Please share your opinions on this blog post

This forum is only for questions or discussions about working with the mojoPortal source code in Visual Studio, obtaining the source code from the repository, developing custom features, etc. If your question is not along these lines this is not the right forum. Please try to post your question in the appropriate forum.

Please do not post questions about design, CSS, or skinning here. Use the Help With Skins Forum for those questions.

This forum is for discussing mojoPortal development

This forum is only for questions or discussions about working with the mojoPortal source code in Visual Studio, obtaining the source code from the repository, developing custom features, etc. If your question is not along these lines this is not the right forum. Please try to post your question in the appropriate forum.

You can monitor commits to the repository from this page. We also recommend developers to subscribe to email notifications in the developer forum as occasionally important things are announced.

Before posting questions here you might want to review the developer documentation.

Do not post questions about design, CSS, or skinning here. Use the Help With Skins Forum for those questions.
This thread is closed to new posts. You must sign in to post in the forums.
10/23/2009 4:59:36 PM
Gravatar
Total Posts 18439

Please share your opinions on this blog post

Hi All,

If any of you feel as I do that mojoPortal is the most user friendly CMS especially among .NET solutions, feel free to weigh in on the comments at this blog post.

http://www.danielbardi.com/blog/post/2009/10/23/mojoPortal-CMS-Can-Be-Confusing-For-New-Users.aspx

The author, who obviously is affiliated with Umbraco and therefore his neutrality is suspect, seems to think mojoPortal is confusing to new users, a conclusion that seems  extremely odd to me especially if Umbraco is the baseline he is comparing against. I'd especially be interested in comments on that post from users who have tried both mojoPortal and Umbraco. 

Best,

Joe

10/25/2009 2:56:21 PM
Gravatar
Total Posts 190

Re: Please share your opinions on this blog post

I tried posting a reply there, but the page kept returning all kinds of errors. I created a sign in and everything but nothing worked. (I'm guessing they aren't using mojoPortal for their blog!)

10/25/2009 5:35:00 PM
Gravatar
Total Posts 4

Re: Please share your opinions on this blog post

.Joe,

I need to clarify that I am in no way affiliated with the Umbraco team.  Yes, I like Umbraco, but the reason is because it is a .Net based system, the same reason I like mojoPortal.  Let me repeat.. I like mojoPortal.  It is a very well put together product.  My primary reason for choosing Umbraco over mojoPortal, was the ease of developing extensions and the overall feel of the system.

I am sorry if John Sanborn had any issues on my blog, he would be the first to report it
My blog uses BlogEngine.Net and my main site is using Umbraco.

I am a huge supporting of .Net and opensource CMS.  I use varying systems depending on my need.

Daniel Bardi
www.danielbardi.com
www.dascoba.com
cmstv.net

10/25/2009 5:57:20 PM
Gravatar
Total Posts 18439

Re: Please share your opinions on this blog post

Hi Daniel,

Ok, cool, I forgive and glad to have your support. Would have been nice if your original post had the same tone like if the conclusion was "I like mojoPortal" but your negative title and negative conclusion hurts me. I've invested 5 years of effort and all my savings trying to build a great product and a great reputation. This is a labor of love for me and also I have risked everything to pursue my labor of love. It is very easy to throw around criticism and opinions and it takes a lot work to actually create something that is useful to thousands of people.

While you say "If you are a larger company that needs a CMS that is updated frequently I would not recommend mojoPortal as a solution as there are plenty of more viable open source solutions", it might interest you to know that in your own home state of Colorado, Colorado State University is one of my best customers, you can see a partial list of the sites they run using mojoPortal on our mojo Sites page.

I basically feel like you spent a few hours scratching the surface of mojoPortal, did not watch the free training videos, did not read much if any of the documentation, never asked a question in the forums and then pronounced your judgment in a blog post. I hope you will investigate it further and see how much it really offers.  Like why do you need Blog Engine .NET if Umbraco meets your web site needs? Wouldn't you rather have something really integrated?

Joe

10/25/2009 6:35:00 PM
Gravatar
Total Posts 4

Re: Please share your opinions on this blog post

You are correct.  The post title is a bit mis directed.  I will do some more research and post a more indepth review.  Fair?

As far as why I use BlogEngine.Net.  It's a great .Net blogging app, just that simple.  It's extensible and easy to use.  Umbraco is a great platform for CMS based web applications (development framework), but blogengine is focused on blogging.  I enjoy both platforms.  I look at web applications as tools and I decided on using a particular tool for a particular purpose.  You should read my post on "why I use blogengine.net" for blogging.  I support several opensource applications; each one has something it does better than the others.

10/25/2009 6:47:46 PM
Gravatar
Total Posts 18439

Re: Please share your opinions on this blog post

I will definitely keep my mind open to any future posts you make, and hope you will see the value mojoPortal provides as an integrated solution with a lot of out of the box features all integrated visually and in terms of security. There are so many powerful built in features that a cursory investigation will miss like our built in widgets, our awesome image/upload/crop facilities, html slide shows built in to our main Html feature. Not to mention content templates and style templates.

Joe

11/16/2009 11:09:04 PM
Gravatar
Total Posts 5

Re: Please share your opinions on this blog post

I was glad to see this conversation between two respective experts on the two open source CMS systems I am considering for my business, and I want to take this opportunity to pose a question to BOTH of you regarding how to accomplish my goal in using an open source CMS.  You see, I am actually writing an iPhone application that manages an entity that is essentially a type of content (a "quote").  As with many iPhone applications, it is useful to have a community web site (usually built using a CMS system), to perform some small percentage of tasks and allow those that don't have iPhones to have a way to view your content (in this case, quotes are sent to other people with little notes attached that the user provides).  To implement this, I need the following:

  • To extend the content type "namespace" and use custom tables and my OWN schema for saving the data.  This seems to be more easily accomplished with Umbraco.
  • To extend the way the content is displayed in a way that can be partially controlled by site installed templates.  While the display can be more easily customized with Umbraco, it seems that mojoPortal might win on this one, since there is an easy way to control the entire look and feel of a site centrally without building your own structure to do so--like it seems you would have to with Umbraco.
  • Have the resulting customization tie into the user namespace and community functions that the CMS provides without marrying me to it in a way that prevents me from migrating my data services that my iPhone application will use and keep the same code base.
  • Be able to use the same security model for both web and iPhone--but have the iPhone leverage an OAuth-driven model for authentication to a REST API (implemented with WCF).  In other words, the user should use the same User ID and password in both places.
The first CMS system to make this easy to accomplish will be dominant, because people like myself want to spend MORE time dealing with my iPhone (and other mobile platforms) than with the supporting web site--which we intend to be used less and less as time goes along.
Also, it would be good to provide a way to tap into browser capability support built into ASP.NET but leveraged by NEITHER mojoPortal OR Umbraco, so a pure mobile web user interface could be provided with full support for access to all content and extensions to the content model.
Is this too much to ask for?  Any thoughts from the experts on what I am trying to accomplish? Both platforms are frustrating to me with regard to documentation of extensibility features (advanced ones like my scenario), and I don't like that Umbraco ONLY provides videos that they want to make you PAY to access.
Any advice would be appreciated.

11/17/2009 3:08:43 AM
Gravatar
Total Posts 4

Re: Please share your opinions on this blog post

Umbraco as a full open API which allows full access the the data.   You can have a look at the Umbraco API.

You can extend Umbraco to change the entire site look/feel without building a new site structure.
New site structures are usually left for localizing content; templates can be controlled via the API as well.  Umbraco's templates are simply CSS/XHTML where mojoPortal templates are somewhat confined to sections (or panes as in DNN).

Umbraco allows for customized components (including usercontrols) without the need to use the Umbraco API.  This allows the customized to NOT be married to the CMS.  You can use your own DAL within your customized components that might make some calls the the Umbraco API.

Umbraco uses standard .Net best practices with regards to security (Roles, Membership, etc.) which is not tied to the CMS.
Using varying templates (one for PC and one for iPhone) the CMS security will remain the same.

I don't know if the the preceding information helps at all, but I hope it guides in which ever direction you decided to go.

11/17/2009 3:31:10 AM
Gravatar
Total Posts 4

Re: Please share your opinions on this blog post

GQAdonis,

You should also read "A Complete Newbie's Guide To Umbraco CMS".

11/17/2009 7:16:12 AM
Gravatar
Total Posts 18439

Re: Please share your opinions on this blog post

Hi GQAdonis,

You ask a lot of detailed questions, I'd love to be able to answer them all in detail but I'm drinking from a fire hose already so briefly I will answer what I can.

It is very easy to add custom features and integrate your own tables in mojoPortal. I think with any CMS you are going to have to invest some time to understand the system in order to become really comfortable developing custom features or solutions. One of the great things about open source is that you can see the source code for existing features and find examples of almost any specific thing you need to do.

We are always working on improving the documentation. In addition to the developer docs section of the site we also have an online API reference and you can also download a .chm file with the API documentation from our download page.

We do have a rest service for authentication, but it is the one built into ASP.NET and based on the MembershipProvider, so it does not currently support oath

http://demo.mojoportal.com/Services/AuthenticationService.svc

We also support the RPX service which uses openid/oauth, I just tested and was able to login using my open id from my iphone on this site. We also degrade the editor to a text area automatically for the iphone since it does not support wysiwyg editors, so you can even answer forum posts or edit content from the iphone, though it requires knowledge of html to do extensive content editing since there is no wysiwyg.

Best,

Joe

11/17/2009 10:20:19 AM
Gravatar
Total Posts 5

Re: Please share your opinions on this blog post

Thanks so much to the both of you for the detailed and quick responses.  There was some admitted ignorance in my asking my question, because I had had very little contact with either CMS before now--I had done more with Drupal, Joomla!, and Telligent Community Server.  I eliminated Drupal and Joomla! on the basis of wanting to have a single code base based on .NET for server side functionality.  I eliminated Community Server because it was expensive and did not improve function or extensibility any better than open source solutions.

Bottom line is this is what I found since I have reviewed the materials both of you sent:

  • Both solutions offer ways to accomplish my goal quite nicely.  Setting up a development environment for Umbraco was slightly easier and natural to do, and I like the way "packages" are done so fluidly.  It reminds me of the neat fluidity of Wordpress in this regard (ability to search for and load packages from the Internet in place as an administrative function).
  • After following the instructions Joe has posted on setting up the development environment manually and watching his video going over the code, I had a much better understanding of what was going on and was able to get myself started.  I do wish there were options other than adding all those post-build steps to copy assemblies, etc., however, because my "quote engine"--the back end services infrastructure--makes use of Microsoft Enterprise Patterns for DI and has its own layered architecture, which means about 6-10 more assemblies to copy than in Joe's "WebStore", which is the example I followed.
  • As far as theming, mojoPortal seems to have a slight edge for what I am doing although, the XSLT-based model in Umbraco is VERY similar and compatible with the work I am doing on the iPhone application, where I am using XSLT, JTemplate (with JQuery), and other template methods to create HTML on the fly for use in "hybrid" views (HTML local to iPhone and used for display in WebKit while data comes from my back end services mentioned above).  There is some good potential to share XSLT templates, I believe in the future, although this will take more time than I want to spend figuring it out right now.  On this point, mojoPortal still wins for me, because I don't have to create my own theming theory or infrastructure like it seems I have to in Umbraco (unless someone can point me to how I can do it easily without giving my graphic design partner--who knows HTML and typical models for theming like Wordpress and ASP.NET--a heart attack and making HIS job tougher).
  • Authentication with the model I am looking for can be implemented either place, but I, at this point, think my intended model for providing applications (iPhone, BlackBerry, and other web based integrations to other sites and widget frameworks) might be more quickly done with mojoPortal by a very slight margin.
  • Administration facilities are prettier, cooler, and a bit more functional and extensible--in my quick analysis--with Umbraco.  Like I said, I love the packaging, but I also feel this could be accomplished with mojoPortal by extending it a bit to process zipped files of resources with a manifest XML file somewhere in there telling mojoPortal where to find everything (like the features XML and setup and tear down components).
In the end, for my first project, I am moving forward with mojoPortal just because I understand it better at this point--it is more like what I already know with ASP.NET and other CMS'es I have worked with.  However, for my NEXT iPhone project that involves a web community in the back end, I would like to try Umbraco just because I think I can share user interface code a bit more creatively considering my "hybrid" model on the iPhone, and I might be able to support mobile devices in general more fluidly--adjusting to form factor, features in JavaScript, etc. for each individual platform without a lot of repetition in creating separate controls for each platform, etc.  Eventually, I would like to have most of my time in coding invested in the mobile platforms (iPhone, Android, Palm WebOS, BlackBerry, etc.) and NOT on building the web versions that must be provided for "backward compatibility" and to support lower level devices.
Thanks for the tutorials and pointers, guys!  You both are very, very good at this with each platform, and I as I learn more, I hope to participate in future development on potentially BOTH projects, adding some of the mobile-friendly capabilities, etc. that I am looking for in a "partner" CMS package.  No matter what, a web site is always needed in addition to a native mobile application that provides community style features.
If either of you has any additional pointers that might make things easier, please let me know.  I will follow both projects and blog about this process on my personal blog.  I have at least 3 mobile projects planned that require community features and connectivity, and I hope to narrow the field on this to a single platform.
Finally, any words of wisdom or comparison with regard to the "cloud" capabilities of each product?  When all is said and done, at least my back end database will be in the Amazon cloud (MySQL), although I am also evaluating SQL Azure and the Azure platform for this (I noticed that  mojoPortal already has code for this type of thing, although it is for SQL Azure, which has not been released and has its problems with database size and SQL transactions features from my understanding).  Eventually, it would be nice to have the web site in the cloud as well--along with my REST services infrastructure.  What is planned for the future of both products in this regard?
Thanks again, and sorry for the lengthy messages!

11/17/2009 11:10:17 AM
Gravatar
Total Posts 18439

Re: Please share your opinions on this blog post

Hi GQAdonis,

I have it on my Road Map to implement Web Farm support including Azure support as an add on product. Most of the issues to resolve to run on Azure have to do with eliminating all use of the file system as discussed on this thread.

However, not all cloud infrastructures require not using the file system, as I have been told the mojoPortal can run in the Rackspace Cloud, and I will be installing it myself for one of my customers in the Rackspace cloud in the next few days.

I will tell you why mojoPortal does not have a feature like DNN or Umbraco to install features via the web. Like DNN allows you to upload a .zip and it extracts it an install the dlls and Umbraco goes and gets a package from the internet and installs the dlls in the /bin folder.

To me this is not a good idea from a security perspective. The entire web site must be writable by the web process to support this. I do not want my web process running with permission to write to the/bin folder nor change the Web.config file, nor upload files to any folder that is marked to allow execution. To me it seems particularly risky for the web code to be able to download more code over the internet and install it. It seems to me that some DNS spoofing could be used to manage to install malicious code, so there is a potential for remote code execution.  It is not that I couldn't build a feature to install features, it is that I think features should be installed via a more privileged  ftp user just like the initial installation. There is always a trade-off between convenience and security and I tend to land on the security side. In general I  don't like to see a web app that requires the web process to have full control over the whole web file system. Probably there are ways to mitigate some of those risks like a private/public key pair could be used to verify the server where the download comes from but it is more secure not doing these things.

mojoPortal limits the need for write permissions to only the /Data folder and App_Data folder and scripting/execute permissions can be removed from those folders to harden security further.

I do have plans to make it possible to upload skins as a .zip and also to be able to create/edit skins right in the browser, but this doesn't involve any executable code and skins like every other user uploaded file live beneath the /Data folder.

Best,

Joe

11/17/2009 11:59:50 AM
Gravatar
Total Posts 5

Re: Please share your opinions on this blog post

Thanks again for the quick response!  I do have a question with regard to your statement about not supporting an installable packaging model due to security concerns:

The beauty of ASP.NET and the Application Pool model is that you have so many options for determining how the logged in user can or cannot write to the file system.  It is possible to support dynamically installable features through the configuration of the site, and you can make this "hard" to do, so the installers are forced to have specific privileges.  This would seem to allow the best of both worlds.

I am very interested in what happens with your cloud install on Rackspace, and I read your forum posting on the things that need to be done in order for you to support Azure.  It seems that solutions to those can be found by the time that Azure itself has its model worked out.

 

Another idea:  would you consider providing REST-based access to each and every feature in a manner that makes it automatic for third party developers to tap into (as a matter of definitions of entities and workflow via attributes, metadata, or configuration without extra coding)?  The reason I ask is that such access (e.g., being able to read/write the blog, forums, threads, or any other "content" based entity equally from REST or web interface) would make integration with other systems and native mobile development automatic.  If there is one thing I would perhaps consider doing as a contribution to the mojoPortal community, that would be the thing.

 

Finally I really appreciate your approach to building your software as a "labor of love."  This approach to your work will continue to result in spectacular results, and I wish more software providers/developers adopted this point of view.  It makes this a fun job.

11/17/2009 1:24:16 PM
Gravatar
Total Posts 18439

Re: Please share your opinions on this blog post

Hi,

I'm not really following you on the installation question. File system permissions are set on the file system, the identity of the application pool is the user who must have file system permissions for reading and writing to the file system. Yes you could limit use of some installer functionality to a site user in the admins role, but the web process does not run as the site user and does not execute with permissions based on the site user unless you are using impersonation and this only works with windows authentication which does not work on the internet. So the web process is going to run with the same permissions no matter who is signed in or even if the request is anonymous. So the only protection you have is in the application code where you can limit what a user can do. But you get additional protection from the file system by not making it writable, then even if someone finds a way around or a way to exploit your application code, they cannot install unwanted code. Anyone who can manage to bypass you or exploit your app logic and install executable code essentially now owns your app/site. It is basic security strategy to reduce attack surface, making the whole web file system writable opens up a much larger attack surface.

My opinion is that giving write permission on the whole file system to the web process user is a bad idea. I design my add on features to be installed by ftp by constructing the package such that uploading the files in the root of the package to the root of the web site makes everything land in the right place. It is very easy to install but it requires using ftp.

If someone wanted to make a feature for mojoPortal that could be used to install other features it certainly would be straightforward to implement and could be used if the whole web file system is configured as writable but it is not something I really want to bake in as a requirement for the whole file system to be writable or encourage as a best practice.

Other strategies that occur to me would be implementing an install arrangement where the user uploads a .zip to a writable folder under /Data, and a more privileged Windows Service comes along and does the installation, but this would only be possible in dedicated server environments where you could install the windows service. At the end of the day I really don't think it is so difficult to just install with ftp.

I am very interested in having a REST API wrapping most functionality. If you would like to help with that, it would be great as I have a lot of other things much higher on the priority list and my current plan is just to implement REST methods on a case by case basis as I find need for them. So if you have an interest in working on a more comprehensive REST API, I would welcome your help on that.

Best,

Joe

11/17/2009 2:18:11 PM
Gravatar
Total Posts 5

Re: Please share your opinions on this blog post

Hey, Joe!  Thanks for your reply once again.  I am probably thinking too hard about how to engineer a solution that provides that "downloadable install" kind of convenience just because it looks so cool and seems so convenient despite the risks.

 

As for the REST API work, I would love to participate in providing that feature, as I will be doing it anyway as part of my current iPhone project.  As I complete my work on this for the first site, I will communicate with you about how it goes and send a proposed design that would work for the larger set of functions on the site.  Take a look at http://blogs.msdn.com/vbertocci/archive/2008/03/10/wcf-rest-at-mix08-the-tale-of-myspace-apis.aspx for my thinking regarding adding REST support to a community site.  MySpace uses this method with WCF to provide basic and OAuth support for authentication. 

11/17/2009 2:40:42 PM
Gravatar
Total Posts 18439

Re: Please share your opinions on this blog post

Sounds great! You can reach me directly at joe dot audette at g mail dotcom.

Quite  a while back I stubbed out a project using the WCF REST Starter Kit as you'll see in the source code mojoPortal.Web.Rest. However I never got back to working on it and I think there is a newer better version of the REST Starter kit since then. We can completely ditch what I have there now and start from scratch. I'm completely open to ideas about how it should be organized.

Best,

Joe

11/17/2009 3:04:38 PM
Gravatar
Total Posts 5

Re: Please share your opinions on this blog post

Thanks, Joe!  I have already started my own process for this, and I will send you an email, so we can sync up.  I am very excited to work on this!

11/30/2009 3:52:48 AM
Gravatar
Total Posts 31
There are 10 kinds of people in the world, those who know binary, and those who don't

Re: Please share your opinions on this blog post

It seems Daniel Bardi did not really do his research well. The first "con" in the review is that MojoPortal only has three content panels, but in fact anyone can find this page easily in the skin design page: http://www.mojoportal.com/morethan3contentpanels.aspx If the first con is plain wrong, I would hesitate to rely on the rest of it to make any meaningful decision. Note that I am not trying to defend either system but my opinion on the blog post post is that it is just a piece of subjective opinions.
11/30/2009 7:22:22 AM
Gravatar
Total Posts 192

Re: Please share your opinions on this blog post

umbraco? can something that can only be installed to the root and can't be installed to a sub-folder or a virtual directory be called a good system? this this was enough for me to forget umbraco for ever.

how is it compared to the commitment of joe to the project to keep everything perfect?

You must sign in to post in the forums. This thread is closed to new posts.