Planet Plone

This is where developers and integrators write about Plone, and is your best source for news and developments from the community.

October 21, 2016

Maurits van Rees: Lightning talks Friday

by Maurits van Rees at 2016-10-21T22:04:03Z

Paul Roeland: Plone Open Garden

Sorrento. Lovely spot in Italy. Annual event for past ten years or more: Plone Open Garden. What is it? It is a place that has Plone and Plonistas. It has a hotel as our central place, great food and drink, family friendly atmosphere for open discussions. Nice view. We want to focus on headless CMS. But not only tech, also how this affects our marketing and strategy. People with different skill sets are welcome to join.

When? Not fixed yet, but around 18 till 22 April 2017. Watch for one or more preparatory sprints over the world. Watch for discussion docs and roadmap. Please signal your attention early so we can make a great deal with the hotel.

Eric Bréhault and Philip Bauer: Plone futures

There are different possible futures for us. Valid, possible, and good. Several roads.

  1. CMS. We are targeting that market. It's what we do right now. Lots of plans like moving to Python 3.
  2. Products. Quaive (Intranet), CastleCMS. Targeting specialised audiences. Built on the same technology. Various approaches to UI.
  3. Headless CMS. Different market, like Contentful. Expose Plone as API for Javascript. Compared with comparable solutions, we are way better and we are open source. It is a different market with a lot of potential. We have a management application already in front of it: Plone 5. Unique! Plone 5 is the reference implementation of the UI.
  4. plone.server. All of the above, headless plus Python 3.

Thomas Schorr: Managing revisions in Plone

CMFEditions has been used for a long time for content revisions in Plone. Configured in the control panel. You can view old versions, or revert to them.

Several limitations and issues. History listing and statistics are calculated on the fly, which takes a very long time. If you delete a working copy, old revisions stay in the ZODB, they will not get deleted by anything through the web. Real life example, 50 GB data, out of which 34 GB was in revisions. That may not be common, they were editing several large documents daily.

We created collective.revisionmanager for this customer. Sorted listing of portal_historiesstorage. You can purge revisions or delete entire histories. It maintains a cache for statistics and history data. It has a control panel for the purge policy.

Timo Stollenwerk: Angular2 app

We made an example Angular2 blog app on top of Plone.

Fred van Dijk: From process with love

Talking about processes let's you end up with an empty room. There was a Planning and Organising Sprint in June this year in Amsterdam. Shouldn't we write down our processes? We have between ten and fifteen teams in Plone. Who knows what a PLIP is? Everyone. Who does the roadmap? Framework team? Release team? Roadmap team, is that existing?

How do people who are not here or are introverts, give feedback? How much time does volunteering cost? If we describe tasks, it makes it easier to give a task to someone else.

Release team only does releases to PyPI? What about press releases? News items, tweets, documentation? There is more process here.

Do we need a process team? Yet another team? I will start documenting some.

Hector Velarde: Brazil

Joke in Brazil: Brazil is a country of the future and it always will be. President Lula got lots of people out of poverty. Still big gap between rich and poor. Next president Dilma was impeached. Police used to be nice to protesters, but not anymore.

What has this got to do with Plone? We created a blog add-on, with payment system, to maintain freedom of speech.

David Bain: Gloss

Gloss helps with theming by adding classes. gl-menu, gl-drop, gl-frontend. Diazo makes xslt easy. Gloss is supposed to make Diazo easy.

Other David: Don't get pwnd

Use https! Get a certificate. Nag your sysadmin about it. Free at Commercial may be better for you.

Don't drop to http if the client tells you.

Only send cookies over https

Get a good score on ssllabs.

Ivan Teoh: Plomino 2.0

Plomino is a flexible and powerful application builder in the Plone UI. Version 2.0 is mainly to support Plone 5. Archetypes support has been removed. Small demo.

Annette Lewis: Empathetic designer

This is for anyone who needs to give deliverables to other person. Don't let others set your feelings. They will try to bring you down if they see it has an effect. Smile, turn up the corners of your mouth. The person in front of you is inclined to mirror this. Enjoy what you are doing, appreciate what you enjoy. Disassociate from 'toxic' workplaces or persons, you are separate.

Eric Wohnlich: ims.upload

In other solutions we were missing chunked uploads, resuming a failed upload when you retry. The jquery.upload library does support it, so we support it in ims.upload.

Not released or on github yet, I hope to do that soon.

Matthew Wilkes: Saving a start up money

Using Pyramid and Probability. I created a site for a startup that were trying to match cat owners and cat sitters. We needed to enable conversations by phone between the two groups, using Twilio. We made it so it in the end cost far less than otherwise. Lesson learned: don't guess, because we started with a solution that would have cost much more. See

Sally Kleinfeldt: CMFBibliographyAT

This was not Plone 5 ready. We had several options, but decided we may just want to store it outside of Plone. There is Plone plus Zotero. It would still be a lot of work, but if you are using it, please contact us and we'll see if we can pool resources.

Cris and Sally: Closing words

Thank you to the Microsoft NERD center for hosting us. Thanks Jazkarta and Wildcard for organising. Thanks to MIT Media Lab for provide us the Barton room for the keynote talks, especially Jen. Thanks to the training spaces: District Hall, Landmark Center, ZipCar. Thanks to Gold sponsors and SixFeetUp, and the sponsors at all the other levels. Thanks to our media partner evenios, especially Armin. Special thanks volunteers Doug Feeney and Michelle Esperanza. Thanks to T. Kim Nguyen for your time, effort, patience, generosity of spirit and just being you. Thanks to our fantastic trainers, our amazing speakers. Thanks to every last one of you who attended the conference.

Paul: "A roaring applause for you two, Cris and Sally!!!!"

Ramon and Victor: Special surprise announcement

16 to 22 October 2017: Plone Conference Barcelona. We will be at the technical university, they support us, they have 400 Plone sites. We want to involve the wider Python community of Barcelona, encouraging others to join, maybe a more general Python track.

Timo Stollenwerk: Sprint kick-off

The sprint starts tomorrow at 9 o' clock, in this room. This is a perfect time for beginners to join and start doing some work. You don't have to be a crack core developer, not at all. You are very welcome, we are very friendly and open people.

Possible sprint topics are on titanpad.

Maurits van Rees: Plone Foundation Annual General Meeting

by Maurits van Rees at 2016-10-21T20:10:32Z

Not only is the full current board here, but also our treasurer Jen Myers. Hurray!

Thank you to our membership committee, ambassadors, sprint organisers, creators of the new site, our keynote speaker at PyCon (Cris Ewing), speakers at other conferences, CMS Gardeners, Google Summer of Code students and mentors, our intellectual property and trademark watchers and relicensers, new Foundation members, sponsors both companies, universities and individuals. The general and financial reports have been approved.

The current board has these seven members:

  • Chrissy Wainwright
  • Paul Roeland
  • T. Kim Nguyen
  • Carol Ganz
  • Philip Bauer
  • Víctor Fernández de Alba
  • Alexander Loechel

And the new board:

  • all of the above.

Please step up to nominate yourself next year if you want to serve on the board. If there are more than seven, we will have an election.

The board has received a proposal for the next Plone conference, we have done due diligence and you will hear about it later today.

by Maurits van Rees at 2016-10-21T19:18:24Z

This talk is about psychoanalysis of a community, psychology of developers. What motivates 'us', the Plone community? How do we feel? We do technical stuff, but we are humans, so we have feelings.

Open source, free software: you work for free for people you don't know. That is how your father-in-law would think about it. He thinks you are either stupid or generous.

Jessie J: "It's not about the money, we just want to make the world dance."

We work because we need to eat, and belong, and have a shared ideal, participating in something.

Study: only 16 percent of employees would recommend their company's products. Disaster! Okay, this was in France, we love to be critical, even about things we don't care about.

100 percent of community members would recommend their product.

Two times:

  • Otium: free time, but not just leasure, also time for caring.
  • Negotium: the very opposite of negotium. Time for business.

In English: business and busyness. Being busy. Business is about not caring? That may be exaggerated.

Doesn't it happen to us? A client says something does not work, we don't care. Someone on the other side of the ocean says something does not work in our favorite project: we fix it even in the middle of the night.

Kant talks about minority and majority. Minor: dependent, unfree. Major: autonomous, a scholar among scholars. Developers are grown-ups. But software industry tends to reduce our responsibility. You cannot make developers responsible. Communities value their grown-up status. You do not face clients or a boss, but your co-developers. We discuss with equal people. We feel more committed in this kind of group than in a private company.

Writing software is a full process. You do everything. You are going to iterate over versions. This process induces parenthood. You spend time with the code. You want to fix it, want to feel proud about it, mainly if we show this code to someone. We want to be prepared for the future. In English, software 'runs'. In French it walks, it marches ('il marche'). My kids don't wake me up at night anymore, my 10 year old Plomino software project sometimes does.

Communities are adoption structures. They make sure a piece of software always has loving parents to raise it. It is not just a bunch of developers sharing code. It works like a family, and we welcome new members into the family.

Another concept: how do we build our identity? 'I' needs a 'We'. Gilbert Simondon says: "Becoming myself is a process, which is both individual and collective." Belonging to a group makes me feel more myself. You imitate others.

We want to be Plone. The community is more than the sum of its contributors. The fact that developers want to be a community, makes it a community.

Bernard Stiegler: transindividuation. Plone participates in our 'We' and each of our 'I' processes. We and I influence one another. We change I, and I change We.

Plone-the-thing is just the software itself. Code. Not perfect, lots of bugs. It is real.

Plone-the-concept is a moral ideal. We want it to be perfect, 100 percent tested, fully secure. It is the community's super-ego, in German an Über-Ich. The concept rises above the thing. And the concept influences the thing. The concept stays in the mind of the community, even as individual members may leave or enter.

What keeps Plone going? Love!

by Maurits van Rees at 2016-10-21T18:37:19Z

Datawire is a first-class Python shop. Python and microservices complement each other really well.

What is a microservice? Small service, self contained, narrow in scope. It is like a lego block. Simpler: it is a unit of business logic. It could send a mail, or fill out a row in a database, anything. You wire them together by combining them in a topology, like a ring, map, star, fully connected, line. Fully connected topology is what I a focusing on in this talk. Netflix five years ago had more than 500 microservices. Twitter too.

Developers are the ones who should define the topology. Business logic is distributed, rather than central. It can help when you need to scale up, integrate various systems, or have really high reliability. If one part of the topology fails, the rest should still remain functioning as much as possible.

Linear topology lends itself for scaling and optimising each part separately: ingest data (network heavy), have one source of truth for data (disk heavy), transform data (disk and cpu), present data (network and cpu).

Microservices are about service oriented development. Thinking about architecture up front can sound nice, but when this takes months without actually building anything, you are probably out of date before you get started. An architecture should think less up front, and do more experimentation, and enable developers.

You need to move away from DNS to service discovery. And from central load balancers to smart end points, to update routing tables in real time. A microservices client should be a smart endpoint that can do the routing, that knows how to discover working and available services.

A microservice is a node in an agile service topology. And it is service oriented development. Needed mindset: from architecture to experimentation.

See the company at and the microservices development kit at

Twitter: @TheBigLombowski

by Maurits van Rees at 2016-10-21T16:48:35Z

See slides at

Paul Everitt introduces the talk: The ZODB is still amazing after twenty years. Hierarchical object database including permissions, NoSQL, lots of things. On to Jim.

I am working one hundred percent on ZODB currently. Previously for Zope Corporation I could focus only part of the time on it, solving some problems we were having. Zope Corporation no longer exists. I was contracted by ZeroDB, who made this possible. ZeroDB had two products. Database that stores data encrypted at rest. Big-data analysis with hadoop. They decided to focus on their Hadoop-based product for now. I plan to offer ZODB support, consultancy, so get in contact if you need me.

Are any people here using ZODB based on NEO? No. NEO is doing some interesting things for highly durable storage. I bit more effort to setup. Poll: about half the people on the room use RelStorage, all use ZEO, a few use ZRS. I really recommend you to look at ZRS if you use ZEO. ZRS (Zope Replication Services) 1 was a nightmare, but version 2 is very good. We never made backups with repozo, we just replicated it.

ZEO version 4 used asyncore, by far the oldest async library in Python. It has lots of issues and is deprecated. I had a suspicion that maybe asyncore made ZEO slower. I rewrote most of ZEO to use asyncio instead, and cleaned the code up. In most cases there is performance improvement.

The ZODB API is synchronous. I have been using async libraries since say 1996. The API could change. Shane added a cool hack to ZServer to avoid waking up the event loop, which is a big performance win.

Transactions should be short. The longer the transaction, the higher the chance of a conflict. Connections are expensive resources, they take memory. If you have long-running work, try doing this asynchronously. But handing this off reliably is tricky.

Consider using content-aware load balancers, so you don't need all data in memory on all servers. They working set may not even fit in memory.

Might ZODB run with Javascript in a browser? Run ZODB in a web worker. Provide an async API to your UI code. This assumes that ZODB has been ported to Javascript, which should actually be doable. If someone wants to pay me for it... :-)

A challenge for some applications, is to get objects loaded fast, especially on startup. (You can often mitigate this using a ZEO client cache.) There were some problems with persistent caches, but they have been stable for a few years. But you can now prefetch items. You tell ZODB to prefetch some items, and then you can forget about the request and ZODB will meanwhile prefetch it for you, so it may be available later when you really need it. So the items are loaded asynchronously.

ZEO now has SSL. ZEO had authentication, but it made the code harder to understand. It is now out in favor of SSL. So you can restrict access to the ZODB.

ZeroDB stored the data encrypted, which meant the server could not do conflict resolution. So I added conflict resolution on the client. You can then work with real objects instead of just state. Solving conflicts in BTree splits would be easier then. It reduces processing time on the server. I would like to move conflict resolution up to the ZODB, instead of having it in ZEO.

Object-level locks. Currently ZEO locks the database for writes during the second phase of the commit process. In that phase it needs to wait for the clients to maybe do conflict resolution. Object-level locks could help here. I got it working, but it mostly did not give a performance win.

ZODB on the server is actually faster with PyPy.

ZeroDB did some interesting experiments. Split a database into multiple virtual databases, one per user, separate invalidations.

Unification of RelStorage, NEO, ZEO. NEO had some patches for ZODB and they are now merged, like a simpler implementation of multi version concurrency control. This is better for RelStorage as well. RelStorage is no longer a special case, and it has a new maintainer in Jason Maddon.

Inconsistency between ZEO clients. Scenario: add an object in one zeoclient, next request goes to second zeoclient and it potentially does not have the object yet during a very short timespan. There now is a new server-sync option to force a server round trip before each transaction. That is a cost, but maybe it should be the default.

What have I been doing after my work for ZeroDB. I worked on decent documentation, which lagged behind a long time. See You can help me improve it, by writing documentation, or also definitely by bugging me about documentation that you are missing.

FileStorage2. FileStorage worked out much better than I ever imagined. The main code has probably not changed in twenty years. It is a bit slow. With FileStorage2 we have better, separate packing, external garbage collection needed though, but that is better. Unneeded features are removed: versions and back-pointers. It uses multiple files, so with a pack you can split a file, write newly incoming transactions to the new part and pack the old part.

Byteserver is an alternative ZEO server implementation, written in the Rust language. Rust is very fast, faster than Go mostly. No Global Interpreter Lock like Python has. Byteserver includes a FileStorage2 implementation, new API between server and storage, built for speed rather than pluggability. Initial tests, from this morning, are promising, twice as fast as ZEO.

We used Zookeeper a lot, which helps keep track of which server are live and which have disappeared.

Future ZODB ideas:

  • more speed. I don't need speed to be the reason people use ZODB, but it should not be a barrier.
  • more documentation
  • OO conflict resolution
  • The ability to subscribe to object updates.
  • Integration with external indexes like Elastic Search, Solr. ZRS could be used for this: look at that stream of data and push the relevant parts to the external index.
  • Persistent pandas data frames
  • A 'jsonic' API, to be able to look at the data without having the classes. There are some zodb browsers already.
  • ZRS auto fail-over. At Zope Corp we probably only had one or two unexpected fail-overs in all those years.
  • Official Docker images would be good. But if that uses Python 3 then your client also needs to be Python 3.
  • ZEO authorization.
  • Persistent classes?
  • Other languages? Javascript, Ruby, Scala.

by Maurits van Rees at 2016-10-21T16:39:02Z

I work at Wildcard, mostly on highly secure websites. I am on the Plone Security Team.

CastleCMS is an opinionated version of Plone. It packages all kinds of things up for Plone that we have been doing for security.

It is not a fork and it won't ever be. We want to work with the Plone community and want to continue to innovate with Plone. It gives us a place to innovate. Performance is important for us, and we have integrations like CloudFlare for that. ElasticSearch indexes all your content, with an asynchronous implementation of the search api. We heavily use Redis, using it as a cache that is shared between clients or threads. ZRS (Zope Replication Services) to share the load over databases. A lot of ReactJs. z3c.unconfigure for some adapters. And sometimes just monkey patches if there is no better way.

Security is integrated 2-factor authentication. Too many login attempts lock you out. The root Zope user can only login at the root of Zope, not in Plone.

Adding content is done slightly differently, and everything is Mosaic. No display menu, no default pages. All videos are compiled to a web compatible format asynchronously when uploaded. We have a Map tile for OpenStreetmap. Focal point image tile, where you can indicate what the main focus point of an image is, which is then using during image cropping. Social media tiles. All tiles are integrated with patternslib. We have a preview for different screen sizes.

We have a plugin for ElasticSearch to let the search results order be impacted by Google Analytics and social media popularity, for anonymous users.

You can audit what users have been doing. You can login as a different user. We have additional integrations with Google Analytics, archiving of content in S3, sms support, twitter. Recycle bin. Celery integration for asynchronous tasks like video conversion or pushing large files or moving lots of documents.

What is missing? Diazo (you could use it for theming, but we don't, and you don't need it for moving html content around), portlets and viewlets (just use tiles, also possibly inheriting from parent pages), default pages and display menu (we use Mosaic).

When stuff is not open sourced yet, bug me about it.

Roadmap: chat (rocketchat, ask Sam Fords about it), Mosaic enhancement, built-in A/B-testing, continue to refine the UI, more rich tiles, on the long term use plone.server.

We use React because it is better for small parts of the page. If you create a whole app, Angular2 would be better I think. We can fight.

by Maurits van Rees at 2016-10-21T15:50:24Z

In Europe there is the CMS Garden project: combined marketing for open source CMSes. We are partners and learn from each other.

Is Plone secure? It depends. Core is pretty secure. But security of an installation is dependent upon maintenance: if you don't apply hotfixes, it is not secure.

You can look at number of hacked sites, but security is a process, not a state. You may get a zero day export today. Are you ready for it? Are there bugfix or hotfix release processes? How do you discover those?

OWASP has a top ten report on common vulnerabilities in web sites. Plone is handling them.

Study from BSI 2013: the vulnerabilities in Plone are in the core, mostly not the add-ons, which is different in other systems. So Plone actually protects the add-ons: you don't usually make a site insecure with an add-on. New BSI study this year, not yet published, raw number may seem not so good for Plone, but there was only one really important issue, they were looking at the fresh Plone 5.0, and most problems have meanwhile been fixed.

For most of the other CMSes you need a lot of add-ons to come to a comparable functionality as Plone, and that may be less secure: their add-ons have more problems. On my university I see hacks for wordpress and Typo3 sites every week, for Plone: none.

Plone has a different focus. It is good for intranets, and is not only a CMS, but a portal engine. Security is built in, with RestrictedPython, AccessControl. There is no SQL database, which means you avoid a whole category of problems. We have generators for add-ons, giving a secure base for adding features, so you don't make beginner's faults.

Plone's market share is not so large, so large botnets will mostly ignore us. That does not mean we are more secure, but it does help in practice. But we are used by several high value targets, like the FBI, which will normally get attacked first. Zope/Plone users are usually more aware of security.

Permissions and workflow are a real strength in Zope and Plone. An institute like BSI will give Plone at most a medium security level. Not high security, because admins can see all information. If you really would want this, you could actually build it with workflow.

In PHP, data and code are mixed, also for add-ons. In Plone, code is on the filesystem, and you cannot change it.

Sanitised input. Warning: don't use the structure keyword to display unfiltered user input. We do automatic csrf protection.

Plone does not enforce active bans of ip addresses, and security studies may complain about it missing out of the box, but you can simply use fail2ban in front of it. Use tools like that. And use good caching to avoid your site going down under an attack. There are ways outside of Plone, or any other CMS, that you can use.

The Joomla security team does a good job of communication, we could learn from that.

But other security teams often belong to one company. Often only bug fix releases, not security hotfixes. Bug fix releases may contain all kinds of small or large feature updates. Sometimes no security information is available, especially for add-ons, which is where most of the issues may be.

Never use a system 'as is'. Think about extra security you can apply in front of it. Spend fifteen minutes a day per system to maintain it.

If you have a strong security need, check out the Zope Replication Service to have a read-only front-end.

Audience: shameless promotion for Radio Free Asia. It is using Plone, and it is a constant target of attacks, and we have a clean record, no successful hacks.

by Maurits van Rees at 2016-10-21T15:03:08Z

It's nice to do a tech talk again, instead of always doing a keynote about the future of Plone. Sorry, I can't show you details, because I got laid off and there is a non disclosure agreement.

SQLAlchemy allows you to talk to SQL databases in a Pythonic way, getting Python objects as results.

Martijn Faassen created Traject, combining routing and traversal. Izhar Firdaus wrote collective.trajectory to do this in Plone. We use this to traverse to SQLAlchemy objects, by registering functions. We hooked the results up to as well, so they show up correctly in listings, like the standard tabular view.

A trajectory example project: It has add and edit forms which talk to the SQL database.

We had really a lot of tabular data, so it made sense to do this in SQL, not in a normal Plone portal type.

by Maurits van Rees at 2016-10-21T14:01:44Z

When I met the Plone world around 2008, I saw there were lots of small companies and individual consultants. It inspired me to quit my job and university. Then the economy collapsed. Coincidence?

Movie The Social Network, 2010. When I heard about this movie, I thought it was going to be horrible. A movie about Facebook, really? But it was really good writing. One line struck me especially: "We don't even know what it is yet." Often we will get a new technology, and in retrospect have no idea what it was yet. We invent something, but we don't even know what it is yet.

The web in Python, end of the nineties. It was not much, it did not look like clean code today. The web was young. The blink tag, anyone? These two not yet mature technologies met, and mingled.

What does Python offer? What sets it apart?

  • Reflection. Your program can look at itself, like in a mirror. Things like: list all functions of a class, ask the type, get an attribute by name. Not a lot of languages did that.
  • Object oriented. Not just object based, allowing you to split functionality over several objects. But sub classing, multiple inheritance. You get invited to write new methods for existing classes. (And it eats a whole level of indentation, but that is another story.)
  • Dynamic. You can wind up with code and objects that don't even exist in your raw source code. You can generate code on the fly, insert variables dynamically/magically. Such things might not make your code more readable though: code that does not even exist on the file system?
  • Simple. Einstein: "Things should be as simple as possible, but no simpler." Dan McKinley, book Choose Boring Technology: "Every company gets about three innovation tokens." You can do about three new things without falling over. Are you going to use MongoDB? You have just used up one of your innovation tokens. Only choose new exiting technology in strategic places. For the rest: just use MySQL, Postgres, Python. Boring, but stable.

Some Python web technologies: Django, Flask, Bottle, Pyramid, Morepath. Flask and Django are an order of magnitude more popular. I created this list, found the same list somewhere else. But some techs fitting in the middle were forgotten, like, web2py, CherryPy.

Flask and Django:

  • Views are plain functions
  • explicit registration, not reflection
  • your app can start small and simple

Today, Django stands as Python's default first framework. Flask actually has more github 'stars' for people who follow it. Yet there are far more Django conferences or meetings world wide. Django gives you a good start. Years later, you may get more opinionated, with good reasons, and choose your own ORM and a different, smaller framework. As a beginner, Django just helps you a lot.

And Django has a forms library. Wait, that may involve classes. You may need inheritance and introspection. But good programmers don't avoid complexity when it helps them. Then again, a form library is a bit like backing up a truck with multiple trailers. You have knobs to control how they are going, but can you do that without failure? And you are probably missing all kinds of knobs that the forms library has not thought about. But a forms library does automatic validation, refills forms for retry, does cross site scripting, which a new web developer probably does not even think about. So it is good for them to use it.

Flask has become the go-to second framework, for when you know what you are doing.

But will we keep writing Python for the web? We have competition. Javascript is in every browser. With Node.js you even have it on the server.

Javascript is a much cleaner story from the outside. Python has 2 versus 3, C Python versus PyPy. For Javascript on the server, everyone uses Node.js, which is the PyPy of Javascript. And for ES6 there is a cross compiler to ES5.

But, you say: Python has reflection, generators, iterators, classes, modules, and Javascript has not. Wrong. ES6 adds this. You turn your back, and suddenly a language has involved. Javascript has Python features! Vi has syntax highlighting! "Everything that rises must converge." Languages grow similar.

But what about the fact that Javascript is just dumb?

40 - '30' -> 10
40 + '30' -> '4030'

In Python you get a helpful traceback when you try this, instead of running into undebuggable errors later on. Ah, but in TypeScript you get the same. They fight back successfully against the broken type system. And you can cross compile it to ES5.

So Javascript is a contender, is gaining features, and becoming safer.

There has always been another language that was more popular than Python. There is nothing new. What are Python's advantages then?

It is becoming the world's default language. Science is moving to Python. Data is moving to Python. At weather conferences there is now a Python track. Simple syntax is perfect for the occasional programmer, who has other stuff to do, like science. You do your science, and one every three weeks you write a small program. Django Girls organizes lots of weekends around the world where women use Python to write their first website. The new programmer needs Python, because it is simple.

The web and Python met when both were immature. In the years, both learned the patterns to make the web possible and sometimes even simple to program for. And even after all this years, we don't even know what it is yet.


First language for a child? Scratch is good for young children. Python is a good language to get used to. In the US it has become the default in universities for courses.

Where at the language syntax level has Python done anything really new? When you open a file, once PyPy got popular, it got clear that files would remain open. We had to have a way to run cleanup code, even when exceptions rose. So we did try/finally, like in the Java world. It solves the problem... and it is ugly because it is Java. So we decided we needed to do one better. I believe we innovated with the with statement. It was not intuitive for me at first, but it is very helpful. It is marvellous for any kind of recursive context management, changing directories being sure that you will return to the previous directory.

In Javascript you have classes now, finally, but the Python community is far more used to it, right, which helps? Yes. Node and Javascript are still in a period of change, features have not been around for a decade. Writing in NodeJS you have spent one of your innovation tokens, writing Python you still have that one.

Find me on Twitter: @brandon_rhodes.

October 20, 2016

Maurits van Rees: Lightning talks Thursday

by Maurits van Rees at 2016-10-20T22:08:14Z

Maurits van Rees: Jens Klein - Modern LDAP User and Group Authentication

by Maurits van Rees at 2016-10-20T20:36:07Z

This is an update on pas.plugins.ldap.

LDAP is Lightweight Directory Address Protocol. This protocol for storing and querying information on users goes back to the eighties. There are various solutions, like OpenLDAP, ActiveDirectory.

There has been LDAP support in Plone for a long time. Products.LDAPUserFolder has been available as basis, replacing the standard user folder. Products.LDAPMultiPlugins wraps it to the PAS API, difficult to install. Products.PloneLDAP integrates is more into Plone, but also difficult to install. is a wrapper around this, making it easy to install in Plone. But everything is stacked on top of each other, very difficult to maintain or understand.

We created a complete rewrite: pas.plugins.ldap. We use an abstraction of the LDAP features, in``node.ext.ldap``, Python 2.7 only, using python-ldap, pure Python.

You can get groups and users from LDAP. It maps LDAP attributes to PAS property sheets. Support for caching, for many users, 98 percent test coverage.

Limitations: you cannot add users or groups, only edit them. The underlying library does implement this, so this is a TODO item, although our sites don't actually need it: users are added or deleted in a different system. No multiple (fallback) servers possible. It patches the user portraits, so this may conflict with other patches that you may have.

We have a test layer that uses an OpenLDAP instance.

node.ext.ugm is used, which is a set of interfaces for User and Group Management.

pas.plugins.ldap uses those base packages, configures it using GenericSetup, provides ZMI and control panel forms to configure LDAP.

Supporting 'many' users is tricky, this was solved using money from a fund raiser campaign. Thank you!

by Maurits van Rees at 2016-10-20T19:30:29Z

Lessons from integrating Pyramid, React, and Plone (and elasticsearch, and Salesforce, and a payment gateway, and...) Quoting from the Plone conference site: "The Volunteer Management System (VMS) is a tool that Jazkarta built for Washington Trails Association to manage volunteer sign-ups for helping maintain hiking trails in the state of Washington. It allows staff to schedule work parties, volunteers to find and register for them, crew leaders to access information about their crew, and land managers to report on work that was done in their region."

The tools you use matter. So use the correct tools.

So at the start, we had the site, and Salesforce, and, which was basically a bunch of ten year old scripts.

We could have built everything in Salesforce. It has all kinds of options for doing this, but there are all kinds of restrictions.

We considered Plone. All user accounts were already in here. But we did not need a lot of content management.

On the front-end we used ReactJS. This communicates with Plone for content and with Pyramid for the volunteer management. Pyramid interfaces with Redis, ElasticSearch and Salesforce.

With Pyramid, the view configuration is very close to the actual code, so you don't need a separate zcml file like in Plone. There are no globals, which makes it easier to write isolated tests. Views are easier to test because they return a dictionary instead of a complete html response.

Pyramid is a framework that is good for writing frameworks. We needed to write some infrastructure ourselves, which is nice to do in Pyramid. For example, with config.add_request_method we made a method available on the request to access Salesforce. We registered an exception view to gracefully handle exceptions for either html or json.

With Pyramid, batteries are available for cheap:

  • pyramid_chameleon
  • pyramid_layout
  • pyramid_cachebust
  • pyramid_mailer

As special deployment bonus: we were not using a ZODB, so no ZODB cache was needed, so memory requirements were low, so we could use lots of threads to handle moments of high load.

It is not perfect, for example there is no automatic csrf protection like in Plone. Some assembly is required: Plone has lots built-in and in Pyramid you need to do more yourself, for example setting up logging.

We used the py.test framework, which makes it really easy to define fixtures. There is some magic, which not everyone likes. Assertions are easier to debug, giving you more feedback. We used factory_boy to provide fixtures. [See a talk at PyGrunn earlier this year, by Oleg Pidsanyi. Maurits]

We used for load testing.

React was our chosen Javascript framework. I like that it is declarative. You can focus on what is displayed, not how. A lot of changes, like toggling a checkbox, happen automatically.

We have shared navigation between Plone and Pyramid. The navigation is done in Plone, and we created a json endpoint in Plone that Pyramid could call.

We needed to think about Cross Origin Resource Sharing (CORS), with all kinds of headers. These days I would look at and how it does this.

Single sign-on. Pyramid redirects you to Plone, where you can login, and with a token you are then logged in to Pyramid.

by Maurits van Rees at 2016-10-20T18:46:13Z

I am in Berlin via a live video feed. Hello!

In several recent projects with Plone I had a common challenge. The CMS was just one of many parts of the stack. People may view our content on a large computer screen, a mobile phone, or virtual reality glasses, which all need to be handled differently. There are several solutions, like contentful. Some common traits:

  • Everything is through the web.
  • APIs for various languages

Why was I using Plone for that?

  • No more custom PHP development please.
  • Lots of things included.
  • I am still quite productive with Plone.

Biggest reason:

  • I did not look for hosted solutions.

If I build it in Plone, I may be the only one at the company who can maintain it. Not so with a hosted solution.

But: I still love Plone, and want to use it, for good reasons:

  • One API endpoint.
  • Better control over performance issues.
  • Integration with front-end development is essential.

And now I actually have four Plone developers in the team, so that is great. The team is happy with Plone. We use as building blocks:

  • plone.restapi. This saved a lot of time.
  • a policy package
  • PyCharm IDE for writing Python
  • AWS/Kubernetes/Deis
  • Thumbor. Image server over Tornado. Cropping, filters, transforms. We have integrated this in Plone using event subscribers.

Lessons for Plone:

  • documentation, documentation, documentation. Everything I did was possible due to documentation.
  • More documentation, more documentation, more documentation.
  • We need more projects like plone.client.
  • We need more commercial offering of headless hosted Plone.

by Maurits van Rees at 2016-10-20T15:56:56Z

Docker is what virtualenv is for Python. Isolated environment. You have the same environment on Linux/Mac/Windows and development/test/production.

For Plone without Docker you need to install all kinds of libraries, run a buildout, ignore some SyntaxErrors.

For Plone with Docker you can run:

docker run -p 8080:8080 plone

This uses the new official Plone Docker image at See information on that page, also on including add-ons or developing. In that case buildout gets run so it can fetch the add-ons.

Always label your Docker volumes to avoid data loss.

You can use a zeoserver:

docker run --name=zeo plone zeoserver

In production you should create your own Docker images, including all add-ons you need. You can use extended_buildout.cfg. For composing your own Dockers, see

When using multiple hosts, you want orchestration. There are several options. We use Rancher. You can use the official Plone Docker image and set several options.

The plan is to use this for continuous delivery, like in the talk by Nejc Zupan.

See various repositories with Docker for the EEA.

See for the source of the Plone Docker image.

by Maurits van Rees at 2016-10-20T15:10:14Z

Discussions in the hallway are the best part of this conference. You don't have slides there, so I won't use them here either. I do have them by the way.

Have you deployed anything to production this month? Week? Today? If code only sits on your local computer, it does not give value to your customer.

What would deploying look like if it was easy? You fix a big, push the change, the tests are run, they pass, production gets updated automatically or maybe after one push of the button. Instead of saying 'the fix has been committed and will be in the next release', you want to say 'it is fixed'.

The bigger the change, the harder it is to deploy. One fix, with one data migration, is fast to deploy, and easy to undo if needed. With three fixes: it gets harder. For one fix, do you really need a developer, a QA person, a project manager, a sysadmin?

When you push to a git repository, you can hook up actions to start testing and deploying.

Tools are interchangeable. You are smart people, you can figure out how to do this. More important is why you should do this.

When a pull request is made, we copy production data to staging. This may be a lot of data, so in case of SQL database we only copy a subset. The pull request is deployed to staging, so a reviewer can immediately check it there. We have 100 percent test coverage. We have regression tests. For new employees, I want them to deploy something to production the first day, going through the whole process. This is very empowering. It keeps developers happy.

Code ownership. If you know that your pull request may be deployed within the next twenty minutes, then you will be careful about what you put in the pull request.

Tip: if you don't have this yet, then start doing this with a very small project.

Give your customers access to the staging machine that has this change, so they can check it.

We host everything on Heroku. For the highest paying levels, you have a button to revert the code change and the database change. Heroku does this well. If you are not in the business of hosting, then don't do hosting.

We have about ten people in the company. We do have a few small Plone Sites.

For us, the only way to get code into the master branch, is via pull requests.

We spend more money on the staging servers than on production.

You can automate stuff like: if a new tag of a package is generated, push it to your internal PyPI.

What about big features instead of bug fixes? You can use feature flagging, showing for example a new UI to only a few people. But anyway, it is rolled out to staging, you test it, if it works you can deploy it. For big features it can take longer to get everything correct, so you just don't merge the pull request yet.

I will never write code without writing a test. For an emergency fix, it is still better to spend twenty minutes to write a test, instead of spending two hours later reverting and debugging.