Version 2.0.0 Brainstorming Thread

[paragonie-scott]

Post feature requests here. Backwards compatibility is optional.

[paragonie-scott]

So far:

• More familiar naming convention:
  • Renamed Landings to Controllers
  • Renamed Blueprints to Models
  • Renamed Lenses to Views
• Integrated with psalm (automated type safety checking as part of continuous integration)
• Raised PHP version to 7.1 (will be 7.2 when it's released)
• Upgraded dependencies. We're using e.g. Halite 3.2 but will be using 4.0 when it comes out (depends on PHP 7.2)
• New Motif for Version 2 New Motif for Version 2 #122
• Integration Testing Implement Automated Integration Testing #106
• Twitter Cards Twitter Cards #102
• Open Graph Open Graph Integration #99
• Halite v4
• Passwdqc Add passwdqc, optionally require passwords pass both zxcvbn and passwdqc #89
  • https://github.com/paragonie/passwdqc
• Enabling 2FA should require a TOTP challenge Enabling 2FA should require TOTP #81

What else would you like to see in version 2?

[harikt]

I had looked at airship ( not today, but when ever I see your posts in reddit or else where ) , but the user interface doesn't look nice. I didn't understood many of the functionalities in the cms itself.

I am looking at : https://github.com/paragonie/airship#screenshot

Eg : Cabins , Bridges .

Probably need a good UI for the website and documentation then only people will checkout things.

Just a feedback what I feel.

Thank you

[harikt]

By the way, I have a confusion with the GPL license itself. Do you think MIT makes easier for adoption ?

[paragonie-scott]

I had looked at airship ( not today, but when ever I see your posts in reddit or else where ) , but the user interface doesn't look nice.

What would you recommend to make it look nicer?

Probably need a good UI for the website and documentation then only people will checkout things.

What do you mean by "a good UI"? What sort of changes need to be made to make the existing UI "good"?

Just a feedback what I feel.

Thank you

Thanks. We're trying to improve but we have very little outside guidance from the community at large so every little bit of feedback helps.

By the way, I have a confusion with the GPL license itself. Do you think MIT makes easier for adoption ?

Every other product in this space uses GPL.

[harikt]

What would you recommend to make it look nicer?

Light background color, the current color scheme black is not catchy to eye. I am not so good in UI itself. Else I would have tried to make my hands dirty :) .

You can have a look at http://demo.processwire.com/ and http://demo.processwire.com/admin/page/ as examples.

Every other product in this space uses GPL.

May be I didn't understand. Which products are you mentioning ? Are you saying about 3rd party libraries airship is using is GPL ?

[paragonie-scott]

May be I didn't understand. Which products are you mentioning ?

WordPress, Drupal, and Joomla are the three big CMS products. All three are released under GPL.

Are you saying about 3rd party libraries airship is using is GPL ?

That wasn't my point, but that's actually true. For instance, Halite is GPL (though we also sell commercial licenses).

[harikt]

I have some confusion with the GPL license. I believe you can use GPL based software for commercial purpose also. Or does it need to buy a license itself ?

[paragonie-scott]

The only requirement for GPL is:

1. You make the source code of your derivative works available to your customers.
2. You share whatever derivatives under a GPL-compatible license so they can do the first part themselves.

The only time you would need to buy any sort of license from anyone is if you don't want to share your works under a compatible license.

GPL is a public license, but Airship is still technically a copyrighted work, whose rights are held by Paragon Initiative Enterprises, LLC. We can sell licenses under terms equivalent to the MIT license to businesses that want to produce non-free software. (Non-free here refers to freedoms, not price. You can sell GPL software.)

If you're fine with GPL, or you simply don't want to purchase anything from us, you're still free to use Airship under the terms of the GPL and you're protected from any sort of copyright infringement actions (not that we do that sort of thing anyway).

[harikt]

@paragonie-scott why does airship not using https://github.com/paragonie/easydb ? Are you considering it for 2.x ?

[paragonie-scott]

Our usage has diverged from EasyDB a little bit, mostly in the realm of type safety.

It's possible to make our database class simply extend the EasyDB object. I'm not sure if it's worth doing that.

[O3wallet]

Have a look at https://octobercms.com

• Allot of users don't know much about terminal commands etc. And also October's installer checks
  dependencies and shows missing ones.
• Create tutorials – Step by Step guide (For Beginners)
• Nice UI/UX – Experienced users can fix it themself but for others it needs improvement
• Allot of documentation - https://octobercms.com/docs

Biggest issue with this project was learning new terminology and hence confusion, Glad that will not happen in 2.0.
Don't feel bad. I believe 2.0 will shine. We will contribute but currently we have resource constrains.
We might develop bitID plugin for it when 2.0 released or PHP implementation is available here (If you want to have a look yourself).

Most important Find ways to monetize this project via assisted installations, plugins or custom plugins, sponsors, partnerships etc.

This is tough market to crack into but your project is unique with security first approach. I think you guys can make it.

[O3wallet]

Built in Mail :: API based - Some user behind cdn or proxies don't want to reveal their server's ip and most users need mailing app. So why now built it into the cms.
Mailgun, Mailchimp etc

[paragonie-scott]

Nice UI/UX – Experienced users can fix it themself but for others it needs improvement

I'd love to offer this, if I wasn't completely and inherently untalented here.

Built in Mail :: API based - Some user behind cdn or proxies don't want to reveal their server's ip and most users need mailing app. So why now built it into the cms.

That's a good idea.

[mindctrl]

If monetization is a goal, via any of the methods mentioned here, then I think the mail features mentioned here are a great candidate for add-ons that can be sold.

[O3wallet]

I'm just throwing ideas. If @paragonie-scott wants to sell then they can sell and they have every right to. But at the same time they have to make assessment what they can and can't sell. Most other CMS they are competing against already have these free options. They can monetize plugins like support tickets, Create API's, login / Social Login for front end users etc..

[O3wallet]

Security Headers: Content Security Policy, Cross-origin Resource Sharing, HTTP Public Key Pinning, HTTP Strict Transport Security, Referrer Policy, X-Frame-Options, X-Content-Type-Options, Sub-resource Integrity, Set-Cookie :: secure.

These all headers can be categorized under security headers tab.

[mindctrl]

re: mail. I can see both sides of it. One thing I'm thinking about is a CMS is about content management, not email integrations. I think the core CMS should stick with content management and let enhancements happen via add-ons (free or paid).

I can say that in the WordPress world (I know, I know), there are many people willing to pay for mail add-ons that integrate with the CMS and/or other add-ons available for the CMS (ecommerce for example). It's enough money to employ multiple people too, so it's something worth considering in my opinion.

[O3wallet]

I agree with you, CMS should focus on core only but world of Wordpress has changed things allot. I believe they should have set of core features with CMS like mail, because securing apps is not easy, free addons are available they are buggy and venerable . This is like throwing something free to get attention. this is the sad part most people go for free and buggy stuff and have no regard for secure applications and secure apps cost more time and resources and hence the cost but people don't understand that. May be they should package addons in bundles e.g eCommerce, blog, etc. its the world of itunes focus at volume and keep price point low enough to sustain business model.

[O3wallet]

Project like this should survive. Once I have few resource available. I would also like to contribute. if no one fixes design then I'll take that bit

[O3wallet]

High availability setup/clustering (Web server & Database server) - Make it easy to Scale or provide easy options and docs to scale this project easily on multiple instances.
I don't think any other CMS focus on that.

Websocket allow bidirectional traffic and consume very little bandwidth. I think if airshipCMS comes with it out of the box then this might also be a unique feature. And All common web browser already support this protocol

[O3wallet]

And on Mail integration I agree with @mindctrl on the point that core should only focus on CMS and extra features must be introduced via addons either paid or free. Here I believe It'll be allot easier to monetize. Rather than waiting for other dev's to create addons may be start making your own. I have noticed people abandoning their addons after a while. This is a serious problem with serious projects and also developers don't check security updates. You can provide addons and also maintain them. Create a whole class of addons and use CMS as platform to sell. So long they also follow security first Approach people will pay for it.

[johnny-bit]

If it would at all be possible - would you consider supporting MariaDB and MySQL as DB Backend?

[paragonie-scott]

If and only if they support CTEs and recursive queries a'la

airship/src/Installer/sql/pgsql/11-groups.sql

Lines 25 to 74 in ccc588a

	CREATE OR REPLACE FUNCTION group_ancestors(child BIGINT)
	RETURNS TABLE (parent BIGINT) AS $$
	WITH RECURSIVE parents AS (
	(
	SELECT
	node.groupid,
	node.inherits
	FROM airship_groups AS node
	WHERE
	node.groupid = $1
	)
	UNION ALL
	(
	SELECT
	g.groupid,
	g.inherits
	FROM airship_groups g
	JOIN parents p
	ON p.inherits = g.groupid
	)
	)
	SELECT $1
	UNION
	SELECT groupid
	FROM parents;
	$$ language 'sql';
	-- Get all of a users' group memberships
	CREATE OR REPLACE FUNCTION memberOf(user_id BIGINT)
	RETURNS TABLE (groupid BIGINT) AS $$
	SELECT DISTINCT airship_groups.groupid
	FROM airship_groups
	LEFT JOIN airship_users_groups
	ON airship_groups.groupid = airship_users_groups.groupid
	LEFT JOIN airship_users
	ON airship_users_groups.userid = airship_users.userid
	WHERE airship_users.userid = $1
	UNION
	SELECT DISTINCT group_ancestors(g.groupid)
	FROM (
	SELECT airship_groups.groupid
	FROM airship_groups
	LEFT JOIN airship_users_groups
	ON airship_groups.groupid = airship_users_groups.groupid
	LEFT JOIN airship_users
	ON airship_users_groups.userid = airship_users.userid
	WHERE airship_users.userid = $1
	) g;
	$$ language 'sql';

[johnny-bit]

That's Great! MariaDB supports Recursive CTL from version 10.2.2 - https://mariadb.com/kb/en/library/with/ MySQL will support from version 8.0 (current 5.7 no-go): https://dev.mysql.com/doc/refman/8.0/en/with.html Would that be OK and match requirements? 2017-11-21 18:16 GMT+01:00 Scott <notifications@github.com>:

…

If and only if they support CTEs and recursive queries a'la https://github.com/paragonie/airship/blob/ccc588a55258565532035fb4a5d0bc e541771403/src/Installer/sql/pgsql/11-groups.sql#L25-L74 — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#160 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AKMVFdpxG_xC7tgQ77_wPdaKPZ0UrDzFks5s4wV1gaJpZM4KqiLf> .

-- Pozdrawiam, Hubert Kowalski

[paragonie-scott]

Yes, that's fine, we were holding out on this support. :)