Benji Fisher on Drupal Security, Usability, and Focusing on the Basics

Ahead of NEDCamp 2022, The DropTimes spoke with Benji Fisher about Drupal security, usability, community contribution, and the changes then approaching with Drupal 10. At the camp, he presented “Security in Drupal: What Can Go Wrong?”

At the time of the conversation, Fisher was a senior developer with Fruition, a provisional member of the Drupal Security Team, a maintainer of Drupal core’s Migrate API, and moderator of the weekly Drupal usability meeting. He discussed his introduction to the Boston Drupal community, the role of process in website security, developments expected around Drupal 10, planning for Drupal 7’s end of life, and the value of concentrating on usability fundamentals.

The interview was originally conducted as part of The DropTimes’ short speaker interview series around NEDCamp 2022.

TDT [1]: Please introduce yourself and your work in Drupal.

Benji Fisher: I am a back-end Drupal developer. I work for Fruition, maintaining and troubleshooting client websites. I also contribute to the Drupal project in several ways:

• I am a member of the Usability team and have been moderating the weekly meeting for over two years.
• I am one of the maintainers of the migration subsystem (Migrate API) in Drupal core.
• Since February, I have been a provisional member of the Drupal security team.

TDT [2]: The Drupal community often says that people “come for the code but stay for the community.” How were you first introduced to the community?

Benji Fisher: I do not remember how I found it, but I started going to the Boston Drupal meetups while I was still experimenting with Drupal, a year or two before I started looking for a job in the field. I had questions and got good advice from people with more experience.

TDT [3]: What were you planning to present at New England Drupal Camp 2022, and who was the session intended for?

Benji Fisher: I will be talking about keeping a Drupal site secure. I think that is something that everyone should care about. Some of my slides have a few lines of code, but most of the presentation is accessible to everyone. A big part of security is related to processes, not code.

You May Like

Blog

The Process of Interviewing Explained: TDT Way

Blog

The Process of Interviewing Explained: TDT Way

There is a standard review of security issues from the Open Web Application Security Project (OWASP): the OWASP Top Ten. Each time I give this talk, I cover two of the ten topics and how they apply to a Drupal site. The slide deck is a work in progress.

TDT [4]: At the time of this conversation, Drupal 10 was due for release in December 2022. Which feature were you most excited about?

Benji Fisher: That is a tricky question!

For one thing, all the exciting new features of Drupal 10 will also be in Drupal 9.5. After years of work, I am glad to see that Claro will be the default back-end theme. Olivero, the new front-end theme, is beautiful and accessible. I have not had a chance to look at CKEditor 5 and the new way of extending core themes, but they look promising. By now, it is old news, but I love that Drupal 9.4 added a permissions page for every content type, vocabulary, etc.

Another thing is that I see a lot of things in development, so I am currently excited about the features that will be added in Drupal 10.1 or later. At a recent usability meeting, we saw a demo of the project browser, and it looks great. Also, I think we are finally going to rearrange the admin pages for managing blocks.

In a sense, the big news about Drupal 10 is what it will not have. Several modules will be moved out of Drupal core and made available as contributed modules. Once we get used to that, we might add some contrib modules, like Pathauto, into core (but not in 10.0). We will not have to support IE11 (nor any other version). That means we can have a better responsive grid in Drupal 10 Views.

TDT [5]: After multiple extensions, Drupal 7’s end of life was being described as finally set for November 2023, while many websites still ran Drupal 7. What was your advice for people staying on Drupal 7?

Benji Fisher: First of all, the last time I checked, there was nothing “final” about the 2023 EOL date for Drupal 7. According to the Drupal.org public service announcement,

[T]he scheduled Drupal 7 End-of-Life date will be re-evaluated annually.

We will know next July whether the EOL will be extended to 2024.

We will announce by July 2023 whether we will extend Drupal 7 community support an additional year.

Either way, my advice to anyone using Drupal 7 is to do some serious long-term planning. Is your site still doing everything you want it to do? What changes will you want to see in 3-5 years? Make some decisions now while you still have options.

There are several options. You can stay on Drupal 7 for quite a while: the EOL is a year away and may be extended, and there will be hosting companies that offer support even after the EOL for community support. You could migrate to Drupal 10 or to Backdrop. You could give up on Drupal and switch to WordPress, Shopify, or Squarespace.

TDT [6]: At the time, you were a provisional member of the Drupal Security Team. What could you share about your experience there? Drupal website administrators, after all, tend to watch Wednesdays closely.

Benji Fisher: I have to be careful not to say too much about the security team. Since you asked about my experience, I think I can say that it is a treat to work with the other members of the team: they are dedicated, generous, and have a lot of expertise in Drupal and other things. I also want to emphasize that it is a team: there is a lot of work requiring different skills, and for both reasons, no one person can do it all.

TDT [7]: You were also involved with Drupal’s usability group. What was your perspective on emerging UX and UI trends?

Benji Fisher: I am not a usability expert. I am a back-end developer with an interest in usability, and I moderate the weekly meetings. (If I do that job well, then I let others do most of the talking.) So I am not the right person to ask about the latest trends in usability.

I do have some practical experience in usability, having attended the weekly meeting for several years. More importantly, the weekly meeting includes people with diverse points of view: site builders, developers, front-end and back-end developers, designers, etc. Most of us have a lot of Drupal experience, but sometimes we also get people who are new to Drupal, and that is a valuable point of view.

I like to focus on the basics more than the latest trends. I learned a lot from The Design of Everyday Things. If there is an error message, is it descriptive and actionable? If you want to do a task, is there a way to do it, and are there clues to point you in the right direction? Are descriptions clear and accurate without being too long? You could say that it all comes down to common sense, but we acquire common sense through experience.