high fructose corn

I just got done reading this article on Slate, which argues that whitehouse.gov moving to Drupal is a “political disaster waiting to happen”. Let me take some time to address each of these lies.

Drupal knows best. It's not that Drupal thinks you're evil. It just thinks you're ignorant. In a basic setup, the software is suspicious of everything you try to do. Should you, say, go completely rogue and try to add some Javascript in the body of a page—a 14-year-old technology that controls interactive components like buttons—the platform will have none of it. The message: "That's dangerous stuff, and you probably don't know what you're doing." Better to outlaw something altogether, Drupal figures, than simply ask you if you really want to use it. If Drupal ran the Food and Drug Administration, it would ban high-fructose corn syrup. This is just the sort of straitjacketed paternalism that half the country is convinced the Democrats are hell-bent on imposing on us all.

Javascript is dangerous stuff. Ever try putting it in on Wordpress? You can’t. That’s not the case with Drupal, and it exemplifies that the author of this article has no idea what he is talking about.

XSS, that acronym for “cross-site scripting” is a huge security risk, accounting for 80% of all vulnerabilities in 2007. For example, when you login to a Drupal site there are cookies stored on your computer. Those cookies are what lets Drupal know that you are that logged in user. By placing a simple line of javascript inside of content posted on a Drupal site that allowed it, I could easily have your session cookie sent to some server I run and then put that cookie into my browser and now I am logged in as you and you would never know I got it. This isn’t limited to Drupal, but to any system that allows logging in.

So does that mean I can’t use Javascript in Drupal? Absolutely not. Let’s look at the code to embed a CNN video:

Know what that is? It’s Javascript and you can see that exact video on this site by clicking here.

Wow that must be some kind of voodoo, but it isn’t. It didn’t even require any programming. It was a simple option inside of Drupal where I can change my “input format” to allow it. Not only that but I can limit what users can enter Javascript and not (try doing this on something like Wordpress – you need a plugin or to code it yourself). That’s the power of Drupal, and the piece of mind any website owner can have with it.

Let’s move on