Talking Drupal #577 - Off The Cuff 14

[00:00:00] Nic: This is Talking Drupal, a weekly chat about web design and development from a group of people with one thing in common: we love Drupal. This is episode 577, Off the Cuff number 14. On today's show, we are talking about Drupal 12, field UI, general UX, and we'll also cover Droobom as our module of the week.

Welcome to Talking Drupal. Today, we're doing one of our Off the Cuff episodes with our hosts. I'm Nic Laflin, founder at nLightened Development, and today my co-hosts are, joining us for the next three weeks, Emma Horrell, UX lead for Drupal CMS and UX manager for Drupal Core. Emma is the UX lead for CMS, the UX manager for Drupal Core, and is also part of the Drupal AI Initiative.

She also organizes the Drupal Gun Higher Education Summit, and is all about making Drupal easier to use and opening it up to new audiences. Welcome to the show, and thank you for joining us.

[00:01:00] Emma: Thank you for having me.

[00:01:02] Nic: Also joining us as usual, John Picozzi, solution architect at EPAM.

[00:01:07] John: Nic, you'll be, uh, you'll be happy to know that I actually wore a Halloween costume this year.

[00:01:12] Nic: Oh, who, who were you?

[00:01:14] John: I was actually just a, a dude in a tracksuit from the '80s. Had a nice, had a nice '80s style hairpiece that I was wearing and a bright colored tracksuit, and it was, uh, it was great.

[00:01:27] Nic: That's fun. Uh, our, our longtime listeners will know that my wife always makes a con- uh, a big costume, and we always go to Salem, Mass for Halloween.

This year there were, I think, close to 140,000 people. Um, so I was Woody and she was Lobo Peep, and we found quite a few, uh, other characters from the movies, so it was a lot of fun this year. Um, we even put in a pull string so people could pull the string, and then I'd say some of the quotes. So it was, it was a lot of fun.

And also joining us for the whole show today, Martin Anderson-Clutz, product marketing manager for Drupal at Acquia.

[00:02:09] Martin: Hello, internet friends.

[00:02:11] John: Martin, what were you for Halloween?

[00:02:13] Martin: Uh, I did not dre- dress up, I'm afraid to say so.

[00:02:18] Nic: It's no fun.

[00:02:19] John: I was a Drupal solution architect.

[00:02:21] Martin: There you go.

[00:02:24] Nic: And now it's time to talk about our module of the week, so let's turn it over to Martin.

Martin, what do you have for us this week?

[00:02:32] Martin: Thanks, Nic. Have you ever wanted a full inventory of everything your Drupal site is built from, checked against public security advisories, and exportable as a standard SBOM? There's a module for that. It's called Drubom, or D-R-U-B-O-M, uh, Drupal Bill Of Materials.

It was created in October of 2023 by Paolo Mainardi of SparkFabric and rewritten this fall. It has a 1.0.0beta4 version available, which works with Drupal 11.3 and 12, and it is actively maintained. In fact, that latest release and commit were both just this past Sunday. For security coverage, it has opted in, although there's no stable release yet.

It has test coverage, and for documentation, there's an in-depth README, plus separate docs on the advisory sources and on scanning in CI. Um, it has four open issues, none of which are bugs, and one of them is the plan for the stable release. It is officially in use by nine sites according to Drupal.org.

And for anyone not familiar, SBOM stands for Software Bill Of Materials, a list of every component a site is built from with its version, license, and source. Auditors, security teams, and customers are increasingly asking for exactly that information. Uh, Drubom takes a snapshot that covers the PHP runtime and its extension, Composer packages, Drupal modules and themes, asset libraries like jQuery and CKeditor 5, and NPM, Yarn, and pnpm lockfiles in your themes and modules.

Anything it can't read shows up as a coverage gap. Gaps are always listed, never hidden. Advisory checks are opt-in. You can check against Drupal.org security advisories, the Packagist advisory database, osv.dev for NPM, and the PHP project's own advisories. Packages from private repositories are never sent out, and you can list private NPM scopes to keep them out of advisory checks, too.

Findings that appear in CISA or ENISA catalogs of known exploited vulnerabilities get flagged and go to the top of the f- of the list. For each finding, you can record a decision on whether your site is actually affected, called a VEX statement. A decision applies only to that exact package version and gets confirmed again after each new snapshot.

The adit- admin dashboard under reports has an interactive dependency map, so you can see which Drupal project brought in some deep NPM package. For CI, drush drubom colon check, uh, can fail a, excuse me, can fail a pipeline when open findings hit a severity threshold, and the export is a standardSPDX 3.01 document ready for auditors.

Under the hood, it's all pure PHP now. The original version wrapped the, uh, SYFT and, uh, Grape binaries, and the rewrite dropped them. Running drush updb saves your old reports as files before removing the old settings. There's also a bin/drubom-scan script that builds the SBOM from the code-based files without running any of the site's code.

That's useful when an auditor shouldn't have to trust the site or after a suspected compromise. Uh, a couple of caveats. You need a private file system, and few security tools yet are able to read the newSPDX four, uh, three format Now Update, uh, Status in Core is the obvious comparison here. Both will tell you when something on your site has a security advisory, but Update Status checks Drupal.org release data for Drupal projects only.

Drubum builds its inventory from lock files and the code base, so it also covers Composer NPM libraries and PHP, and matches advisories against exact versions. So let's talk about Drubum.

[00:06:31] John: I like the name of the, uh, the module. Um- Yeah ... feels, feels very hip and cool. Um, I, I like actually the visuals that this gives you, and the fact that it's looking at your, your lock files and your code base to kind of determine what is making up your project, as opposed to just the, um, you know, the Drupal security or the Drupal update script that looks at Drupal modules.

I also thought it was interesting, I scrolled down the page here and it has, like, a dependency map feature where you can kinda see all of your, um, dependencies and, and i- in, like, this kind of, like, galaxy-looking map thing. Um, so, I mean, I think a- great visualizations here, but of course that's not the main focus of the module.

I think it's interesting to be able to have this kind of, um, this kind of depth into, um, you know, upstream or downstream dependencies that may, may be impacting your, your code base. So very cool.

[00:07:30] Nic: Yeah. I think-

[00:07:31] Martin: Yeah ...

[00:07:31] Nic: I, I think... Oh, go ahead, Martin.

[00:07:33] Martin: Oh, I was just actually gonna say, Nic, you had been the one, I think, who originally nominated this one.

So, uh, would be interested to hear if this was something you needed for one of your, uh, clients.

[00:07:43] Nic: Um, I, I think we'll talk about it a little bit more, uh, if we get to that, this section of the Off The Cuff episode. But basically, one of the, uh, with the new kind of update landscape for security across the web, not just Drupal.

Drupal's, I mean, been hit pretty hard, but, uh, i- in the sheer scale of releases that have been coming out recently. But just being able to quickly see at a glance everything that's available, all the plugins, all the modules, everything is, is really important. Because e- even if you look at just NPM, if, if you have any moderately complex NPM- project, you're gonna have 25,000 node module dependencies and keeping track of all the individual ones and you have the audit, but you have to kind of run that.

This is something you can just throw in CI and have a nice little visual to show you what you need to do. Um, it also probably, I think for some clients might be a good way to be like, "Hey, look at all these dependencies we have. Should we consider maybe removing some of them, or should we consider finding replacements for some of them that are more modern?"

And that might be, um... It, it, it's something that seems like a, an easy thing to share with clients. Um, uh, maybe you'll, with screenshots and things, maybe it's not something you would just give them access to, but it'd be something you could, um, start that discussion with. Um, 'cause hi- historically it's a discussion I have with some clients, but if they're not an agency, it's usually a discussion that doesn't go very far.

So I think having something like this back, like, "Hey, we have 82 dependencies. That seems kind of like a lot. Maybe we should reduce that." Um, be- so I, I haven't actually used it yet. I've shared it with three or four clients. I think we'll probably start installing it in the next week or two and see how it, how it goes.

[00:09:39] John: So just out of curiosity, and I just thought of this based on something you just said, Nic, but, like, you have this installed on a client's site, right? And you're, I don't know, you're installing a module that has a lot of, um, a lot of dependencies in, in other, other spaces, right? And this report comes back with, like, you know, some, some security flaws, right?

Not, maybe not major security flaws, maybe, you know, maybe, uh, whatever. Like, what does the process look like to get those things addressed? Because they're not necessarily Drupal module related, right? They're, they're another package or another thing that, like, then you have to get into their issue queue and, like, try to see if you can get a resolution there.

And then if you do get a resolution there, then do you have to then ask the module maintainer to update their version of the, the... Like, could you, could you summarize how you think that, like, that works? Because, like, for me, I'm like, "Oh, this would be a cool module to have on my site just to kind of see what, what's going on."

But, like, then what is the, what does the path to remediation look like?

Uh, you're, you're muted

[00:10:52] Nic: Yeah, I'm muted. Yeah, I need to- Unmute.

[00:10:54] John: There

[00:10:54] Nic: you go Yeah, hit unmute. Um, it... That's an interesting question. It's something that Core itself, if, if I understand your question correctly, it's something that Core itself has been battling with. So, um If you, if you have a module that's a dependency and it's not a direct dependency using, for example, update-W, capital W will generally update it, right?

It's updating all the dependencies, too. Um, so you can... If C Tool, C Tools is a common one, right? If C Tools had a security update, almost nobody includes C Tools directly, but there's three or four projects, uh, three or four contrib modules that use it. Um, so if you just did Composer update, it's not gonna get updated.

Dash W generally will cover that. But sometimes if they, uh, let's say for example, C Tools does a major version update, so I think, I don't know, say version four is the current version, they release version five. If the contrib module only says, "Hey, four is the only version we allow," doing even with dash W, it's not gonna update.

So there's a couple of ways around that. One is, um... Sorry, we're getting some typing from somebody. I'm, I'm not sure who that is. I think that might be you, John. I don't know if you're typing. It's not

[00:12:07] John: me.

[00:12:08] Nic: Um, if we're, it- I- you-- so there's some ways to get around that. One way is you can tell Composer, "Hey, install this version, but pretend it's that version."

So it's like a short-term solution. You have to be very careful and test that thoroughly. Um, the other, uh, way to do it is to reduce the complexity. So the, the issue that Core was running into is all- a lot of the dependencies outside of Drupal for Core, like Twig and Symfony, they only do minor version updates, and the Core recommended package, like, pinned those versions pretty tightly.

And in the last version, we actually just opened a lot of those versions up because update... That meant that Drupal had to do an update every single time any dependency updated, and that's really painful. Um, so we've slowly been opening those dependencies up to make it easier to update. But really, the, the big thing is, and this is what I was alluding to earlier, reduce your dependencies.

You know, it, it... we're getting to the point where the amount of time you have to spend updating, it's worth investing some time reducing and removing dependencies. The fewer modules you have, the fuse- fewer upstream dependencies you, you have, the fewer things you have that are external code, the less likely you're gonna get hit by a security update and need to update.

So I, I... Oh, go ahead, Martin.

[00:13:33] Martin: Oh, I was just gonna add, like, I have actually not too long ago been through a process that I think is exactly what John was describing. So, um, I'm one of the maintainers on the SVG image field module, and it has a dependency on a library called SVG Sanitize that basically, whenever a user uploads an SVG, we'll look for any kind of malicious code in there.

And there was some kind of a security advisory on that library on the version that had been required for, by the SVG image field module. But there was a period of time where the, the version where the fix was implemented didn't have a stable release. So eventually, somebody from the Drupal community basically pinged the maintainer of the library until they actually made a stable release, and then we were able to update the module to require the new stable version that had the security fix- Yeah

in the downstream library, and then everybody was sort of, uh, secure again. So, uh, that was kind of, I think, you know, speaks to the process that, that you were asking about, John.

[00:14:38] John: Yeah. I mean, I think that's part of, like, that's like- I don't know. I think that's p- one of the hard parts, right? Because I, you know, I've even had, um, I've had instances where, you know...

I'll, I'll give a great example. I use, um, Mailgun on my, on my personal site for, for transactional email delivery, and, um, this doesn't, this isn't, uh, a- any sort of security issue. Uh, but like their current, the, the mo- the, uh, library that's used currently for that module doesn't support, uh, I think PHP 8.4 or 8.5, or I, I don't know.

It doesn't, doesn't support the, like, latest and greatest version of PHP that I'd like to, I'd like to be using. So, like, there's a whole process there to try to get this module updated to use the, like, 4- 4.x branch of, of the, of the, uh, Mailgun library to be able to then support the, you know, PHP, you know, 8.5 or whatever, whatever it is.

So, like, you know, I think it's great to have the insight, but then there's, like, that underlying, uh, work that has to go into, like, you know, pushing, pushing the people to make the changes that are necessary to, to resolve the problem

[00:15:54] Emma: Can I ask a question? Yeah, yeah. Oh, I was just gonna ask a question. No, no, go ahead.

Yeah. Like, how do you know it's got everything? Like this map, does it... You know, is part of the success of the mapping functionality gonna depend on how, like, data is labeled and such? Could it, you know... I guess- So- ... this is a question when it's been installed with, with use cases.

[00:16:18] Nic: Yeah. So, so it, um, I, I haven't looked at the internals.

I probably will before I use this, but, um, I, I would suspect it's using the NPM and Composer APIs to, like, understand the dependency chains, and then just building a graph from that. That's how it's building that, you know, fancy Galaxy- Mm-hmm ... um, map that John had mentioned. But it, you know, it's certainly possible to include things directly.

It's really not recommended in the community anymore, but, uh, it's more common in WordPress, for example. So WordPress is, if something like this exists on WordPress, it probably would have a harder time because it's pretty standard in WordPress just to copy and paste a plugin in. Or, uh, in fact, some premium plugins require you to kind of copy directly and, and you can't use a dependency manager.

But kind of the, the whole point of using something like Composer NPM is that it does dependency management, and because it does that, it can report at fairly accurately what, what is installed through itself. So it's using those APIs, I would suspect. Um, could there be bugs or gaps? Certainly. Like for example, I know NPM does a really fuzzy job at including specific versions.

It's one of the reasons why if you do NPM I, it's faster than doing NPM CI, is because if you do NPM install rather than, um, whatever, uh, CI stands for there, it, it's just pulling in whatever version it thinks it can, rather than the specific version that you've defined. So you can end up with different versions than what you kind of would expect between different runs.

But that's really the, on the dependency manager side- Mm-hmm ... not Drupal. Like, there's nothing Drupal can really do about that, I think. Um- All right. Anyway, as always, Martin, you found a, a, a wonderful module of the week, and I plan on installing this, like I said, in the next couple weeks, so I'll be happy to report back.

But if folks wanted to connect with you or suggest a module of the week, where's the best place to do that?

[00:18:21] Martin: We're always happy to talk about candidates for module of the week in the Talking Drupal channel of Drupal Slack, or folks can reach out to me directly as mandclu on a variety of Drupal and social platforms.

And in the coming weeks, I'm gonna be at a couple of different events, so, uh, by all means, if you're there and see me, uh, you know, stop by and let's have a chat. Uh, so I'm gonna be at NedCamp in, uh, a couple of weeks. Uh, the week following I'll be at Evolve Digital in New York City, and, um, about a week and a half after that I'll be at the DrupalAI Summit in Paris.

[00:18:57] Nic: Awesome. Thank you, Martin All right, so since we are live, we have a few listeners. We can, uh, uh, just quickly give a PSA that, uh, today is Election Day in the United States. So if you are in the US and eligible to vote, get out to the polls. Um, most places I think you can vote till 8:00 PM. Uh, so do your, do your civic duty.

[00:19:20] John: So for the first time, uh, my ballot was actually two pages.

[00:19:28] Nic: Mine was three.

[00:19:30] John: What

[00:19:31] Nic: is happening

[00:19:32] John: here? Double-sided.

[00:19:32] Nic: Five pa- ... We have nine ballot questions-

[00:19:36] John: So- ...

[00:19:36] Nic: this election in Massachusetts ...

[00:19:38] John: yeah, it was like, I was like, "Wow." I'm like, "This is a lotta, a lotta questions, a lotta stuff going on." Um, so yeah, I, I echo, I echo Nic's, Nic's sentiment.

Go out, vote. Um, you know, if you're, if you're one of those folks that likes to complain that, uh, you know, your elected officials don't do what they should be doing, this is your, uh, this is your point in time to be able to, to change that. Um, and if you don't vote, you know what? You can't complain. Kevin Thal just told me that his page, his ballot was 10 pages.

Uh, that is-

[00:20:12] Nic: 10 pages ...

[00:20:13] John: ludicrous, sir. Did you have to spend an hour at your polling place? Did they offer you lunch or something? That seems absolutely insane to me. Uh, so- 10 pages?

[00:20:23] Nic: In Indiana, wow. So I, I, I don't know if they do this for you guys, but for us, we have, like, those Scantrons. When you put them in, it counts- Mm-hmm

each page. Mm-hmm. So when I put, put in my last one today, it was 165, which I think means before me there were 55 people, or I was the 55th person. But I... 10 pages, my good- I imagine- They're gonna have to empty those things- I imagine the Scantron- ... every 10 people.

[00:20:45] John: I imagine the Scantron line at, uh, Kevin Thal's polling place was, like, around the corner because, um, he was in and out in 10 minutes, so it took him a minute a page, which is impressive because I did a, I did a little bit of research as well, and I still had to read, read the rules of how many people I could pick for each and, and what, uh, you know, what the questions were and all that stuff.

I also read incredibly slow, as our listeners know. So anyway.

[00:21:12] Nic: Yeah, it was... It... Yeah, do, do your duty. Polls are open.

[00:21:16] John: Ha ha, you said duty.

[00:21:19] Nic: All right, so, uh, Martin also quickly mentioned these, but we'll give you the dates. Uh, NedCamp is going to be on November 13th and 14th in, at Rhode Island College. Evolve Digital New York is November 19th and 20th.

Mm. There's also apparently a Drupal AI Summit, but I don't have a date in the show notes, so we'll have, we'll have that next-

[00:21:39] Martin: It's December 1st. December 1st. Yeah, I have it in the show notes, yeah.

[00:21:42] John: And whereabouts is that?

[00:21:43] Nic: Perfect.

[00:21:44] John: In

[00:21:44] Emma: Paris, I think.

[00:21:46] Martin: In Paris, yes.

[00:21:47] John: Martin, are you going to Paris?

[00:21:49] Martin: I am.

[00:21:50] John: Look at this guy.

Oh. He, Martin gets around. So- Jet, jet setting. Martin, Martin and I will both be at NedCamp and, um, Evolve Digital, uh, New York. Uh, I will say, uh, for NedCamp, uh, two-day event, uh, November 13th and 14th, as Nic said. The 13th is contrib day. It is training day. The summit, right? We have Mike Anello doing an AI training that I'm, I'm actually attending myself, 'cause I think it's gonna be great.

Um, and then we have the education summit happening as well on the 13th. Um, uh, and Mike Miles is, is running that, and it's gonna be, it's gonna be fabulous. And then the 14th we have a full day of sessions, so excited about that. We actually added one more session room, because we had so many great sessions.

We, we, um, wanted to, wanted to be able to showcase them all. And, uh, Ethan Marcotte is actually gonna be our keynote speaker, and that's super exciting. Super exciting to me. So, um- Yeah ... you know, I think, you know, NedCamp this year is gonna be great. Hope to see you there. If I can't see you there, I'll be, uh, doing a panel discussion, uh, in New York at Evolve Digital on the 19th and 20th.

Martin is also speaking at both of these events as well. Um, the panel discussion is the, uh, future of CMS. Uh, it's an honest panel discussion with folks from the Drupal community, um, the, uh, WordPress and Joomla communities, and, uh, some other, some other popular CMS communities. So, um, definitely gonna be a good time in New York as well.

So, if you're around, say hi. Always like to meet, uh, listeners. And yeah, I look forward to, uh, getting out and meeting the people

[00:23:38] Nic: Awesome. Okay, I think, John, you put this next top... So i- if it wasn't clear, this is gonna be an off-the-cuff episode, so we are each, we each submitted a few topics. Um, unfortunately, our g- our guest was under the weather today, so we had, we had to reschedule.

Uh, so Martin- I will say

[00:23:56] John: the Drupal 12 was Martin, I think. I, it wasn't me.

[00:23:58] Nic: Oh, was that you? Okay. That was

[00:24:00] Martin: me, yeah. So Martin,

[00:24:00] Nic: D- Drupal 12 is coming. What, what are your thoughts?

[00:24:04] Martin: So a couple of thoughts. I mean, number one, if anybody hasn't already tried it out, you know, we have had for, I think it was before Rotterdam maybe, the, uh, the Drupal 12 beta.

[00:24:14] Nic: Mm-hmm.

[00:24:14] Martin: But the release candidate is due next week. So, you know, again, you know- This week

[00:24:19] Nic: or next week, yeah.

[00:24:20] Martin: Next week, I think, yeah. I think next week. So, um- So yeah, you know, moving us, you know, that, that n- important next step closer to the final release, which is, I think ex- expected the second week of December.

So, um, you know, I think it, it's, uh, it's always exciting when there's a new release, you know? It's, we're gonna get a version of Drupal that's, you know, faster, more secure. Um, you know, this one in particular a little more svelte in terms of having the reduced code base from having some of the modules that, uh, that are being kind of removed from, uh, Drupal 12.

So but importantly, it becomes sort of, you know, the launching off point for the next round of innovation that we're gonna have, and, you know, 12.1, 12.2, and, and all of those other good things. Yeah. So, um, so it, it's an exciting time, but, you know, there's, there's always, you know, some level of work involved.

Um, so, you know, if you're a Drupal site owner, I would say this is a great time to make sure that you're running the latest version of Drupal, you know, 11.4, so that that transition into Drupal 12 will be as painless as possible. Also look at, like, environment requirements, so getting onto PHP 8.5 now or, you know, finding places where, as John cited earlier, maybe there are some modules that don't yet fully support PHP 8.5.

Yeah. Those are the kinds of things that it, it's good to find out now so that, you know, you can start to plan out, um, you know, what's the work that's required to make sure that your whole sort of tree of dependencies is gonna be, uh, ready to make the transition to Drupal 12.

[00:25:50] John: I will, I will say I, I switched over to, and I know Nic's gonna chastise me about this, but I switched over to the, uh, experimental admin theme.

Um, and- I won't chastise

[00:26:00] Nic: you for that.

[00:26:01] John: What's that?

[00:26:02] Nic: I won't chastise you for that.

[00:26:04] John: Well, I'm using it on a production site, Nic, and it's an experimental module. Yeah.

[00:26:08] Nic: On, on your personal site, right? And you are a Drupal, so you are, you are an informed person making that decision. I wo- I won't do that for a client at the moment, but-

[00:26:17] John: I w- even if you inform the client-

perfectly acceptable ... I feel like that seems fine if they're willing to accept the risk. But anyway, um, I am very excited about the new admin theme, uh, coming in, I believe it is Drupal 12. Um, and that, that's one of those things that I think you were talking about where you gotta make sure that, you know, you are ready for, ready for that change.

Um, 'cause I think previously I was using whatever the, the Claro? Is that the, that is the, the admin theme previously, right? I was using Claro, and then I had this weird, weird curve where I was using Gin, and then I went to Claro 'cause I wanted to be closer to Core, and then Core kind of switched it up on me and went over to Gin, which was fine, 'cause I, I, I li- I enjoyed Gin.

I just, you know, I didn't, I wanted to be closer to Core. So I guess Core was just helping me realize my true potential. Um, but yeah. Yeah. That's one of those things you gotta kinda move over to.

[00:27:12] Nic: Yeah. So we, so we, we have a comment from Steven talking about, um, he thinks we should maybe slow down with major releases.

Oh, get

[00:27:20] John: out of here.

[00:27:21] Nic: I, I, I won't be that- Get out of

[00:27:23] John: here ...

[00:27:24] Nic: um, I, I won't be that emphatic, but I th- I think that the cadence of every six months having a minor and every two years having a major is good. Um, I was thinking about this when you, when you put this in, Martin, is all my clients are on 11 except for two actually at the moment.

So I think the bigger thing about 12 isn't that you really have to get ready for 12. You don't. But you have to get off of 10, because 10.6 is done, is no longer gonna be in security coverage- Ah ... on December 7th.

[00:27:56] John: I don't know. So- I struggle, I struggle with the, like, slow down, slow down aspect of things. Um, 'cause I, I do feel like, um, you know, I think Kevin's point is, is, is a good one, right?

There is a little bit of, um, maybe r- uh, security release fatigue, because everybody's kind of getting all of these things all, all the time now. Yeah. Especially with AI kind of doing both the good and the bad, like you're getting more, more stuff. But I think, like, major releases to me feel like, feel like You know, they feel, they, they feel to me like a necessity to keep moving things forward.

And what I mean by that is, like, if Apple were to slow down or if, if a m- you know, if, if Microsoft were to slow down, people might stop using their product because somebody else is innovating faster and people love the, the new shiny stuff. Um, you know, one of the, like I just mentioned the admin theme.

Like, I'm super excited to get into the admin theme in Drupal 12. Like, I think that's gonna be, that's gonna be, um, a great improve- a, a great improvement. Um, I, and I, I don't know. I mean, I think we all upgrade our software regularly. Why, why not upgrade our CMS?

[00:29:08] Nic: Well, I, I, I wanna point out too that the, the cadence now is what makes the major version upgrades so smooth, right?

It- Yeah ... the longer you go, like, the longer you go between upgrades, the more... So for example, going from 11 to 12, we dropped I think five modules and two themes. If we waited another six months, a year, two years to upgrade to 12, to create 12, there'd probably be another three or four modules in there. So, like, it makes those upgrades much more painful, much more broad, much riskier.

[00:29:42] John: Hmm.

[00:29:42] Nic: Uh, the process where 11, where 12.0 is the same as 11.5 also means that it's a lot smoother for upgrades, and you don't... Like, look at, like I said, all my clients upgraded to 11 probably in the last three months.

[00:29:56] John: Mm-hmm.

[00:29:56] Nic: And I'm down to one. Like, it's-

[00:29:58] John: Wait a second ... 12 is- From what? From 10?

[00:30:01] Nic: Yeah, from 10.

10 is fully supported. In the

[00:30:03] John: last three months?

[00:30:04] Nic: Yeah, 10 is fully supported.

[00:30:06] John: Really?

[00:30:07] Nic: And a lot of modules didn't get fully updated until six months ago. So 12 is coming out in December, but I'm not gonna be putting clients on 12 until- Probably next November, December anyway

[00:30:19] John: Was, was the slowness in adoption due to lack of modules being ready?

[00:30:24] Nic: That, that's part of it, and that's kind of Kevin's question here, which is, you know, the problem with core release cadence is we still face that challenge of contrib. But that's the other big thing that changed. Um, Bjorn did- Mm ... so much work in automating even more of the process. Almost every... I mean, he scaled back a little bit because it was a little too much, but almost every release or breaking change now in 11 has a rector rule for automatically updating.

Like, there's some things that you have to manually update, and I'm responsible for some of those. So like, for example, you, you do have to manually update, uh, hook requirements. You have to manually update hook module implements alter. Uh, you have to manually update hook, hook info, and there's a couple of things that you're gonna have to manually do, but the, the scale of that is very, very low.

[00:31:11] John: So I, I maybe I'm the only one that feels like this, and I'm sure everybody else can tell me that, um, uh, when I say it, but I looked at Kevin's comment, uh, and the problem with core release cadence is, is the challenge of contrib. And I looked at it as, like, I don't see that as a problem. I see it as a way to kind of, like, suss out modules that are not necessarily being as, being used as much or not necessarily being maintained, um, as, as frequently as they should be.

Um, and, and a way for people to either reengage with those modules and, and get them to be supported or to figure out what the, what the, like, more, more mainstream solution is. Um, I can't remember. I wrote a blog post about it. I'd have to go back and look. But, like, I remember, um, during my Drupal 10 to 11 upgrade, there was, like, a, a module that, um, uh...

Oh, actually, I think it was- Ju-

[00:32:17] Nic: Juicero. Yeah ...

[00:32:18] John: Jui- Juicer? '

[00:32:18] Nic: Cause you, you would post about that every, like, month or two, but you still didn't apply to be a maintainer to fix it yourself. Yeah, it...

[00:32:24] John: Well, so I wouldn't, I wouldn't. But, like, I was, I was... Because I felt like the, the maintainership, like, wasn't gonna, it wasn't gonna flourish if I had just decided to jump in there and start doing stuff.

There were, there weren't enough cycles in my day to be able to be productive there, right? Um, but, like- Being able to have that other module supported by the actual company and being able to, being able to, like, unlock my Drupal 11 potential there was, like, was, like, huge. And now that other module is probably not needed anymore, right?

Because there's a module supported by the organization that, that's, that's being able to move us forward. So I think, like, I don't necessarily see the rapid releases, uh, for core, and they're not ... I mean, they're not rapid. They're just scheduled and regular now- Yeah ... which is,

[00:33:08] Nic: which- Sch- whi- which is a huge improvement.

[00:33:11] John: A huge improvement, 100%. I don't see them necessarily as a problem. Um, I see them as more of a way to, you know, m- I don't know, weed out the, the module ecosystem to say, like, "Hey, you know, the, the, the stems and other bits are, are going to the bottom, and the, the good stuff's

[00:33:29] Nic: going to the top." Yeah, I mean, the, the truth is we, we need more maintainers.

We need to open up the contribution pipeline. I mean, there, there, there are things that need to be solved still. That, that's for sure. Um, but those are kind of systemic things that the community's been working on. Um- Okay, so Drupal 12 is coming out. It's very exciting. Um, I would like to take this opportunity to talk through some UX things since we have Emma on the, on the show.

Um, so there, there's some... So I try not to be, um, people may be surprised by the comment I'm about to make, but I try not to be one of those people that's like, "Hey, get off my lawn. Something changed. I don't like it." Um, I do try to test things out, but I- I'm curious about... There was a, there was a very large UX change in 11.3, which as far as process goes, I think typically this would, should have been a major or an opt-in thing.

I think it was... It broke a lot of stuff the way it was released. Mm-hmm. But there's a couple of things in particular about the UX that, um, I, I'm curious about how you would think about this, Emma. So the, the thing I'm talking about is the field UI. So if you've upgraded from 10 to 11.3 or above, you've noticed that when you go to add a new field, you now get a modal instead of, um, a page load.

[00:34:49] Emma: Yep.

[00:34:49] Nic: And in general, I think modals are considered the better because you don't have to wait. There's less bandwidth being used, all that kind of stuff. I find there, there are two things that happen that I think are, um... One is kind of just a, a bug, and I, I think you would agree, just needs to be fixed. The other is a UX thing, and I'm curious, I'm curious about.

So the, the bug is, for me, on some sites it sometimes opens below the fold. Like, I can't see the modal. Yeah. Just doesn't-

[00:35:19] Emma: Mm. Mm-hmm ...

[00:35:20] Nic: show up. Like, I literally can't interact with it. Um,

[00:35:24] Emma: I- So you have to scroll down to find it?

[00:35:26] Nic: You can't. Then you have to- You can't scroll down. Okay. 'Cause the, the- That must be a bug

screen behind scrolls, the dialogue doesn't scroll into view. Like, you can see the dialogue is at the bottom of the screen, but you can't get to it. So I, I think that's just a clear bug. I think that's the kind of thing that ideally would've been sussed out. Maybe it's an interaction with Claro or Gin or something.

W- who knows? The thing that I find that keeps tripping me up though is there's a new button. So you choose... You say, "I wanna add a new field." Yeah. You add the label, you create some machine name. You choose the type, plain text, whatever.

[00:36:02] Martin: Yep.

[00:36:03] Nic: You have some things to select. There's two buttons now. There's one that says change the type of field-

or save. And the amount of times-

[00:36:14] Emma: You're like-

[00:36:14] Nic: I click change ... what is the

[00:36:15] Emma: difference?

[00:36:16] Nic: No, no. Yeah. No. I'm trying to save and move forward, but I click the other one and it goes back a step. Like I just- Yeah ... I instinctively click the wrong one. Yeah. I have no idea why. How do you-

[00:36:26] John: Yeah, no, I, I literally just pulled this up to look at it because I was like, "What's Nic talking about?

This guy, he's get- he's getting," you know. And, um, no, yes, I, I agree. Uh, the save button should be on the left, and I don't know why it's on the right.

[00:36:40] Nic: Well, I, well, that, that's my question, Emma. When you're looking at a UX thing, how do you understand kind of the instinctive thing incorrect for something like...

Because I click the wrong one, I'm not, I'm not joking, 30 or 40% of the time. Maybe more.

[00:36:56] Emma: So there's various things. If it's a change, then you have to look at how... And this is very difficult to do in Drupal, because Drupal changes, like, more quickly than you can track how it's changing. And sometimes things change and they're not deliberate.

But with something like that, if a button is placed in a particular way, the muscle memory of everybody that's using it is just gonna click in the same place, and you're not really gonna read what's on the button. So y- you know, that's something to feed in. If you're adding And it seems, I can confess I don't know exactly the reason behind this change and how...

You know, there's obviously a reason for it. So this, is it a repositioning of the change button, or is it adding it? Was it never there to begin with? Yeah, it was

[00:37:48] Nic: never, it was never there before,

[00:37:49] Emma: right? Okay. It wasn't... Okay.

[00:37:51] John: So I think, Nic, you gotta put a ticket in because now, now this is, this is, I don't know.

It feels annoying to me. There might be a ticket. And I've been bitten by this one before, and I just kind of like suppressed that

[00:38:02] Nic: memory. They're, they're blue, right? I, I think that's what it is. I think it's, I think they're both blue, right?

[00:38:07] Emma: If they're both blue, yeah, then you're... But j- but just using button to make a s- a distinction between two different pieces of functiona- sorry, just using color isn't a great idea because if you're- Oh, okay

you know, for accessibility, you might not see it if you have- Well- Like, it, it's better not to just rely on color. What I would say- Yeah ... there must've been a way to make that change previously that maybe was a bit more involved, and if it's a common task

[00:38:32] Nic: that- Yeah, you just had to hit back. You just had to hit back.

Yeah. The back button. Like, it was a separate page, so you didn't really have a way to-

[00:38:38] John: I don't- Just instead ... I personally don't mind the modal. Like, the modal feels good to me. I am looking at it right now in, um, the new admin theme, and I am, I'm in, I'm in dark mode, and the change field type button is actually not the same as the save button.

So the change field type button is like an outline button that says change field type. Mm. And then the save button is a full, full, fully, uh, you know, colored button. May- maybe Mike,

[00:39:03] Nic: maybe Mike

[00:39:04] Emma: could probably address this, and- There's a primary and secondary thing.

[00:39:06] John: Yeah, yeah, exactly.

[00:39:07] Emma: Mm-hmm. Okay, okay.

[00:39:08] John: Exactly. So change field type is secondary- ... um, save is primary. My problem is the positioning of the buttons. Like, to me, it feels like save should be on the left and change field type should be either on the right, right next to it, or on the right all the way at the other end of the modal, um, just to give those space so that you're like, "Oh, save.

I'm gonna click here for save." Um-

[00:39:29] Emma: And the action of save will apply to the field. Like, it will apply to the same area as the change button, so it's not like... Because usually you would position, for proximity, you'd position the button near to the thing you're acting on. So if-

[00:39:44] John: Yeah. So the modal, yeah, it's...

So the whole modal is kinda like what you're working with, I

[00:39:49] Emma: guess. Got it. Okay.

[00:39:50] John: And like, and then one is like, "Hey, change the field type," which, uh, in my head equates to cancel. I don't know why, but I-

[00:39:56] Emma: Yeah ...

[00:39:56] John: I'm, it's like, okay- It basically is

[00:39:57] Nic: canceling, 'cause

[00:39:58] Emma: you have to re- It is, basically, yes. 'Cause if, if you're- Yeah

gonna use back as the other alternative way of doing it, then you are like undo.

[00:40:04] Nic: So- Yeah, it, it is. 'Cause you have, you have to reenter the label and all that. Uh-huh. Like, that's why it's anno- it's not like, "Oh, I accidentally clicked it. I just have to cl- select again."

[00:40:11] John: Yeah.

[00:40:11] Nic: Now I have to select it again, reenter the label- Get myself back to where I was

then be

[00:40:15] Emma: very...

[00:40:15] Nic: Yeah. Yeah,

[00:40:16] John: where like- Fill

[00:40:16] Nic: everything out

[00:40:17] John: again ... if I'm looking at it as a full modal, right, I would say like save on the left, cancel on the right, right? Where like you usually see that in Drupal maybe. And then, like, uh, these, these buttons are like reversed. And maybe- Uh-huh ... I mean, maybe it's just a...

Well, I guess, what, uh, theme are you using, Nic? Are you using Claro?

[00:40:36] Nic: Uh, it's a mixture of Claro and Gin.

[00:40:39] John: Yeah, okay. I've

[00:40:39] Nic: run into this on, across many-

[00:40:40] John: So you're seeing it in the same, same- ... several sites ... you're seeing it the same way, way I am, so it's not theme, theme dependent. But- Yeah ... that feels like, that feels like you should put a, you should put a ticket in, and we should have a conversation about this, Nic.

[00:40:51] Martin: I mean, I will say I feel like Gin was moving in the direction of having all of those action buttons in kind of like the top right. So you could make an argument- Oh, yeah ... that maybe those buttons should actually be top right instead of bottom right in the modal, but,

[00:41:04] John: uh- Yeah. Well, they do... So they do, when you go to the manage field page, they have top right buttons for create new field and reuse existing field.

[00:41:12] Nic: Yeah.

[00:41:13] John: Um, and- Are those

[00:41:14] Nic: on the top right now?

[00:41:15] John: Yeah, yeah. To be fair- Oh, okay ... like I wouldn't, I wouldn't necessarily be upset if those buttons were up there, uh, like in the modal. I just think it's a little weird maybe in the modal- I mean, I- ... to, to do that. It...

[00:41:28] Nic: Personally- '

[00:41:29] John: Cause that's where the X is to close the modal.

[00:41:31] Nic: Yeah. The, the modal in general feels like, I don't know. Like on Drupal 7, if you remember the overlay module- No, no, no ... I used to get... That was the first thing-

[00:41:39] John: No, no, no.

[00:41:39] Nic: You, you- ... I installed on every project.

[00:41:41] John: No, no, no. You, you... The first part of your statement m- makes you sound like, "Get off my lawn." The second part of your statement- No

is valid feedback. Those buttons definitely shouldn't be next to each other like that.

[00:41:51] Nic: Yeah, yeah. No, uh, that, that's my point. Like I, I'm not against changing things. I mean, personally, I don't like modals in general 'cause they feel more restricted. Like I, I have a lot of real estate. I like the fact- I

[00:42:01] John: like-

there isn't another page load, honestly.

[00:42:03] Nic: Well, no, I, I like-

[00:42:05] John: Like,

[00:42:05] Nic: uh, don't do it ... I like that piece, but I, it, may- maybe it just needs to be a, a nearly full width modal, right? 'Cause not having, using Ajax- Mm ... is a better experience. It's faster, right? But also I'm only using 50% of my screen now, and-

[00:42:17] John: I mean, I don't know

like- This thing takes up a lot of, a lot of space and doesn't feel like it's... Like I'm not, I'm not struggling to like- Hey ... use it

[00:42:25] Nic: Anyway, we're, we're not trying to solve this problem here. M- my, the reason why I wanted to bring it up was- ... uh, like I said, I'm curious how you think about these kinds of things and underst- 'cause maybe it's automatic for me to click the cancel, but maybe most people don't do that.

[00:42:38] Emma: Yeah. Right? You have to go on evidence. You have to go on looking at how frequent the task is, where people are most clicking. I mean, ideally you'd wanna test it. If you're making a change, you wanna see where peop- you, you wanna map it to the particular tasks and use cases. Put somebody in a scenario, show me how you would use this thing.

See where they click, hear what they're thinking, and then you make a change, like, as a, a prototype, and you see the equivalent experience. It's not always possible to do that. Drupal changes quicker, as I said, than you can test that kind of stuff. But wherever you make UX decisions, we're always trying to make them based on evidence and data rather than opinions.

Because just as you guys have just, like, shared there, one of you will like modals, the other will not. Like, you know, so it's like you can't... You can never please people- Me ... if you try and make decisions based on opinions. You have to kinda go with, like, wh- what people are used to. And I would always argue in favor of, like, keeping existing patterns if you, y- you know, you're, you're, you're catering for people that are using this already.

Yeah. So you, you know, you have to kinda use... You have to put some strong evidence to change a pattern that people are already used to because of muscle memory placement and so on. But like I said, I don't know for this exact change what the motivator was.

[00:44:04] Nic: I-

[00:44:04] Emma: Maybe it was accessibility driven, maybe, I don't know.

I'm nickel and diming a bit because I don't know. Yeah. So- No, it, it makes sense ... I feel like issue is the way to go here.

[00:44:13] Nic: I, I have... Before we move on, Emma, I have, and we have a comment from a listener I want to pull up, but before we move on, I actually have a... So is there a term in UX, 'cause I find for some things, you do it wrong a few times, you learn, okay, y- eventually you rebuild the muscle memory, right?

[00:44:29] Emma: Yep.

[00:44:30] Nic: For most of the time. But there are times where that doesn't. So like, for example, there's, um, there's another interaction in Drupal that I almost always do the backwards one, and it's been years, and I... So for example, paragraphs, you h- now has a built-in feature where you can duplicate an existing paragraph or just delete it.

Yeah. Right? And the order is, the top one is delete and the bottom one is duplicate. And I always, always, always almost click the wrong one. Like, I always have to s- like, I've trai- what I've trained myself to do is open the drop-down, look at it, and decide which one I'm trying to do- Yeah ... rather than just instinctively cl- 'cause I always instinctively hover over the wrong one.

And it's, it's been like that for three years.

[00:45:15] Emma: You try- It's re- It is very contextual. I th- I think I know what you're asking, but it, it does a lot... it does depend a lot on-

[00:45:24] John: Well- ...

[00:45:25] Emma: the use case. Like, so for, in that instance, what's the worst that could happen if somebody clicks delete? How could they repair that if they click the wrong button?

Whereas if somebody clicks- Refreshed the page ... duplicate, if they click duplicate, then they, you know, like, what, that's some- that's something else that can feed into it to-

[00:45:42] John: Nic ... have Nic, I think you gotta- ...

[00:45:43] Emma: to correct it ...

[00:45:44] John: I think you gotta put an issue in for that one, too, 'cause it's an anti-pattern. All of the remove or delete buttons in Drupal are at the bottom of the menu, so that- That's

[00:45:51] Nic: probably why it is

[00:45:52] John: so hard for me to- That, that- Yeah

that module should swap 'em around so that the delete button- That's probably why it's so- ... is consistent with all the rest of them ...

[00:45:59] Nic: yeah, that's

[00:45:59] Emma: probably why it's

[00:46:00] Nic: so ingrained. There is- Yeah.

[00:46:01] Emma: So there's a UX law called Jakob's law, which is, like, don't reinvent the wheel. If people are used to a pattern to do a particular task, then stick to that.

Like, don't make people learn something just for your system. Did you say Jake- Jakob's

[00:46:13] Nic: law?

[00:46:14] Emma: Jakob's law, yeah. I think it's named after Jakob Nielsen, but it might be another Jakob, but he is a significant Jakob in the world of UX. Yes. Um, but it, uh, but the, yeah, so, so that, like, says stick to established patterns.

However, it's interpretive, right? Because a pattern could exist in CMS world, but it might be different in Drupal, and it's been like that in Drupal for decades. So again, you don't wanna change something-

[00:46:41] John: It's like-

[00:46:41] Emma: But this... Go

[00:46:43] John: on. Go ahead. I'll let you finish your thought.

[00:46:46] Emma: Uh, what was my thought? That's a good point.

Uh, yeah, so, so you have to, you kind of go on evidence. What's the, the, what's the use case that most people have? And it can also depend, obviously, on your admin theme, if it's Clara, if it's Gin. Mm. It can depend on various things, and some people set things up in Drupal the way they like them, y- you know, and then if it gets passed down, it's unclear how that happened.

So there can be a bit of- Yeah ... like, lack of design history and un- understanding why it was built that way. But there's always usually, like, an underlying reason why it went a particular way, and things get built onto stuff that's there already, and it's difficult to then, like, bring it to a screeching halt and then change for something else.

Um- Yeah. No,

[00:47:36] John: I also imagine there's, like, a, like, a doctor, a doctor, uh, like, do no harm sort of thing there, where, like, hey, listen, if you're implementing something, like, you know, follow the, follow the pattern, and then just, like, don't make it harder for your users. Um-

[00:47:55] Emma: Yeah, that's Jacob's Law basically.

People expect things to work the same way

[00:47:59] John: Yeah. So I mean, like looking at Drupal right now and I'm, I'm testing this on my own personal website 'cause I wasn't sure, but like remove block is at the bottom of the list, delete is at the bottom of the list. Like-

[00:48:10] Nic: That, that's pro- that's probably why I keep doing that.

I, I'll- So like ... I'll see if there's an issue in paragraphs.

[00:48:14] John: Oh, although I will say that, uh, the edit menu, um, remove block is in the middle of the list. Edit menu is now at the bottom of the list. So you might need- Hmm ... you might need to look at Maybe the, I don't know, the way that that menu item is configured, but- Yeah

um, maybe, maybe, yeah, maybe, maybe it's the right way. I don't know. I'm looking, looking at other things and not necessarily seeing it.

[00:48:44] Nic: Awesome. So just really quickly, uh, a couple of things from our listeners. So Etchy said that, you know, they feel UI changes may not have been necessary in general. But I, I will say the, the experience of not having a page load is nice.

Like, I do like that part of it. The, the, you know, the bug that it shows up off-screen is an obvious bug, and there's... I think there's an issue to fix that already. It'd be nice if it was easier to configure how big it is, because again, I, I have a very large monitor. I wanna use the whole monitor. But that's my...

I think that's probably my biggest complaint.

[00:49:16] John: Um- All about Nic's use case.

[00:49:18] Nic: And... Well, no, if you can configure it, then you j- can configure it for your use case, right?

[00:49:23] John: Who is configuring that? I, I do think that, like-

[00:49:25] Nic: I would be. I would, 'cause-

[00:49:27] John: I do think one, one thing in the comment there is like, um, you know, how ma- how often, uh, do users really need to administer field settings?

I, I don't think once you create the field that you go back there all that often, but I, I would say that if you're creating a content type and you're, you're creating a bunch of fields for that content type, that button kind of s- being switched around like that is annoying enough where you're like...

You're gonna get, you're gonna get annoyed. I- It's gonna take... It's gonna reduce your speed.

[00:49:56] Nic: I, I'll, I'll be honest too, like, the, the, the other place where the modal really doesn't work, and, and this is probably why it's affecting me so much, is the custom field or the new compound field. 'Cause the, the custom field and compound field adds a significant amount of content in that modal.

[00:50:12] Emma: Right.

[00:50:12] Nic: And it just doesn't, it doesn't... Like, I have compound fi- or custom fields that have eight subfields, and that's all now- So then you've

[00:50:20] Emma: run out of real

[00:50:21] Nic: estate- Yeah ...

[00:50:21] Emma: really quickly.

[00:50:22] Nic: Yep.

[00:50:22] Emma: Mm-hmm.

[00:50:23] Nic: E- exactly. So there, there's other reasons, but, um, a- anyway. Another really quick an- uh, announcement, Luke mentioned that Badcamp is, uh, going to be on the 12th and 13th in No- November, but you should come to Netcamp instead.

But I guess if you're on the West Coast.

[00:50:40] John: Uh, listen, you can do both. You just gotta take a red-eye. It's all good.

[00:50:44] Nic: Yeah. Anyway, um, okay. So let's see, what's next on our list? Next we have a discussion about... John, I think, I think you, you emcee these off-the-cuffs a little bit better than me, but-

[00:50:59] John: All

[00:50:59] Nic: right ... um, let's see.

Next, John, you had some questions about the PHP vulnerability Let's, uh-

[00:51:05] John: Oh, so I- ...

[00:51:05] Nic: talk about that quickly.

[00:51:06] John: I mean, so, uh, I I don't think anybody, unless you're living under a rock or maybe you were asleep all of last week, um, like, you know that there was a PHP vulnerability. Everybody's kind of been doing postmortems on it and, and, and putting out the facts.

Um, I was listening to a podcast the other day, and I don't know, like, if I understood them correctly, but, like, apparently these vulnerabilities were kind of, like, had been introduced in, like, I don't know, PHP 4 or something like that. Like, they aren't, they aren't necessarily new vulnerabilities. They'd been around for a while, and I guess they had just been exploited, or they've been- No

had been validated. But, uh, I was looking to maybe, maybe get some clarity on that from folks that might know more than I do.

[00:51:51] Nic: So, so yeah, they, they were introduced a very long time ago. They were actually uncovered about a year, I think, a- and a half ago too- Yeah ... i- internally to the PHP team. But there was no...

So just because you have a vulnerability doesn't mean that it's something you immediately need to patch, right? If you have a vulnerability that has no way to get to that code, then it's not really a vulnerability. It just means that- Yeah ... if something were to get there. And this is one of

[00:52:19] John: those cases- It's like a, it's like, it's like a security vulnerability in Drupal that's like, "You need to have ultimate admin access."

Like, as long as you don't have ultimate- N- not even- ... admin access, like...

[00:52:27] Nic: Not even necessarily that level. It, it could even be something like, um... It- it's, it's, but, but that's a, that's a good analogy, but it, it's not exactly correct. But the, the thing is that what happened about a month ago or a month and a half ago is that with the help of AI, they were able to uncover a pathway to get to that vulnerability.

So then it became- Got it ... important to fix it. Now, there, there's been some discussions since the release that came out that basically it's, it's a, it is a real vulnerability. You do wanna patch it. People are looking to exploit it. But as far as I know, there are no known exploits yet. It seems that AI's exploit pathway and proof of concepts all rely on basically what you just said, John, right?

You have to, in order to get it exploitable, you have to build your PHP server in such a way that you execute user lang code and give them a file on the server and let them put whatever code they want in there. And it's like, well, if you're doing that, it's the same as giving somebody user one access and being surprised that they can delete content, right?

Um, and people generally don't configure PHP that way. You wanna patch it because people are trying to find ways in still, and maybe they will. But a week, week and a half later, nobody, as far as I know, nobody's found a way, a real way past that. If you point to any... And one of the reasons why they've upgraded so much was, if you point any engine at it, any AI system, they're going to fi- they're going to find a, they're gonna find that exploit and give you that and say, "Look, here's a proof of concept."

And you're gonna run the proof of concept against it, and it's gonna show, yes, this is vulnerable. But it's because they're configuring it that way, every single one. They're stochastic. They all do the same thing, basically. Um-

[00:54:21] John: Sorry, what was that word?

[00:54:23] Nic: Stochastic. Like a, it's a, basically, statistically something is going to ha- Because they're statistical models, they take the average of everything.

On average, they solve problems the same way, which is one of the strengths and one of the weaknesses of AI. Basically, like, if the wrong way of doing things is the average way of doing things, it's always going to promote the wrong way of doing things, because that's the average. Um, and that's what's happening here.

Now- That doesn't mean that you don't wanna update, like I said. That doesn't mean that future updates you take with a grain of salt. Like, that's one of the dangers is when there's something so se- that's measured so severe, but then the actual fallout doesn't happen, people are less likely to take the next one seriously.

And you can't take security that way. You, if an update comes out, you have to apply it. It's the Chicken Little,

[00:55:12] John: Chicken Little philosophy.

[00:55:13] Nic: Yeah. Exactly. Or the boy

[00:55:14] John: who cried wolf as a philosophy, whichever- Yeah. So- ... you know. Exactly Yeah. Go ahead, Martin.

[00:55:20] Martin: Uh, I was just gonna say, I feel like the, the increasing frequency that we're seeing for these security vulnerabilities really speaks to a need for teams to think or change the way they think about security.

So as opposed to it being sort of, like, incident based in terms of, like, wait until there's a security issue and then mobilize resources to, to go ahead and, and address that one particular issue, to really think about, like, security hygiene, right? So even things like what we were talking about with Drupal 12 earlier of, like, always making sure you're on supported versions of software so that when patches come out, you're gonna be able to apply that patch.

Yeah. Right? Because if you're on a version of PHP that's so old that no patches are released for it, well, you've got a lot of work to do before you can even get to a point of being able to patch that, right? Yeah. So, so I think there needs to also be a bit of a mindset, because in this AI era, we are just seeing more and more, um, you know, a much higher frequency in terms of, you know, how often these kinds of issues are coming out.

It's like what you were saying, uh, Nic, earlier about having to kind of unpin the specific releases of some of the deeper dependencies of Drupal core because they were just being updated so often, you know, it wasn't, it wasn't feasible for Drupal site owners to having to constantly- Yeah ... you know, update to new security releases of Drupal just to get the lower level dependencies.

[00:56:41] John: Yeah. It's interesting, Martin, you were, you're saying that now, and I was, I was actually thinking that when we were talking about the update, update thing. Uh, you know, a lot of larger organizations with larger, more complex websites have a hard time kind of upgrading as rapidly as I would like because I'm a little bit, I'm a little bit anal about that sort of thing.

But, like, because, you know, a module isn't supported or there are other priorities to, you know, enhance the platform, um, you know, that sort, that sort of thing. Like, and I think that you're right. Like, we, organizations and, and governments and EDUs and, and all of them have to kind of get better at being able to more rapidly, uh, update their code to be able to keep it, not only for Drupal updates, but also for the security issues that come up to keep it more, um, you know, uh, with the times, I guess.

[00:57:32] Nic: Yeah. It, I, I'll say too, it's also forcing me to... There's things that I've wanted to do for years and just never quite got around to it, but because of the frequency, it's forced me to. So for example, I now have- I, I, I've had scripts for years for, like, doing local management and stuff, but I now have one that does end to end.

It takes an environment, resets it to main, pulls down the latest, does... Like, basically prepares the environment for updating something related to security and makes sure I have no local stuff overridden. It, like, it just basically creates a fresh, full fresh copy from scratch and checks out a new branch for the update.

And then I have another command now that basically goes through and updates all modules and, like, it won't do major version updates and stuff. There's some limitations still, but it'll do all the updates, so then I don't have to... Because one of the problems with all the updates now is they're doing them in waves.

So you don't know if, like, oh, like you don't wanna check each... Bas- I just run the command, it updates everything, and then it commits one at a time, and I can look at the list and be like, "Okay, it got all the security updates." And I, and because we're doing that weekly or biweekly now The odds are there's only one or two mod- maybe I get a module or two that's not a security update.

[00:58:41] John: Mm-hmm.

[00:58:42] Nic: But who knows when the next security update's coming out, so it's fine to get that in there. So now these releases are, um, they still take time 'cause you have to wait for the security team to publish everything, but the actual pro- It's more about making sure I go through every single project and run these commands.

Mm-hmm. Um, so it's actually, the, the actual act of updating is-

[00:59:05] John: Well- ...

[00:59:05] Nic: less

[00:59:06] John: work ... so your, your platform can also help you with that, right? So, like, I, cover your ears, Martin, use Pantheon for my personal site. And, you know, they have, like, a push button like, "Hey, run, run check for updates. Show me what updates need to be done.

Go ahead and apply the updates." And then, oh, I can pull up the dev, the dev environment, test, test this, make sure, like, kick the tires, make sure there's nothing going on- Yeah ... that's, that's... And then d- then work through deploying it, right? So, like, you can build this into your CI process for sure, like, without a doubt.

[00:59:35] Nic: Yeah, Dependent Bot is another way to do it that's not-

[00:59:37] John: Yeah ... tied to a particular- You know, there are definitely other ways to do this- Environment ... where it's not, like, taking a developer, like, a lot of time to, to be able to keep up with these things.

[00:59:46] Martin: Yeah, I was just gonna quickly say, I mean, definitely I have heard, you know, from lots of people the value of what you're talking about, John.

Um, Acquia has a capability we call Auto DevOps that's similar. So it'll do the, the same process you were describing, Nic, of checking for composer updates, and then if it finds any, it'll automatically create a m- an MR that has those. Oh, cool. It can automatically run all of your automated tests, um, against that and'll and actually spin up an environment so somebody can automatically go in and, like, click around- Yeah

do, like, a smoke test in addition to the automated test. The other thing that it'll do that's nice is it'll also, on that scheduled basis, uh, check your custom code for anything that's deprecated so that, you know, even, you know, you talked about, like, Drupal 12 readiness. It'll sort of do some of that work for you in terms of on an ongoing basis.

As new deprecations get announced, you know, it'll open up the MRs so that your code base is, is always updated as well. So I think the, the bigger point is exactly what you said though, John, that, you know, these are the kinds of things I think teams need to be thinking about. Like, how do we build that into our CI- Yeah

on more of a scheduled basis? So that it's just sort of like hygiene. It's just something that happens- Yeah ... you know, on an ongoing basis. The- It's not, like, a periodic thing where it's a, a big effort.

[01:00:56] Nic: The, the complex thing about Drupal, and the reason why I don't usually just use Dependabot, by the way, is because of config, right?

Because many times if there's an update hook, the config is gonna change, and if you don't account for that, then you're just blowing away config updates. So the, the nice thing about the scripts that I use in doing it locally is it will run the- Yeah, they do

[01:01:17] John: the, the

[01:01:18] Nic: config

[01:01:18] John: export ...

[01:01:19] Nic: it'll update it. It'll export the config, commit that, and then again you can see all that stuff, and usually it's pretty minor.

But it's a, it's a good way to kind of, kind of manage it. And since it's just a couple commands It's, like I said, the actual update's a, a breeze, it's just that it's so frequent and you have to make sure you don't forget a site. Um-

[01:01:39] John: All right ...

[01:01:40] Nic: any last thoughts on this before we- No ... move on to our,

[01:01:42] John: our last- I wanna tackle the, I wanna tackle the last item.

[01:01:46] Nic: Go ahead. Sure. '

[01:01:46] John: Cause this, this was a, um, it was an enlightening experience, but also an infuriating experience. So, um, I came across, uh, last week, uh, an instance where, um- Uh, some team members of mine were working on a project, and they were using a, a, a module, um, supported by an organization, uh, or... Well, let me, let me make sure I'm using the right terms.

Um, they were using a module that a company had produced to integrate with their product, uh, for translation and, um, they were working with a client to, to use this module, to use this service to translate the website. Um, the module had had some issues. Uh, they went into the issue queue in Drupal and posted a bunch of issues, and then, um, went down the road of, of fixing the issues and, uh, providing patches and so on, and then reached out to the organization to say like, "Hey, we have all these issues with the Drupal, the Drupal module.

Um, you know, would be great if we, you could kinda like re-roll a release or like get these included," blah, blah, blah, whatever. Um, provided all the links to the issues and whatnot. And, um, you know, the company kind of replied with, "Hey, thanks for this. We'll take a look at these." And then they, they kinda replied back with, um, "Again, thanks for this.

We'll try to incorporate these into a release. Um, but for in future just post your, post your issues here in the, in the s- in the support channel. Don't, don't post them on, on drupal.org." Um, to which I was like, "Ah, that's like not great," 'cause now like, you know, not that I'm looking for, for credits for fixing the issues, but like issues aren't tracked in public, issues aren't, um, you know, fixed in public.

The, you know- Yeah ... the patches are still there so they can be used. But it was just like... I, I don't know. I don't know if you guys have seen a, a lot of this in kind of building client sites and, and like what your point of view is on it.

[01:03:57] Nic: I, I think it's pretty, um, I think it's pretty rare in the Drupal world.

I have seen it a few times. In fact, I've had even funnier versions of that where there was a, there was a service that one of my clients was looking at using in the proj- it wasn't Drupal 11 ready. So I opened the issue and made it Drupal 11 ready, and then we were in sales talks with that client, with that custom- that pr- company, um, for using their service, and they ignored my pull request.

They've released the Drupal 11 version ready. They used my work 'cause there were some very... Like, I have a very particular way of doing certain things, and so I could tell that they used the pat, the merge request I created. And then during the sales call, they came back like, "Yeah, see, we made a Drupal and ready ju- just for you guys."

I was like, "Wait a second. I'm the one that did that. You're taking-" Yeah, but like- "... credit for my work to me," which was kind of funny. But, um, in, in general, I would say it's pretty rare. I, I would try to encourage those companies to use Drupal for the... 'Cause I mean, they're building on top of Drupal, they should use the Drupal system, but I also understand- Well,

[01:05:02] John: yes and no

that might be too much influence Like, I, I see their, their-

[01:05:05] Nic: Yeah ...

[01:05:06] John: reasoning for it. Like, if they are, you know, they have a support channel that they're using. Yeah. Um, you know, maybe there isn't an easy way to integrate the Drupal, you know, the Drupal issue queue into their kind of support and, and development workflow.

But I'm also kinda like, "Well, you're building a Drupal module, you should, you know, you should meet, meet the people where they live," right? You should, you should be working in the ecosystem and the, and in the, in the way that the, the Drupal- It- ... community's used to, not just-

[01:05:34] Nic: And, and there are ways to mirror things, so like, there's o- So for example, I know Drupal Spoons did this.

They mirrored to, uh, GitLab. I think they mirrored to GitHub at one point. So there's ways to mirror these issues. Um, I think it's just all about learning the community that you're integrating with

[01:05:52] John: and trying to- And the other thing that, that was annoying to me was that they actually posted right on their, their module page, like, "Don't, don't post issues in the issue queue.

Like, go to the-"

[01:06:02] Nic: Yeah, they c- they can just close the issue queue at that point. Like, that's an option. They can just turn it off if they don't wanna use it.

[01:06:07] John: Oh, really? Yeah. I didn't know, I didn't actually know you could turn off the issue queue.

[01:06:11] Nic: Yeah.

[01:06:11] John: Which again, feels-

[01:06:12] Nic: I don't think you can on GitLab, but you can on drupal.org for sure.

[01:06:15] John: That feels, that feels, like, annoying to me, but okay.

[01:06:19] Nic: Yeah. All right. Well, thank you everybody for joining us, uh, for our 14th Off The Cuff, or as we used to call it, This and That- This and Thats, I think. I think Off The Cuff is a better name. But, uh, don't for- uh, don't forget that y- you can reach out to us on Drupal Slack in the Talking Drupal channel or email the show at talkingdrupal.com.

If you'd like to promote your Drupal event, like, uh, Badcamp, you can always send us a, a note and a recording, and we'll post that as well. You can become a guest or a guest host by visiting the talkingdrupal.com website and clicking the buttons in the sidebar. Also, we'd like to thank our patrons for supporting Talking Drupal.

Your support has kept us talking for 577 episodes. All right, Emma, thank you for joining us. Thank you. If our listeners wanted to get in touch with you, what's the best way for them to get in touch?

[01:07:14] Emma: Uh, Drupal Slack. It's just my name, so DM me on Slack.

[01:07:18] Nic: Awesome. And Martin, if our guest want... If our listeners want to get in touch with you, what's the best way?

[01:07:23] Martin: Folks can find me as mandclu on most of the Drupal and social platforms, and most of my current writing these days is at acquia.com/blog.

[01:07:33] Nic: I, I have noticed an increase in blog posts by Martin on Acquia.

[01:07:40] John: I will say- And- ... I, I don't know if it was his last one, but, um, he, he talks about, uh, Canvas and, and compares it to, uh, to another, another service out there, which I thought was very interesting.

So it's worth a, worth a read.

[01:07:53] Nic: And John- Thanks ... if our listeners want to get in touch with you, what's the best way for them to do that?

[01:07:57] John: Uh, oh, geez, so many ways. Uh, you can find me, uh, personally on picozzi.com. You can find me on the social media and, um, Slack at johnpicozzi, as well as, uh, drupal.org at johnpicozzi.

And then you can find out about EPAM at epam.com.

[01:08:16] Nic: And you can find me pretty much everywhere, nicxvan, N-I-C-X-V-A-N. And if you've enjoyed listening, we've enjoyed talking.

[01:08:24] John: Have a good one, everyone.

[01:08:26] Emma: Bye.