News for hackers. Stuff that matters.
Re:Drupal Remote Code Execution vulnerability exploited widely by orf on Thursday April 26, 2018 @04:41AM (#16930105)
> Nowadays Drupal is mostly marketed as a robust enterprise tool for markets to hold critical data

Who markets it as this? That's utter madness!

Re:Drupal Remote Code Execution vulnerability exploited widely by EnderMB on Thursday April 26, 2018 @07:24AM (#16930882)
The enterprise market is a huge one for all involved in the chain.

Drupal loves it because their tools get used on large-scale websites, and it differentiates them from the likes of WordPress. Agencies love it because the enterprise market usually means a larger budget than what you would get for a standard site. Clients love it because they feel they are paying for quality.

Of course, there's nothing stopping a development team from using a standard CMS or framework to build this site. In fact, I've had far more success with the likes of Umbraco than with enterprise-level systems like Sitecore, and we've delivered the same marketing features the enterprise systems use as a selling point. The problem is that a lot of clients explicitly say they want a site built in Drupal, Sitecore, Episerver, etc, and in an agency or in-house environment it's often not the developers making the tech decisions...

Re:Drupal Remote Code Execution vulnerability exploited widely by jochung on Thursday April 26, 2018 @04:46AM (#16930124)
This is what millions in enterprise funding gets you. A decade+ of sunk cost fallacy.
Re:Drupal Remote Code Execution vulnerability exploited widely by pjc50 on Thursday April 26, 2018 @04:56AM (#16930164)
What are the alternatives in ""enterprise"" CMS, though? Would you rather use Sharepoint?
Re:Drupal Remote Code Execution vulnerability exploited widely by setquk on Thursday April 26, 2018 @05:07AM (#16930207)
When someone suggests an enterprise CMS, the usual best case outcome is to go back to the requirements analysis and remove enough requirements until an enterprise CMS is not required.

I've done my fair share of work on the things over the years and the outcome has never been the best one for the organisation.

Re:Drupal Remote Code Execution vulnerability exploited widely by Angostura on Thursday April 26, 2018 @05:46AM (#16930394)
Ah yes, training up people to handcraft html every time a new press release needs to go up on the site, or a VP changes on thecabout us page. Not fun.
Re:Drupal Remote Code Execution vulnerability exploited widely by empath75 on Thursday April 26, 2018 @08:25AM (#16931193)
There are apps that generate static websites.
Re:Drupal Remote Code Execution vulnerability exploited widely by detaro on Thursday April 26, 2018 @08:15AM (#16931138)
By that definition, everything that has a WYSIWYG editor is an "enterprise CMS"?
Re:Drupal Remote Code Execution vulnerability exploited widely by setquk on Thursday April 26, 2018 @07:33AM (#16930920)
Hire someone to do it. Cheaper than an enterprise CMS is to run and/or commission.
Re:Drupal Remote Code Execution vulnerability exploited widely by Angostura on Thursday April 26, 2018 @08:14AM (#16931131)
Lets see, my Wordpress install running a well known theme, using Wordfence to alert for plugin updates, with me keeping an eye on it cost about £2,000 to set up and has ongoing costs of about £1,000 a year.

No. Its not cheaper to hire someone to hand-code the site and then hand-code every change.

Re:Drupal Remote Code Execution vulnerability exploited widely by setquk on Thursday April 26, 2018 @08:48AM (#16931356)
If you're doing that, just use wordpress.com. Wordpress is way out of scope for the term "enterprise CMS".
Re:Drupal Remote Code Execution vulnerability exploited widely by Angostura on Friday April 27, 2018 @01:36PM (#16942621)
So we've gone from "there's no need for a CMS, write HTML flat files" to "Use a hosted CMS" - OK.
Re:Drupal Remote Code Execution vulnerability exploited widely by bshimmin on Thursday April 26, 2018 @06:32AM (#16930613)
Sitecore and Episerver are quite "popular" (probably not really the right word) in some circles.
Re:Drupal Remote Code Execution vulnerability exploited widely by jochung on Thursday April 26, 2018 @05:25AM (#16930297)
People keep trying to make it so you can build complex sites and applications without coding, and in the end, what you end up with is far more complicated, fragile and inflexible than if you had just stuck with a normal development pipeline. Drupal's insistence on being both a product and a platform out of the box is what got them into this mess in the first place. They overestimated how much different use cases have in common, so they had to bolt on late-binding and lazy evaluation all the way up into the presentation layer.

I don't know if this is solvable. A CMS is complex enough that each of its functionalities deserves the care of good product and technical designers. These pieces ought to then be integrated into a cohesive whole, a la carte. For desktop software, we were able to pull this off pretty well, with 2000s OS X as the most cohesive, successful attempt, dictated by strong design guidelines and solid enough tech... And note that they invisibly transitioned CPU architecture along the way! But when online collaboration and multi device access became a requirement, everyone flailed and forgot the lessons of the past.

I don't think the current software market is capable of something like that. Almost everyone is trying to make captive SaaS where compatibility only exists on a service-to-service basis, in a subordinate manner. Branding is more important than cohesion, and flexibility and interoperability has taken a back seat to dumbing down.