CMS Option: Zikula

[Eric Christensen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Earlier today I had the chance to talk with Simon, who represents
Zikula, about his CMS solution.  I did the interview on IRC on
#fedora-docs so it could be seen by all on IRC and so I could record the
conversation for everyone to read.

I created a wiki page[1] on Zikula and asked most of the information
that was requested (my time was short).  Simon provided good answers to
all the questions which went a lot further than the check marks that I
used on the wiki.  I invite everyone to read the transcript[2] and pose
additional questions or comments to the list.  Simon has subscribed to
the list so he can probably field questions by email.

All CMS options are on the wiki[3].  Of course this is the only one that
has come to light with a lot of energy.  If anyone else would like to
suggest a CMS solution please complete a CMS template[4] so we can make
an informed decision.

[1] https://fedoraproject.org/wiki/Zikula_CMS_Option
[2] https://fedoraproject.org/wiki/Zikula_IRC_Chat_Interview
[3] https://fedoraproject.org/wiki/Category:Documentation_CMS_Option
[4] https://fedoraproject.org/wiki/Documentation_CMS_Template


Thanks,
Eric Christensen
Fedora Docs Project

Fedora Talk: 5102043                  Phone: [phone] x 5102043
E-Mail/SIP Address: sparks(a)fedoraproject.org
IRC: Sparks on freenode.net

GPG Fingerprint: CA02 4ACA EB6C 1A76 F0D6  1127 7D04 D240 BD0C 14C1

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkl6IgUACgkQfQTSQL0MFMH7JQCeKMBVfv/AIQO/vb7E/iKqFPtf
> E7kAn3ZWwky5Fzq/HUoVHGM7A2Ou5BYm
> =W1oZ
> -----END PGP SIGNATURE-----

[Paul W. Frields]

On Fri, Jan 23, 2009 at 03:01:12PM -0500, Eric Christensen wrote:
>  
>  Earlier today I had the chance to talk with Simon, who represents
>  Zikula, about his CMS solution.  I did the interview on IRC on
>  #fedora-docs so it could be seen by all on IRC and so I could record the
>  conversation for everyone to read.
>  
>  I created a wiki page[1] on Zikula and asked most of the information
>  that was requested (my time was short).  Simon provided good answers to
>  all the questions which went a lot further than the check marks that I
>  used on the wiki.  I invite everyone to read the transcript[2] and pose
>  additional questions or comments to the list.  Simon has subscribed to
>  the list so he can probably field questions by email.
>  
>  All CMS options are on the wiki[3].  Of course this is the only one that
>  has come to light with a lot of energy.  If anyone else would like to
>  suggest a CMS solution please complete a CMS template[4] so we can make
>  an informed decision.
>  
>  [1] https://fedoraproject.org/wiki/Zikula_CMS_Option
>  [2] https://fedoraproject.org/wiki/Zikula_IRC_Chat_Interview
>  [3] https://fedoraproject.org/wiki/Category:Documentation_CMS_Option
>  [4] https://fedoraproject.org/wiki/Documentation_CMS_Template 
I think we should also be considering the other major players in the
CMS game, if there are people available to deploy and maintain them.
Drupal and Joomla! immediately come to mind, the latter especially
because it actually has some DocBook XML support.  Features aren't
particularly compelling, though, if we have no one around to help with
the maintenance.

None of this has any bearing on the quality of Zikula, which I'm sure
is excellent.

-- 
Paul W. Frields                                http://paul.frields.org/
  gpg fingerprint: 3DA6 A0AC 6D58 FEC4 0233  5906 ACDB C937 BD11 3717
  http://redhat.com/   -  -  -  -   http://pfrields.fedorapeople.org/
  irc.freenode.net: stickster @ #fedora-docs, #fedora-devel, #fredlug

[Eric Christensen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Paul W. Frields wrote:
>  I think we should also be considering the other major players in the
>  CMS game, if there are people available to deploy and maintain them.
>  Drupal and Joomla! immediately come to mind, the latter especially
>  because it actually has some DocBook XML support.  Features aren't
>  particularly compelling, though, if we have no one around to help with
>  the maintenance.
>  
>  None of this has any bearing on the quality of Zikula, which I'm sure
>  is excellent.
>   
I completely agree.  Herlo talked to someone about WordPress earlier
this afternoon (review should be coming later the weekend).  The more
information we have about the choices out there means we'll be better
prepared to make decision.

If anyone knows someone with these other CMSs it would be good to talk
with them and ask them the questions.


Thanks,
Eric Christensen

Fedora Talk: 5102043                  Phone: [phone] x 5102043
E-Mail/SIP Address: sparks(a)fedoraproject.org
IRC: Sparks on freenode.net

GPG Fingerprint: CA02 4ACA EB6C 1A76 F0D6  1127 7D04 D240 BD0C 14C1

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkl6Ri0ACgkQfQTSQL0MFMEcmwCeN+IJwewLsZd0CYoNH5caWaXt
> XzAAnRx4+mxhTTXjdcokui9mzOJxycZg
> =eUAA
> -----END PGP SIGNATURE-----

[Paul W. Frields]

On Fri, Jan 23, 2009 at 05:35:27PM -0500, Eric Christensen wrote:
>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>  
>  Paul W. Frields wrote:
>  > I think we should also be considering the other major players in the
>  > CMS game, if there are people available to deploy and maintain them.
>  > Drupal and Joomla! immediately come to mind, the latter especially
>  > because it actually has some DocBook XML support.  Features aren't
>  > particularly compelling, though, if we have no one around to help with
>  > the maintenance.
>  > 
>  > None of this has any bearing on the quality of Zikula, which I'm sure
>  > is excellent.
>  > 
>  I completely agree.  Herlo talked to someone about WordPress earlier
>  this afternoon (review should be coming later the weekend).  The more
>  information we have about the choices out there means we'll be better
>  prepared to make decision.
>  
>  If anyone knows someone with these other CMSs it would be good to talk
>  with them and ask them the questions. 
It's interesting you bring up WordPress, because I think there are
Fedora folks (and maybe Red Hat folks too) who have prior contact with
people at Automattic.  I do know there are sites out there using
WordPress as a CMS when the required workflow is the right fit.  I've
been using it since 2002 myself and I can see where it would be a good
fit.  It's also already packaged for EPEL and Fedora, actively
maintained, and has a thriving community.

-- 
Paul W. Frields                                http://paul.frields.org/
  gpg fingerprint: 3DA6 A0AC 6D58 FEC4 0233  5906 ACDB C937 BD11 3717
  http://redhat.com/   -  -  -  -   http://pfrields.fedorapeople.org/
  irc.freenode.net: stickster @ #fedora-docs, #fedora-devel, #fredlug

[Clint Savage]

On Fri, Jan 23, 2009 at 3:47 PM, Paul W. Frields <stickster(a)gmail.com&gt; wrote:
>  On Fri, Jan 23, 2009 at 05:35:27PM -0500, Eric Christensen wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > Paul W. Frields wrote:
> > > I think we should also be considering the other major players in the
> > > CMS game, if there are people available to deploy and maintain them.
> > > Drupal and Joomla! immediately come to mind, the latter especially
> > > because it actually has some DocBook XML support.  Features aren't
> > > particularly compelling, though, if we have no one around to help with
> > > the maintenance.
> > >
> > > None of this has any bearing on the quality of Zikula, which I'm sure
> > > is excellent.
> > >
> > I completely agree.  Herlo talked to someone about WordPress earlier
> > this afternoon (review should be coming later the weekend).  The more
> > information we have about the choices out there means we'll be better
> > prepared to make decision.
> >
> > If anyone knows someone with these other CMSs it would be good to talk
> > with them and ask them the questions.
>
>  It's interesting you bring up WordPress, because I think there are
>  Fedora folks (and maybe Red Hat folks too) who have prior contact with
>  people at Automattic.  I do know there are sites out there using
>  WordPress as a CMS when the required workflow is the right fit.  I've
>  been using it since 2002 myself and I can see where it would be a good
>  fit.  It's also already packaged for EPEL and Fedora, actively
>  maintained, and has a thriving community.
>
>  --
>  Paul W. Frields                                http://paul.frields.org/
>   gpg fingerprint: 3DA6 A0AC 6D58 FEC4 0233  5906 ACDB C937 BD11 3717
>   http://redhat.com/   -  -  -  -   http://pfrields.fedorapeople.org/
>   irc.freenode.net: stickster @ #fedora-docs, #fedora-devel, #fredlug
>
>  --
>  fedora-docs-list mailing list
>  fedora-docs-list(a)redhat.com
>  To unsubscribe:
>  https://www.redhat.com/mailman/listinfo/fedora-docs-list
>  
The guy I talked with lives in Utah and works at Automattic, he's
quite knowledgeable but admits he's not on the core team.  If we
decide to go this route, (or at least when it's whittled down) if
WordPress still fits, I can ask him to bring in a core dev.

Clint

[Toshio Kuratomi]

Paul W. Frields wrote:
>  I think we should also be considering the other major players in the
>  CMS game, if there are people available to deploy and maintain them.
>  Drupal and Joomla! immediately come to mind, the latter especially
>  because it actually has some DocBook XML support.  Features aren't
>  particularly compelling, though, if we have no one around to help with
>  the maintenance.
>   
One of the things I didn't know until I did some browsing around their
website is that Zikula started off as PostNuke but that they changed the
name in June.  So they are a long term player in the CMS market.

>  None of this has any bearing on the quality of Zikula, which I'm
> sure
>  is excellent.
>   
I was impressed by a few of the things I've learned since this morning
:-)  The answers to how Proactive the security is was a nice change from
the usual thoughts I've seen::
   https://fedoraproject.org/wiki/Zikula_IRC_Chat_Interview#t12:20

Here's my naive search of cve.mitre.org for issues reported in 2008.
Note that some people would say to exclude plugins from this but my view
is that we're going to be running plugins as part of our deployment and
we'll want to know if we can expand our capabilities by pulling in
functionality via plugins without compromising security.  So knowing
this does a little towards understanding whether the Core provides an
API for writing secure plugins and the plugin community is security
minded as well as Core developers.  And like I say, this is naive :-)

91 Joomla -- Lots of plugins a few in core
79 Drupal -- Lots of plugins a few in core
60 Wordpress -- Lots of plugins, a few in core
53 Mambo --Lots of plugins, at least one in core
4 zikula + postnuke -- 1 in Core, 3 in plugins
1 midgard
0 zikula
0 enano

For reference, mediawiki, which we think has an acceptable
security-to-benefit ratio, had 8 vulnerabilities reported in 2008 using
the same naive count.

-Toshio

[Simon Birtwistle]

As the representative of Zikula on this list I wanted to follow up the discussion I had
with Eric yesterday.

> From what I could see, the area to focus on is the content publishing
> workflow, and to that end I've been evaluating some content management modules for
> Zikula.  I've narrowed it down to a couple of options, both of which have revisions
> control and may suit you to a greater or lesser degree.  If neither option suits we could
> either modify and existing module or create something new. 
The first 'PageMaster' allows the creation of custom document types.  These can
contain any number of fields (e.g. you could add a multi select box for applicable
versions or a document upload box for a PDF version, in addition to title and content
fields etc).  It's also possible to insert images and documents inline from a number
of the media management modules mentioned later.  There is also full revisions control.

The second module is 'Content'.  This module allows you to construct pages with
various components according to pre defined templates.  Components can be blocks of text,
images, headings, tables of contents, slideshows or a whole host of other things.  Adding
more component types is also easy, and all pages have a full revisions control and a
translations interface for adding multilingual versions of pages.

Both these modules come with a choice of visual editors - we have one module that provides
a choice of Xinha, TinyMCE, FCKeditor, openWYSIWYG and NicEdit - you can use different
editors in different modules if you wish.


On the media management side, there's MediaAttach, which provides upload and storage
capability for all sorts of different media types, many with preview functionality.  These
can then be embedded into content using the Xinha visual editor.  There's also CoDoc,
which allows you to upload a document to a category, and then upload new revisions of it. 
Like the two content modules, revisions are tracked by username and date/time, and
there's locking functionality for when someone is working on a particular document. 
There's no easy way to embed CoDoc items into other content though.  Lastly,
there's Relay, which is a port of a file management script written in javascript. 
Nice and simple way to manage files in a given directory without resorting to FTP.  There
are also a selection of gallery modules for displaying screenshots if that might be
useful.


I'm in the process of setting up a demo site over at Zikula which you'll be able
to use to test these modules out if you feel that's helpful - just let me know.



Simon

[David Nelson]

Hello,

If it's of any interest to you, there's a history and timeline about
the Zikula project
at http://zikula.tv/zikula-postnuke-history.html

The timeline tracks all the security advisories since the project's
beginning, and
would let you gauge our attitude to security, etc. Plus there's lots
of other info
there too (although it's a work in progress...)

If I were to venture why Zikula would be so good for Fedora Docs, I'd suggest:

1) The people in the project all believe fervently in Zikula as a
product. We love
it for its power and flexibility. We love it because you can do
anything with it.

2) Our devs have the imagination and the skill to help you not only fulfill
your presently-known needs, but also to help you examine and explore new
possibilities for the future. Our platform is sufficiently powerful,
well-designed
and flexible to provide your future platform without having to change to another
product.

3) Every member of our team would *love* to have you as our client. We
would all be strongly involved in making sure that you achieve what you want.

Hope this helps, and hope very much we'll be working with you in the future,

-- 
David Nelson
Web: http://zikula.tv

>  One of the things I didn't know until I did some browsing around
> their
>  website is that Zikula started off as PostNuke but that they changed the
>  name in June.  So they are a long term player in the CMS market.
>
> > None of this has any bearing on the quality of Zikula, which I'm sure
> > is excellent.
> >
>  I was impressed by a few of the things I've learned since this morning
>  :-)  The answers to how Proactive the security is was a nice change from
>  the usual thoughts I've seen::
>    https://fedoraproject.org/wiki/Zikula_IRC_Chat_Interview#t12:20
>
>  Here's my naive search of cve.mitre.org for issues reported in 2008.
>  Note that some people would say to exclude plugins from this but my view
>  is that we're going to be running plugins as part of our deployment and
>  we'll want to know if we can expand our capabilities by pulling in
>  functionality via plugins without compromising security.  So knowing
>  this does a little towards understanding whether the Core provides an
>  API for writing secure plugins and the plugin community is security
>  minded as well as Core developers.  And like I say, this is naive :-)
>
>  91 Joomla -- Lots of plugins a few in core
>  79 Drupal -- Lots of plugins a few in core
>  60 Wordpress -- Lots of plugins, a few in core
>  53 Mambo --Lots of plugins, at least one in core
>  4 zikula + postnuke -- 1 in Core, 3 in plugins
>  1 midgard
>  0 zikula
>  0 enano
>
>  For reference, mediawiki, which we think has an acceptable
>  security-to-benefit ratio, had 8 vulnerabilities reported in 2008 using
>  the same naive count.
>
>  -Toshio

[Gayathri Swaminathan]

Hi:

>  I think we should also be considering the other major players in the
>  CMS game, if there are people available to deploy and maintain them.
>  Drupal and Joomla! immediately come to mind, the latter especially
>  because it actually has some DocBook XML support.  Features aren't
>  particularly compelling, though, if we have no one around to help with
>  the maintenance. 
+1 to your statement regarding maintenance. There are too many choices
for CMS under three major platforms PHP, Python, JAVA, Ruby on rails
etc., Enlisting some here that I have supported/ maintained:

1. JAVA based

Apache Jackrabbit, Liferay

2. Python based

Plone, Django framework

3. PHP based

Mediawiki, Drupal, Wordpress, Joomla

As Paul mentions, each of these CMS come with their own "features"/
"necessity for extension" which of course is based on what we need as
a group as in, how to:

- structure content - can be viewed from maintenance (or) usability perspective
- involve volunteers
- customize the framework
- maintain
- volunteer base and their associated knowledge of choice of platform
- localization concerns

Am still catching up on all IRC logs/ email archives so some of the
listed were perhaps already reviewed and addressed :)

>  None of this has any bearing on the quality of Zikula, which I'm sure
>  is excellent. 
Zikula looks cool indeed.

-- 
Gayathri Swaminathan
gpgkey: 3EFB3D39
Volunteer, FDP

[Karsten Wade]

On Fri, Jan 23, 2009 at 05:25:22PM -0500, Paul W. Frields wrote:
>  
>  I think we should also be considering the other major players in the
>  CMS game, 
It's not they aren't being considered, but ...

>  if there are people available to deploy and maintain them. 
Yeah, that's the catch.

>  Drupal and Joomla! immediately come to mind, the latter especially
>  because it actually has some DocBook XML support.  Features aren't
>  particularly compelling, though, if we have no one around to help with
>  the maintenance. 
To be honest, the whole process for evaluating a tonne of CMSes to
weed them down to a short list and a complex matrix ... sounds like
work.  A lot of work.  The kind of work many of us have been paid to
do.  In the end, we are then paid to implement the solution we picked.

In this case, none of us are likely to be the actually implementers of
the solution.  Talking with Toshio one night, it was suddenly obvious
that we needed to approach this from the angle of getting the people,
and then getting the solution.

So, if a team of web developers wanted to just run a CMS and go
through the complex matrix picking process, more power to them.  But
to ask this group to do a deep evaluation of systems with no actual
task involved that moves us any closer to a real, installed CMS
... sounds like madness to me.

To be honest, I haven't contacted anyone from Joomla or Drupal yet.  I
can probably find the person from OSCON who dropped me his business
card about Drupal; we'll find out if they want to chat.

But to be honest, if they didn't respond from posts on fedora-list,
fedora-art-list, and fedora-devel-list, plus traffic in
fedora-docs-list and posts on Fedora Planet ... well, I reckon whoever
"they" are, they're not Fedora people already.

- Karsten
-- 
Karsten 'quaid' Wade, Community Gardener
http://quaid.fedorapeople.org
AD0E0C41