Showing people good web practices in extensions development

Replies to This Discussion

Permalink Reply by Oleg Nesterov on October 5, 2009 at 1:05pm

As for me, I've created an educational resource for Joomla developers where I'm going to write some useful tutorials for Joomla developers (those who make websites work) for free.

I look forward to your comments.

Permalink Reply by Torkil Johnsen on October 5, 2009 at 4:59pm

Higher quality extensions is really important, and by using a certain well-known RAD framework and decreasing the amount of code you write, you subsequently also reduce the amount of bugs and security holes in the same code. With that being said, there is no law against being careless or stupid, so I think educational material would be a good thing to spend time on, rather than trying to correct the mistakes of people who have been lazy or just lack the knowledge.

Teach people to fish rather than just handing the fish to them, it will serve them better in the long run.

Permalink Reply by Jeremy Wilken on October 5, 2009 at 9:38pm

I'd be interested, but I think one thing that could help was just a basic "Welcome to Joomla, now here are some lessons learned" type information. For example, many new people are excited about the thousands of extensions, and just start adding away to their hearts content. This can become a huge problem for their site, which might also become a big discouragement to using Joomla. The as was mentioned above, various other levels of info can be provided, but there is so much to include in the docs that is missing still, we should make sure not to skip the Docs where it is most appropriate for this kind of detail.

I'm not sure if the Docs is the best place for this or not, but why not something that gives some practical advice to newcomers about how to make good decisions related to using Joomla? However, it still seems like a lot of details which should be on the Docs, or something similar, and perhaps we just need to try and encourage users to fill the wiki?

Permalink Reply by Amy Stephen on October 5, 2009 at 9:56pm

Definitely think there are good ideas here.

Creating documentation and learning material is a good opportunity for experienced and new developers to work together. I'd certainly be willing to help, as I am able.

I think the eventual goal for this work should be the community documentation site. It might be good to talk to Chris Davenport, Ian MacLennan to see if there are priority items or ideas they might have on this.

In terms of reducing duplication, we won't be able to directly impact that (unless we as developers choose to consolidate our existing extensions, or work together on future work.)

I agree with Torkil. Focus on learning material. Find good ways to get the word out so developers know this is available and then work with those interested. That will do wonders for code quality.

Good start Oleg. If you know Ian and Chris, I'd encourage you to talk to them and see what ideas they might have for us.

Permalink Reply by Mark W. Bender on October 5, 2009 at 10:37pm

Great Idea. Based upon what I've learned using Joomla! in the past 18 months, there is definitely some room for improvement in the extensions category! I've got a few ideas for some new extensions, but don't know any PHP (yet) and would love to have an educational resource place where I could pickup PHP with a "tips and tricks" section.

Maybe a "Joomla Extensions Developer Checklist" needs to be created with some basic info that needs to be in their code to comply with a "Joomla Approved" label that only would go with "well written" and SECURE extensions.

Permalink Reply by Royce Harding on October 5, 2009 at 10:55pm

Hi there, this is conceptually a good idea. However its hard for me to see how it could work in the real world unless the evaluation is automated ala jsonlint, html/css validator, etc. It would be highly unlikely that you could get a group of volunteers to pore through a CB/SOBI2 size application to see if they missed a $_REQUEST call somewhere. And they certainly couldn't do it for every update or minor revision!

There are all kinds of checklists, dos/dont's, etc around, even if they are spread out in various places. The only logical place to put such a consolidated effort would be joomla.org, but even then, you can't force a developer to adhere to best practices. And, unfortunately, why would an org such as OSM want to take on the potential liability of certifying the security of a 3p extension? Any evaluator would have to include the usual disclaimers about liability.

Also, doesn't the JED remove extensions if there are known exploits in them? Short of some sort of automated evaluation system before inclusion, I don't see how else you could perform such a gargantuan task on all but the most trivial sized extension.

Permalink Reply by Bill Joseph on October 6, 2009 at 8:56am

As someone brand new to developing my own extensions, I can say that a resource like this would be invaluable!! ANY advice/tips would be helpful.

When I work my way through the books/documentation, I can reproduce the results, and then I start to go "off-book" and that's where the problems start. If there were a "best practices" resource it would help me to understand if I'm developing it correctly or if I'm unintentionally introducing fatal errors. My biggest fear right now is that what I am building is insecure so a "common beginner's errors" area would be helpful.

I would hope that any resource would be written at the level of a beginning developer, or that there would be opportunity for conversation. Sometimes when I look at the forums/books/tutorials I get it right away, sometimes it doesn't make sense because I don't have the solid development foundation yet. (But I'll try not to ask too many stupid questions!! :-D )

Permalink Reply by Amy Stephen on October 6, 2009 at 9:04am

Having new developers ask questions is very helpful - points to what's needed. So, I say, ask away! Might be worth opening a forum topic "New Developer Questions" and people can use it to ask any question - especially if they worry it's a "stupid question" (which there are none!). That way, they might feel less intimidated about asking and end up finding out many share the same puzzlement.

Permalink Reply by Mark W. Bender on October 6, 2009 at 10:42pm

You can't learn if you don't ask questions! Chances are someone else has the same exact question but hasn't written/asked it yet!

I want to learn more about writing php so I can start "playing" around with it, then eventually put it use in the Joomla world.

We also could use a "developers resources" area too!

Permalink Reply by Oleg Nesterov on October 7, 2009 at 3:24am

Thank you all for your thoughts.
I offer to divide the problem into 2 parts:

1. Developer resources (e.g. tutorials, videos, lessons).
Before deciding to create the Jookungfu I googled for developer tutorials and was really upset to find only a few good websites. There are a lot of end-user tutorials and only a couple of "Hello World" articles on docs.joomla.org for web developers.

Though, I think the documentation should be strict and I doubt whether docs.joomla.org is a good place to have some "extended" tutorials. There is enough information in those "hello world" lessons to help you developing an extension. But when you are trying to improve your extension or add some not-so-obvious features — you create an approach. For example, I have approaches on how to structure MVC-files, what to have and not to have in models, how to validate form fields and how to make it painlessly in Joomla, and many more. These are my own approaches, however who says they are absolutely right? Also some good approaches may may be born in discussions, and there is no way to do this on docs.org.

Wiki is a good place to store some "absolute" things which a beginner may read, learn and use immediately. I believe all other things might be maintained by the community. If you have ideas and approaches why not to share them in your blogs or other resources (like this website)? Others can get them and discuss. I assume we can have some page with links of useful resources on docs.joomla.org?

So my point of view is: The approaches should be discussable, the documentation should be strict.

2. Researches.
I agree with those of you who say that educational resources are better that trying to correct mistakes of lazy developers. But sometimes even a good developer who have read the documentation thoroughly doesn't have the necessary experience, especially in security questions.

Let me explain how I see it: I dream we can have research.joomla.org website where the group of experts will analyse extensions (for example by categories). The goal is not to find all the mistakes in this particular component or module, but to figure out the tendency, i.e. what errors happen more often. We can decorate such researches with images and graphs, diagrams, statistics, for example to let people know whether extensions' quality increases or decreases. Then some advices can be published on basis of such researches.

For instance, If I'd see such kind of information I would definitely go and review all my extensions regardless of thinking that I've learnt all the tutorials.

We can also create the "review request form" for developers who doubt whether their extension is good or not. This won't be a demand in order to be placed on JED, but rather the recommendation.

So:
1. Researches and statistics.
2. Advices based on item #1.
3. Ability to upload an extension and receive particular advices directly.

What do you think about creating such "research group"? Is it worth a further discussion?

Permalink Reply by Amy Stephen on October 7, 2009 at 8:44am

Regarding the Where should documentation go question:

Joomla.org should have (at least) basic documentation for developers. The API, how to build the various Extension types, how to create a form and validate contents, building secure Extensions, adding Ajax, etc. Those items are simply not up-to-date or available today. It's not the "project's responsibility", it's our responsibility as a community to fix that. So, I feel it's very important as developers that we recognize our role to assist in that regard.

Certainly, I do agree that a healthy blogisphere of developers talking about how to do things in Joomla! is a good thing. It's fun to visit people's sites, see what they are doing, comment on their approaches, point to someone else's approach, add to the conversation - that interactivity builds community and draws in others. It shows a dynamic community. The links to blogs are shared at Joomla.org on JoomlaConnect. That's Joomla!'s Planet, if you will, so we already have the exposure needed to build an audience.

The community resources are offered at Joomla! org. In my opinion, we have a duty, as developers, to ensure the basics new developers need are available. It's our community, our project, our new developers, our responsibility. I hope we work together to contribute to that. It would be good to hear what the project thinks is needed and see if we can help with that, especially for 1.6.

I am certainly willing to put some effort in this. Who else is in? If we an get a list and split it up, we could make a big, positive difference, in short order.

Permalink Reply by Amy Stephen on October 18, 2009 at 7:09pm

Oleg - If you want to continue this discussion, would you please summarize where things are and what people should do to help it continue in the Learning Group? We are closing the home page forums for simplification. Thanks!