Chris Kelly Makes Easier Drupal Adoption a Focus of Board Candidacy

Longtime Drupal contributor Chris Kelly says the candidacy for the Drupal Association Board is shaped by a practical concern: how Drupal can become easier to install and upgrade without weakening the security practices that protect websites.

In written answers to The DropTimes’ Allen Jason, Kelly connects artificial intelligence, digital sovereignty, institutional neutrality, installation guidance, secure updates, and public-sector contribution through a common question: how the Association can lower barriers to Drupal adoption while preserving the project’s security and independence.

Kelly has been active on Drupal.org for 19 years and six months and works as a freelance developer in Los Angeles. Kelly maintains several contributed projects and has participated in documentation and issue queues. The projects include a proof-of-concept Composer wrapper intended to help users update Drupal and its modules without relying on SSH. Drawing on that work, the candidate argues for simpler installation guidance, closer scrutiny of AI-assisted contributions, greater support from major Drupal users, and an ideology-neutral institutional position.

This interview is part of The DropTimes’ series with candidates for the at-large seat on the Drupal Association Board. The DropTimes sent each candidate five common questions and two candidate-specific questions to help readers compare their priorities, experience, and approach to the Association’s role.

Interviews in this series are being published as candidates return their completed responses.

TDT [1]: As AI-assisted and agentic site-building grows, what role should the Drupal Association play in protecting Drupal’s open-source values, data privacy, maintainer well-being, and freedom from vendor lock-in?

Chris Kelly: We should verify with experts that any contributions that had any AI input won’t cause patent, copyright, trademark, etc. issues. AI code shouldn’t be used without extensive review because a) AI tends to leave out checking for edge cases, and b) it might contain something that could be used in an exploit.

AI shouldn’t be given access to any non-public data, and even public data might be used to track people. Any use of trademarks or similar terms as general nouns or verbs, such as “a Kleenex” or “to Google,” should not be allowed.

Interfaces, services, etc., should be used to make AI services as general as possible. If something is for one service, other services should be encouraged to create it for their services.

TDT [2]: Drupal benefits from enterprise users, agencies, and public institutions, but contributions are still uneven. What should the Drupal Association do to turn more of that use into visible support through developer time, code, documentation, infrastructure, or funding?

Chris Kelly: The Association should lobby representatives to pass laws, or at least resolutions, stating that any projects involving government developers should give back some time to open source. Similar clauses could be written into government contracts.

There are current U.S. laws mandating that products used in government contracts should have a majority of domestic products, and so on. Contributing to open source should be presented along the same lines.

It should be pointed out that the government relies on software that they aren’t helping maintain. That message would be varied based on the politician.

Asking governments to donate money towards software is problematic because several developers would be competing to receive it; asking them to donate money for hosting is less problematic, but even so, it might result in favoritism for specific hosting services.

TDT [3]: How should the Drupal Association balance investment in enterprise tooling with simpler entry points for junior developers, hobbyists, and new site builders?

Chris Kelly: Currently, Drupal docs recommend DDEV as a one-size-fits-all solution. It and similar tools should be suggested for experienced developers, but instructions for LAMP, XAMPP, etc., should be given equal weight.

Documentation should start with the easiest path to get something running first. The most popular documentation—such as how to install Drupal—should have some sort of a wizard, as I’ve proposed.

TDT [4]: If digital sovereignty is increasingly defined through national ownership, where does that leave a global open-source project like Drupal? How should the Drupal Association argue that distributed international stewardship can offer a credible form of sovereignty?

Chris Kelly: I’ll push to make Drupal an ideology-neutral “honest broker.” Not being in a position where we could be swayed by one government or another means they could use Drupal without worrying about being held hostage, such as by denying updates based on their country’s IP addresses.

Individual members would be free to criticize as much as possible, but Drupal itself would remain neutral.

TDT [5]: Where should the Drupal Association draw the line between individual expression in the community and institutional positions taken in Drupal’s name?

Chris Kelly: Drupal should make clear that it’s an ideology-neutral community and should oppose censorship, with exceptions for cut-and-dried issues like specific threats, doxing, nudity, stuff involving kids, etc.

A disclaimer can be placed on every user profile and project stating that these are from the community and that any views expressed might not represent the Drupal project itself.

I will attempt to make installing and upgrading Drupal almost as easy as WordPress.

TDT [6]: Do you believe Drupal should make secure, UI-driven module installation easier for non-Composer users, and how can that be done without weakening modern security practices?

Chris Kelly: Yes, and I’m the author of a project that provides a wrapper for Composer. Users can update modules and Drupal without having to use SSH.

It’s just a proof of concept, and the Java app was cobbled together from another one of my Java projects. So it would require some work to be broadly usable, but it shows what’s possible.

The alternative that’s proposed—letting Drupal update itself—is completely unsafe. For around twenty years, Drupal has had .htaccess files that stop people from uploading PHP files and executing them.

Any time the web server can write to code directories, you’re opening yourself up to exploits, and that’s exactly what some would have you do. A flaw in core or a contrib module could lead to hackers being able to upload a PHP file to one of the code directories, and then they could take over the whole site.

TDT [7]: If elected to represent the community on the board, what is the single most important, measurable outcome you intend to deliver by the end of your term, and what specific metrics do you want the community to use to evaluate your success?

Chris Kelly: I will attempt to make installing and upgrading Drupal almost as easy as WordPress. It used to be so, and many people stopped using Drupal due to having to use SSH and Composer. I will attempt to bring some of them back.

I’ll recruit ambassadors/evangelists to present Drupal as an alternative to WordPress for many projects. I’ll also work to increase contributions by the major users of Drupal—governments, big business, major NGOs, etc.