23 Oct 2016
2020 is approaching fast, one day at a time, and besides being a nice catchy year, it will be also the year where Python 2.7 will no longer get any security updates.
What that means for Plone? We should hurry up and get a python 3 porting of the whole stack, yes, including Zope, ZTK, ZODB and all the tooling around (zc.buildout, etc etc).
Fortunately quite some tooling and Zope/ZTK/ZODB is already updated and there's ongoing effort on porting the remaining parts.
The big elephant on the room blocking any porting effort of Plone to python 3 was RestrictedPython, a python distribution that, quoting itself: provides a restricted execution environment for Python.
Note the past on the previous sentence.
Since RestrictedPython is being worked, now it's high time for the other python distributions from Plone to be also made compatible with Python 3. Stay tuned for the Plone Conference 2016 sprint report!
Copy&pasting&adapting a set of scripts to track the progress of the porting for the Zope foundation github organization, results here, I made the same but tracking what Plone 5.1 (including our testing environment) looks like on Python 3:
During the Plone Conference 2016 there is quite some work put on either reducing the amount of dependencies, or updating our stack to use newer (already python 3 compatible) part of the underlying stack.
The clock is ticking and Plonistas all over the world are working hard on it!
23 Oct 2016 3:53am GMT
22 Oct 2016
- Updating add-ons for Plone 4.3 and 5. social.like, FacultyStaffDirectory, contentrules mailtogroup, collective.cover.
- Working on nicer listing of add-ons on Plone.
- Plone 5 toolbar UI improvements, default icons if they are missing, changed manage portlets sidebar with sensible texts, edit all portlets.
- plone.restapi. Long discussion about the framing, options listed as url, building basic Angular app, tutorial for search explaining how to setup al kinds of stuff.
- RestrictedPython to Python 3: lot of work
- Porting away several packages from ZopeTestCase. Looking for new server for Jenkins nodes. Removed lots of old upgrades from plone.appgrade.
- Release team: working on signing PyPI uploads.
- Review Plone documentation, looking how to use Sphinx in more sophisticated way, linking to the source if we mention classes or modules.
- Documentation on Plone support channels is done.
- Pyramid. Start using cookiecutter instead of pcreate to create a new project. Tutorials. Working on deform, colander, and demoes of that.
- Rapido in Mosaic tiles.
- Video and VR, Plone 5 support for c2.app.streamingaws, created template for 360 degrees viewer
- Update Zope dependencies, working at fixing some breakage when using newer versions.
- Resource handling, working on bug with legacy scripts, discussions.
- eea.facetednavigation, fix issues during upgrade from version 9 to 10, fixed batching issue, working on final blocker for release.
- Jasonic api for ZODB, working remotely with Jim.
- plone.app.multilingual, better visibility for selecting translations, inline svg.
- Make icons great again with inline svg instead of fonts.
- bobtemplates.plone theming improvements, separate the theming template from plone_addon, add a fat theme template for TTW, added fat theme buildout template, adding Rapido and other stuff, working on wrapper script.
- Plone marketing, prepared more news items for plone.org, plone.com content changes, marketing ideas for headless CMS, Carol will be interviewing some of you.
- Plone Cleanup, made it so that you can really get Products.CMFPlone without Archetypes, removed zope.formlib from GenericSetup which was the last one that was using it, zope.globalrequest, reviewing work.
22 Oct 2016 9:33pm GMT
21 Oct 2016
Sorrento. Lovely spot in Italy. Annual event for past ten years or more: Plone Open Garden. What is it? It is a place that has Plone and Plonistas. It has a hotel as our central place, great food and drink, family friendly atmosphere for open discussions. Nice view. We want to focus on headless CMS. But not only tech, also how this affects our marketing and strategy. People with different skill sets are welcome to join.
When? Not fixed yet, but around 18 till 22 April 2017. Watch for one or more preparatory sprints over the world. Watch for discussion docs and roadmap. Please signal your attention early so we can make a great deal with the hotel.
There are different possible futures for us. Valid, possible, and good. Several roads.
- CMS. We are targeting that market. It's what we do right now. Lots of plans like moving to Python 3.
- Products. Quaive (Intranet), CastleCMS. Targeting specialised audiences. Built on the same technology. Various approaches to UI.
- plone.server. All of the above, headless plus Python 3.
CMFEditions has been used for a long time for content revisions in Plone. Configured in the control panel. You can view old versions, or revert to them.
Several limitations and issues. History listing and statistics are calculated on the fly, which takes a very long time. If you delete a working copy, old revisions stay in the ZODB, they will not get deleted by anything through the web. Real life example, 50 GB data, out of which 34 GB was in revisions. That may not be common, they were editing several large documents daily.
We created collective.revisionmanager for this customer. Sorted listing of portal_historiesstorage. You can purge revisions or delete entire histories. It maintains a cache for statistics and history data. It has a control panel for the purge policy.
We made an example Angular2 blog app on top of Plone.
Talking about processes let's you end up with an empty room. There was a Planning and Organising Sprint in June this year in Amsterdam. Shouldn't we write down our processes? We have between ten and fifteen teams in Plone. Who knows what a PLIP is? Everyone. Who does the roadmap? Framework team? Release team? Roadmap team, is that existing?
How do people who are not here or are introverts, give feedback? How much time does volunteering cost? If we describe tasks, it makes it easier to give a task to someone else.
Release team only does releases to PyPI? What about press releases? News items, tweets, documentation? There is more process here.
Do we need a process team? Yet another team? I will start documenting some.
Joke in Brazil: Brazil is a country of the future and it always will be. President Lula got lots of people out of poverty. Still big gap between rich and poor. Next president Dilma was impeached. Police used to be nice to protesters, but not anymore.
What has this got to do with Plone? We created a blog add-on, with payment system, to maintain freedom of speech.
Gloss helps with theming by adding classes. gl-menu, gl-drop, gl-frontend. Diazo makes xslt easy. Gloss is supposed to make Diazo easy.
Use https! Get a certificate. Nag your sysadmin about it. Free at https://letsencrypt.org Commercial may be better for you.
Don't drop to http if the client tells you.
Only send cookies over https
Get a good score on ssllabs.
Plomino is a flexible and powerful application builder in the Plone UI. Version 2.0 is mainly to support Plone 5. Archetypes support has been removed. Small demo.
This is for anyone who needs to give deliverables to other person. Don't let others set your feelings. They will try to bring you down if they see it has an effect. Smile, turn up the corners of your mouth. The person in front of you is inclined to mirror this. Enjoy what you are doing, appreciate what you enjoy. Disassociate from 'toxic' workplaces or persons, you are separate.
In other solutions we were missing chunked uploads, resuming a failed upload when you retry. The jquery.upload library does support it, so we support it in ims.upload.
Not released or on github yet, I hope to do that soon.
Using Pyramid and Probability. I created a site for a startup that were trying to match cat owners and cat sitters. We needed to enable conversations by phone between the two groups, using Twilio. We made it so it in the end cost far less than otherwise. Lesson learned: don't guess, because we started with a solution that would have cost much more. See http://catinaflat.com
This was not Plone 5 ready. We had several options, but decided we may just want to store it outside of Plone. There is http://pleiades.stoa.org: Plone plus Zotero. It would still be a lot of work, but if you are using it, please contact us and we'll see if we can pool resources.
Thank you to the Microsoft NERD center for hosting us. Thanks Jazkarta and Wildcard for organising. Thanks to MIT Media Lab for provide us the Barton room for the keynote talks, especially Jen. Thanks to the training spaces: District Hall, Landmark Center, ZipCar. Thanks to Gold sponsors cars.com and SixFeetUp, and the sponsors at all the other levels. Thanks to our media partner evenios, especially Armin. Special thanks volunteers Doug Feeney and Michelle Esperanza. Thanks to T. Kim Nguyen for your time, effort, patience, generosity of spirit and just being you. Thanks to our fantastic trainers, our amazing speakers. Thanks to every last one of you who attended the conference.
Paul: "A roaring applause for you two, Cris and Sally!!!!"
16 to 22 October 2017: Plone Conference Barcelona. We will be at the technical university, they support us, they have 400 Plone sites. We want to involve the wider Python community of Barcelona, encouraging others to join, maybe a more general Python track.
The sprint starts tomorrow at 9 o' clock, in this room. This is a perfect time for beginners to join and start doing some work. You don't have to be a crack core developer, not at all. You are very welcome, we are very friendly and open people.
Possible sprint topics are on titanpad.
21 Oct 2016 10:04pm GMT
Not only is the full current board here, but also our treasurer Jen Myers. Hurray!
Thank you to our membership committee, ambassadors, sprint organisers, creators of the new plone.org site, our keynote speaker at PyCon (Cris Ewing), speakers at other conferences, CMS Gardeners, Google Summer of Code students and mentors, our intellectual property and trademark watchers and relicensers, new Foundation members, sponsors both companies, universities and individuals. The general and financial reports have been approved.
The current board has these seven members:
- Chrissy Wainwright
- Paul Roeland
- T. Kim Nguyen
- Carol Ganz
- Philip Bauer
- Víctor Fernández de Alba
- Alexander Loechel
And the new board:
- all of the above.
Please step up to nominate yourself next year if you want to serve on the board. If there are more than seven, we will have an election.
The board has received a proposal for the next Plone conference, we have done due diligence and you will hear about it later today.
21 Oct 2016 8:10pm GMT
This talk is about psychoanalysis of a community, psychology of developers. What motivates 'us', the Plone community? How do we feel? We do technical stuff, but we are humans, so we have feelings.
Open source, free software: you work for free for people you don't know. That is how your father-in-law would think about it. He thinks you are either stupid or generous.
Jessie J: "It's not about the money, we just want to make the world dance."
We work because we need to eat, and belong, and have a shared ideal, participating in something.
Study: only 16 percent of employees would recommend their company's products. Disaster! Okay, this was in France, we love to be critical, even about things we don't care about.
100 percent of community members would recommend their product.
- Otium: free time, but not just leasure, also time for caring.
- Negotium: the very opposite of negotium. Time for business.
In English: business and busyness. Being busy. Business is about not caring? That may be exaggerated.
Doesn't it happen to us? A client says something does not work, we don't care. Someone on the other side of the ocean says something does not work in our favorite project: we fix it even in the middle of the night.
Kant talks about minority and majority. Minor: dependent, unfree. Major: autonomous, a scholar among scholars. Developers are grown-ups. But software industry tends to reduce our responsibility. You cannot make developers responsible. Communities value their grown-up status. You do not face clients or a boss, but your co-developers. We discuss with equal people. We feel more committed in this kind of group than in a private company.
Writing software is a full process. You do everything. You are going to iterate over versions. This process induces parenthood. You spend time with the code. You want to fix it, want to feel proud about it, mainly if we show this code to someone. We want to be prepared for the future. In English, software 'runs'. In French it walks, it marches ('il marche'). My kids don't wake me up at night anymore, my 10 year old Plomino software project sometimes does.
Communities are adoption structures. They make sure a piece of software always has loving parents to raise it. It is not just a bunch of developers sharing code. It works like a family, and we welcome new members into the family.
Another concept: how do we build our identity? 'I' needs a 'We'. Gilbert Simondon says: "Becoming myself is a process, which is both individual and collective." Belonging to a group makes me feel more myself. You imitate others.
We want to be Plone. The community is more than the sum of its contributors. The fact that developers want to be a community, makes it a community.
Bernard Stiegler: transindividuation. Plone participates in our 'We' and each of our 'I' processes. We and I influence one another. We change I, and I change We.
Plone-the-thing is just the software itself. Code. Not perfect, lots of bugs. It is real.
Plone-the-concept is a moral ideal. We want it to be perfect, 100 percent tested, fully secure. It is the community's super-ego, in German an Über-Ich. The concept rises above the thing. And the concept influences the thing. The concept stays in the mind of the community, even as individual members may leave or enter.
What keeps Plone going? Love!
21 Oct 2016 7:18pm GMT
Datawire is a first-class Python shop. Python and microservices complement each other really well.
What is a microservice? Small service, self contained, narrow in scope. It is like a lego block. Simpler: it is a unit of business logic. It could send a mail, or fill out a row in a database, anything. You wire them together by combining them in a topology, like a ring, map, star, fully connected, line. Fully connected topology is what I a focusing on in this talk. Netflix five years ago had more than 500 microservices. Twitter too.
Developers are the ones who should define the topology. Business logic is distributed, rather than central. It can help when you need to scale up, integrate various systems, or have really high reliability. If one part of the topology fails, the rest should still remain functioning as much as possible.
Linear topology lends itself for scaling and optimising each part separately: ingest data (network heavy), have one source of truth for data (disk heavy), transform data (disk and cpu), present data (network and cpu).
Microservices are about service oriented development. Thinking about architecture up front can sound nice, but when this takes months without actually building anything, you are probably out of date before you get started. An architecture should think less up front, and do more experimentation, and enable developers.
You need to move away from DNS to service discovery. And from central load balancers to smart end points, to update routing tables in real time. A microservices client should be a smart endpoint that can do the routing, that knows how to discover working and available services.
A microservice is a node in an agile service topology. And it is service oriented development. Needed mindset: from architecture to experimentation.
21 Oct 2016 6:37pm GMT
See slides at http://j1m.me/plone16
Paul Everitt introduces the talk: The ZODB is still amazing after twenty years. Hierarchical object database including permissions, NoSQL, lots of things. On to Jim.
I am working one hundred percent on ZODB currently. Previously for Zope Corporation I could focus only part of the time on it, solving some problems we were having. Zope Corporation no longer exists. I was contracted by ZeroDB, who made this possible. ZeroDB had two products. Database that stores data encrypted at rest. Big-data analysis with hadoop. They decided to focus on their Hadoop-based product for now. I plan to offer ZODB support, consultancy, so get in contact if you need me.
Are any people here using ZODB based on NEO? No. NEO is doing some interesting things for highly durable storage. I bit more effort to setup. Poll: about half the people on the room use RelStorage, all use ZEO, a few use ZRS. I really recommend you to look at ZRS if you use ZEO. ZRS (Zope Replication Services) 1 was a nightmare, but version 2 is very good. We never made backups with repozo, we just replicated it.
ZEO version 4 used asyncore, by far the oldest async library in Python. It has lots of issues and is deprecated. I had a suspicion that maybe asyncore made ZEO slower. I rewrote most of ZEO to use asyncio instead, and cleaned the code up. In most cases there is performance improvement.
The ZODB API is synchronous. I have been using async libraries since say 1996. The API could change. Shane added a cool hack to ZServer to avoid waking up the event loop, which is a big performance win.
Transactions should be short. The longer the transaction, the higher the chance of a conflict. Connections are expensive resources, they take memory. If you have long-running work, try doing this asynchronously. But handing this off reliably is tricky.
Consider using content-aware load balancers, so you don't need all data in memory on all servers. They working set may not even fit in memory.
A challenge for some applications, is to get objects loaded fast, especially on startup. (You can often mitigate this using a ZEO client cache.) There were some problems with persistent caches, but they have been stable for a few years. But you can now prefetch items. You tell ZODB to prefetch some items, and then you can forget about the request and ZODB will meanwhile prefetch it for you, so it may be available later when you really need it. So the items are loaded asynchronously.
ZEO now has SSL. ZEO had authentication, but it made the code harder to understand. It is now out in favor of SSL. So you can restrict access to the ZODB.
ZeroDB stored the data encrypted, which meant the server could not do conflict resolution. So I added conflict resolution on the client. You can then work with real objects instead of just state. Solving conflicts in BTree splits would be easier then. It reduces processing time on the server. I would like to move conflict resolution up to the ZODB, instead of having it in ZEO.
Object-level locks. Currently ZEO locks the database for writes during the second phase of the commit process. In that phase it needs to wait for the clients to maybe do conflict resolution. Object-level locks could help here. I got it working, but it mostly did not give a performance win.
ZODB on the server is actually faster with PyPy.
ZeroDB did some interesting experiments. Split a database into multiple virtual databases, one per user, separate invalidations.
Unification of RelStorage, NEO, ZEO. NEO had some patches for ZODB and they are now merged, like a simpler implementation of multi version concurrency control. This is better for RelStorage as well. RelStorage is no longer a special case, and it has a new maintainer in Jason Maddon.
Inconsistency between ZEO clients. Scenario: add an object in one zeoclient, next request goes to second zeoclient and it potentially does not have the object yet during a very short timespan. There now is a new server-sync option to force a server round trip before each transaction. That is a cost, but maybe it should be the default.
What have I been doing after my work for ZeroDB. I worked on decent documentation, which lagged behind a long time. See http://zodb.org. You can help me improve it, by writing documentation, or also definitely by bugging me about documentation that you are missing.
FileStorage2. FileStorage worked out much better than I ever imagined. The main code has probably not changed in twenty years. It is a bit slow. With FileStorage2 we have better, separate packing, external garbage collection needed though, but that is better. Unneeded features are removed: versions and back-pointers. It uses multiple files, so with a pack you can split a file, write newly incoming transactions to the new part and pack the old part.
Byteserver is an alternative ZEO server implementation, written in the Rust language. Rust is very fast, faster than Go mostly. No Global Interpreter Lock like Python has. Byteserver includes a FileStorage2 implementation, new API between server and storage, built for speed rather than pluggability. Initial tests, from this morning, are promising, twice as fast as ZEO.
We used Zookeeper a lot, which helps keep track of which server are live and which have disappeared.
Future ZODB ideas:
- more speed. I don't need speed to be the reason people use ZODB, but it should not be a barrier.
- more documentation
- OO conflict resolution
- The ability to subscribe to object updates.
- Integration with external indexes like Elastic Search, Solr. ZRS could be used for this: look at that stream of data and push the relevant parts to the external index.
- Persistent pandas data frames
- A 'jsonic' API, to be able to look at the data without having the classes. There are some zodb browsers already.
- ZRS auto fail-over. At Zope Corp we probably only had one or two unexpected fail-overs in all those years.
- Official Docker images would be good. But if that uses Python 3 then your client also needs to be Python 3.
- ZEO authorization.
- Persistent classes?
21 Oct 2016 4:48pm GMT
I work at Wildcard, mostly on highly secure websites. I am on the Plone Security Team.
CastleCMS is an opinionated version of Plone. It packages all kinds of things up for Plone that we have been doing for security.
It is not a fork and it won't ever be. We want to work with the Plone community and want to continue to innovate with Plone. It gives us a place to innovate. Performance is important for us, and we have integrations like CloudFlare for that. ElasticSearch indexes all your content, with an asynchronous implementation of the search api. We heavily use Redis, using it as a cache that is shared between clients or threads. ZRS (Zope Replication Services) to share the load over databases. A lot of ReactJs. z3c.unconfigure for some adapters. And sometimes just monkey patches if there is no better way.
Security is integrated 2-factor authentication. Too many login attempts lock you out. The root Zope user can only login at the root of Zope, not in Plone.
Adding content is done slightly differently, and everything is Mosaic. No display menu, no default pages. All videos are compiled to a web compatible format asynchronously when uploaded. We have a Map tile for OpenStreetmap. Focal point image tile, where you can indicate what the main focus point of an image is, which is then using during image cropping. Social media tiles. All tiles are integrated with patternslib. We have a preview for different screen sizes.
We have a plugin for ElasticSearch to let the search results order be impacted by Google Analytics and social media popularity, for anonymous users.
You can audit what users have been doing. You can login as a different user. We have additional integrations with Google Analytics, archiving of content in S3, sms support, twitter. Recycle bin. Celery integration for asynchronous tasks like video conversion or pushing large files or moving lots of documents.
What is missing? Diazo (you could use it for theming, but we don't, and you don't need it for moving html content around), portlets and viewlets (just use tiles, also possibly inheriting from parent pages), default pages and display menu (we use Mosaic).
When stuff is not open sourced yet, bug me about it.
Roadmap: chat (rocketchat, ask Sam Fords about it), Mosaic enhancement, built-in A/B-testing, continue to refine the UI, more rich tiles, on the long term use plone.server.
We use React because it is better for small parts of the page. If you create a whole app, Angular2 would be better I think. We can fight.
21 Oct 2016 4:39pm GMT
In Europe there is the CMS Garden project: combined marketing for open source CMSes. We are partners and learn from each other.
Is Plone secure? It depends. Core is pretty secure. But security of an installation is dependent upon maintenance: if you don't apply hotfixes, it is not secure.
You can look at number of hacked sites, but security is a process, not a state. You may get a zero day export today. Are you ready for it? Are there bugfix or hotfix release processes? How do you discover those?
Study from BSI 2013: the vulnerabilities in Plone are in the core, mostly not the add-ons, which is different in other systems. So Plone actually protects the add-ons: you don't usually make a site insecure with an add-on. New BSI study this year, not yet published, raw number may seem not so good for Plone, but there was only one really important issue, they were looking at the fresh Plone 5.0, and most problems have meanwhile been fixed.
For most of the other CMSes you need a lot of add-ons to come to a comparable functionality as Plone, and that may be less secure: their add-ons have more problems. On my university I see hacks for wordpress and Typo3 sites every week, for Plone: none.
Plone has a different focus. It is good for intranets, and is not only a CMS, but a portal engine. Security is built in, with RestrictedPython, AccessControl. There is no SQL database, which means you avoid a whole category of problems. We have generators for add-ons, giving a secure base for adding features, so you don't make beginner's faults.
Plone's market share is not so large, so large botnets will mostly ignore us. That does not mean we are more secure, but it does help in practice. But we are used by several high value targets, like the FBI, which will normally get attacked first. Zope/Plone users are usually more aware of security.
Permissions and workflow are a real strength in Zope and Plone. An institute like BSI will give Plone at most a medium security level. Not high security, because admins can see all information. If you really would want this, you could actually build it with workflow.
In PHP, data and code are mixed, also for add-ons. In Plone, code is on the filesystem, and you cannot change it.
Sanitised input. Warning: don't use the structure keyword to display unfiltered user input. We do automatic csrf protection.
Plone does not enforce active bans of ip addresses, and security studies may complain about it missing out of the box, but you can simply use fail2ban in front of it. Use tools like that. And use good caching to avoid your site going down under an attack. There are ways outside of Plone, or any other CMS, that you can use.
The Joomla security team does a good job of communication, we could learn from that.
But other security teams often belong to one company. Often only bug fix releases, not security hotfixes. Bug fix releases may contain all kinds of small or large feature updates. Sometimes no security information is available, especially for add-ons, which is where most of the issues may be.
Never use a system 'as is'. Think about extra security you can apply in front of it. Spend fifteen minutes a day per system to maintain it.
If you have a strong security need, check out the Zope Replication Service to have a read-only front-end.
Audience: shameless promotion for Radio Free Asia. It is using Plone, and it is a constant target of attacks, and we have a clean record, no successful hacks.
21 Oct 2016 3:50pm GMT
It's nice to do a tech talk again, instead of always doing a keynote about the future of Plone. Sorry, I can't show you details, because I got laid off and there is a non disclosure agreement.
SQLAlchemy allows you to talk to SQL databases in a Pythonic way, getting Python objects as results.
Martijn Faassen created Traject, combining routing and traversal. Izhar Firdaus wrote collective.trajectory to do this in Plone. We use this to traverse to SQLAlchemy objects, by registering functions. We hooked the results up to plone.app.contentlisting as well, so they show up correctly in listings, like the standard tabular view.
A trajectory example project: https://github.com/esteele/example.trajectory It has add and edit forms which talk to the SQL database.
We had really a lot of tabular data, so it made sense to do this in SQL, not in a normal Plone portal type.
21 Oct 2016 3:03pm GMT
When I met the Plone world around 2008, I saw there were lots of small companies and individual consultants. It inspired me to quit my job and university. Then the economy collapsed. Coincidence?
Movie The Social Network, 2010. When I heard about this movie, I thought it was going to be horrible. A movie about Facebook, really? But it was really good writing. One line struck me especially: "We don't even know what it is yet." Often we will get a new technology, and in retrospect have no idea what it was yet. We invent something, but we don't even know what it is yet.
The web in Python, end of the nineties. It was not much, it did not look like clean code today. The web was young. The blink tag, anyone? These two not yet mature technologies met, and mingled.
What does Python offer? What sets it apart?
- Reflection. Your program can look at itself, like in a mirror. Things like: list all functions of a class, ask the type, get an attribute by name. Not a lot of languages did that.
- Object oriented. Not just object based, allowing you to split functionality over several objects. But sub classing, multiple inheritance. You get invited to write new methods for existing classes. (And it eats a whole level of indentation, but that is another story.)
- Dynamic. You can wind up with code and objects that don't even exist in your raw source code. You can generate code on the fly, insert variables dynamically/magically. Such things might not make your code more readable though: code that does not even exist on the file system?
- Simple. Einstein: "Things should be as simple as possible, but no simpler." Dan McKinley, book Choose Boring Technology: "Every company gets about three innovation tokens." You can do about three new things without falling over. Are you going to use MongoDB? You have just used up one of your innovation tokens. Only choose new exiting technology in strategic places. For the rest: just use MySQL, Postgres, Python. Boring, but stable.
Some Python web technologies: Django, Flask, Bottle, Pyramid, Morepath. Flask and Django are an order of magnitude more popular. I created this list, found the same list somewhere else. But some techs fitting in the middle were forgotten, like web.py, web2py, CherryPy.
Flask and Django:
- Views are plain functions
- explicit registration, not reflection
- your app can start small and simple
Today, Django stands as Python's default first framework. Flask actually has more github 'stars' for people who follow it. Yet there are far more Django conferences or meetings world wide. Django gives you a good start. Years later, you may get more opinionated, with good reasons, and choose your own ORM and a different, smaller framework. As a beginner, Django just helps you a lot.
And Django has a forms library. Wait, that may involve classes. You may need inheritance and introspection. But good programmers don't avoid complexity when it helps them. Then again, a form library is a bit like backing up a truck with multiple trailers. You have knobs to control how they are going, but can you do that without failure? And you are probably missing all kinds of knobs that the forms library has not thought about. But a forms library does automatic validation, refills forms for retry, does cross site scripting, which a new web developer probably does not even think about. So it is good for them to use it.
Flask has become the go-to second framework, for when you know what you are doing.
40 - '30' -> 10 40 + '30' -> '4030'
In Python you get a helpful traceback when you try this, instead of running into undebuggable errors later on. Ah, but in TypeScript you get the same. They fight back successfully against the broken type system. And you can cross compile it to ES5.
There has always been another language that was more popular than Python. There is nothing new. What are Python's advantages then?
It is becoming the world's default language. Science is moving to Python. Data is moving to Python. At weather conferences there is now a Python track. Simple syntax is perfect for the occasional programmer, who has other stuff to do, like science. You do your science, and one every three weeks you write a small program. Django Girls organizes lots of weekends around the world where women use Python to write their first website. The new programmer needs Python, because it is simple.
The web and Python met when both were immature. In the years, both learned the patterns to make the web possible and sometimes even simple to program for. And even after all this years, we don't even know what it is yet.
First language for a child? Scratch is good for young children. Python is a good language to get used to. In the US it has become the default in universities for courses.
Where at the language syntax level has Python done anything really new? When you open a file, once PyPy got popular, it got clear that files would remain open. We had to have a way to run cleanup code, even when exceptions rose. So we did try/finally, like in the Java world. It solves the problem... and it is ugly because it is Java. So we decided we needed to do one better. I believe we innovated with the with statement. It was not intuitive for me at first, but it is very helpful. It is marvellous for any kind of recursive context management, changing directories being sure that you will return to the previous directory.
Find me on Twitter: @brandon_rhodes.
21 Oct 2016 2:01pm GMT
20 Oct 2016
We have overhauled the related items widget in Plone 5.1. You can configure it, you can upload extra items. More possibilities now.
BTW, Welcome at Alpine City Sprint.
Also, after the lightning talks there is an open framework team meeting in this room.
- collective.fingerpointing: select which events to log, like who logged in, who created content, etc.
- collective.lazysizes: lazy loading of images, iframes and tweets, while you scroll down the page. We reduced initial load times with 80 percent.
- collective.liveblog: content type for micro updates, bit like twitter. Automatically refresh using ajax calls.
Unofficial Zope on Python 3 status: http://zope3.pov.lt/py3
Today I worked on the same for Plone packages. So:
Unofficial Plone on Python 3 status: http://gil.badall.net/py3
Everybody was sure that Somebody would do a job. Nobody realised that Anybody could do it. Etcetera.
That is decision paralysis, waiting for anybody else to do the job. That is why we have teams in Plone. Maybe we can use the teams more on github. If you start looking for things to do, there are hundreds of issues for Plone. Split by team, it is less daunting.
There will be sprints this weekend, in this room. It is when a group of people get together for a project. Timo will be leading and assisting the sprints. Find him if you have questions.
There is a list of things to work on, you can add more. Please put your name in as a leader if you are up for that.
Buy one, get one free!
Thank you, Plone community, for all the documentation.
At http://themeforest.net you can find and submit themes as plugins for various systems.
http://themes.quintagroup.com is already doing this for Plone.
Why doesn't http://plone.com have something to sell? That was always my question. The Plone Foundation could get a share of the sales.
Money is not everything. You get to involve developers from around the world.
How to grow the community with little time and no money.
We have a small percentage of the market. Don't wait for marketing to rescue Plone. What made you come to Plone? Most of you know and like Python. You tinker with code.
IndyPy User Group started very small, now hundreds of people, with at least forty people meeting each month. In a Python group like that you are going to find Pythoneers, thinkers, tinkerers, prime targets for becoming a Plone person. Sponsoring is cheap: buy pizza. There are 700 Python meetups in the world. We can spread the message about Plone there.
How about creating a demo leader board? A competition for who gives the most demos for Plone.
I gave my first Plone training in the Arnhem conference. In Bristol there were four trainings, Bucharest three, lots of people were there. In Boston we had 19 trainings, 22 trainers, over half the people of the conference attended the trainings.
Trainings are hosted on http://training.plone.org. For various audience and topics. If you use the trainings and spot an error in the code or in the language, please report it.
I use cookiecutter to create a new project. I copy some settings over. Then I use zappa to deploy it to lambda from Amazon, or update it.
Works with Django, Flash and Pyramid. May work with Plone, but I have not tried it. Only Python 2.7, not Python 3 currently.
This is a Pyramid sprint in my home town of Ljubjana, Slovenia. 5 to 9 December this year. It would be great to have Plone people there too.
IRC comes from Finland, just like Linux, SSH, and Angry Birds.
On IRC you invest in the community, and the community invests in you. Useful IRC channels are #plone, #pyramid, #python-friendly.
But IRC is dying. Other mediums are Stack Overflow chat.
Some thoughts on training. I moved from end user to consultant and trainer.
I tried to teach configuring Plone in four hours.
We forgot to buy coffee. The guy made us a blend of coffee after a few questions. I did the same during the training. The people I taught were older, more experienced than I am. Who was the newbie?
Structure the information that you are teaching. That gives them a map.
Progressive exposure, teach them more and deeper as you go along. Don't start too deep. But: when the people already know enough, then you can dive deep quickly.
You guide people on their learning path.
You can be a trainer too!
mr.docs helps you write documentation for you packages. From the source it creates nice html, without you needing to setup Sphinx yourself. It checks for typos. It knows names of PyPI packages and adds it to the dictionary, which helps. You can let it create a fresh config for you to edit.
Since last week, we have an official Docker image for Plone.
See also his talk earlier today: http://maurits.vanrees.org/weblog/archive/2016/10/alin-voinea-docker-and-plone
Me again with another experimental package. :-) See https://pypi.python.org/pypi/experimental.publishtraverse
20 Oct 2016 10:08pm GMT
This is an update on pas.plugins.ldap.
LDAP is Lightweight Directory Address Protocol. This protocol for storing and querying information on users goes back to the eighties. There are various solutions, like OpenLDAP, ActiveDirectory.
There has been LDAP support in Plone for a long time. Products.LDAPUserFolder has been available as basis, replacing the standard user folder. Products.LDAPMultiPlugins wraps it to the PAS API, difficult to install. Products.PloneLDAP integrates is more into Plone, but also difficult to install. plone.app.ldap is a wrapper around this, making it easy to install in Plone. But everything is stacked on top of each other, very difficult to maintain or understand.
We created a complete rewrite: pas.plugins.ldap. We use an abstraction of the LDAP features, in``node.ext.ldap``, Python 2.7 only, using python-ldap, pure Python.
You can get groups and users from LDAP. It maps LDAP attributes to PAS property sheets. Support for caching, for many users, 98 percent test coverage.
Limitations: you cannot add users or groups, only edit them. The underlying library does implement this, so this is a TODO item, although our sites don't actually need it: users are added or deleted in a different system. No multiple (fallback) servers possible. It patches the user portraits, so this may conflict with other patches that you may have.
We have a test layer that uses an OpenLDAP instance.
node.ext.ugm is used, which is a set of interfaces for User and Group Management.
pas.plugins.ldap uses those base packages, configures it using GenericSetup, provides ZMI and control panel forms to configure LDAP.
Supporting 'many' users is tricky, this was solved using money from a fund raiser campaign. Thank you!
20 Oct 2016 8:36pm GMT
Lessons from integrating Pyramid, React, and Plone (and elasticsearch, and Salesforce, and a payment gateway, and...) Quoting from the Plone conference site: "The Volunteer Management System (VMS) is a tool that Jazkarta built for Washington Trails Association to manage volunteer sign-ups for helping maintain hiking trails in the state of Washington. It allows staff to schedule work parties, volunteers to find and register for them, crew leaders to access information about their crew, and land managers to report on work that was done in their region."
The tools you use matter. So use the correct tools.
So at the start, we had the wta.org site, and Salesforce, and vols.wta.org, which was basically a bunch of ten year old scripts.
We could have built everything in Salesforce. It has all kinds of options for doing this, but there are all kinds of restrictions.
We considered Plone. All user accounts were already in here. But we did not need a lot of content management.
On the front-end we used ReactJS. This communicates with Plone for content and with Pyramid for the volunteer management. Pyramid interfaces with Redis, ElasticSearch and Salesforce.
With Pyramid, the view configuration is very close to the actual code, so you don't need a separate zcml file like in Plone. There are no globals, which makes it easier to write isolated tests. Views are easier to test because they return a dictionary instead of a complete html response.
Pyramid is a framework that is good for writing frameworks. We needed to write some infrastructure ourselves, which is nice to do in Pyramid. For example, with config.add_request_method we made a method available on the request to access Salesforce. We registered an exception view to gracefully handle exceptions for either html or json.
With Pyramid, batteries are available for cheap:
As special deployment bonus: we were not using a ZODB, so no ZODB cache was needed, so memory requirements were low, so we could use lots of threads to handle moments of high load.
It is not perfect, for example there is no automatic csrf protection like in Plone. Some assembly is required: Plone has lots built-in and in Pyramid you need to do more yourself, for example setting up logging.
We used the py.test framework, which makes it really easy to define fixtures. There is some magic, which not everyone likes. Assertions are easier to debug, giving you more feedback. We used factory_boy to provide fixtures. [See a talk at PyGrunn earlier this year, by Oleg Pidsanyi. Maurits]
We used http://locust.io for load testing.
We have shared navigation between Plone and Pyramid. The navigation is done in Plone, and we created a json endpoint in Plone that Pyramid could call.
We needed to think about Cross Origin Resource Sharing (CORS), with all kinds of headers. These days I would look at plone.rest and how it does this.
Single sign-on. Pyramid redirects you to Plone, where you can login, and with a token you are then logged in to Pyramid.
20 Oct 2016 7:30pm GMT
I am in Berlin via a live video feed. Hello!
In several recent projects with Plone I had a common challenge. The CMS was just one of many parts of the stack. People may view our content on a large computer screen, a mobile phone, or virtual reality glasses, which all need to be handled differently. There are several solutions, like contentful. Some common traits:
- Everything is through the web.
- APIs for various languages
Why was I using Plone for that?
- No more custom PHP development please.
- Lots of things included.
- I am still quite productive with Plone.
- I did not look for hosted solutions.
If I build it in Plone, I may be the only one at the company who can maintain it. Not so with a hosted solution.
But: I still love Plone, and want to use it, for good reasons:
- One API endpoint.
- Better control over performance issues.
- Integration with front-end development is essential.
And now I actually have four Plone developers in the team, so that is great. The team is happy with Plone. We use as building blocks:
- plone.restapi. This saved a lot of time.
- a policy package
- PyCharm IDE for writing Python
- Thumbor. Image server over Tornado. Cropping, filters, transforms. We have integrated this in Plone using event subscribers.
Lessons for Plone:
- documentation, documentation, documentation. Everything I did was possible due to documentation.
- More documentation, more documentation, more documentation.
- We need more projects like plone.client.
- We need more commercial offering of headless hosted Plone.
20 Oct 2016 6:46pm GMT