Drupal

A few months ago I setup Varnish on my Macbook Pro and have deployed it for a production site which serves anonymous and (a lot of) authenticated users. Initially, I spent a couple months just running it in my local environment, including backporting the Varnish.module to Drupal 5. In retrospect, I'm glad that I spent the time to learn how Varnish and it's configuration file works before deploying it, as it's paid off in a big way as our production site now has something which is equivalent to:

• ...an in-memory static file server for all users (e.g., the equivalent of hooking up something like nginx or lighttpd as a front end to Apache (or whatever you're using).
• ...an in-memory boost.module in terms of database-relief for anonymous users.

Contrary to popular belief the two items above are in no way an automatic benefit of simply installing Varnish. If the configuration file, and Drupal installation, is not massaged with care one definitely won't get the database relief from anonymous page caching, and the benefits from Varnish-as-a-static-file server will not nearly be optimized. Bottom line Varnish can be a temperamental piece of software. It only gives back what you put into it.

Drupalcon San Francisco was great. Here is some of what stood out to me, in no particular order:

• Tim O'Reilly's keynote was great (see link for it in comments). It put perspective on where Drupal fits into the larger world and reminded me that I actually came to Drupal for a reason, not just for technology or Drupal itself. While listening to the keynote, I couldn't help but think that Dries' personal push for RDF in core (which I've seen some head-scratching about from some) might owe part of its genesis to his own talks with O'Reilly.
• The presentation YOU SHALL NOT PASS: Managing Expectations and Boundaries of Clients is one of the hidden gems of Drupalcon. If you're not project managing your clients/work the way they describe, you're doing it wrong (or at least for less money, more aggravation, and less satisfaction!).
• Larry Garfield's session Objectifying PHP was a wonderful session for anyone who is ready to move to the next level with object oriented methods (pun intended) and practices.
• Drupal training and certification seemed to be a hot topic for any number of reasons, and there seems to be consensus that somewhere along the path of Drupal's march to being a commodity, that "official" certification for Drupal developers/themers/etc is probably inevitable. GVS weighed on the matter of what should constitute certification with their own (unofficial) certification site http://certifiedtorock.com/
• The money, as well as the number of people, and type of people involved with Drupal these days has definitely changed the feel of the conference as compared to earlier ones I've attended. This is true even comparing it to DC which was only last year, let alone the first one I went to 4 years ago (OSCMS). There is no good or bad implied here, just worth noting since it has implications (and things will likely continue in this direction for a while).
• For the past year or so it's been cliche to say, 'No one person one can know everything about Drupal anymore'. For me the new saying is, 'No one person would even *want* to know everything about Drupal anymore'. There are vast, vast knowledge areas within Drupal that have their own following, experts, and activity levels. Don't get me wrong, it's *all* extremely interesting, but gazooks...
• For now videos/screencasts for presentations (they don't all seem to have them) can be found by going to this page and clicking through to the individual presentation page you're interested in. UPDATE: Videos posted here too.
• Hottest Drupal-related career: Project/QA manager. The need for developers and themers, is plenty hot of course, but I'd be willing to bet that at least some of the larger Drupal-based companies/shops would choose a competent project/QA manager over a competent developer if forced to choose only one.
• The way Drupal 7's $page array, hook_page_alter, and drupal_render works, simultaneously makes me want to use Drupal 7 RIGHT DARN NOW, as well as makes me wonder just how horrifically these features will be abused. (who needs a custom theme anymore - Garland with a bunch of hook_page_alters should work just fine, right) ;)
• If you want the sneak peak for the next North American Drupalcon, look no further.

If you have a highlight you'd like to share please leave a comment.

Below is the screencast for a presentation I gave at the Sacramento Drupal Users Group on Saint Patrick's Day 2010, titled "Drupal as a profession". (I apologize ahead of time for my lack of public speaking skills, hopefully you'll find this information helpful in spite of this!)

In this short screencast a variety of security holes are shown, as well as some malicious things which are made possible due to these lapses. We'll take a walk-through of two security issues showcased in the vulnerable.module, as well as two other exploits which I put together:

• User account hijacking via cookie/session XSS thievery
• User account hijacking via password-changing-inline-XSS