fidzu : web

Today we are talking about Drupito, its Business model, and Marketplaces with guest Ashraf Abed. We'll also cover Generate (Social Media) Image as our module of the week.

For show notes visit: https://www.talkingDrupal.com/563

Topics

• Meet Drupalito and the Mission
• Platform Layers and Roadmap
• Pricing and New Markets
• Marketplace Success Stories
• Exportability and Vendor Lock In
• Growing the Drupal Ecosystem
• Derivatives and Recurring Revenue
• Rebuilding on Drupedo
• Funding Drupal Association
• Global Community Check In
• Migrating Sites to Drupedo
• Marketplace Vision Shift
• Maintenance and Incentives
• Safe Updates Blue Green
• Testing Mindset for Templates
• Official Marketplace Collaboration
• Agency Revenue and Partnerships
• Niche Derivatives and Pricing
• Launch Plans and Vetting

Resources

• Code that ships

Hosts

Nic Laflin - nLighteneddevelopment.com nicxvan John Picozzi - epam.com johnpicozzi Ashraf Abed - drupito.com ashrafabed Avi Schwab - froboy.org froboy

MOTW Correspondent

Avi Schwab - froboy.org froboy

• Brief description:
  • Have you ever wanted Drupal to generate dynamic social media images using tokenized node data, similar to the share images on GitHub repos or Reddit threads? There's a module for that
• Module name/project name:
  • Generate (Social Media) Image
• Brief history
  • How old: Created by tfranz of Germany on 22 April 2022
  • Versions available: 1.x-dev, 2.0.0-beta2, published a few weeks ago by our own Martin Anderson-Clutz
• Maintainership
  • Minimally (although now slightly more actively) maintained
  • No Security coverage (yet)
  • Passing GitLab CI tests
  • Well fleshed out README for docs
  • Number of open issues: 8 open issues, 0 of which are bugs against the current branch, but there are lots of feature requests
• Usage stats:
  • 1 site reports using this module
• Module features and usage
  • GSMI requires an image style that uses a "Text Overlay" effect - this comes from the Image Effects module and lets you burn tokenized (or static) text onto an image. Normally, when Drupal generates an image style derivative, there's no entity in scope - it's just processing a file - so a token like [node:title] would resolve to nothing. GSMI's real contribution is the glue: when it builds a derivative for a specific node, it swaps in the node-resolved text before generating the image. That's what makes entity-aware tokens work inside an effect that otherwise only sees global tokens.
  • Once the image style exists, GSMI's settings form lets you pick a source image field on the node - an image field or a media-reference field - plus a fallback image for when that's empty. From there it generates the styled derivative from that source image, for any node of any content type that has the field.
  • Finally, GSMI exposes its own token - [node:generate-style], with optional style/field overrides - so you're not locked into the one global style/field pair configured in the settings form. I used that to drop the generated image into Metatag's og_image field for the Session content type on the MidCamp site, getting us dynamically generated session images..
  • A couple of gotchas we hit setting this up:
  • Text Overlay's layout options have some bugs, and not filling out all of the options will result in an image library error.
  • The bigger one: GSMI names the generated derivative file after the source image's filename - extension included - not after whatever format the image style actually outputs. If you try to convert an image to WebP you might get a WebP image with a JPG extension.
  • BUUUUT - LinkedIn still doesn't support WebP (at least as per their documentation, so it's still in 2026 not safe to use WebP for a universal og:image. https://www.linkedin.com/help/linkedin/answer/a521928

30 Jul 2026 6:00pm GMT

Some WordPress sites reach a point where the content model no longer fits the organization's needs. Custom content types, custom entities, and custom fields become necessary to represent internal data precisely, and Drupal supports all three, shaping that data with full flexibility.

Other sites reach that point because of AI. Drupal has built a strong AI ecosystem over recent years, enabling integrations of every needed type: content creation, accessibility checks, RAGs, among others. These are the two situations behind most WordPress-to-Drupal migrations: an architecture the site has outgrown, or an AI integration WordPress cannot support natively.

The challenge of migrating WordPress content to Drupal

The core challenge in a WordPress-to-Drupal migration is migrating the content itself. WordPress sites may host thousands of pieces of content that need to be moved to the Drupal site.

A full migration project runs through several phases: redesigning the site if needed, building the new architecture, and creating a Drupal node for every WordPress post or page. Creating the content is where the real work concentrates, since every image, every user, and every translation has to make it across, on top of adapting content to a different format defined by the new architecture.

A manual content migration is not viable due to its high costs and risks. Handled by hand, this work is prone to human error. A single error is easy to fix, but a…

30 Jul 2026 6:15am GMT

An AI model does not decide what data it can access, which tools it can use, or whether it can act without approval. People make those decisions at different points. Upstream, a model developer trains and tests the model and decides whether and how to release it. Downstream, a developer builds the model into a system, connects that system to data and tools, and decides whether a person must review its proposed actions before they take effect.

Those choices determine whether harm is possible at all. So when harm occurs, responsibility should fall on those who controlled the relevant choices. That responsibility may be shared: model developers control training and release, product builders control permissions and deployment, and users control deliberate misuse.

Responsibility should follow meaningful control.

That principle is missing from much of the debate over open-weight AI models, which often treats the decision to release a model as the only one that counts.

Axios recently reported that United States officials had considered measures that could restrict American companies from using Chinese open-weight models. Open-weight models make their trained parameters available for others to download, modify, and run on their own infrastructure, without going through the company that built them.

More than 230 companies and organizations have since signed an industry letter defending open weights. After critics accused Anthropic of supporting a ban on open-weight models, Dario Amodei published a statement denying that position. He described open-weight models that do not have dangerous capabilities as a public good and supported mandatory safety testing for sufficiently capable models, open or closed.

The disagreement is less about whether open weights can create risk than about when those risks justify restricting a release, and whether restrictions would improve safety or mainly concentrate power in the largest AI labs.

I am firmly in the open-weights camp. I have run and compared open-weight models, argued that digital sovereignty depends on who controls software, not where it comes from, and believe organizations should control their infrastructure and data instead of depending on a handful of providers.

I also believe consequential algorithms need oversight. More than a decade ago, I argued that we would eventually need something like an FDA for software. The harder question is where responsibility for that oversight should lie.

Open-weight models unbundle control

With hosted, closed-weight models from providers such as Anthropic and OpenAI, the provider typically keeps the weights private, controls how customers access the model, and decides when to update the hosted service.

Open weights can separate those roles. One organization creates and releases the model. A repository such as Hugging Face hosts and distributes the weights. Another team might fine-tune them. A product builder incorporates the model into a product and connects it to data, tools, and users.

Each team controls something different. Because open weights unbundle control, it becomes harder to say who is responsible when harm occurs.

A model developer controls the training process, capability testing, documentation, and release decisions. A repository controls what information it displays about a model's origin, which security checks it performs on uploaded files, and which access restrictions it provides or enforces. A product builder controls what data and tools the resulting system can reach, which actions require human approval, and what gets logged.

Control is not the only thing that matters, but it shows who could still have changed the outcome. When harm involves AI, several actors may bear responsibility for the same incident because each controlled a different opportunity to prevent it.

A lesson from Drupal and Open Source

Like open-weight models, Drupal's code can be copied and changed without asking anyone's permission. A site owner could use it to spread misinformation or operate a fraudulent website. The site owner controls the content and operation of the site and is responsible for those choices. The Drupal project is not responsible merely because someone used its code.

But the Drupal project controls other decisions. When someone privately reports a security vulnerability, the Drupal Security Team follows a coordinated disclosure policy. It keeps the issue private while a fix is prepared. Once a security release is available, the team publishes an advisory and tells site owners to upgrade. The timing of that disclosure can give site owners a fair chance to protect themselves.

The same distinction applies to AI. Responsibility should follow the decisions each actor controls.

The product is where capability receives authority

A model generates outputs. An agent is a software system that uses a model to work toward a goal, often by calling tools and taking actions. The people who build and configure the agent decide what it can access, which actions it can take, and when it needs a person's approval.

In a coding agent such as Claude Code, a model can generate a database command. Whether that command can run depends on the tools and permissions the agent provides, as well as the access allowed by the computer, network, and database.

A content management agent can propose deleting an article. The content management system (CMS) determines whether the agent has permission to delete it, whether the deletion is reversible, and whether the action is recorded.

Permissions, isolation, audit logs, rate limits, human approval, and rollback are not merely engineering details. They determine who has control at the point where harm can still be prevented. That is why AI governance is becoming an essential part of product architecture.

How should government regulate AI?

Deciding who should answer after harm is the easier half of this, even when the answer is not obvious. The harder half is deciding what government should require before any harm has happened.

If control and responsibility are distributed across several actors, government rules should be distributed across them too. This is not a new idea. We already regulate many technologies this way.

More than a decade ago, when I argued for something like an FDA for software, I had drug approval in mind. I no longer think that is the right model. The FDA approves a drug for one or more intended uses, while a general-purpose model may be used for many different purposes.

Cars are a better comparison. The government sets safety standards, manufacturers certify that their vehicles meet them, and drivers are licensed separately. Manufacturers must also report safety defects and conduct recalls when required. Alcohol is regulated in layers too. Bars need a government license that they can lose, and in many US states a bar can be liable for harm caused by serving someone who is visibly drunk.

Each rule targets the actor who controls a particular decision. I would take the same layered approach to AI.

For most risks, government should regulate the products and services that put a model to work. Those rules might limit what data and tools an AI system can access, require human approval for consequential actions, or require those actions to be recorded.

Blocking a model's release is a much stronger step. For an open-weight model, that means preventing the developer from publishing the weights. For a closed model, it could mean preventing the provider from offering access.

I would support that only when safeguards in products and rules governing their use could not prevent a serious danger in time. The three-part test below applies only to this exceptional step, not to AI regulation in general.

Three questions before blocking a model's release

The strongest argument for restricting open-weight releases is that they are difficult to reverse. The UK AI Security Institute notes that safeguards can be removed and that released weights can be redistributed and run privately beyond the original developer's monitoring.

If a model made catastrophic harm much easier, its release could be the last moment anyone had meaningful control. By catastrophic, I mean mass-casualty or comparably systemic harm, not ordinary product failure, fraud, or abuse.

Before blocking a model's release, a government should be able to answer yes to three questions:

1. Would releasing it make catastrophic harm substantially easier? The comparison should be with closed models and other tools people can already access.

2. Would safeguards applied when the model is deployed or used fail? They might be ineffective, easy to bypass, or simply arrive too late.

3. Would blocking the release materially reduce the danger? A restriction should reduce the risk, not merely move it to another country or distribution channel.

The third question is the one I expect people to argue with. Slowing an attacker down has value even if you cannot stop them. But if the same model remains available from another country or distribution channel, a ban costs defenders a tool they can inspect and run themselves while taking almost nothing away from the attacker.

As of July 2026, I have not seen public evidence that an open-weight model has crossed this threshold. It will eventually be crossed, which is why I still think meaningful regulation is coming.

For now, I would allow publication and place obligations where control already exists: on model creators for testing and release decisions, on distributors for provenance and file integrity, on product builders for permissions and deployment, and on users for deliberate misuse.

This approach also protects competition. A regulatory regime that only the largest labs can satisfy could protect them from competition without necessarily making anyone safer. It could also push organizations toward depending on a handful of providers for infrastructure they cannot inspect.

Open weights do not eliminate control. They distribute it. Regulation should follow that structure: place obligations on each actor at the point where harm can still be prevented, and block publication only when release would make catastrophic harm substantially easier, downstream safeguards could not contain it, and a restriction would materially reduce the danger.

29 Jul 2026 9:27pm GMT

The anniversary of the first public release of Web Open Font Format (WOFF) is a very interesting historical milestone on the decades-long road of W3C's work on fonts on the web.

28 Jul 2026 2:40pm GMT

This blog post is about incremental improvements by W3C's IT/Systems Operations Team that puts task force participation management directly in the hands of participants and chairs.

24 Jul 2026 10:35am GMT

At the European Identity and Cloud Conference (EIC 2026) in Berlin, we explored how Threat Modeling with LEGO® SERIOUS PLAY® can help uncover security, privacy, and human-rights threats in age-based content restriction systems. Starting from an Issuer-Holder-Verifier model, participants built harms such as exclusion, surveillance, profiling, and correlation, then mapped them back to flows, actors, and assumptions. The exercise showed how compliance choices can become Web architecture.

20 Jul 2026 9:23am GMT

On January 14, 2006, John Resig introduced a JavaScript library called jQuery at BarCamp in New York City. Now, 20 years later, the jQuery team is happy to announce the final release of jQuery 4.0.0. After a long development cycle and several pre-releases, jQuery 4.0.0 brings many improvements and modernizations. It is the first major … Continue reading →

18 Jan 2026 12:29am GMT

It's here! Almost. jQuery 4.0.0-rc.1 is now available. It's our way of saying, "we think this is ready; now poke it with many sticks". If nothing is found that requires a second release candidate, jQuery 4.0.0 final will follow. Please try out this release and let us know if you encounter any issues. A 4.0 … Continue reading →

11 Aug 2025 5:35pm GMT

Last February, we released the first beta of jQuery 4.0.0. We're now ready to release a second, and we expect a release candidate to come soon™. This release comes with a major rewrite to jQuery's testing infrastructure, which removed all deprecated or under-supported dependencies. But the main change that warranted a second beta was a … Continue reading →

17 Jul 2024 2:03pm GMT

When it comes to crafting an article, the headline is crucial for grabbing the reader's attention and enticing them to read further. In this post, I'll explore the 7 types of article headlines and provide examples for each using the subjects of product management, user experience design, and search engine optimization. 1. The Know-it-All The […]

The post 7 Types of Article Headlines: Craft the Perfect Title Every Time first appeared on Smiley Cat.

29 May 2023 10:20pm GMT

Product management is one of the most exciting and rewarding careers in the tech world. But it's also one of the most misunderstood and misrepresented. There are many myths and misconceptions that cloud the reality of what product managers do, how they do it, and what skills they need to succeed. In this blog post, […]

The post 5 Product Management Myths You Need to Stop Believing first appeared on Smiley Cat.

09 Apr 2023 5:28pm GMT

The role of a product manager is crucial to the success of any product. They are responsible for managing the entire product life cycle, from conceptualization to launch and beyond. A product manager must possess a unique blend of skills and qualities to be effective in their role. Strong strategic thinking A product manager must […]

The post The Key Strengths of the Best Product Managers first appeared on Smiley Cat.

11 Dec 2022 4:43pm GMT

Last week I helped the folks at ezSystems debug some APC problems they were having. The problems ended up being a 64bit architecture problem (they have uber-fast Opterons) and the bug is now fixed in 2.0.3.

Today I received Python & XML from them (off my Amazon wishlist). Thanks guys!

On a side note, my wishlist seems borked. The list I get when I search on my email address or name is not the same one I can edit when I log into the site.

01 Apr 2004 6:53pm GMT

1st of April 2004 get's to it's end and I guess it's time, to summarize the recent April fools a bit. Not that I think anyone in the world believes in them, but some were quite funny:

1. Changes to case sensitivity in PHP.
Alan Knowles announced that PHP will change to the studlyCase API and therefor will get everything broken by changing established functions.

2. IBM takes over Zend.
Myself hacked a little article about IBM taking over Zend to make PHP a compete of Java.

3. The first PHP virus has been seen.
Wasn't there one last year, too?

4. PHP has been overtaken by Micro$oft.
Mhhh... a little bit unreliable, if they had been taken over by IBM this morning... Maybe one should first look, what others wrote...

5. And finally, PHP4 and 5 showed their real faces...
Take a look at a phpinfo() output!

I guess I missed some, so feel free to comment on this entry, if you found another!

01 Apr 2004 5:49pm GMT

Symantec have a report of the virus here. I've yet to see any of the PHP news sites picking up on it but, using a virtual host account, managed to deliberately expose some PHP scripts to it. From examining the infected scripts, what's disturbing is once infected, every tim...

01 Apr 2004 12:19pm GMT