When the defacing occurred, for whatever reason (thankfully) wordpress sent me an email to say the admin user email address has changed. This was about 30-40 minutes before I got into work, so as soon as got to work, I was able to disable the site quickly and add a temporary message.

Anyway, I thought I’d post what I did to recover the blog, without loosing any date. If your doing this yourself, please note that this will definitely not fix all defacements, this is just a log of what I did to get things working again. Also you’ll need your ftp username & password, and access to your mysql server (i.e. via phpmyadmin or direct mysql access):

1. The first thing to do, is disable the site whilst you perform the fixes. So rename your public_html folder to something else (so it can’t be accessed from the web to be re-defaced). In this example we’ll call it ‘public_html_stuffed’.
2. Next, take a look in your uploads folder (public_html_stuffed/wp-content/uploads/) to see if there’s anything that was recently added to the site and looks suspicious. I found something called l_php.jpg which was actually ended up being some very cryptic php code if you open it up in an editor.
3. Now take a look in your theme folder (public_html_stuffed/wp-content/themes/alexs-blog) to see if there’s anything there that has also recently changed. I found the index.php file here which had all the markup you would see when visiting the site. I just purged the whole folder to be on the safe side (we’ll fix this later).
4. Next you want to download a copy of the latest wordpress installation from wordpress.org, unzip the contents and overwrite all the files in your public_html_stuffed folder with the new wordpress. This is to firstly upgrade to a safe version, but also to purge any system files that may have been altered by the crackers.
5. Now for the database changes: goto the wp_users table and edit user 1 (the admin user). Make sure this users email address is your own, and if its been changed, set it back. Also set the password field to empty (don’t worry about this, it won’t let anyone log in with an empty password but we’ll fix it in a minute anyway).
6. While we’re in the database, we’ll want to remove any new posts that look like they relate to the defacement – in my case, there was one post that mentioned the odd filename (l_php.jpg) I found in the uploads folder. So I simply deleted that row.
7. We should be safe now to move the site back to being web accessible, so rename your public_html_stuffed back to public_html.
8. Access the site’s admin login page and click the recover password link. Follow the instructions for resetting the admin user’s password.
9. When in your admin, reset the theme, or download a new theme and set it to this (if you deleted it entirely). You’ll also want to make sure all your plugins are updated too! To be on the safe side I also re-ran the wordpress update via the update section of the admin area.
10. Clear your browser cache, and then you should be done.

In the process of doing the fix to my blog, I’ve also changed my theme – did anyone notice? probably not!

Just a FYI: the wordpress version I was using when this all happened was 2.8.5 – so it was only 4 versions (6 months) since I updated.

Administration Modules

• Menu Settings per Content Type
  When creating a node of any content types, the menu field will always be present. This module lets you enable/disable the menu field, as well as select which menu groups are selectable to a content type.
• Better Formats
  Greatly improves the ‘input filter’ features of textareas.
• TinyMCE Node Picker
  Adds a picker feature to TinyMCE for linking to internal pages.
• Link Checker
  Periodically checks content links to ensure they still work properly.
• Vertical Tabs
  Hides a lot of the really unnecessary system fields in node edit forms.

Front-end modules

• Menu Block
  Allows you to create local menu blocks showing child items of the current page.
• Site map
  Provides a page view of the pages of the site in a hierarchical list.

SEO modules

• Global Redirect
  When you have pathalias and pathauto on, the urls of your nodes look all pretty, but can still be accessed on the internal url, such as node/<node id>. If google finds you duplicating content on too many urls, they may water down the importance of the content. So what this module does is ensure the node views are only accessible on the pathalias url.
• Nodewords
  Whilst meta description and keywords are not so important now days, they still have a small place to play with the results pages for some search engines (like Yahoo). This module essentially allows you to set the meta description and keywords on a per node, per view basis.
• PageTitle
  Page Title simply allows you to set a custom title tag (used in head block of your markup) on a per node, per per view basis
• XML Sitemaps
  Automatically creates an xml sitemap to allow search engines to more intelligently index your site.

Other useful links

• Lullabot’s top 40 Modules
• Module usage statistics
• Acquia 3rd party Module list

Below is an approximate route of our journey through Europe:

London, UK

Massive, vibrant, old/new, clean/dirty, efficient, relatively affordable! We stayed with my very hospitable cousin in East London (which despite the bad reputation for the area) seemed really safe, and convenient, since it was only a 10 min bus and 10 min tube ride to city centre. Tips as follows:

• Learning to navigate the various tubes lines is a requirement! They’re fast and regular, and theres stops near just about everything. Get yourself an Oyster card and add credit as needed, as it makes getting on and off, really easy. You’ll also want a tube map as well as a normal street map and use the indexes in both to work out the best route. The Bus system in London is also just as reliable – most come every 5 or 10 minutes, and have priority in the traffic too.
• If your a museum/sites type, and want to really absorb stuff, give yourself at least half a day for all the majors. There’s heaps of museum’s, but of the ones we visited: National History Museum and Westminister Abbey – we could have spent agers there if we had the time.
• Make sure to check out the London Eye, but don’t bother with the more expensive fast queue tickets, as the normal queue is pretty fast anyway. Also don’t miss the 4D cinema experience which comes free with all Eye tickets – don’t be afraid, its actually pretty entertaining!
• Other cool things to check out are the markets Covert Gardens. On a weekend they have all these street busker’s that are actually really entertaining. The London Transport Museum is here too, which isn’t too bad if you were obsessed with the tubes like us! Also check out the Harrods department store, and go to a Westend show, like the Lion King – was freaking fantastic (even if your non-theater type like me!).

Munich, Germany

Modern, well maintained, boozey!, beautiful, friendly! Tips as follows:

• Don’t be too worried about the language barrier – most Germans speak English! That’s of course if you can find locals. When we went (during Oktoberfest), there were heaps of other Australians there, so it was a really friendly environment. To be on the safe side just learn the basics, Thankyou very much, Sorry, etc.
• Oktoberfest is such a crazy festival, I’d never expected it to be so huge and so happy. The beer at Oktoberfest is specially brewed to have a higher alcohol content, so take all the normal precautions, i.e. remember to eat a decent meal before you start drinking the beer. We filled up on beer pretty quickly and didn’t last very long at all (only 3 Steins, whilst most people were doing 6-8 a day).
• Oktoberfest goes for 2 weeks, but if you want a no fuss drinking session, attend the event during the weekdays (Mon-Thur) and start around 1PM. If you get there later in the day, or if you go instead on weekends, you apparently won’t get in, due to all the table bookings. We went on a Tuesday at 12PM, and no trouble getting in to the main english tent Hofbräu-Festzelt and later that evening into the Löwenbräu-Festhalle!
• If visiting Munich for Oktoberfest, also allocate some time to do a few non-boozy things – the city has a lot of history from WW2, and the like. Check out the first Nazi Concentration camp: Dachau, King Ludwig’s 18th century Castle: Neuschwanstein Castle, and Marienplatz in the city centre. There’s heaps of other great things to do there, like bike tours to the Gardens, etc, but we didn’t get a chance to do that, unfortunately.
• For decent priced & tasting food, check out Augustina Brewery – we went there for dinner just about every night! It was conveniently across the road from our hostel: Meininger, which is also conveniently close to Oktoberfest.

Ossoppo, Italy

A small, quiet country town in the north east of Italy, about 3 hours drive from Venice. We got here, via a Trenitalia train direct from Munich to Trento station, which wasn’t too bad going through the alps and then a car ride to Ossoppo. We stayed here with Katrina’s Aunty and had a really relaxing rest away from the bustling cities. The homes in the Italian Country are really different to Australia – they have all the homes packed up next to one another and then the gardens & paddocks are all together next to each other down the road. Speaking of roads, the driving there is really slack, no one really indicates, and people rarely keep left on multi lane roads. I may sound a bit negative, but I don’t mean to be, the place was so quiet and friendly – everyone in the town knew everyone, and its surrounded by the beautiful Alp mountain range.

Venice, Italy

Canels, culture and history! When you step off the train, its all just hustle and bustle with tourists and dodgy sales people swarming everywhere. Tips:

• It’s definitely one of those cities you’ve got to see – but give yourself at least a few nights here. We only stayed 2 nights due to our busy schedule, and only started to settle in and relax the night before we left.
• If you want to get around the various islands yourself, get the 24 or 48 hour water bus passes, and hop on and off whenever you please. Get them from the vendors at any water bus stop. They also have combo deals with a pass to get into a bunch of museums pre-paid, so ask them about that too, to save a few Euro.
• Avoid the famous sites of St Marco square anytime before 11AM, because from this time onwards, it’s basically impossible to walk around without getting a few squashed toes or a few bumps and bruises (yes!).
• As mentioned, theres heaps of tourists around and a lot of them are 50+. So if you’re looking for a break, check out the Caffe Rossa, Santa Margherita to the south west of the islands. It’s a little walk away from the main tousty area, but its where all the 20-30 year old’s hang out and drink copious quantities of Campari in the form of a cocktail called a Spritz. For 2.20 Euro you can’t go wrong!
• Getting to and from the Venice airport: the quickest and cheapest way is via a bus. It’s something like a 2 zone trip (3-4 Euro) and only takes 15 minutes, rather then using a water taxi, or other transport.

Paris, France

Culture shock!

• If you’re visiting Paris, do your very best to learn a bit of French. ‘Parley vou Ongley’ and ‘Merci Bookoo’ were really not enough, you need to learn a few more lines then that.
• Like London, the city underground train system is fantastic. Get yourself a Navi-go card and again (like the Oyster card in London) add credit as needed, or get all-day zone 3 or 5 features added to the card. Get the Metro map and a decent street map too.
• If you’ve read The Davinci code or seen the movie, check out the Louvre of course, its really massive! The museum has heaps of different sections, but the one you probably want is the Italian Art section where has all of Davinci’s works and the like. If you’re a little clueless on the art scene like myself, grab an audio commentary device (although a bit pricey) they really help to make you understand the stories that these ancient paintings tell. Allocate at a bare minimum at least half a day to this place, as there really is a lot to absorb.
• Paris is quite expensive, so be prepared for it: 4 Euro coffee’s, and 115 Euro per night rates for a small room in the city – its really over the top. To keep costs down find the super markets and buy your meals there most of the time and then just splurge a little at a nice restaurant at least once.
• Tower Eiffel is freakin massive – I would have never thought. Avoid visiting around 7PM, because this is when the lines start going really slowly, as they let pre-booked guests of the restaurant jump the queue! It’s also worth paying the little bit extra to get access to the top floor – just do it, its amazing!
• Palace Versailles is also worth a visit. It’s where Napoleon use you to hang out, and its also where the WW2 peace treaty was signed. The palace has some great art, and the massive gardens surrounding it which can be explored with golf buggy’s (although we didn’t have time for this). It’s definitely a full day trip.

Amsterdam, Holland

This place rocks, and was a nice change from Paris.

• All dutch people speak English, so there’s basically zero language barrier. After trying to learn 3 languages in about 2 weeks, we really didn’t have any time or patience to learn another (Dutch is also apparently a lot harder then most other European languages).
• Check out the coffee shops, but apparently go easy on the space cakes – they take at least 40 minutes to kick in. If you’re one of those types that wants to try everything, they don’t sell Magic mushrooms there anymore (due to a recent controversies involving tourists) but they do sell the truffles (roots/stalks) of the mushrooms which apparently have the same effect. All at your own risk of course!
• With all the dodgy stuff that happens there in terms of drugs and prostitution, we actually felt really safe here. You can walk around at 1AM in the morning, and have nothing to worry about, because theres always people out and about (mostly being entertained themselves).
• The Heineken Museum is worth a visit, with 3 free beers included and another 4D cinema experience (they call it “brewing you”). The Vodka museum is also interesting, and only costs around $7 Euro.
• If staying at a hotel, checkout the tourist brochures and pamphlets at the front desk – they usually have discounts written on them for museum entry and souvenir shop purchases.

Southhampton, UK

We took an overnight visit down to Southhampton and hired a small vechicle from Europ car and visited the Stonehenges. You may say, its just a bunch of rocks, why would you waste all the time and money? I’d probably say the same thing about Wave Rock here in Western Australia, but I dunno, I really liked visiting the Stonehenges – there’s something about 4000 year old rocks  that mysteriously came to rest from a place far far away. It was also a nice way to see the British country side. We stayed with Katrina’s Aunty in a small town out of Romney (near Southhampton) that not even the GPS could find – so don’t rely completely on these things – get a map too (any service station should have one)!. Another quick tip for hiring a car: with an Australian License, I had no trouble what so ever hiring the car in the UK, i.e. I didn’t need any sort of ‘international license’, so no fuss there.

General long haul Europe travel tips:

• Whenever landing in a new city, getting a decent map is critical! I’m not talking some free commercialized version, I mean paying 5-10 Euro to get one that actually has the street names on and comes with an Index. It saves a lot of hassle and headaches!
• The New Europe tours are really well worth it and the tour guides are extremely knowledgeable. We went on a total of 4 New Europe tours around Europe and of the 4 different tour guides, every single one of them were really friendly and had so many stories to share!
• When getting from one city to the next, investigate all forms of transport, be in plane, train, bus or ferry. In some cases, planes were cheaper, and other cases trains were. Kayak.com has a great system to search all the airlines for you. For trains, these differ for each country, and we found it best to book when you are actually at the origin – as the online systems seemed to always be more expensive (not sure if theres commissions there or something).
• Pack lite when you first leave, cause you’re going to bring a heap of crap back home for sure! Try save your present hunting until the last destination, but always pick up a few bits and pieces along the way, because you’ll never get a chance to get them again. The souvenirs you buy from dodgy looking street markets are often the cheapest, compared with proper shops or the airports.
• Have an open mind – and don’t show it if you get offended or upset! Your the tourist, so you should be offended but that’s what its all about, just don’t take it out on the locals.

Hopefully this tip list can help at least one budget traveller out there! Happy and Safe travels.

• For all 3rd party modules, first make sure a Drupal 6.x version exists! (if it doesn’t, see the next point).
• If you have any custom themes or modules you’ve developed, you’re going to need to re-write some parts of them. The quickest way to do this, is to install the coder module, which (when instructed) will scan your source code and tell you exactly what needs to be changed and directs you to the relevant section in the Drupal 6.x API changes doc. It’s a pretty sweet module and the documentation there rocks too!
• If the site you’re upgrading was at one stage version 4.x of Drupal, and you get an error in the initial run of update.php about “Unknown column ‘language’ in ‘where clause’” – this is normal, just manually correct the table, as per the following drupal.org thread: Upgrading from D5 -> D6 url_alias field errors prevent upgrade, manual bootstrap necessary.
• When you’ve finished re-writing your custom Drupal theme to be compatible with 6.x, make sure you Clear the Drupal internal cache, either from the menu option ‘Flush tables’ provided by the admin_menu module, or by truncating the contents of the cache_* tables.
• If you use the nice_menus module, and use a custom css file, you’ll need to reset the custom path location of the css file (set in Site Building->Themes->Configure->Global Settings).
• If you have some custom menu groups, by default they are set not to expand – if your themes were expecting them to show all the contents simply set them to expand via the Site Building->Menu’s section.

As you can see, it’s a lot easier upgrading from 5.x to 6.x then 4.x to 5.x!

So what’s next then? Drupal 7.0 of course! It’s due out in early 2010 and will feature major improvements in usability, automatic module updates, a fields api and much much more. The development version is due to be frozen in a week’s time, leaving a good 5-6 months of bug fixing (see webhick’s twitter profile – the honourably D7.0 co-maintainer). For more info about the 7.0 features, also checkout the D7UX.org website!

Functionality Issues:

• The option in the Site Configuration to “Disable One Page checkout” actually disables the checkout entirely (Disable One Page checkout).
• You have to install an extension to be able to edit email templates, without them being replaced when you upgrade the Magento Core (CLS Upgrade-proof Email Templates).
• I installed an upgrade to an extension (Securepay integration) via the Magento connector, and due to an sql issue, the whole site died with debug info on the homepage. I ended up having to restore my backup and then not upgrade to the bad version of the plugin.
• Page loads are really really slow although it appears to have been improved in the latest 1.3.2.3.

General Magento website issues:

• You can’t actually download the magento package directly (via another machine) from the link issued when visiting their website! They have some sort of cookie check – which means when you want to download the package to a server, you have to open up lynx and go through a bunch of pages rather then a simple wget command.
• The handbook for developers and designers on their website is really small and outdated. Most of the help online can only be found in their forums, which if your lucky enough, sometimes a Magento developer will actually reply with the ‘best practice’ way of solving something otherwise it’s hacks all the way.

Templating issues:

• The directory structure can be really really long, i.e. to edit the templates, you have to copy the existing themes, and then you’re editing files here: public_html\app\design\frontend\<theme name>\default\template\page\html\.
• If you want to make sense of what the contents of variables being echoed in template files you have to refer to the really ugly code located in another random place. @OliveChi notes Magento’s source code commenting hasn’t been properly written to support phpdoc, so you can say good bye to auto suggest/auto complete is ZDE.

On the plus side:

• The ‘Magento Connect’ feature of Magento allows anyone with the plugin key (obtained from their website) to download and install the plugin without any technical knowlege. There’s no downloading/uploading/untarring/running sql updates/update scripts – something you’d normally have to do for something like Drupal or Zencart.
• The sales & profit reports in the administration area provide all sorts of pretty charts.
• (this could also be a bad thing), but just about every facet of the magento ecommerce system can be configured via the Administration Area. i.e. you can have all sorts of product configurations/types.
• Multi-site/multi-store support.
• Out of box support for Paypal, and support for heaps of different payment gateways.

Feel free to comment if I’ve got something wrong!

The first thing to always do, is to make backups repeatedly throughout the upgrade process. I had the following commands handy and ran them right before I did anything serious:

tar -czvf site-backup-`date '+%y%m%d-%H%M%S'`.tar.gz public_html
mysqldump -u sitedb_primary -p sitedb_primary > \
`date '+%y%m%d-%H%M%S'`.sql

The other thing to do before you start,  is to do all your upgrading on a staging or development version of the site first. This is because, theres a high chance you won’t be able to do this whole process straight off the bat, and you probably don’t want to leave your site in maitenance mode over night while you recover for another attempt.

The following guides/screencasts are what I followed to perform a successful upgrade, plus a few notes, I made that weren’t covered:

1. Converting custom content types from Flexinode to CCK: http://docs.indymedia.be/node/1

• Make sure your flexinode fields all have unique names from one another. I had to rename a few of my flexinode body fields before flexiconvert would convert things successfully.
• Keep notes on all your original flexinode names and field names. This is so that when it comes to your themes you can easily update them to the new field names.
• When creating new content types, you must add the add/edit/delete privileges for each new content type before you can access this section.

2. Screencast for upgrading from D4.x to D5.x: http://drupal.org/videocasts/upgrading-to-5

• Disabling any custom theme or custom modules are some of the preparations recommended in the screencast. Before you do this though, make sure you don’t have any php code used for block visibility that might use functions in these custom themes or modules. You can either update them with a function_exists(), or re-write them to work out the condition another way.
• Before running update.php, it might help to do run the following commands on the database “DELETE FROM `variable` WHERE `name` = ‘cache_inc’; TRUNCATE TABLE `themonth_monthlydb`.`cache`;”. I read somewhere that the D4 caching options were different in D5, and if you tried accessing the site after the upgrade without doing this, it would cause your site to die.
• If your going to leave your site in maintenance mode for an hour whilst you conduct the upgrade, and don’t want the default Drupal Alien logo to show up, simply update the public_html/misc/maintenance.css body tag not to reference ‘druplicon.png’. This might be particularly important if you have a popular site and don’t want to scare people!
• For views, if you use the filter by ‘Distinct’, make sure its the first filter in your list, otherwise it doesn’t seem to let you save it.

3. For converting your custom themes and modules to D5: http://drupal.org/node/64279

• For a custom nice_menu’s css file, you can now specify the css filepath via Admin->Themes->Global Settings->Path to custom css file.
• Put all your custom modules in their own folder within public_html/sites/all/custom/
• Where possible try to keep your drupal install on the upgrade path by overriding things, or creating custom modules, rather then touching core or contributed php/theme code .
• When upgrading custom modules, if your in the process of doing things like updating modulename_settings – make sure you disable and then re-enable the module, otherwise, you’ll get some whacky side effects like double admin menu items, etc.

That’s it!

If you are doing an upgrade, I wish you all the luck and patience in the world! And for those that believe in doing a site rebuild over the upgrade, I recommend you try the upgrade first and exhaust all possibilities before giving up, because either re-entering all your sites content, or hacking up a content copy script is more work then it seems.

Basically, the reason for changing, is because subdomains (like blog.akb.com.au) carry less weight in google indexes then TLD’s or Country Second Level domains. The other reason was for my personal preference not to use subdomains, as they just seem a bit too tedious.

Another change I made here, is install this handy Twitter Widget Wordpress plugin which automatically updates this site with my tweets! I’m a bit of a Twitter noob – only opened an account a few weeks back for fun, so feel free to follow me, and I’ll follow you back

Anyway, the number is calculated on the financial year, then week number of that year, and the day. It’s all explained on this page, along with a handy date code to real date calculator: Seagate date code.

Acquia is the commercially supported version of Drupal. The standard package (which can be downloaded from the acquia site) comes with all those important 3rd party modules: CCK, Views, Wysiwyg, Filefield, Calendar, Date, Google_Analytics, Imagecache, Pathauto, Print, Admin_menu and a whole lot more. Individually downloading, extracting and moving/uploading all these modules can take a fair bit of time normally.

One of the (pretty minor) downsides to using Acquia though, is that the commercial subscription options come bundled (and enabled) with the package, and the default garland themes has a little Acquia branding. Surprisingly though, its pretty easy to disable (aka vanilla-ise it), and I’ve jotted down the whole 2! steps taken below:

1. Simply disable the modules (Site Building->Modules): Acquia Site Information, Acquia Search (if you’ve switched it on) and then Acquia Agent (you might need to disable each one individually). This will remove the subscription messages and the flag shown in your admin menu (top right hand menu).
2. Go to Site Building->Themes->Garland->Configure and tick the ‘User the default logo’. This will switch back on the Drupal alien logo, rather then the acquia logo.

That’s it, pretty simple, huh!

Now a quick note if your a developer:

The 3rd party modules which you’d normally install into ’sites/all/modules’ are instead installed in ‘modules/acquia’. No, don’t put any custom or other 3rd party modules in ‘modules/acquia’ – continue to put them in ’sites/all/modules’ to ensure you don’t contaiminate the acquia installation. The reason you might want to know where the 3rd party modules are that come with acquia, is that you might need to go through the code (perhaps for searching for a theme function, or function parameters).

Not much more to say at this point about Acquia, other then that it rocks!

While I can say first hand (attempting to maintain Zencart, Joomla and phpNuke sites in the past) that there are a lot of open source web apps that do suck, I don’t agree that they all do (and the same probably goes for proprietary software too! – some suck and some rock).

“1. You can’t guarantee the code. Unless your developers has spent A LOT of time working with the application, they aren’t going to know the code. For them to become familiar, they are going to have to spend a lot of time getting to know it. This doesn’t save time, it wastes it.”

Can proprietary web apps be guaranteed too? If anything proprietary web apps can be guaranteed less, because in a company where only staff members of that company know the ins and outs of that application, if those staff leave (which, they naturally will), the new comers are going to be spending more time learning and testing, then actually producing work. At least with an open source web app, they could have been exposed to the app before hand, and can hit the ground running when they start?

“2. Making core changes to a system is just asking for trouble – I hope the time you saved by using the system is re-allocated to testing the FULL application – you have no idea what you will break.”

Take the CMS Drupal for example – it’s designed in such a way that no one needs to make any changes to core code because everything can be overridden.

You put your contributed themes and modules into their own folders, and your customised themes and modules into another set of folders. Core updates can be applied without affecting these because Drupal simply knows not to touch these folders.

“3. Skinning pre-built applications sucks. Trying to modify some else’s CSS is worse than someone else PHP. Just like modifying core code libraries and hoping for the best, it is really hard to know what you will break. That is of course assuming the application isn’t a spaghetti of tables, and includes that have little structure (Xoops, osCommerce, Joomla – I’m looking at you).”

In Drupal, all pages, nodes, fields, blocks, and so on, can have their own overridden template files. Whether you choose to call your div something specific and then do your own styling is entirely up to you.

“4. Open source developers are very narrow minded – their contributions are to suit their specific need, which means every developer will try to include their feature, and unless the leads are ruthless, you end up with a application that has everything that opens and shuts, but that doesn’t really open or shut very well.”

Just about any type of developer is going to have their own agenda. For the Drupal core though (like a proprietary app I’m sure), there is Dries, the original and lead developer and then there is a small set of developers that stick to their own areas. See the Drupal MAINTAINERS.txt for details. For developers that are narrow minded, this is still allowed of course, its just a case of them developing their work as a pluggable module.

“5. As soon as you modify software, forget about updating it. If there is a security fix, or a new feature, you will basically have to spend a similar amount of time re-patching the new version with your changes. If you wrote your own application, you can add a feature much more easily.”

With open source web apps, you’re naturally going to require applying security fixes and updates, so its in the developers best interest to support such a thing. Take the Drupal CMS again – it can actually be setup to talk to the Drupal software Repository, and notify you when updates are detected.

“6. ‘Modules’ are a misnomer, I am yet to see a decent module system for anything but the most basic feature – they all involving modifying code to work, which is you ask me, isn’t a module.”

With Drupal, you simply: 1. Download, 2. Upload, 3. Activate in your Module Listing via the admin menu. 4. Configure in the configuration settings of that module via the admin menu. If and when you want to customise the styling of the module output, you create functions or template files in your custom theme folder, not the module (so it also can be updated, see #5)!

Take a look at the 3rd party Drupal Modules: CCK, Views and WebForm – these really add a lot of functionality to Drupal.

“7. The documentation will never be up to date. On of the selling points of open source software is that you have thousands of developers at your disposal to fix and add features quickly – unfortunately, the documentation never keeps up. You better get used to reading source code.”

Most documentation for web apps is outdated anyway. Personally, I always found wiki’s, discussion forums and mailing lists as the best place for advice – at least they are more likely to exist with open source applications and don’t cost an arm and a leg to access?

“8. Open source apps are hacked not engineered. Design by committee never works, design by ad-hoc anarchy REALLY never works – if the project doesn’t have a clear leader who has a vision and is ruthless in implementing it, you are going to end up with a mess.”

After the first sentence, this is pretty much true – but again, it applies to all types of software/web apps. Drupal started off as a hack, but after many rebuilds and iterations, I’d be surprised if even one line of code is still in there from version 1.0.

“9. Support. You don’t get any. Budget time for your developer to scour the ‘net for an obsure german forum where someone has found a solution to the similar problem you have had that may or may-not actually work.”

Check out Acquia – commercial user and developer support for Drupal.

I think the main point here is, just because a web app is open source, doesn’t mean it sucks.

I’m also going to make a note here, that despite me being a Drupal fanboy, I do acknowledge that its not a perfect web app (for one, there are some serious usability issues with the administration interface that have been around since the early days – suppose to be fixed in the upcoming Drupal 7 release though), but hec, can any piece of CMS software be? Hopefully other open source web applications will follow a Drupal like development and maintenance model..