Information Technology

Last week was a very frustrating time for me. For whatever reason, an unusually number of botnets decided to zero in on my Drupal site and created what I call an unintentional  Denial of Service attack (DOS). The attack was actually from spambots looking looking for script vulnerabilities found mainly in older versions of e107 and WordPress. Since the target of these spambots were non-Drupal pages, my Drupal site responded by delivering an unusually large number of "page not found" and "access denied" error pages. Eventually, these requests from a multitude of IPs were too many for my server to handle and for all intents and purposes the botnet attack caused a distributed denial of service that prevented me and my users from accessing the site.

These type of attacks on Drupal sites and numerous other content management systems are nothing new. However, my search at Drupal.org as well as Google didn't really find a solution that completely addressed my problem. Trying to prevent a DDoS attack isn't easy to begin with and at first the answers alluded me.

I originally looked at Drupal for the solution to my problems. While I've used Mollom for months, Mollom is designed to fight off comment spam while the bots attacking my sight were looking for script vulnerabilities that didn't exist. So with Mollom being the wrong tool to fight off this kind of attack, I decided to take a look at the Drupal contributed model Bad Behavior. Bad Behavior is a set of PHP scripts which prevents spambots from accessing your site by analyzing their actual HTTP requests and comparing them to profiles from known spambots then blocks such access and logs their attempts. I actually installed an "unofficial" version of the Bad Behavior module which packages the Bad Behavior 2.1 scripts and utilizes services from Project Honey Pot.

As I had already suspected, looking for Drupal to solve this botnet attack wasn't the answer. Pretty much all Bad Behavior did for me was to take the time Drupal was spending delivering "page not found" error pages and use it to deliver "access denied" error pages. My Drupal site is likely safer with the Bad Behavior module installed, but it was the wrong tool to help me reduce the botnets from overtaxing Drupal running on my server. Ideally, you would like to prevent the attacks ever reaching your server by taking a look at such things as the firewall, router, and switches. However, since I didn't have access to the hardware, I decided it was time to look at my Apache configuration.

"You could say, as many do, that shipping jobs overseas is no big deal because the high-value work—and much of the profits—remain in the U.S. That may well be so. But what kind of a society are we going to have if it consists of highly paid people doing high-value-added work—and masses of unemployed?"

Andy Grove, Intel CEO 1987-2005, Andy Grove: How America Can Create Jobs, BusinessWeek, July 1, 2010

What are the enterprise trends in content management? This past month, I've given a lot of thought on the evolution of content management and social media in large organizations. Perhaps the amount of time I've recently spent on the plane traveling both coasts of the United States gave me too much reflecting time on this subject. Most of us understand the impact Enterprise 2.0 has had on enterprise content management, yet I feel like we're missing pieces to the puzzle. Luckily, there are a lot of smart people out there giving us clues to what the current enterprise trends are with content management.

"The fact is, however, that major IT projects are inevitably going to be about business change, and the two have to go hand in hand. As it continues its steady evolution, IT becomes less and less about individual products, languages or whatever, and more about getting things to work together."

-Jon Collins, Freeform Dynamics, Organisational Change and IT: More than a bar-room conversation?, The Register, April 28, 2010

Tim O'Reilly is the Tuesday keynote speaker at DrupalCon 2010. His talk was on open source in the cloud era. I had some WiFi issues that slowed my typing down so I've embedded the his slide presentation at the end of this post.

2:30 PM: What is wrong with government? "We need to do more than shake the vending machine." O'Reilly is giving examples of people doing things themselves. Do it yourself on a civic scale...the heart of Gov 2.0. Drupal is an example of do it yourself spirit. O'Reilly's putting Drupal back into the speech on how people come together to build something better.

This week I have been thinking a lot about how poorly we manage data and information. The quality of the data and the lack of needed data has historically been an issue at work. We have focused a lot of our time on data mining but never really recognized that one day there would be too much data and information for our staff to sift through. Recently, our managers proposed two new data sources for the operational staff to review and I decided that it was time to hit the panic button that we're currently giving out more information to our workers than they can handle.

When a business presents too much information to their staff it is a lot like catching deer in your headlights. If the deer is too overwhelmed to run and you don't steer the car out of the way then no good can come to both car and deer. This is where I think we are at work and we're needing to slow things down a bit to give both driver and deer time to think about their next move. For the moment at least, I'm personally at a lost on how best to solve our issues with information overload.

Earlier this week, I announced a new site that I'm working on under the domain SocPub.com. What I didn't say in the announcement was which CMS I was going to use for the site. I also didn't say that my choice in the CMS version could be considered by some as risky. I have decided to use the alpha/beta/release candidates of Drupal 7 for the SocPub site.

At the start of every year, I like to resolve to read a number of IT, CMS, and business related books. The Internet is a good resource, but perhaps because I'm too old school I still like to learn a thing or two from a book. So far I have three books on my reading list for 2010.

I plan to review each of these books at a later date but since I'm a slow reader I thought I'd share them now. Links to the books go to Amazon for a possible purchase are our available in CMS Report's Amazon store.

This year, I had the privilege of participating as a member on the judging panel for Packt Publishing's Overall Best Open Source CMS Award. As I mentioned last month, WordPress was declared the winner of the award followed by MODx, SilverStripe, DotNetNuke, and finally XOOPS. Since the award announcement, I've had a lot of inquiries asking me how and in what order did I rank the content management systems. I decided to wait for a month before my posting my rankings of the Web applications because I wanted focus to remain on the declared winners and not my individual choices.

My rankings for the Overall Best Open Source CMS (with number one being the highest) were:

1. WordPress
2. DotNetNuke
3. SilverStripe
4. MODx
5. XOOPS

Each of the judges on the panel, selects their top three CMS from the five included in this category. The judges are given a lot of reign for how they rank the CMS and may consider a number of factors such as performance, usability, accessibility, ease of configuration and customization, scalability and security. Despite the criteria given, the fact is the best CMS is the CMS you determine is best in meeting your project requirements. In other words, you may find that all five CMSes in this category meet your project needs or in some cases none of the given applications will meet your requirements. Despite how I ranked the CMS you still need to do your own homework before choosing what your "best" CMS.

I'm one of the many CMS enthusiasts excited about CMIS. CMIS is the abbreviation for the OASIS Content Management Interoperability Services (CMIS). Please check AIIM's official guide to CMIS for further details.

Before you do go over to AIIM's site, you might want to also check out Stefan Waldhauser's "8 reasons why CMIS will transform the ECM industry" posted at Digital Landfill. I like reason number four:

4 -- No more lock-in to one ECM-vendor because of CMIS.

Until today the ECM industry was driven by high complexity and proprietary systems that prevented to switch to other vendors. Even when a vendor dramatically increased maintenance fees (many customers know what I’m speaking about) there often was no choice to go somewhere else because of the tight and proprietary integrations between the customer build applications and the ECM-infrastructure. CMIS will help separate the applications from the ECM-platform and so there will be no more lock-in to one vendor. Doesn’t that sound great?

I think the biggest thing CMIS offers is customer satisfaction in not having to choose one vendor over another. As I stated this morning on Twitter, I see CMIS as recognition that the "total enterprise solution" is a lie. I have yet to see an enterprise software package provide the complete solution that vendors often promise their customers. Somewhere in the product's life cycle the customer finds that they need more than what the current software and/or vendor can deliver but the customer also isn't ready to leave their current system behind. CMIS hopes to solve the migration issues involved with moving from one application to another by allowing both applications to work together.

There is a cost issue here with CMIS though and, so far, I haven't seem much dicussion on the subject. While CMIS allows more than one application to share and work with the content it will not always reduce costs and maintenance fees. The fact is CMIS may now require the customer to provide ongoing support for multiple applications and platforms instead of the single platform they were once supporting. In general, when the customer's IT group has to support additional applications they also need additional time and money required to provide that support. Just like the problem CMIS is trying to solve, CMIS will not always be the total solution to your problems.