is definitely going to happen within the next months !

How changing our estimation process took our project endgame from WTF? to FTW!

Project management – video

It is really rare that a client comes to you to build a project with endless budget. So how to deal with a client that requests for proposals but only has a fixed budget?

Ashleigh Thevenet's solution is to integrate two estimate revisions in the project during discovery phase and design phase. It is very important to explain this process to the client and be transparent during all the phases: kickoff meeting, early technical planning (first rough estimation), UX sketches, wireframes and final technical planning (second revised and accurate estimation). And the results are deliverables shared with the client that include links to wireframes, implementation notes and a full feature list with estimates.

If there is over budget, some options are to de-scope items to a later phase, ask for more budget or divide work between your team and the client's one.

Even if some budget has already burnt for doing the whole estimation process, this is time well spent to avoid rabbit holes with technical plannings and valuable deliverables. In fact, the project has already started during the estimation process.

There are still some disadvantages: the client has to understand the whole process and has to buy in. It also can be difficult to schedule meetings as a lot of people within the team are involved but this is still work in progress with a lot to improve.

Defense in Depth: Lessons learned securing 100,000 Drupal sites

Devops – video – slides

Starting with the statement that every online website can be hacked, David Strauss, Chris Teitzel and Luke Probasco showed us how to secure websites today from the hosting to the team. As the typical breach comes from human errors and bigger breaches are often built on smaller ones, you really have to build a security consciousness. You have to think about security when building a module, deploying a website and accessing emails… And be aware of all of the aspects of it: confidentiality, integrity of data and availability.

Then you need to have procedures within the company to limit your exposure. It is useless to have a secure Drupal website and a secure hosting environment while you're emailing your server's passwords. You also have to know if you're vulnerable thanks to security announcements ( Cert-EU, drupal.org/security, Twitter security groups etc.).

Keeping a backup, using version control to know if the code has changed, using secure passwords and two-factor authentications are some of the keys to ensure essential security. Keep in mind that the whole stack has to be secured: the hosting, the operating system, the web server, the database, the Drupal sources and the team.

Building semantic content models in Drupal 8

Content strategy – video – slides

Stéphane Corlosquet and Kevin Oleary's session was about how to create semantic contents and models in Drupal 8.

First of all, schema.org standard was adopted by Drupal in 2012 and it provides schemas for structured data on the internet. Its vocabulary can be used with different formats including RDFa that simply adds HTML attributes to describe content and these are really useful for search engines such as Google to understand and reuse these values.

Currently, there are existing contrib modules in Drupal 8 (and 7) dealing with semantic content strategy. RDF UI enables to map each field with an RDF property using the regular field UI. RDF UI Builder go further by generating “ready-to-use” content types with existing fields built from the schema.org models. In the future, we could imagine content models bundled as shareable features and also have a UI with a content modelling tool. Plus, we could imagine connect the content with third-party APIs: for instance, we could use echonest to get a list of musical genres that is constantly updated instead of creating taxonomies for that.

There is also a WYSIWYG plugin for TinyIMCE called RDFaCE which enables to create semantic content. In that way, you can annotate words to avoid ambiguity, for instance using “London” for the city in Canada and not the one in the United Kingdom.

Using linked data tool module, you can map a node or a term to a particular ID from external sources of wikidata or freebase. And the idea behind this is to be able later to search related contents (videos, audio etc.) and pull them directly into the content edition page.

But the the whole work about semantic is still in progress and feedbacks are very welcomed.

The third day of conferences finished with the closing session where Holly Ross and Amanda Gonser from the Drupal association announced the next Drupal big events: DrupalCon Asia, DrupalCon New Orleans and DrupalCon Dublin ! The Indian community members warmly promoted their event as they prepared a traditional and colorful dancing for it.

On the last day, I attended the first-time sprinter workshop where you can learn about all the tools needed to have a computer ready-to-sprint. For more information, you can go to:  Drupal.org/tools and also check out the page about mentoring: Drupal.org/core-office-hours.

It is important to say that everybody can be part of sprints as all skills are needed and of course mentors do a great job to push people in the right direction. During this DrupalCon, 70 mentors were there to help and there were about 200 sprinters working on the Drupal 8 issues.

There are also many social events organized at night where you can exchange with the community around a beer or some tapas like the Welcome party or the Women in Drupal meetup. Even if there are few, I could met some women in the community including site builders, themers, back-end developers and project managers and it was a pleasure to exchange with them about Drupal !

There is actually a really good spirit all around the Drupal community and we could feel it during  the whole DrupalCon event.