webjoke.de

Join John and Steve as they delve into the intricacies and challenges of maintaining Drupal modules, comparing experiences with WordPress, and sharing their journey in making web development more accessible. They discuss their personal stories, the learning curve in module development, balancing user experience, and the importance of contributing back to the community. Learn about their current projects, thoughts on AI's role in accessibility, and get inspired by their dedication to improving the web for all users.

For show notes visit: https://www.talkingDrupal.com/cafe010

Topics

• Drupal Beginnings: Personal Stories
• Journey into Module Development
• Accessibility in Web Development
• Navigating the Learning Curve in Development
• The Importance of Community and Collaboration
• Challenges in Module Maintenance
• Comparing Drupal and WordPress
• Innovative Approaches to Development
• Pet Peeves and Frustrations
• Future Directions and AI Integration
• The Story Behind the Shovel Avatar

Steve Wirt

Being a Developer and Tech Lead at CivicActions has exposed him to the experience of working on some of the largest government websites in the United States. A passion for opensourcing as much as possible has lead him to develop a growing number of modules, with two addressing accessibility Alt Text Validation & Node Link Report)

John Jameson

As the Digital Accessibility Developer at Princeton University, John has come to believe that the biggest barrier to accessible content is the idea that training can compensate for unintuitive authoring interfaces. So far his work to fix the authoring interfaces, to make workflows intuitive and accessible by default, has resulted in the Editoria11y Accessibility Checker and Link Purpose Icons JS libraries and Drupal modules.

Guests

Steve Wirt - swirt John Jameson - itmaybejj

Resources

Modules

• Editoria11y Accessibility Checker https://www.drupal.org/project/editoria11y
• Link Purpose Icons https://www.drupal.org/project/linkpurpose
• Alt Text Validation https://www.drupal.org/project/alt_text_validation
• Node Link Report https://www.drupal.org/project/node_link_report

Talking Drupal #490 Contrib First https://talkingdrupal.com/490 Contrib First https://guidebook.civicactions.com/en/latest/common-practices-tools/contribution/contrib-first/

Jorge Tutor, CIO and co-founder of Metadrop, shares what he’s learned from two decades of building digital products, leading teams, and bridging the gap between business goals and technical execution. In this candid conversation, he explains why clarity—not code—is often the deciding factor in whether a project succeeds or stalls, and how systems thinking, coaching, and open source all play a role in getting it right.

All the deep dives about Drupal's future at DrupalCon Vienna

In the past month or so I had the opportunity to record videos featuring key DrupalCon Vienna sessions where you can learn about where Drupal is going. With only a couple days left to buy regular tickets, I think it is a good time to review my suggestions. 

Gábor Hojtsy Wed, 09/10/2025 - 18:03

Embrace ECA: The Future Beyond Classic Module Development Richard Papp Wed 10 Sep 2025 - 15:39

If you've been building Drupal sites for a while, you know the pattern: a new requirement comes in, you reach for a custom or dust off an aging contributed module, and before long your code base is a patchwork of narrowly-focused solutions. Over time, maintenance becomes a chore.

There's a better way.

Colombian Drupal agency Seed EM introduces Drup & Drop, a streamlined platform built on Drupal CMS that reduces setup complexity for organizations. The solution combines optimized configuration, modular architecture, and secure hosting to accelerate digital project launches while maintaining scalability and governance standards. Designed for multilingual and multisite deployments, the platform enables editorial teams to begin content publishing immediately while preserving technical customization capabilities for development teams.

Keeping your site up to date is essential, but it is only the beginning when it comes to web security. For Drupal site maintainers, this comes naturally thanks to a long-standing culture of best practices, code quality, and the dedicated work of the Drupal Security Team. But today’s threat landscape doesn’t just target vulnerabilities in code. It exploits infrastructure, automation, and scale.

This is where the Drupal Association and CrowdSec collaboration comes in. It combines deep application-layer awareness with a community-powered defense system to offer broader, more adaptive protection for the modern web.

Drupal’s Internal Security Culture

Drupal has earned a reputation for prioritizing security from the ground up. Core security practices, frequent updates, and responsible disclosure processes form the baseline. Modules like CAPTCHA, Honeypot, TFA, OAuth, and header hardening tools are widely used across websites to harden attack surfaces.

“We’ve always used a layered security model,” explains Jürgen Haas, a long-time Drupal contributor and maintainer of the CrowdSec Drupal module. “Before using CrowdSec, the Drupal Ban module helped us manually block problematic IPs, and we combined that with host-level tools like Fail2Ban or Apache’s security plugin.”

But that model has limits. For many Drupal sites, especially those with interactive features such as logins, registrations, and comment sections, malicious behavior can’t always be spotted at the infrastructure level. As traffic becomes more dynamic and attackers more sophisticated, another layer of protection is needed.

The Growing Challenge: Spam and Bots

Brute-force logins, spam submissions, scraping bots, and SEO manipulation are not new, but their sophistication is evolving. AI-generated content can now bypass traditional filters. CAPTCHA-bypass tools are widely available. And attacks are no longer personal. They are automated and global.

One Drupal community member running a high-traffic political forum suffered frequent spam attacks that rendered the site nearly unusable. Implementing CrowdSec almost immediately resolved the issue. However, it also revealed new challenges around legitimate traffic coming from sources like Tor. It is a reminder that today’s security work is not only technical but also must be ethical and nuanced.

CrowdSec: A Community Approach to Protection

CrowdSec is a free and open source security engine that detects aggressive behaviors and shares signals with a global network. If a malicious IP is attacking other sites, CrowdSec users benefit from that real-time threat intelligence. The Drupal module brings this collaborative protection directly into the CMS layer.

Initially, Jürgen was skeptical. “I used to think you should block threats early, at the server level,” he admits. “But I came to understand that some patterns of abuse, like brute force or spam, only emerge over time within the application. Drupal is in a unique position to spot them.”

That is where the Drupal integration shines. It enables behavior-driven detection that contributes to our global reputation network, without tracking personal data. The result is smarter, faster protection, especially when combined with traditional host-level defenses.

Why CrowdSec and Why Now

“We were already researching CrowdSec as a potential replacement for Fail2Ban,” Jürgen explains. “It’s easier to configure, and the crowd-sourced decision-making is what really convinced us. The idea that we all benefit from what others observe is a very open source way of thinking.”

The Drupal module allows CrowdSec to gather rich behavioral context from inside the CMS, something not possible from logs alone. Current efforts are focused on building APIs to allow other Drupal modules to contribute signals, from spam protection to user activity patterns.

“There are a dozen modules already doing great work spotting bad behavior,” says Jürgen. “Imagine if they could all contribute signals. The insights we could gain and share would be huge.”

Real-World Use and Future Evolution

Today, the CrowdSec module is running on dozens of Drupal sites, protecting everything from portals to customer platforms and content-rich applications. The roadmap includes:

• Richer behavioral context to improve upstream signals
• A signal-sharing API that enables other modules to contribute
• Enhanced reporting in the Drupal backend to show impact
• Improved documentation to help users understand and build on the module
   

On the infrastructure side, most deployments run on LAMP stacks, with a gradual shift toward Docker-based hosting. Regardless of setup, the goal is the same: stop threats efficiently, collaboratively, and without compromising the openness of the web.

Rooted in Open Source Ethics

What sets this partnership apart is not just the technology. It is the shared values. Drupal Association and CrowdSec are both rooted in transparency, collaboration, and community-driven improvement.

“CrowdSec's approach feels intuitive to people from open source communities,” says Jürgen. “You contribute data, benefit from what others share, and improve things together.”

Security is often treated as a premium feature, locked behind proprietary platforms. This partnership challenges that idea. It shows how powerful, scalable security can be built in the open, shared freely, and improved collectively.

Together, We Can Build a Safer Web

Security is not a static checklist. It is a living, evolving effort. As attackers innovate, so must defenders. That is why this partnership invites not just users, but contributors.

Here’s how to get involved:

• Try the CrowdSec Drupal module and explore what it can do
• Share your experience with others in the CrowdSec community and Drupal Security Team
• Contribute your story to help others improve their defenses
   

Security is not just about stopping bad actors. It is about protecting the values that make open source and the open web possible. Through this partnership, the Drupal Association and CrowdSec are helping build a more resilient internet. One where collective action protects everyone.

Safer together.

Keeping your site up to date is essential, but it is only the beginning when it comes to web security. For Drupal site maintainers, this comes naturally thanks to a long-standing culture of best practices, code quality, and the dedicated work of the Drupal Security Team. But today’s threat landscape doesn’t just target vulnerabilities in code. It exploits infrastructure, automation, and scale.

This is where the Drupal Association and CrowdSec collaboration comes in. It combines deep application-layer awareness with a community-powered defense system to offer broader, more adaptive protection for the modern web.

Drupal’s Internal Security Culture

Drupal has earned a reputation for prioritizing security from the ground up. Core security practices, frequent updates, and responsible disclosure processes form the baseline. Modules like CAPTCHA, Honeypot, TFA, OAuth, and header hardening tools are widely used across websites to harden attack surfaces.

“We’ve always used a layered security model,” explains Jürgen Haas, a long-time Drupal contributor and maintainer of the CrowdSec Drupal module. “Before using CrowdSec, the Drupal Ban module helped us manually block problematic IPs, and we combined that with host-level tools like Fail2Ban or Apache’s security plugin.”

But that model has limits. For many Drupal sites, especially those with interactive features such as logins, registrations, and comment sections, malicious behavior can’t always be spotted at the infrastructure level. As traffic becomes more dynamic and attackers more sophisticated, another layer of protection is needed.

The Growing Challenge: Spam and Bots

Brute-force logins, spam submissions, scraping bots, and SEO manipulation are not new, but their sophistication is evolving. AI-generated content can now bypass traditional filters. CAPTCHA-bypass tools are widely available. And attacks are no longer personal. They are automated and global.

One Drupal community member running a high-traffic political forum suffered frequent spam attacks that rendered the site nearly unusable. Implementing CrowdSec almost immediately resolved the issue. However, it also revealed new challenges around legitimate traffic coming from sources like Tor. It is a reminder that today’s security work is not only technical but also must be ethical and nuanced.

CrowdSec: A Community Approach to Protection

CrowdSec is a free and open source security engine that detects aggressive behaviors and shares signals with a global network. If a malicious IP is attacking other sites, CrowdSec users benefit from that real-time threat intelligence. The Drupal module brings this collaborative protection directly into the CMS layer.

Initially, Jürgen was skeptical. “I used to think you should block threats early, at the server level,” he admits. “But I came to understand that some patterns of abuse, like brute force or spam, only emerge over time within the application. Drupal is in a unique position to spot them.”

That is where the Drupal integration shines. It enables behavior-driven detection that contributes to our global reputation network, without tracking personal data. The result is smarter, faster protection, especially when combined with traditional host-level defenses.

Why CrowdSec and Why Now

“We were already researching CrowdSec as a potential replacement for Fail2Ban,” Jürgen explains. “It’s easier to configure, and the crowd-sourced decision-making is what really convinced us. The idea that we all benefit from what others observe is a very open source way of thinking.”

The Drupal module allows CrowdSec to gather rich behavioral context from inside the CMS, something not possible from logs alone. Current efforts are focused on building APIs to allow other Drupal modules to contribute signals, from spam protection to user activity patterns.

“There are a dozen modules already doing great work spotting bad behavior,” says Jürgen. “Imagine if they could all contribute signals. The insights we could gain and share would be huge.”

Real-World Use and Future Evolution

Today, the CrowdSec module is running on dozens of Drupal sites, protecting everything from portals to customer platforms and content-rich applications. The roadmap includes:

• Richer behavioral context to improve upstream signals
• A signal-sharing API that enables other modules to contribute
• Enhanced reporting in the Drupal backend to show impact
• Improved documentation to help users understand and build on the module
   

On the infrastructure side, most deployments run on LAMP stacks, with a gradual shift toward Docker-based hosting. Regardless of setup, the goal is the same: stop threats efficiently, collaboratively, and without compromising the openness of the web.

Rooted in Open Source Ethics

What sets this partnership apart is not just the technology. It is the shared values. Drupal Association and CrowdSec are both rooted in transparency, collaboration, and community-driven improvement.

“CrowdSec's approach feels intuitive to people from open source communities,” says Jürgen. “You contribute data, benefit from what others share, and improve things together.”

Security is often treated as a premium feature, locked behind proprietary platforms. This partnership challenges that idea. It shows how powerful, scalable security can be built in the open, shared freely, and improved collectively.

Together, We Can Build a Safer Web

Security is not a static checklist. It is a living, evolving effort. As attackers innovate, so must defenders. That is why this partnership invites not just users, but contributors.

Here’s how to get involved:

• Try the CrowdSec Drupal module and explore what it can do
• Share your experience with others in the CrowdSec community and Drupal Security Team
• Contribute your story to help others improve their defenses
   

Security is not just about stopping bad actors. It is about protecting the values that make open source and the open web possible. Through this partnership, the Drupal Association and CrowdSec are helping build a more resilient internet. One where collective action protects everyone.

Safer together.

Since late August, Acquia has been gradually upgrading from Solr 8 to Solr 9, a process that will culminate with the migration of production environments in the second half of September. This upgrade brings significant improvements and changes that require the attention of development teams.

Choosing the self-service path gives you more control over the timing of the upgrade and the ability to verify your custom configuration before the date scheduled by Acquia. This proactive approach ensures a smooth transition and guarantees that your website's search functions stably in production.

This article details the process for performing a self-service Solr 9 upgrade in Acquia environments, focusing on key configuration aspects in Drupal and the management of custom configsets.

What does the change to Solr 9.8 entail?

Solr 9 represents a significant evolution, built on Lucene 9, bringing improvements in index management, query efficiency, and a more modern and secure foundation. Among the most notable innovations is native capability for vector search (KNN and embeddings), opening the door to semantic and AI-driven search functionalities.

Key aspects to consider for configuration primarily revolve around changes in format and module management.…