Login

Register

Member List

RSS Feed

Amanda | Contact

Auguste | Contact

Jesse | Contact

Pam | Contact

Next entry: Pandas last stand Previous entry: The Peter’s ‘Ten Reasons to Support Americans For Truth in 2009’

Soapblox—and the larger issue of long-term survival of online progressive content

(Pandagon is on the ExpressionEngine CMS platform, btw, in case anyone was wondering…)

NOTE: I was interviewed about the Soapblox hack a couple of days ago by Jeffrey Toobin of The New Yorker for the January 19th Talk of the Town column, It hits newsstands Monday. You can read it here.

In the days since the hacking of the blogging platform Soapblox’s server on which Pam’s House Blend, OpenLeft and many state blogs reside (my reporting here), there have been a lot of discussions around the blogosphere about the fate of the content management software and its hosting service (Soapblox provided both).

One development has been the launch of a “Save Soapblox” fundraising campaign on Friday by Chris Bowers of OpenLeft (administered through BlogPAC). BlogPAC was alreadly deeply involved with Soapblox, paying the service fees for most of the state blogs on the platform each year, so that existing relationship was in place. Donating to “the cause,” as defined in the DKos diary, is to deal with the short-term issue of migrating the data and making it secure.

—Recharge ten servers
—Perform a full security audit of the SoapBlox server/unix infrastructure to prevent hackers from gaining access
—Ensure all backup processes are working and functional to guarantee that if hacking happens, data is preserved
—Perform a security audit on the SoapBlox code itself so that hackers cannot exploit the SoapBlox code itself.
—Migrate to new, secure servers

The good news is that, in addition to restoring full service for Soapblox, Paul has already found a system administrator who lives in his area and is able to help. All of the work listed above is currently underway. Here is what it will cost:

—Recharging ten servers at $100 apiece: $1,000
—Purchasing new, secure severs, and migrating the data: $8,000
—One month of full-time work at $50 / hour in order to complete all of the tasks listed above: $8,400

A big caveat here—nothing about the above is a long-term solution for a to-date closed-source, run-on-a-shoestring by one person effort, and they know it. Evolving a business based on the programming savvy (and the health and well-being) of Soapblox owner Paul Preston is not a business plan, particularly in crisis management mode, and without transparency.

The question needs to be asked—what is in the best long-term interest of supporting the progressive blogosphere? More below the fold, and it’s about more than just one content management system and hosting service.


Complicating the matter is that right now, there is not a turnkey alternative available to bloggers on the Soapblox platform that will provide the same functionality as the open-source, Scoop-based Daily Kos. If it did, we’d all already be there. Drupal, for instance, is open source and can provide the same feature set, but it involves programming expertise, time or money to develop and maintain the back end, something most bloggers on Soapblox don’t have. Same thing with Scoop.

As I said above the fold, the fact of the matter is that most of the blogs affected by the SB takedown don’t have the technical skills or time to easily migrate their content to another platform—they want to be free to produce the content that resulted in the progressive online political revolution. Paul Preston and Soapblox provided this on a shoestring and herculean personal commitment. Now that a good chunk of the progressive blogosphere is on the platform and politically institutionalized, the sad story of last week is that its existence is tethered by a thread to weak technical and support infrastructure—an easy point of failure.

Interestingly, a MyDD diary by Drupal consultant Shai Sachs (and thus a competitor with Soapblox), “SoapBlox meltdown and Drupal,” makes some observations that are relevant to consider in terms of a long-term future of stability, even if there’s a vested interest in Drupal:

Soapblox is a reasonably good technological platform, but I think the key to its success, until this week, was its low barrier to entry.  For a low monthly fee and with very little technological expertise, a blogger could launch a full-featured blog that was felt, to readers, a lot like DailyKos.  In contrast, Drupal and multi-user Wordpress would require an awful lot of tinkering and monkey-wrenching in order to simulate the Dailykos experience.

With Soapblox hanging by a thread, it’s important to develop a new and stronger alternative to the old system.  There’s very little question, in my mind, that the best foundation for this kind of hosted blogging system will be Drupal, for a wide variety of reasons.  First, Drupal’s out-of-the-box features include user-specific diaries, moderated comments, and the capability to front-page a diary - those are all key features of Soapblox.  What Drupal lacks is the ease-of-use of Soapblox, but as OnSugar demonstrated late last year, it’s entirely possible to run a hosted, easy-to-use blogging platform on Drupal.  Second, Drupal is one of the most popular content management systems in the world, which means it has an enormous user, developer, and support community; there is no single point of failure in the Drupal community, meaning that a near-meltdown like Soapblox’s is nearly unthinkable.   Finally, there is already a considerable degree of cooperation between the Drupal and progressive communities.  Many local Dean organizing groups, and later DFA chapters, developed websites based in Drupal, thanks largely to the release of a Drupal distribution called Deanspace, (which later changed its name to Civic Space Labs).  Today, there are a variety of progressive Drupal development firms, including Development Seed, Chapter Three, Prometheus Labor, ZivTech, and my own company, Lightbulb First Consulting, LLC.  Drupal is a community which is strongly based in a number of open source values, including meritocracy, transparency and accountability - the same values that drive the progressive blogosphere.

...Primarily, I think it is the responsibility of the progressive Drupal community (which I count myself a part of), to answer this call-to-arms.  We must develop a stronger, better alternative to the Soapblox platform, and we must properly productize and market that solution in order to make it palatable to progressive bloggers.  These are busy days for me, and it’s not entirely clear that I’ll have time to develop such a product on my own, or to organize a larger effort.  But I think we need to get the ball rolling very soon, because the days when it made sense to run the progressive blogosphere on a shoestring are long gone.

And that last comment is quite apt because you get what you pay for. Poor Paul Preston had to deal with deadbeat customers who wouldn’t even pony up their cheep $15/month. That doesn’t exactly inspire one to believe in a sustainable operation.

Conversely, if Soapblox blogs migrated to a platform that required each blogger to foot the bill for redesign, programming and adequate hosting, would readers pony up and pay an annual subscription fee (like a magazine) to support the costs of keeping those blogs running? I don’t know, but I do know that it would be tough for a good number of small state blogs to pull in the funds to afford an adequate transition and hosting in perpetuity to ensure the content’s survival. That’s the wake up call for all corners of lefty blogtopia.

While I admire the effort by BlogPAC to raise funds for the short term issues (clearly the Blend benefits from addressing the acute problem), that’s not evidence of a sustainable business plan—and we’ve yet to see what that will look like.  BlogPAC is now in the precarious position by default of being responsible for the security and existence of the Soapblox blogs by asking people to endorse and support Soapblox’s (uncharted) future. Even as an affected blog (and the person who first publicly alerted Soapblox customers about the hack), I haven’t been privy to any specific discussions about long-term plans, so your guess is as good as mine on what’s going on in back-channel discussions.

There’s been plenty of speculation about what will be done about the matter at PHB.  It’s odd that I’ve seen reports that I’ve 1) decided to stay, 2) decided to leave, 3) remain undecided. Clearly people see what they want to see; I did have a thread asking readers their opinion about where the Blend should go from here, but I’ve not stated what I plan to do.

And the kind of public mulling I’m doing here (since I believe in transparency about the PHB community to you, the readers) is going on between Soapbloxers bloggers in private—I’ve been in contact with some of them. Most 1) want to see Soapblox survive and thrive; and 2) are making their own contingency plans to abandon ship if the ship’s leaks aren’t repaired and there’s not a sustainable plan forthcoming. I can’t blame them - they’d be serving their readers poorly if they didn’t. It’s not a trust issue (but given some of the comments on the initial Kos thread about the panic, that sentiment was out there) or a lack of commitment to progressive solidarity, it’s a simple survival instinct based on prudent business decision-making.

There’s no point slagging Soapblox, the bloggers on the platform or anyone else—we’re at this point and need viable options for those who want to provide an online political base for progressive thought in a community based format that enables talented voices to stay in the game without huge overhead or fear that their contributions to the political discourse are at risk of being lost forever. Unlike a book, where there are many copies in libraries as a “backup”, blog content is not guaranteed to survive 100% intact as it was the day it was first published. Look at Archive.org’s Wayback Machine for the Blend. Not comprehensive by any stretch of the imagination.

An example—the first iteration of the Blend was on Blogger, with my files not hosted at Google (the current owner of Blogger), but on my ISP’s server. So if I kick off, my ISP bills will stop being paid, and eventually access will terminate, leaving some cached material in “The Google” cache, but some original content will be gone forever unless it’s preserved offline to be ported elsewhere by someone I name in my will.  At least I have backups of my entire Blogger archive; those who host their content on Blogger’s servers, I have no idea what access they have to download their content wholesale. Not exactly permanent.

Now I’m on Soapblox, a closed system, and I’ve obtained the db, but it’s the same thing. Anywhere the content is hosted, its existence and access to it in the future completely intact depends on a bill being paid in perpetuity by someone. That’s food for thought.

Many readers take these things for granted - the content is you read today is available for nothing but a click of a mouse. Today. Tomorrow is another story.

------

Registration is now required! We're still in the process of getting it all squared away, so for the moment don't forget to Login or Register using the links in the upper left menu before starting to write your comment.

Posted by Pam Spaulding on 09:01 PM • (14) Comments

Pam, I made my points in the earlier thread on the topic, so I’ll just pull some quotes from your post to expand on them from both a professional project management/management consulting POV as well as a liberal one.

Donating to “the cause”

Closed source software development and Web hosting are not “causes” first and foremost—they’re businesses, and separate ones at that.

nothing about the above is a long-term solution for a to-date closed-source, run-on-a-shoestring by one person effort, and they know it

If you want to bring politics into it, that bolded part should be the end of the argument for a reality-based liberal or progressive. Operating on magical thinking is a conservative thing.

And if you think that technical failures are the only way resting everything on a one-man-show closed-source developer/host can destroy a liberal blog, I would refer you to the sad story of the demise of Netslaves.

Drupal, for instance, is open source and can provide the same feature set, but it involves programming expertise, time or money to develop and maintain the back end, something most bloggers on Soapblox don’t have. Same thing with Scoop.

Very true. When it comes to technology, easy solutions seldom exist for complex problems (elegant != easy). Again, who’s more likely to choose the “easy” solution to a difficult problem: a liberal or conservative?

they want to be free to produce the content that resulted in the progressive online political revolution

Then produce the bloody content. Write, record, photograph, sketch, whatever. Ultimately, the content has little to do with the best platform with which to present it. That’s a separate choice.

And choosing means deciding what you can and can’t live without—for example, if you want simplicity, you might have to give up diaries. Think TANSTAAFL, think trade-offs, think productive compromise, think your blog. There’s no one-size-fits-all solution here, but in the age of mash-ups and syndication and open standards there’s no reason that you can’t tie together this coalition.

Shai Sachs (and thus a competitor with Soapblox), ”SoapBlox meltdown and Drupal,” makes some observations that are relevant to consider in terms of a long-term future of stability, even if there’s a vested interest in Drupal

Shai Sachs may be talking about Drupal in his excellent post, but his comments also apply to Wordpress, to Moveable Type, to Joomla and, to a lesser extent, to Scoop. OSS dovetails with the goals of liberal/progressive bloggers, not only in its underlying philosophy but also in its results. That’s not to say the people involved wear sackcloth and ashes—to the contrary, they’ve discovered that being involved in OSS can allow one to do well and do good at the same time.

you get what you pay for. Poor Paul Preston had to deal with deadbeat customers who wouldn’t even pony up their cheep $15/month. That doesn’t exactly inspire one to believe in a sustainable operation.

It’s more than simply getting what you pay for: it’s how you apply those funds. Did that $15/month cover hosting? Bandwidth? Soapblox development? All of the above? Even if it’s just one of those, it seems like “poor Paul Preston” was in way over his head serving the customer base described in several hands-on roles.

Hosting and bandwidth cost money, but they would whether you were using Soapblox or Drupal or Scoop. Software development costs time and/or money, but with OSS development the costs can be spread out.

Start by breaking down the problem and idenitfying strengths and weaknesses of all the players, including Mr. Preston, who I’m sure is both hard-working and a talented coder.

Comment #1: Gracchus  on  01/11  at  10:29 PM

Conversely, if Soapblox blogs migrated to a platform that required each blogger to foot the bill for redesign, programming and adequate hosting, would readers pony up and pay an annual subscription fee (like a magazine) to support the costs of keeping those blogs running?

First, if you “stay the course” with the current Soapblox arrangement, it’s not a matter of “if” but when you’ll be migrating and re-designing and finding a new host.

Second, I’ve found in my own consulting for non-profit orgs that if you’re offering transparency as well as good product/service/content, people will donate. Transparency forces you to be accountable, to show you’re cutting costs without cutting corners. And those are some other things that liberals are supposed to be about.

Even as an affected blog (and the person who first publicly alerted Soapblox customers about the hack), I haven’t been privy to any specific discussions about long-term plans, so your guess is as good as mine on what’s going on in back-channel discussions.

That should be a big clue to the priorities of the Soapblox enterprise. This is a specialty platform for a relatively small group of client stakeholders, and the developer/owner is not soliciting your input after a catastrophic failure? To be brutally honest, I’d have been planning my exit days ago.

It’s not a trust issue (but given some of the comments on the initial Kos thread about the panic, that sentiment was out there) or a lack of commitment to progressive solidarity, it’s a simple survival instinct based on prudent business decision-making.

Bingo. This isn’t personal, it’s business—your business, your brand. And if uou want to incorporate liberal core values into your decision, that’s great—acknowledging hard realities, avoiding seemingly easy choices, engaging in long-term and systematic thinking, promoting transparency and free exchange of information, and teamwork/collaborative efforts by talented individuals are all aspects of real liberalism.

Comment #2: Gracchus  on  01/11  at  10:30 PM

This isn’t just a question, of course, for all the people who currently have blogs (or diaries—how does that work in terms of migration and ownership), but for all the people who may be do so in the future. Is there a reason that Soapblox is closed source other than there’s only one person doing it and he’s not releasing the code?

Comment #3: paul  on  01/12  at  12:03 AM

what is in the best long-term interest of supporting the progressive blogosphere?

This is the sort of thing that Steve Gilliard meant when he talked about the structural weaknesses of funding on the left. He generally discussed it in terms of resources for writers and campaigners—a laptop here, an ISP bill there—but it also covers things like hosting. No PJM venture crapital fund here to send SammyJoe The NonPlumber on assignment.

Comment #4: pseudonymous in nc  on  01/12  at  01:22 AM

I can offer a bit of advice here.  I build content management systems professionally, and have in the past played a part in the foss movement.

I think the question is finding a cms that lends itself to change and reflects the character of the progressive community in a practical way.

I think a free and open source piece of software is essential.  Being able to separate what you use from who you host with is essential for controlling both security and cost.  It also means a lower barrier of entry for smaller blogs that desire the same advanced features as larger ones.

Perhaps one option would be to issue a call for a new cms in a sprint like format.  Tech-minded people in the DC area have converged to launch a web 2.0 startup in a weekend, for example.  Why not a “build a new cms for the progressive blogging community sprint”?

If such an effort were organized and launched, I’d recommend building on something other than php such as django (python).

Comment #5: Dan (Fitness)  on  01/12  at  04:18 AM

What I don’t really get is: why we go to all the trouble of reinventing the wheel?  There are commercial, off the shelf solutions to this.  Typepad being the first one that comes to mind for me.  I use Movable Type for my blog, but that’s because I’m a geek who’s willing to put the time in to set it up.  Typepad is $15/month and they give you pretty much everything you need to setup and run a professional looking blog.  Why not just use that?

Comment #6: Jonah Horowitz  on  01/12  at  04:43 AM

I build, code, and run such servers for a living….
I’m really wondering what the deal is with needing to buy *new* “secure” servers. The security of a server depends on the software and how it’s run, not on the hardware.

As for the software, if you go with a major open source solution you benefit from the network effects of many people working on it. Closed code by one person has no future.

Therefore, it seems to be that any efforts to “save” Soapblox are just throwing good money after bad, and Soapblox users should find a different solution.

Comment #7: Rob Funk  on  01/12  at  04:48 AM

Typepad is $15/month and they give you pretty much everything you need to setup and run a professional looking blog.  Why not just use that?

Moveable Type and Typepad don’t support user diaries (like DKos or Soapblox). That’s the one thing PHB and most of the state blogs desire most.

Comment #8: Pam Spaulding  on  01/12  at  08:42 AM

Oh, I also don’t get this “recharge ten servers” business, unless it’s just another word for the other items on the list (audit and so on). They shouldn’t be running on batteries after all! It all just smells of a a scam to me.

Comment #9: Rob Funk  on  01/12  at  11:04 AM

Moveable Type and Typepad don’t support user diaries (like DKos or Soapblox). That’s the one thing PHB and most of the state blogs desire most.

Great, you’ve identified a must-have feature. So MT and WP are out, Drupal and Scoop and Soapblox are still in. Other must-haves?

By the way, if OSS turns out to be one of those factors, maybe Paul Preston could open up Soapblox’s code. Such things have been known to happen, especially in cases like this.

I’m really wondering what the deal is with needing to buy *new* “secure” servers. The security of a server depends on the software and how it’s run, not on the hardware.

It’s another illustration of the core mental hurdle at work among Soapblox’s clients: all factors—bandwidth, hosting, hardware, OS, sysadmin, CMS development and maintenance, even content—are being lumped into one block, mainly because that’s how this group of bloggers has been operating with the Soapblox developer all along.

BTW, I get the sense that Pam understands all this stuff I’ve been ranting about, and that her bigger challenge is explaining it to her fellow bloggers who are making their decisions first and foremost on the basis of politics and ideology.

Comment #10: Gracchus  on  01/12  at  11:18 AM

The security of a server depends on the software and how it’s run, not on the hardware.

I’m a systems engineer with a background in security and this is absolutely true. Unix, which is open source, is notoriously bad from a security perspective, because the vast majority of servers have their security defined by the engineers, who tend towards very lax security standards because its complex and difficult to properly secure a Unix operating system and file system. What’s needed is good security software in place on top of the OS *and* a dedicated security expert to administer the security in an ongoing fashion. If a new file system is created, it needs to be secured. It can be very labor intensive to keep up with a “moving target” but some standards can be created that can make it a bit easier. Hacking a unix box is pretty easy, because somewhere along the line you’ll find a way in that has been left improperly secured…what’s known as 777 has been used.

I think whats happening is the wider net world is now catching up to where we in the financial services world have been headed for close to ten years in understanding how important it is to secure data. I see this as a good thing, but that’s probably because I came into IT in the security arena originally. I get accused by my coworkers on a regular basis of not having purged the security mindset when I moved into engineering, and thats true. Security matters.

Comment #11: broce  on  01/12  at  12:20 PM

I think what bothers me most is the lack of released forensic or even generalized information about how the intrusion occurred.  That’s an important element in the FOSS paradigm - exploits and failures are criticized in a public forum.  Was it as simple as a UNIX directory or file with universal read/write privileges or was it a buffer overflow attack?  Is it something solely within SaopBlox or was it an exploit on the joint shared 3rd party base code of several blogs?

Comment #12: idiosynchronic  on  01/12  at  01:11 PM

I dunno. I just read the guy’s “press release” on the SoapBlox website, and…I don’t want to tell anyone their business, but I do sysadmin work for a living, and if I had a blog on that platform I’d have started moving it somewhere else last week. To me that “release” just smacks of “I don’t want to admit how bad it was”, and that’s coming from someone who’s been there. (And admitted how bad it was. What else can you do? Lie to paying customers?)

Comment #13: Aaron  on  01/12  at  02:24 PM

Broce, I agree with much of what you say, but I wouldn’t blame Unix for errors by the some of the people who run it. The equivalent of “chmod 777” can be done on any general-purpose OS. Unix can be quite secure or quite insecure, depending on who’s running it—and on the flavor (see OpenBSD, or better, Trusted Solaris or SELinux, where your chmod 777 can be perfectely safe).

Comment #14: Rob Funk  on  01/12  at  08:54 PM
Page 1 of 1 pages
Commenting is not available in this channel entry.