Welcome to Alledia
We blog about Joomla, answer your Joomla Search Engine Optimization questions and create search-engine friendly Joomla templates. We also provide training for Joomla, Drupal and Wordpress.
Aug 26 2008 |
|
Site Login
 |
| Flash video chat component by fcschat.com |
 |  |
 |  |
 |  |
Drupal Training Classes
Learn more about Drupal at our day-long training classes:
- New York - September 22 (Beginner)
- New York - September 23 (Intermediate)
- Atlanta - October 6 (Beginner)
- Atlanta - October 7 (Intermediate)
- Washington D.C. - October 12 (Beginner)
- Washington D.C. - October 13 (Intermediate) TWO EXTRA CLASSES:
- Washington D.C. - October 14 (Beginner)
- Washington D.C. - October 15 (Intermediate)
- Chicago - November 3 (Beginner)
- Chicago - November 4 (Intermediate)
- Boston - November 15 (Beginner)
- Boston - November 16 (Intermediate)
- Los Angeles - November 18 (Beginner)
Joomla Training Classes
Learn more about Joomla at our day-long training classes:
- New York - September 15 (Beginner)
- New York - September 16 (Intermediate)
- Milwaukee - September 22 (Beginner)
- Milwaukee - September 23 (Intermediate)
- Washington - October 12 (Beginner)
- Washington - October 13 (Intermediate)
- Tampa - October 5 (Beginner)
- Tampa - October 6 (Intermediate)
- Atlanta - October 26 (Beginner)
- Atlanta - October 27 (Intermediate)
- Atlanta - October 28 (Templates)
- Chicago - November 3 (Beginner)
- Chicago - November 4 (Intermediate)
- Boston - November 8 (Beginner)
- Boston - November 9 (Intermediate)
- Boston - November 10 (Templates)
- Los Angeles - November 17 (Beginner)
Comments
Being a WordPress user it's nice to upgrade the plugins via the automatic built-in interface.
They've done it using a central repository for the extensions.
That's something interesting that I've always wanted to talk about, as Joomla has tons of extensions but it's a tedious thing to upgrade each extension separately: notice that there's a new version, download, uninstall the old version, reinstall it.. well, we've got so little time
WP notifies plugin upgrades and lets you upgrade them in a click! Fantastic!
I wish that one day this will be a normal task in Joomla, but how to do that?
- create a central repository (joomlacode is just fine)
- adopt a standard way to upgrade the extensions
- enable only the extensions that follow the standard to upgrade themselves automagically
- perform some sort of control over the automatic updates to ensure everything is going the right way and not compromise 1000s of websites in one click because of a sniffed joomlacode password.
If the above mentioned extension works, maybe this this should be integrated in Joomla! Why not?
1. You dont get to check the code before you install
2. Its not direct from the developer so may have been changed
3. Its not direct from the developer so may have been changed
4. Its not direct from the developer so may have been changed
From a security perspective this is a potential nightmare.
If the intellispire server was hacked (and it does happen) and a file changed then the hacker is able to inject all the users site with his infected code.
Sorry but unless each developer individually pgp signs their extension that you can check on the developers own site this is a big NO NO for me.
Nice idea but not quite there.
To me, it sounded good initially, but the more you think about it, the more difficult points arise.
Brian mentions a major security concern that I agree with. Sound security mechanisms are an absolute necessity for this process to work.
My other concern is code quality. I don't know to which extent Intellispire tests new releases before sending them downstream. As nice as a point-and-click update is for many users, you run the risk of having a dead website if a major error is contained in the update.
I'm rather on the conservative side here: Run an update on the local install, test thoroughly, and then do the same process on the production site, that's how I'm doing things.
Kind regards,
Zorro
When Ubuntu ships an update, do I investigate the code before installing? I don't know anyone who has this kind of time. Same goes for Azrul's code, Ryan Demmer's, Joomla! core, etc. The bottom line: I only run applications (in Joomla! and on my OS) that originates from a provider I trust (as much as possible) and has a history of solid work.
I agree, Steve. This is the future of Joomla (notice I dropped the '!'). I'm not convinced that a 3rd party like Intellispire should be the entity governing updates to all 3rdparty apps, but it sure is easy. And, as we know from watching the way the world works, the world sure loves easy... Not hard to see where this is going.
Quote:
Whilst I trust the developers of JCE explicitly as they have shown over time to be worthy of that trust how do I trust intellispire. Remember that they are not just taking the download from JCE and offering it to you, they have to modify it first to work with their updater
It just makes it faster and easier.
Quote:
Actually, that's exactly what we're doing.
As a general rule we do NOT modify extensions (though sometimes the installers have to be modified).
We just package them, using an updated format as documented here:
http://www.intellispire.com/web/developers/jooml-package-manager.html
(a little outdated but basically correct)
I'd like to get to the point we can apply patches as well: simple things to fix like sh404SEF breaking VirtueMart is really annoying and can take ages for the developers to release new fixes.
The goal is to use "virgin sources", just like RedHat does with its RPM packaging system. Joomla makes that difficult for a variety of reasons.
To have technical "trust", joomla is going to need some sort of public key infrastructure - there's no technical way outside of running a diff on the files you can verify what I said is true.
To trust the company, you're just going have to use the software and participate in the process - put in a support ticket, ask people who have used our services, etc.
Finally, the Updater is in addition to the standard installer, not a complete replacement for it. Since we _do_ test everything that goes through, you won't find all extensions available in it: but the ones you do find will be tested, pretty much stable and actually supported.
We're always looking for suggestions on how to improve the service, I look forward to further conversations.
Nick Temple, Founder
Intellispire
RSS feed for comments to this post