Érico Andrei: PyTour 2024

There were five Python conferences in Brazil this year. Six with this one. If you visited all of them, that is more than 12 thousand kilometers. Two heroines visited them all!

Alexander Loechel: Secure your keys

You should only use key-based authentication for accessing servers via ssh. Use ssh-fido or ssh-resident keys. Don't store them on your machines. Get hardware keys. You can check with a command if your server supports these keys.

Alin Voinea: EEA and Plone

The EEA, European Environment Agency, is using Plone since at least 2006. In 2019 we jumped into Volto, Plone 6 in 2023, this year Volto 17.

We have 74 PyPI add-ons and 119 NPM add-ons, around 400 Docker images and 900 repositories on GitHub.

EEA has a design system, see https://eea.github.io/volto-eea-design-system/. That makes them not always work with the Volto Light Theme, but talk with us and we can look.

We use generative AI with Volto-chatbot to generate answers from all our Plone sites.

Kim: Plone user guide

Plone's user guide was written for Plone Classic. We wanted an updated version for the training: https://plone.org/userguide 

This was done with https://scribehow.com/, a paid service. Can export to PDF, html.

Breno Brito: Speed run coding with AI

Demo. Prompt: make a beautiful to do app with Python and Flask.

Belisa: Eu te amo, pandas

I love you, pandas. I am working with some Brazilian data in an Excel file with 188 thousand rows. I import them using pandas and polars and compare how they do. With polars it takes 12 seconds to import. With pandas... still busy, so let's sing some karaoke. So I love you, pandas, but...

Mikel Larreategi: Translations

Plone translations are in the plone.app.locales package: https://github.com/collective/plone.app.locales/

Most translations in Volto also come from this package. Some specific translations are in Volto itself.

In the readme of plone.app.locales you can see a graph that shows how much in your language is translated. You can clone the repo and edit, or use online Weblate: https://hosted.weblate.org/projects/plone/

The documentation is here: https://6.docs.plone.org/i18n-l10n/contributing-translations.html

Link to talk information on Plone conference website.

Volto is already almost ten years old. Things are moving in the frontend world.

We had a client request for something specific for tourists, with native look and feel, PWA support, multilingual, good performance and UX, accessible. Of course limited budget. It did not really need dynamic routes or the whole that Plone has to offer. But they did like to use Plone for this. But did not really look like a Volto project.

Bring your own frontend. There is Vite, but we already knew NextJS and had only short time so we went with it.

I felt it was faster for us to really start from scratch with a new layout, for this project. We used framer-motion for animated route changes. And used @plone/client, @plone/providers, @plone/components, Tailwind CSS, TypeScript.

react-aria actively helps you with accessibility, it logs warnings.

After a while they wanted dynamic routes anyway, so being able to create pages in a section of the site and they could get dynamically loaded, next to the static routes. Sure. We used @plone/registry.

What if... we would show the whole site? With the dynamic routes we were almost there anyway, we could show pages with blocks just fine.

Promise: we can run Plone in Next.JS. I am working on a template for that. Features/plan: config registry and add-ons, blocks, slots, fully dynamic routes, dynamic theme. Ideas and feedback are welcome here: https://github.com/plone/volto/pull/6442.

Link to talk information on Plone conference website.

If your website is slow or is down, you lose money. How do you solve this. Some say: throw servers/money at the problem. Yes, this can work in the short term, but mo' money, mo' servers, mo' problems.

Optimize: make it faster: your Python, javascript, css, html. At some point you hit a limit.

Use caching. That is what we will talk about. Basic idea: why would you recompute if the data has not changed.

I am tech evangelist at Varnish software. I have a colleague here at the conference who speaks Portuguese, and a German colleague who speaks Spanish. So talk to them as well if you want.

New book by me: Varnish 6 by example.

The visitor of your site first gets sent to Varnish, and this either sends the request on to Plone, or serves a previous answer from its cache. That is basically how it works.

Everything that is static is easy to cache. We listen to any cache headers that are available in the request, or set by Plone in the response.

But by default, if the request has a cookie, we do not cache. But these days every website uses cookies! So we just have to deal with them properly.

You do this using the VCL language. This is a domain-specific language for Varnish only. It is not a top-down language, it builds on other settings, and you can write extra routines for this.

Let's talk about caching in problem. Disclaimer: I am not a Plone expert.

I have setup a Plone backend and Volto frontend locally with varnish, in Docker containers.

In the cache settings:

• I see good things in here, you can enable caching.
• Very good: you can set a url for purge requests.
• A bit strange: you need to select which content types should be purged, I selected them all.
• For various sorts of contents and files you can choose strong caching, moderate, weak or terse, which sets all kinds of cache headers, even some e-tags, which is cool.

E-tags are sent on again by the browser if it requests this again. Plone then checks this e-tag and if nothing has changed, it sends back a 304 Not Modified response.

What if we could store the e-tag somewhere, then you could return very fast maybe even without contacting the framework. Maybe this happens already.

Some of the rules use a Vary header, but I wonder if the Accept header is the best here. Also, watch out for filling the cache when an attacker makes request after request with a different Accept header. In Varnish we have an `accept` module that can help here.

Cache purging: on a PURGE request we clear the cache for a url. You allow this from a white list of IP addresses. Plone purges a lot of paths, but maybe not enough. I think the `/Plone` is missing from some urls. And some urls with query parameters are not purged.

I have written a VCL for this, but not sure if that is the way to go. What about tag-based cache invalidation instead? You can do that in the VCL with `add_key`. You can also strip off query parameters.

Also, you can mark things as required, instead of actively purging it. Note that you can also serve stale content while Varnish gets a fresh answer from Plone.

Can we set the stale-while-revalidate keyword in Plone, for the Cache-Control header? That could help.

Question: should you use the varnish load balancer or a specialised load balancer like haproxy? Answer: I am biased of course, but if you are already using Varnish, just use that. We have some advanced options.

Plone is already very advanced here in how it does caching. But look at the Vary Accept header, and at tag-based caching.

Link to talk information on Plone conference website.

The worldwide Crowdstrike outage on Windows computers this year: crazy how such a thing can happen. I have better quality control than that! How resilient is our tech infrastructure?

What is the point of writing code if the world is going to pieces?

A short history of the internet revolution. The Berkeley software was started in the sixties. It grew a lot, in the nineties Web 1.0 started. Metcalfe's law: the value of each new connection increases.

Mandelbrot wrote The (mis)behavior of markets. From bell curve to power law or the long tail: a few people get very rich and most people get very poor. That happens in networked connections. People are more geared towards linear connections.

Web 2.0, in the 2000s, went from a read-only web, to a read-write web.

Trump, Brexit, Covid, they all rocked the world.

"Post-truth is pre-fascism", writes Timothy Snyder in On tyranny. You should read this.

Web 3.0 is skipped and we just have AI. AI will swamp the web with nonsense, and no one can find your content anymore.

I had higher hopes, too. I did not sign up for this dystopia. I have an MBA in environmental economics, done OSS web development for decades, am on the Plone Foundation, and founder of Quaive.

I wrote a book Systems of intent: Open source (Plone) plus knowledge management = Quaive. Quaive changes the Plone UI. It shows an activity stream, documents, news, personally configurable dashboard. It enables a shift in the company from top-down to bottom-up. Technology can also cause problems. But is technology the problem? Or is capitalism the problem? Resistance is not futile.

Chaos theory, butterfly effect: small acts can have huge effects. You and I are all complex individuals, complex systems. It is a shift from a clockwork universe to an alive universe. Emergence: on a higher level something more happens than what you can imagine looking at the lower levels.

Adrienne Maree Brown: Emergent strategy. Adaptive: constant change. Move at the speed of trust.

Principles:

• Local autonomy. Have control over your technology.
• Strive for technological excellence. Our stuff needs to be good and secure.
• Networked agility: how we cooperate and coordinate effectively.
• Community sharing: celebrate that we are not alone.

The clients that use Quaive may not be interested in our GPK license, but they do care about those principles.

Asterix: the whole of France is occupied? No, one corner not. Same now: Half of Belgium (the Walloon region) uses Plone in basically all their towns, supported by IMIO. We got into an agreement when I visited personally.

Technical detail: using Docker, IMIO was able to host 8 sites on a server where we previously could only host one site.

Think global, act local. Open source is not only free as in beer, but free as in freedom. The community makes this possible: Free as in community. Public sector and open source are natural allies.

Link to talk information on Plone conference website.

I am using Plone since 2002, but am not a frontend expert. So currently I still have a bit of an outsider view on Volto, but I am working at Kitconcept now so will gain more experience.

Central thesis in this talk:

We need to rethink and upgrade or extend our content types and blocks system for Plone 7 and beyond.

For a big project at Zest we needed to migrate a website from Plone 4 to Plone 6 with Volto. I and colleague Maurits are mediocre frontenders at best, so we had help from two frontenders, though they had no experience with Plone or Volto.

We have almost all the building blocks already: distributions, the most secure CMS, the composite page editor, dexterity behaviours.

To do: generalised and connected frontend-backend configurations, devcontainers, version 3 of the block model, more documentation.

The big project: upgrade of the main website of the Flemish environmental agency, kind of the little sister of the European environmental agency. A communication agency came up with 20+ content types and a functionality geared towards Drupal. But the existing site was Plone 4. There were far too many inconsistencies in their design. Let's just start.

Old site is still online: https://www.vmm.be. The new site will go live tomorrow: https://vmm.vlaanderen.be. Not the greatest timing, but at least I have no talks tomorrow.

Versions used in this project: Plone 6.0 backend, Volto 18 alphas at first, now 18.1.1, Volto Light Theme. Still a Cookiecutter template as basis, if we would start now we would use Cookieplone.

Main assumptions in the Volto information architecture:

• Composite pages are now built-in, with blocks layout almost everywhere.
• Pages are folders.

Challenge: Where do you store images that belong to a page? If you are still adding the page, there is no place yet for storing the image. Store it in the block? No: use references. Put the images in a folder and reference it from a page.

Metadata images: we have lead images for listings and header images for the top of a page. The design should limit the aspect ratios and sizes, preferably just two are three sizes. That is more pleasing to the eyes than 10+ differently sized images on a page.

Media and data (for example graphs) belong in data content types, and their presentation should be in blocks.

One block to rule them all: we have the teaser block in core Volto now. Then we define adaptations/variations for presenting the different content types.

With Volto the editors can go wild on landing pages. Danger: they also do that in detail pages, which may not be what you want. Templates to the rescue: you can create an initialBlocks configuration. We added metadata (subtypes) with which an editor could say what kind of page it is.

"Listy" blocks: you can either use a grid block with teasers, or a listing/search block. They can look the same. But the design had lots of combinations that should be supported, and then all kinds of exceptions came up. To the rescue: default variants. The default teaser block variant can adapt itself to the listing.

Responsiveness: we sometimes have 2 blocks in a listing or grid, sometimes 3 or 4, needed to deal with that. Needed to fix some restrictions with the search facets too, needing to be able to choose different vocabularies.

We have three layers: the visual side of Volto, then information architecture concepts, then the backend. Idea: connect frontend blocks with backend instance behaviours. Then you have no explosion on content types.