How to create paid plugins / themes and sell them securely - wordpress

I am in the process of creating a payment gateway for drupal / wordpress / magento. I already have clients who want to use my plugin. Because this is a paid piece of work, I want to protect it from being used on other websites.
I have also seen that many vendors who sell themes, modules and plugins are required to put in the API key.
How can I do the same. What do I need on my server side. I know how to create modules, but I don't know to sell them securely and deliver regular updates.
If there is a book regarding this please let me know.

I'm not familiar with any books on the subject, but I'll tell you what I've seen as one of a founders of a component / plug-in marketplace that has many such plug-ins.
There are a few approaches -
Some plugins do not require an API key at all. Either the plug-in is only available after purchase, or has some limitations on the free downloadable version that encourages people to pay for the commercial version. This approach relies more on people's integrity and low motivation to try and hack the free version into the commercial one, especially if they are not technical users (as many CMS users are).
Set up a check against your server that happens periodically. You do not need a full blown API for this, just set up an endpoint on your server that the plug-in can send the API key and according to the response allows the use of the plug-in. You need to plan it so that this check doesn't happen every time the plug-in is run, especially if it a plug-in that runs on the public site and not only in the administration panel - it will seriously degrade the performance of the site using it and create unnecessary load on your server. Use some kind of time based checked - either absolutely or from the time of the last check.
In addition to or instead of doing an API check, some people will obfuscate their code to make it harder to modify and bypass the check. This often requires that the server has a module installed that can parse the obfuscated files - this requirement often makes it less viable for most people. You can see some examples of obfuscators in another question.
Personally, I lean more toward the first option, as someone determined enough will break whatever protection you put (people break much more complicated solutions in no time). This is one of the problems of delivering source-code instead of binaries (and those are broken just as easily by more experienced hackers). Let those who are willing pay, and the others just let them do what they want as you won't be able to create something truly secure anyway.

Related

How can i ship new features only for a group of users?

I would like to ship some new features just for a specific group of users to better test it in production and then release it progressively to everyone, should i put IFs in my code and assign specific policies to users in the database?
Is there a better way to do it?
The normal way to handle this is have two versions of your software. The "main" version is the one most people are on, but you also release an "experimental" version which has the new features.
There are various ways to manage the software, but you should look to use strong version management practices in your source code repository, perhaps using some good branching techniques. You should avoid the two versions from diverging too much.
You can choose to invite certain users to the "experimental" version, or have them opt in but give the necessary caveats that things might not work as well, and if you have any SLAs then you might want to caveat them. If you are hoping users will provide you with feedback then make sure there is a good mechanism for that and that the users are aware of it.
If you have client software then uses will need to get hold of the new version themselves. If your software is purely server side (eg a web application or SAAS platform) then you might look at a routing layer eg in the load balancer which automatically sends users to the normal or experimental version depending on whether they are part of the relevant group.
This is a common scenario in software and you should be able to do some good research. I suggest you start by looking into A/B testing.

Why do websites like Classcraft not use Meteor for their Frontpage

I was looking at some larger scale Meteor applications and was wondering why some of the initial sites do not seem to use meteor.
As an example when you go to classcraft and look at the main website you notice it is not using meteor.
Then when you go to their actual application (click signup for example) you can see it uses Meteor.
So they make a clear separation in terms of technology. Can someone explain the reasons? Is it not as efficient / clean to just use Meteor for the whole thing.
Thanks,
Jean
Each company makes their own decisions on how/when/where to use technologies. In the case of meteor, the really strong part of meteor is that it's real-time updating. That means things like messaging systems, getting updates out quickly, etc. good uses for meteor.
It appears as though classcraft has decided they don't need that capability on the home page. There's also some concerns with SEO and meteor that perhaps classcraft didn't want to deal with.
Finally the home page not being built in meteor shields the DB from public view, which is not a huge security advantage, but may be one they considered.
This is all me finding reasons for them as I don't know why they'd make that decision. I don't make that decision for my sites/apps but that doesn't mean others might not see things differently.
I'm the founder of Classcraft. To answer your question, it's because we didn't need everything Meteor had to offer for the front-facing website : reactivity, flexible templates, a database, etc. Meteor is amazing for building apps, but it's overkill for a static website. Also, if the front-facing website was built within the game app, it'd mean that any copy changes or tweaks to the front-facing would cause us to have to redeploy the app, which means some downtime (not much, but still) for our users. Keeping them separate also allows marketing people (who aren't developers) to tinker with it without going into the code base for the game.
We decided to build the front-facing website using middleman. Middleman allows you to generate a precompiled static website, which allows for amazing speed and simple server configuration (it's served from S3, which means it's super fast).
I'm sure the reasons are different for everybody, but that's what it was for us.
Shawn

How to use issue trackers for internal systems?

I'm working for a company where I develop systems purely for internal use. There are only a few developers but we use redmine for issue tracking & feature requests. However, the only people with access to the issue tracker are team leaders, everyone else is meant to feed their suggestions through their team leader.
The idea is that this will reduce developer workload and give management more control over the features being developed. The reality is that we get emails sent directly to us from people experiencing small bugs, or feature requests.
Is this a sane way to manage user feedback or a known bad practice? I've not seen any articles which discuss managing internal issue tracking, so thought I'd ask you.
You can allow your users to access Redmine and create them a special role where they can only create new issues with a new status then the project managers or the team leaders can priorize the issues and assign them to the right people.
It will imply that your users have to be trained to use the tool to create efficient reports and search before creating a new one. But if it's an internal project it will be "easier" because you can train everybody.
It sounds sane to me. If you have end-users giving you feedback then that's a good thing. I've no experience with redmine but if there's a learning-curve associated with it then end-users may be reluctant to bother giving feedback at all. Also, you may end up with defect targets such as 'it has to triaged with X days, and fixed by Y days'. By having such an informal feedback process you avoid this. Also, your team could take a somewhat Agile approach and write bugs/feature requests onto scorecards and stick them on a wall so everybody can see them, including managers - who get to see how end-users are really using your product, and choose to fix/implement them as your team sees fit, with the priority that you choose yourselves.
Of course, your source control system will have the history of all fixes and new features!

Developing a newspaper site in Drupal

I need to develop a newspaper site in Drupal, I've already played around with Drupal a little, and I think I know which modules would best suit my purposes. Naturally, one of the modules I'll be needing to use most is Views, but I have a couple of questions:
Because this is a content-intensive site, I was wondering if using 5-6 views on each page to generate node teaser + thumbnail lists would impact performance adversely?
I am a designer with significant front-end development experience. Like I said I've played around with Drupal quite a bit and other than running into a few hurdles which I eventually overcame, for the most part I was able to get it to do what I needed it to. Having said that, does one also need strong programming skills to fully develop a site in Drupal?
Thank you very much for your help!
Jane
Views offers caching and Drupal also has block caching, which should help you improve performance. The SQL that Views generates is never as good as handwritten SQL, but if you make simple Views, the SQL is actually quite good and not a performance problem (unless you have millions of page views).
If you can create the features you need, with modules from Drupal.org, you don't need strong developer skills. But you do need to know some PHP to make a Drupal theme which is what controls the layout of the site. It will also be a great help, in understanding the Drupal theming system, but not a requirement.
First off, check out openpublishapp.com for a Drupal distro that is made for publishers from the ground up, it's pretty hot.
To answer your questions:
1) As far as performance and views goes, having 5-6 views on a page is a normal requirement for a drupal news site and the performance issues are usually handled by views/panel cache, and using a page cache like Varnish in front of a web server, Object caches like Memcached (for the DB) and opcode caches like APC...if you don't want to learn all that off the bat you should still be fine if your traffic isn't too intense (but go sign up at getpantheon.com for awesome hosting with all of that and the kitchen sink, and check out groups.drupal.org/pantheon)
2) If the functionality exists by way of core/contrib modules, to fully develop a site for the most part one only needs to understand enough PHP to theme, and often with starter themes like Fusion, and some of the others you hardly even need that, just an understanding of how they work and are extended (which is well documented). That said, if you want functionality that doesn't exist, you'll have to code it, or have someone code it for which strong programming skills are desired, but not necessarily required :)
Even I recommend the use of the OPENPUBLISH - https://www.acquia.com/solutions/publishing
On top of to this you can make an efficient usage of
1. APC - PHP byte-code caching
2. Drupal Caching - block/template/view level caching
3. Boost - Caching module which doesn’t need any external tools
4. Varnish - HTTP accelerator
5. Memcache - Data intensive content.
Apart from this you will also need to think effectively on deciding on DEPLOYMENT ARCHITECTURE of the site - preferably Acquia or Amazon environment.
Learning curve may vary depending on your current skills in PHP or Drupal. Usage of already established distribution like OPENPUBLISH may help you to minimize the dependability on too much custom coding.

Web application integration with Drupal

We want to build a web application, that is specific to our domain, but also includes forums, blogs, etc in this application. Some integration points to Twitter and Facebook are also required.
There will also be a desktop application that connects to our web application for uploading data and downloading configuration and reports.
The question is, can we extend Drupal to host both the regular modules and our web application? (There will be business entities and their properties and daily data uploaded from the desktop application)
Or can Drupal be integrated with external applications? As an example, users and roles need to be the same and consistent across both. We may also want data from the web application searchable in Drupal.
I know this is a bit vague, but I cannot reveal more. I am very new to content management and I just wanted to know if someone has built this kind of application.
I try to rephrase what you wrote, just for you to check that I got your question right. You basically need to create a web application that:
Implements some of the standard functionality of Drupal
Have some custom functionality that should "blend into" the Drupal one (same users, same permissions, etc...)
Be able to upload/download content (or data) from desktop applications.
If I got you right, the short answer is: yes, you can do that with Drupal.
Now for the extensive one:
- Drupal has literally thousands of modules, so I expect you to get most of the things you want by simply installing the right combination of readily available modules.
- Of course, any custom functionality can easily be implemented in form of a module too (quite standard thing these days).
- The interaction with a desktop application is normally implemented via webservices rather than querying the DB directly. Drupal comes natively with a xmlrpc server and client, but you can scale up to SOAP - if you wish - via a couple of contrib modules.
Some additional thoughts:
If you choose to use Drupal, and you start from scratch, then you have to be aware you and your team will need to dedicate some time and effort to understand how Drupal works. Although - differently than Palantir - I stuck with Drupal, I agree with her/him on the fact that Drupal gets complicated complex right off the bat. This is the trade-off you have to pay in order to have a platform that - rest assured - is very flexible, extremely pluggable and rock-solid (otherwise it wouldn't have been used to redesign the whitehouse, nor Drupal would have got for the second year in a row the "best PHP CMS" award, I suppose).
The good news is: there are some excellent books out there, and I would certainly recommend "Pro Drupal Development" for an in-depth and all-around explanation of the system. Just be sure to get the 2nd edition, as the first deals with the now obsolete 5 seres. That said...
A very good thing about Drupal, at least in my opinion, is that most of the tweaks you might need to do to an existing functionality can be implemented by hooking into the original code from a custom module too. This IMO is the biggest advantage of Drupal: you never have to touch other developers' code to achieve your goals, and this means - for example - that you will be able to keep your core and contrib modules up-to-date without breaking any customisation you might have done.
Drupal is heavy. Compared to other CMS it sucks plenty of processing power and RAM from your server, and - unless you are going to have a very small site - I recommend to deploy it in conjunction with nginx, rather than Apache.
Drupal scales well, thanks to a good mechanism of caching and "throttling up" mechanisms. Strange as it might sound, Drupal scales very well on large traffic websites, so that big increases in traffic do not necessarily imply big increases in resource usage.
The user experience out-of-the-box on a Drupal site is quite poor. There is a massive work being done on this at the moment (here and here (video)), but improvements won't be available until D7 is released [soon, but then you will have to wait for the modules to be ported], so it is advisable to allocate some time to create an administrative theme, if the admins of your website won't be of the technical type.
At the end of the day, my advice is: if your site is going to go big / complex / with complicated business logic and lots of functionality, then Drupal is probably a good candidate. If your site is contrarily a small-scale one with standard functionality plus a few custom bits, maybe Wordpress / Joomla could fit your needs better [not because they are 'less powerful' but because Drupal strengths would be unused in this case, while Wordpress/Joomla simpler architecture would probably represent an advantage in this scenario]
Other options would certainly be frameworks like CakePHP or Django, for example, but that - IMO - is a totally different approach to the matter, I would say.
Short answer: Drupal is well suited to build something like that, especially if you are willing to integrate your app/logic into Drupal as a suite of custom modules. The other way, integrating Drupal into an external application, can also be done, but will give you more friction, as Drupals architecture is pretty much geared towards being a framework in its own right.
Longer answer: I have a pretty much opposite opinion/experience compared to Palantirs. I've been working almost exclusively with Drupal for a year now, in the context of two fairly complex/'enterprisy' projects (after several years of 'on the side' usage for smaller things). While I agree that it imposes some rigid rules (but not limits!), I consider this to be an advantage, as those rules give a clear guidance and provide proven ways on how to do things. The three parts Palantir mentions are good examples for this:
Menu system - Provides a well structured and effective dispatching mechanism that is easy to extend with your own stuff, while giving huge flexibility to tweak/manipulate existing/default paths. (Note that 'menu system' in Drupal denotes the whole topic of managing your URL space, not just the subset of 'visible' menus that is usually associated with the term)
Forms API - A declarative approach to web forms, with a well designed processing workflow and a whole lot of built in security features that you would otherwise have to take care of yourself. Also highly extensible, with straight options to adjust/extend already existing forms on demand, add new validation rules to any field or whole forms, multi step forms, javascript based form adjustments, etc.
Translation system - This is pretty complex, simply because internationalization is fricking hard to do. But it is built in, again giving clear guidance on how to do things in order to work in a generic way (though there are problems with quite some contributed modules that are not using/supporting it the way they should).
I could give more examples for parts where I appreciate the 'rules', but this post is getting long already, and I still have to cover some downsides ;)
So to sum up the positive part - if I where given the rough specs you posted, I'd say 'no problem' and go with Drupal, being confident that it would be a solid foundation for the custom parts, while providing all the 'standards' like forum, blogs, twitter/facebook integration and many, many others in the form of already existing solutions (even though those might need some adaption/tweaking).
Downsides: As always, there are flaws, and some of them are substantial, depending on requirements/circumstances.
Learning curve - Drupal is quite complex, and 'grokking' its concepts takes time. 'Playing with it for a week', as Palantir suggests, will certainly give you a general feeling/broad impression, but it is in no way enough to allow for a serious judgement of its pros and cons, as those will only surface while coding in/for it. So if you are already deeply familiar with an established web development framework, this might be an issue. If you have to learn one anyways, this should be less of a problem.
Database restrictions - As of Drupal 6, database support is MySQL or PostgreSQL only, using a Drupal specific 'abstraction layer' (which obviously isn't one ;)
Drupal 7 will move to PDO, which should (finally) end this questionable state.
Test/Stage/Production migrations - Parts of Drupals 'out of the box' flexibility are due to many things being configurable in the administrative backend, which implies that many important configuration settings are stored in the database. This makes migration of data and/or configuration between several instances pretty difficult/tedious, once you left the (early) stages of development where you can get away with complete dump/restore operations (see e.g. this question & answers)
These are the main ones for me, but you'll probably find more :)
I worked for over a year using drupal extensively, but I ended up abandoning it. Drupal, and other CMS systems out there, have very rigid limits and rules. I'd use Drupal for projects where you have simple requirements and few or no business rules. Drupal gets complicated almost immediately when you want to do complex things (especially pay attention at the menu system, forms, and the translation system if you need to be multilingual).
If your system will really be large, with all the things you mentioned, then I'd rather use a PHP framework to implement your business logic, and integrate external products as they fit (a forum, a blog, a twitter client, etc...).
But the advice is: don't trust anyone :) Download it, and play with it for a week. You'll be able to make your mind and be more confident about your choice!
As Drupal is open source, you can pretty much do as you wish with it. A couple of points though:
Changing Drupal's user/role structure would be tedious and unnecessary. You would need to have your desktop application authenticate from Drupal's MySQL database.
Drupal has hundreds of plugins for just about everything, so Drupal could no doubt run the whole "web" side of things including visitor stats etc. You would just need, again, to connect your desktop application to the correct MySQL tables and show the data as desired.
Don't forget to check other content management systems such as Joomla! (and many others). Each has its pros and cons. www.opensourcecms.com allows you to easily test CMSs and I've used it extensively in the past.
Just be sure to map out all the components first. Every hour planning up front saves many hours of headaches later.

Resources