This is a transctipt, for the video, see D6LTS wind down and D7 extension with Tim Lehnen.
Michael Meyers: [00:00:00] Hello, and welcome to another Tag1 Team Talk episode, the podcast and blog of Tag1 Consulting. Today we're going to be talking about how Drupal 7 end-of-life is being postponed again until at least November 2023. So stick around to learn about what that means for you and how D7 is going to continue to operate for the foreseeable future.
And while we have a lot of good news for users of Drupal 7, we also have some sad news for users of Drupal 6. Drupal 6 went end-of-life about six years ago. And today we're going to be talking about how we're going to be winding down extended support for Drupal 6 and officially ending all support for the platform.
I'm Michael Meyers. I'm the managing director of Tag1 Consulting. Those of you who aren't familiar with Tag1, we're the number two all time contributors to Drupal, and we build large-scale applications for global 500 companies and large organizations in every sector using Drupal as well as many other technologies.
We'd love to hear from you about your upcoming projects and talk about how we can help. You can [00:01:00] email us at support@tag1.com. That's tag1.com. We're also one of the official providers of Drupal 7 Extended Support, and the only remaining provider of Drupal 6 Long-term Support, which is going to be the focus of our talk.
Today, I'm joined by a very special guest. Tim Lehnen is the Chief Technology Officer at the Drupal Association. Welcome Tim. Thank you for joining us.
Tim Lehnen: Thanks for having me, really glad to be back on the podcast.
Michael Meyers: It's great to have you frequent guests. , I know it when people think about the DA and we've mentioned this a lot too often, they only think of DrupalCon and while DrupalCons are amazing and, and a really fundamental part of the Drupal Community and the DA is a big reason for why they're so awesome and amazing, DrupalCon is really only a small part of what the Drupal Association does. So Tim and his team are responsible for keeping the Drupal project up and running. You know, they do everything from. [00:02:00] Uh, maintaining and building out all of the tooling for the project, this ranges from drupal.org, the main property where people learn about and get engaged in the platform through to the massively scalable, automated quality and assurance and testing system that checks every proposed commit to Drupal amongst a myriad of different systems.
It's such an awesome thing. and you know, Tim and his team lead a lot of initiatives to keep our project and our tooling on the cutting edge. You know, things like migrating the project to GitLab. I don't know if I can talk about this, but I'm gonna mention anyway, I really exciting single sign on initiative that they have going.
And then really trying to lower the barrier to entry and get more people involved in Drupal and make it easier to get across Drupal projects and entities. So you know, Tim thank you for all your work in, in, in keeping the project running. You guys are really the unsung heroes [00:03:00] too much behind the curtain.
And, um what we're going to be talking about today is you also help establish and enforce governance and policy for the project it's, it's beyond just the conferences beyond just the technology, running a project at the scale of Drupal requires, uh a really well thought out community and governance system.
And, as part of that is how, and when we end-of-life versions of.
Tim Lehnen: Yep. Yep. Absolutely. Well, first of all, let me thank you again for welcoming back to the show and, and say for all the high praise that you've heaped on my team, which I really appreciate it. They do amazing work. We couldn't do it without the partners who support the Drupal Association, right?
We're a nonprofit foundation. It requires the help of a whole community of individual members and businesses who step up to support our work, and Tag1 of course has been a huge partner for us and continues to be a huge partner, not [00:04:00] only through your participation and things like the extended support and longterm support programs, but also with projects that the Drupal Association is undertaking and helping with managing some of that same infrastructure we just talked about for drupal.org.
So the partnership we have with you and others in the community really multiplies what we can do, cause we're, we're a very small team, but we can have an outsized impact on a large global community. Um, and it's thanks to your support. So again, thank you very much and thanks for.
Michael Meyers: Of course. Yeah, your impact is huge.
And I'm going to plug this multiple times throughout. People are gonna start to feel like this is a PBS telethon, please. You know, if you are not an individual or enterprise supporting member of the Drupal Association and you use Drupal, you're making a big mistake and it's a disservice to you and your organization.
Uh, there are so many benefits from getting involved in engaging with the Drupal Association and making Drupal a better project. So, so please find a way to contribute that could [00:05:00] be resources. It could be financial funding, there's many of different ways and opportunities for you to get engaged and it will pay dividends.
You know, we've, we've seen nothing, but uh, amazing results out of our participation in the community. It's what drives our business. You know, people come to us because we're engaged in the community and of our reputation for contributing to dribble.
Tim Lehnen: Yeah. Yeah, that's true. That true commitment to open source really shines through in those, in those partners who do commit.
And I, I firmly believe it makes a huge difference in the, the business they can get and the, the scale and quality of the projects they do. And we see that in what you all do all the time. So awesome.
Michael Meyers: So Drupal 7 it was originally. It was going to reach end-of-life. I think it was what was like 2020?.
Tim Lehnen: And I think the original target date was going to be November, 2020. And then well, and then there was this pandemic thing that we're still living with. [00:06:00] Um, and and we had, there was an initial extension to 2021 and then another extension to 2022. And of course we're here today because there has been another PSA released by the Drupal Security Team that Drupal 7 end-of-life is being extended again by another year.
Um, and we'll get into why that is and the motivation behind the decision. Um, but we've also sort of changed the policy around these extensions. Um, the next. Yeah. The, the current extension that just went out is at least through November of 20, 23, but this time around, we're leaving the door open for possible, additional annual extensions as needed.
And, and we can start talking about why as we go.
Michael Meyers: Um, so w let's stick with that for a second. Um everywhere you see it everyone is saying until 2020, 2023 at the earliest. [00:07:00] And so what does that mean? Like are there going to be future extensions?
Tim Lehnen: Yeah so what it means is there may very well be future extensions.
What it means is we are going to, and by we, I mean myself and the Drupal Association team, the Drupal Security Team and project leadership, like Dries as well as any of the partners who might participate in the Extended Support Program like yourselves, at Tag1, are going to be regrouping to understand as we get closer to the next state Is it time to move into an end-of-life for Drupal or is the community still thriving on Drupal 7?
Right. Drupal 7's a huge part of the Drupal ecosystem. Um, and as long as it is, it keeps thriving and we're able to keep supporting it. Um, we want to keep that running and let people do what they're doing.
Michael Meyers: So 2023 at the earliest. It'll be revisited on a yearly basis moving [00:08:00] forward. And obviously organizations need to plan.
So are you going to give us a heads up in advance of any decisions?
Tim Lehnen: Yes, absolutely. So no matter what, there will be at least six months, notice of what's going to happen next. So six months before the November 23 dates, we will be saying either, Hey, there's another extension, or we're going to go into an extended support program or whatever else.
The decision is, there'll be a minimum of six months notice before that date. Um, and when we do these extensions, there'll be for at least a year. So you'll always get another 12 months back to your planning cycle, if we do announce an extension. And that's, and that's a really good situation for folks, I think because, I mean, right now, this means as of today's PSA, right?
Uh, any organizations out there who are currently on 7 and have at least 20 more months of community support. So that's, that's getting close to two years for people to sort of think about what they're doing, [00:09:00] um, and how they want to move forward. So hopefully people will find that reassuring because I know, and I know that this is something you've experienced as well.
You know, there's a lot of people out there in the community for whom what they're doing with Drupal 7 is actually it's working really well. It meets all their business needs. They don't have a sort of fundamental reason to change that technology. Um, and they want to keep doing what they're doing.
Michael Meyers: Drupal 7 is, is an amazing technology platform. And we'll talk more about motivations and reasons to migrate, but if your business, as you said, is or your organization is seeing a lot of success through your technology platform you shouldn't be forced to migrate.
And you know, one of my favorite things about Drupal is Drupal, I think puts people in control of their technology, whether that's enabling business users to uh, develop their sites through things like views and reducing their reliance on developers, [00:10:00] through to how we handle end-of-life and extended support and giving you paid options or even open source options to continue to run your technology platform well, after end-of-life and the, the.
The, the release cycles on these platforms is, is crazy law, right? Seven has been around for a really, really long time at this point, you know? So you're talking about getting 10, 12, 15 years of use out of your technology stack. Like that's, I mean, no one keeps a phone for. You know,
for a modern, nobody's still running on windows Vista or, or very few people, right?
Tim Lehnen: You don't typically keep on, keep on these sort of old versions of software. And part of it is because while we always refer to Drupal 7 with its single major version number it's been updated continuously through that whole decade, right? It's not, it's [00:11:00] not like it's really literally 12 years old, but the beginning of its story was, was that long ago.
Um, and as much as there's more innovation and new technology models and you know, more forward thinking going on in Drupal 8 and beyond and where we are now. There's still really innovative use cases that people are continuing to do in Drupal 7. So.
Michael Meyers: We we just launched a massive Drupal 7 site for a Fortune 500 company.
Um, they do a lot of Drupal 9 sites, but in this particular use case, given the components that they had, we were able to launch an insanely impressive site very, very quickly so the, the investment in it was minimal. And you know, now that Drupal 7 is going end-of-life, but it didn't really matter because one, we were the extended support providers.
Tim Lehnen: Exactly
Michael Meyers: The maintainer, like we had zero hesitation and [00:12:00] concern in our ability to continue to build out this platform.
And I hear a lot of reasons and rationale from people. And we'll talk more about this later. Like why would you oh, you need to upgrade because you're not getting access to the latest integrations and features and functionality. Uh, and, and that's true, but if you're an organization like this one or a Johnson and Johnson or, or whoever, and you have hundreds of Drupal sites and tens of millions of dollars invested in your technology stack, adding a feature to Drupal 7 is trivial.
Tim Lehnen: Compared to a full replatform and for sure. Yeah. And it's, it's one of those things. It's interesting that we talk about these users. Right. And cause that's, I mean, ultimately when it comes down to why we're making this decision and why we're making further extensions, right. We can talk a little bit about some of the metrics we're looking at.
Like we're, we're looking at things like how many users, how many Drupal 7 sites out there are still reporting updates, statistics to drupal.org. For example, it's a little bit over 50% of our total Drupal [00:13:00] community. So that's certainly a factor. Um, but the, the, the larger factor is we have these stories from different users at all levels of, of complexity, right?
So there's absolutely the sort of Fortune 500 levels. There's big pharma companies, there's universities all over the place with major Drupal 7 installations and government entities as well. But there's also the small nonprofits, the sort of the little guys for whom some of those there may be a time in which some of those like really cutting edge technology features in 8 and beyond are things that they want to get into that become an ambitious part of what they're doing.
But in the meantime, for, for a small non-profit operation they're also perfectly happy in the, in the Drupal 7 environment and may they could really use the help. So we're trying, there are things that we're going to look at this collective group as, as signals for, for, kind of the continued health and interest in Drupal 7, but it ultimately, it's gonna [00:14:00] come down to sort of empathy for the users and, and understanding their use case.
And, and who's still there. So.
Michael Meyers: These are all factors that the various stakeholders are going to have to consider in the future when this sort of renewal decision is going to happen. And I love the fact that you guys are considering all these different stakeholders and factors and making a really thoughtful decision.
And, and I think as a community, I love everybody takes off their sort of business hat and says, how do we make a decision in the best interest of Drupal? And that's what you see happening here and extending it. You know, there are people who already migrated. They're going to say, Aw, man, I wish you guys did this a year ago.
I wish I would've loved to have stayed on it. And unfortunately. You know, we can never make everybody happy. Um that's a really unfortunate situation that we're in and we're really just trying to make the [00:15:00] best decision for the community overall. And, and I think that's clearly what was done here.
Hopefully everyone in the end will benefit from it and, and see it in that same way.
Tim Lehnen: Yeah. And it's a hard problem space to, to live in. I I, for other, even for people out there listening who might be maintaining sort of the internal technology stack on their teams or a contributed module or something like that, like you have that same sort of challenge in microcosm when you're thinking about how long you're going to support something.
And when to cut a new version, whether to support legacy features and things like that. At the scale that we're at, it's very difficult and it requires sacrifices from our partners, from people who are involved in the extended support program, balancing the, the business needs versus the community needs and trying to find a way to align those two together, which I know is very difficult and it involves tricky things for us as well.
Inside on the Drupal Association side, we need to now continue to support all of the packaging, [00:16:00] infrastructure, and security testing and everything for Drupal 7 for sort of an indefinite period of time, at least through 23. Um, so it's not an easy decision and it can be a painful one and sometimes that's the way the right decision is.
Um, and, and we've just got to do it anyway.
Michael Meyers: Yeah. There are pros and cons to it. And one of the reasons that Drupal 7 and all versions of Drupal and any software for that matter reach end-of-life, is that there is a a significant cost to maintaining and running them. And the community has only and the Drupal Association only has so much bandwidth and resources.
And so while we strongly believe it is in the best interest to continue operating D7, we need to be careful that that doesn't distract us from, or prohibit us from accelerating the growth of a Drupal 9 and 10. And that's the challenge that the community now has to deal with in, in making this happen.[00:17:00]
And I think we're all hoping that the users of Drupal 7 are going to step up and, and help support the platform. Initially it was going to be through say Drupal 7, extended support. Um what was good about this is hopefully more companies are going to get engaged in the community itself.
Tim Lehnen: Yeah, I think there's, oh, sorry. I was just gonna say, I think there's opportunity here for for it, like you said, sort of further engagement and not just on the level of the companies who directly do Drupal services, but I think there's a lot of these end-user organizations out there who have stakes in, in helping to support the ongoing support of Drupal 7 for their particular use cases.
And fundamentally a project at the scale of Drupal could never be supported entirely on the shoulders of a few paid developers of a small [00:18:00] nonprofit, or even have a few sponsored developers of the community. It's open source. And the reason that open source can scale is because of these commitments.
Um, and you know, there, there's, there's a little bit of risk there. There's a little bit of understanding. Okay, well, how, how much commitment will people make? What we will see I'm encouraged by the fact that recently some Drupal 7 contributive modules were effectively unmaintained. They were they had some security issues that hadn't been resolved and they went, were flipped to an unmaintained status and we had more than two dozen organizations step up to say, "Hey, no, that's important to me. I'd like to become a maintainer or find a way to participate and give that back some support for these Drupal 7 contrib modules". And that's a really strong sign that there are people who not only are still committed to using Drupal 7, but who are still committed to supporting it.
Michael Meyers: So let's talk more about how things are going to work moving forward. [00:19:00] I think we should really eliminate a lot of the confusion because if you read the PSA or our blog posts it's like, Hey, things are, can continue to work the way they always have.
Tim Lehnen: Not very specific is it?
Michael Meyers: So, you know exactly what does that actually mean for my organization?
And, and there's a lot of different factors, there's core development, and what's going to happen in core development with respect to say, compatibility upgrades and feature upgrades and security patches, and there's contrib. So let's kind of unwind this and, and, and walk through all of these different aspects.
Uh, probably make sense to start with Drupal core development itself. Um, now Drupal 7 has been around for a decade and people are adopting 9 and 10. There has been a very natural slowdown in core development. Um, at the same time, like you said, the community is doing PHP 8 support.
I believe core is PHP 8 ready or, or very close.
Tim Lehnen: Very close, yeah.
Michael Meyers: [00:20:00] Um, and so that's really amazing to see. Um,
Tim Lehnen: I think it's, I think it's really interesting because one way to think about it is in terms of sort of a product maturity life cycle, right? So Drupal 7 is a effectively a mature product. And so what were your, what we're seeing and what we hope to continue to see is that we're not gonna, we're not gonna have the brand new breakthrough.
Highly innovative chip into your brains, CMS features or whatever like that stuff that's going to come in future the modern versions of Drupal or whatever. Right. But, but what we are going to see are exactly that we're going to see people who are interested in compatibility upgrades with the other parts of the stack, PHP 8, being the one that's in progress right now.
Um, we'll see obviously security patches and things like that, those kinds of things. Um, and we may see continued bug fixes and small feature improvements in some of these systems as core contributors or as these large end-user [00:21:00] organizations who were still using 7, need them and decide to contribute them back.
Um, but for the most part, we can sit can, can treat it as a mature product model where, um it's sort of maintenance and sustenance rather than a big innovation drive.
Michael Meyers: That makes sense. And for everybody who's, who's listening or watching. You are the Drupal community, right? And so if you want to see something happen step in and make it happen right.
More so than ever Drupal 7 is dependent upon you. You know, if you want some sort of innovative feature, you could make it happen. If you just want compatibility upgrades, you can help make that happen too. Um what's going to happen with Drupal 7 is dependent upon the community, but I like your cycle view.
That is I think where we're at, it's a very mature product. We're going to see -people should plan to see what you described. Um, it's not impossible to do anything [00:22:00] beyond that. It's just not likely that a company is going to come in and make that kind of investment.
Tim Lehnen: Yeah. I mean, it certainly could happen, right?
It's open source and amazing things happen in the community all the time. And people, people choose to do some awesome things. Um, but you know, that's, that would be where I would set my expectations for what we'll see. The security team is going to still be doing what they do. Um, and that's something that I realize here is not necessarily totally clear to everyone.
I'm not sure everyone knows exactly how the security team usually works. So to, to lay it out a little bit. So there's a security working group and then a security team and the working group makes kind of the policy decisions and things like that. And that's two or three people typically depending on who's currently in rotation.
And then the team has as many as 40 people who are from all parts of the Drupal community. Volunteers sponsored by companies who do a lot of Drupal work, end user representatives, things like that who are experts in security are [00:23:00] specifically experts in Drupal security and they are, they play more of a, sort of a coordination role than necessarily a directly solving or seeking issues roles.
So the security team handles a responsible disclosure process for people reporting issues in core or contrib. Um, making sure that, Hey, there is a channel for someone to say, Hey, I think I found a security vulnerability without disclosing it in public before there's a fix. That team will try and work with the maintainers of a contributed module if the report came for their module or their work with the core maintainers. Folks may directly work on the security fix, or they might engage with the those maintainers to try and develop the fix. Um, and in some rare cases, they also tapped into funding or used grant funding from the Association to try and do key fixes or hardening for certain aspects of the project.
So it's really good work [00:24:00] and just like every other part of open source, they don't take the responsibility for the security of everything on their shoulders. They're a powerful and awesome group of volunteers who, who let the kind of security posture scale by coordinating together with these with these other maintainers and reporters and participants.
Michael Meyers: So to sum up: over the last 10 years, Drupal 7 has operated in this fashion is going to continue to operate in that fashion and expectations should be that we're just in a more mature part of the life cycle. And we're going to see specific kinds of contributions.
Uh, the, the, the most important you're going to get compatibility upgrades for key things like PHP and more important than anything else, you're going to get security patches, and we're going to make sure the security team is going to continue to make sure that Drupal 7 remains secure moving forward.
So that's, that's pretty key.
Tim Lehnen: [00:25:00] Yep. Absolutely.
Michael Meyers: So that's Drupal Core. Um, then there's Drupal contrib, right? Um, what's going on with Drupal Contrib for Drupal 7?
Tim Lehnen: That's a really good question. And it's, it's interesting because the scale, I don't know if everyone really knows the full scale of of contrib because there's actually.
Uh, I think there's crossing all versions of Drupal I think we host 40,000 repos with all of the core and contrib repos. And for, I think for 7 contrib, it's something like 30,000 of those are technically 7, 7 contrib. Now probably the vast majority of installations there use something out of the top hundred even, or top 500, certainly, but there's a lot, there's a huge scope of integrations and custom features and all these sorts of things that have been built to make contrib ecosystem over the course of a decade. Um, and depending on where you're looking, [00:26:00] um, there's a, there's a sort of similar situation. So. Um, some Drupal 7 developers who, who run contrib may be doing ongoing maintenance, but for many of them, it is also in a like mature product mode. They're probably not adding new features.
They may be doing those on their Drupal 9 and above branches rather than their Drupal 7 branches. In some cases, some of them are still doing significant things like they might do some innovative feature in their 9 and 10 branch and back port, it's still through their Drupal 7 versions.
It's going to depend a lot on what VR, what contrib module you're talking about. Um, there are also contrib maintainers who have kind of mostly moved on from Drupal 7. So they've got a stable version out there. It has no known security issues, but it's not necessarily getting a lot of attention. Um, and that's fine, it'll it?
Uh those things still work. There's still there's for the most part still compatible. Um, and if they're opted into the security coverage, they will [00:27:00] still get that same kind of responsible disclosure process that we described for the Drupal core stuff. Um, so you should be in the same place where uh, those key modules you depend on can get security and maintenance support, maybe not a lot of new features, but that'll depend. Um, some of these things will and you know, going back to my anecdote earlier, even in the case where some of our module maintainers are sort of choosing to maybe opt out of continuing support and things like that, what we've seen.
Um, very dramatically is when something that's well used, gets marked unsupported we have tons of people stepping forward to pick it up and become those maintainers. And you said this earlier, but to anybody listening out there, that's an amazing way to get involved in the community and help um, support your own sites that you're using.
And keep, keep Drupal 7 alive.
Michael Meyers: Definitely even if it hasn't been marked on supported yet officially. [00:28:00] And I want to come back to that in a second, like what that is and how that works, because I don't think that's so well known topic. Um, but even if something isn't marked on supported yet officially maintainers may not be actively maintaining their modules anymore.
And there has always been a process where you to request ownership of that module. And it's great to see organizations and individuals coming in and doing that. And so if you want to make a change to a module and you're not getting a response from the maintainers, you can request to take ownership of that.
Um, if you, as an organization or aren't, uh able to do so for whatever reason, you don't have the time, the resources, the know how you can partner with organizations like.
Tim Lehnen: Yeah, that's a, I think there's, there's a number of organizations, including yourselves who have partnered with a lot of end-users to help maintain key modules that are part of their, their stack.
So and, and that's, that's a, a [00:29:00] really good way. You know, I speak to a lot of people at end user organizations who aren't necessarily structured to directly participate in open source contribution from sort of a corporate culture point of view. Um, but often what they can do is, is build a support contract and work with a partner like, like Tag1 or many of the others in that community.
And, and set up something to say, Hey, help us support this module. Um, and that's a, that's a good alternative as well. Um, and you know, you're- the options aren't totally binary either. It's not just, Hey, this module seems to be abandoned or it's fully maintained. There may be ones that have some activity and you could co- maintain.
There's a, for a lesser level of commitment you could come in and just, just broaden the base of people who will be there to support that.
Michael Meyers: I think every maintainer, most maintainers would love a co-maintainer. So definitely if, if something's important to you, uh there's, there's no downside to getting involved.[00:30:00]
Um, so Tim, you mentioned. You know, modules get marked as unsupported. You know, I, I know there's a process and a timing to when that happens and reasons as to when it happens. Like, could you explain how all that works? And, and, and should we be expecting that a large number of modules are about to get marked unmaintained?
Tim Lehnen: I don't think so. Um, it's to answer the last question first. Um, I think so let's, let's break this into two categories. So maintainership of modules has the part that's sort of in control of the active maintainers. And then it has what we do as a larger community to kind of maintain the whole ecosystem of modules.
So an individual maintainer of course, has control over the, the, the module that they've contributed back. And, and they can, you'll see this, if you ever visit these module pages, when you're browsing, they can set some options to say, “Hey, I'm, I'm actively maintaining this,” or “I'm [00:31:00] looking for co maintainers,” or they, they themselves can say, “oh, I'm not supporting this anymore.”
Um, and it'll just be marked as, as unsupported. And I'll come back to what you can do if you see a module in that state that you need. The flip side of that is the sort of grooming that happens on a, on a larger level as we sort of monitor these things. So in particular this is mostly a security team process.
So if there's a module in the contrib ecosystem and a security issue is reported for that module and the maintainer is non-responsive for some number of weeks or they can't reach the maintainer anymore and it appears that there's just no one there on the other end or if they kind of get involved, but it peters out and never gets solved.
If there's if it winds up with this known unresolved security issue or something like that, then eventually that module will be marked unsupported. And typically the security team does try to reach out to people [00:32:00] who maybe they weren't the maintainer, but they'd contributed a patch and the issue queue before or something like that.
Like they typically try to find someone who's willing to take it over, but this kind of last resort is, Hey, there's the known security issue for this module. Um, and you know, we can't leave that lingering. So they'll mark the module unsupported. They usually do it in batches. So if there's if there's five or six modules that have been in that state and they've been trying to contact folks for six weeks or something like that, they might mark a batch as unsupported.
Um, and then what happens from there? If a module is unsupported is effectively, it becomes accepting new maintainers. If someone wants to take it over at that point, any anyone in the community, preferably someone who has already uh, had experience maintaining a module or following the security team process can step forward and say, "Hey, I'd like to take it over. Solve that known security issue and make it a supported module again.
Michael Meyers: Yep. [00:33:00] So you mentioned there is an insanely diverse ecosystem of modules and you have really small modules, like admin toolbar that I love and can't believe isn't part of core, that is small, but like indispensable and like crazy valuable and, and that not to trivialize it, but that's something that a lot of people could come in and maintain.
Tim Lehnen: Yeah.
Michael Meyers: On the flip side, you have something like Views that is now in core, that is this monstrous beast.
Tim Lehnen: It's incredibly powerful, but man, is it a complex system to try and understand for sure. Yeah.
Michael Meyers: Um, every Drupal 7 site or, or the the vast majority of these is reliant on Drupal 7 and it's just simply not something, or it's unlikely that a person or a company is going to come in with the expertise and the resources to be the contributor.
Tim Lehnen: Yeah, for a bit, for some of [00:34:00] these big modules Views especially is the perfect example, right? The idea that any single person could come in and take over as the sole new maintainer of something like that is pretty unlikely and that's that, but that's another reason the flip side of that is part of the reason those are so big and complex is because they're so important.
And so well used. And there's already quite a lot of people who are if not in the maintainers list right now, there's quite a lot of people who contribute. So that's another place where again, co maintainer ship, you're not having to feel like you're the sole maintainer is, is a good place to be. Um, it's also a place where we might need to consider rallying some effort in some specific ways, if something came up that really needed if there was some issue with, with Drupal 7, either, excuse me, with Views in Drupal 7, like some problem with compatibility that wasn't going to be fixed on a community level or security issue that wasn't going to be fixed on the community level.
[00:35:00] Um, we, as in the Drupal Association together with security team and other folks, maybe we would try sort of a crowdfunding campaign or something like that to sort of rally folks around, Hey, this is, this is really important. It's a top five module for this ecosystem and we're going to take some extra attention to see if we can rally some support around that.
And we'll have to take that case by case by case as we see things.
Michael Meyers: Awesome. Yeah. I think there's some really interesting things that can be done there. Again, hopefully the community is going to step up and we don't need to get into that realm in territory. Um, but there's definitely some edge cases there that are going to require a community lift.
Tim Lehnen: Yeah. And, and that's the thing we, we, we got to have faith in, in open source and the whole principle of what we do when, when there is more than what a single person can do, that's when open source does its best. So,
Michael Meyers: yep. And I love this has become like I need forcing functions in my life to get things done. I'll, I'll admit it like it's simple, [00:36:00] whether it's a deadline or, or whatever. Yeah. I what I'm really excited about this is this seems to be a forcing function to getting organizations that historically weren't as engaged in Drupal, more engaged. You know, you mentioned earlier that a lot of modules were marked unsupported a dozen or whatever.
It was maybe not a lot, but and, and, and there was a clamoring a stampede of organizations that came in and said, whoa, I need this. Let me how can we help support it? And so I'm actually really excited and, and hope that we're going to continue to see that happen. Um, and if that's the case when we look at the factors for whether or not we're gonna extend the life of Drupal 7 in the future the, the contributions being done by the community are an important factor in that.
Tim Lehnen: Yeah, absolutely. You know it's not just the end user side of the equation. If the contributor ecosystem is strong and really showing that they want to keep stepping up and want to keep [00:37:00] supporting, that's going to encourage us to say yes, we can commit to yet another year of support or another in or another as it goes. Yeah.
Michael Meyers: Yeah, that was a big reason for needing extended support, I think is because, um because of its maturity and where it is in the life cycle, fewer people were contributing and the security team wanting to move on and, or needing to move on. So there are many reasons that extended support could benefit.
Tim Lehnen: And it still may be part of the solution. It's just, we, we came to the, after, after much soul searching, as you know, we came to the decision that right now wasn't the time to kick it off. Yep.
Michael Meyers: Totally. Um, and, and, and we'll see what the future brings. I I'm, I'm hopeful that the community, I really want to see the community step up.
That would be a dream come true, to see more people get engaged. And then I hope that reverberates that would be something that would have a really positive impact on [00:38:00] Drupal and, and open source in general. Right? You know every open source project in the world is trying to get more people to contribute resources and, and finances.
And so maybe we'll learn something out of this that can help.
Tim Lehnen: I mean, you, you raised a really good point and I don't want to take our whole time on this, but cause I know we still have to cover what people should do if they're on D7 and talk about D6. But for me what's really interesting about this is this is a little bit of an unexplored milestone. It's not that other open source projects haven't had mature versions starting to reach end-of-life and things like that, but it is still. It's a relatively novel situation to understand how the open source movement, not just our community, is going to begin to handle sustainability of concepts, of long term support or mature product life cycles and go from there.
So hopefully we can blaze a little bit of a trail [00:39:00] that will help us again, further in future and maybe help other projects. And hopefully we can also learn from other people in a similar situation.
Michael Meyers: Yeah. I mean Drupal 7 was released in January of 2011. I was in development for years before that.
I know we uh, at Examiner, we used it before its release. Um, so people have been on this platform for 11 years, um 12 years and, um the fact that they're going to get another two years out of it and, and then potentially extended support for five years beyond that.
Um, it, it really begs the question. You know, if I'm on Drupal 7. You know should I migrate off Drupal 7? Should I, should I stick around on Drupal 7? Like I'm sure a lot of organizations have been struggling with this question for three years now as we've kind of kept extending and there's no one size fits all answer.[00:40:00]
Tim Lehnen: I think that's right. I think it's, it's, um we talked a second ago about forcing functions and sometimes you're in a situation like that and it's like if, if it was going end-of-life or if there wasn't an extended support option, or if if none of that was available, then maybe you'd have a forcing function and you just, you just have to do it cause you had to, but that's never a great reason to do something, right.
You want, you want to be making a big business decision about your technology platform based on your business requirements, like based on your users, based on the technology you need, based on your vision for what you want to do for the next several years. And you know, that's the question to start with rather than the question of 7 or 9, right? Like you, you want to start with your needs and then see which option kind of fits what you're doing and what you should consider. And there's definitely a bunch of factors to think about.
Michael Meyers: We did a DrupalCon presentation. Uh, I think it was the last DrupalCon con -North American DrupalCon.
One of [00:41:00] our long standing clients Tern Bicycles. They're a Taiwanese bicycle manufacturing company. E-bikes, folding bikes. Um, they were on Drupal 6 and it was a really beautiful site. I mean, it, it it really with the advent of Views, put their marketing team in control of technology that they didn't need a development team to upgrade and manage their site and add content for many, many years.
And they were, as a growing company wanting to invest their money in new products, marketing many other areas, not their website. Yeah. You know through Drupal 6 long-term support, which we're going to talk about next, they were able to continue running Drupal 6, many years after end-of-life, they got well over a decade out of their investment a phenomenal return, right.
And then it got to the point where they're global distributors and they internally, it was starting to [00:42:00] inhibit their business. And they said, okay, now we need to make a big investment in upgrading to 8 or 9. I think it was 9. And it made total sense to them at that time. Um, but you know, if you are getting a lot of value out of your site and, and there is no reason to migrate for the sake of migrating that's an unnecessary expense.
Tim Lehnen: Exactly right. I mean, it's just, um the, the point of, of technology is to enable you to do new and more powerful things or do the things you already do more efficiently and things like that. Right? And if you're getting that out of what you're seeing in your Drupal 7 site, if it is enabling you, if it's empowering your content editors to work without needing developer intervention, if it's doing all of these things, then it's still serving that purpose really, really well.
At the same time, they will probably come a day where you're doing. Well, gosh, here's this, here's this thing in Drupal 10 that would [00:43:00] really empower us to here's here's this new tool that we would really like to have, or maybe, maybe we start wanting to do more of this sort of headless decoupled stuff in a more native way, supported by like an API first architecture, like Drupal 9 and beyond half.
So but, but I think that's exactly right. It's it's like you are evaluating your technology based on how it enhances your business. And there is a, there is a time when, what you've got on 7 is, is serving all of those needs. And then in the future, there'll be a time when you're like, that is going to be the next generation of what we need.
Michael Meyers: Yeah.
One of the things that surprised me, so we were one of the Drupal 7, or are one of the Drupal 7 extended support vendors. Um, we would get many calls a week from organizations because end-of-life was looming and.
Tim Lehnen: Yeah, it was coming up quick.
Michael Meyers: What was really surprised me everywhere is, oh we're planning, we're trying to make decisions we're concerned about end-of-life.
And I would say the [00:44:00] majority said we're, we're in the process of migrating or we plan to migrate and we just don't have enough time. So we need some support for some window of time after and end-of-life and what, what I would tell them and what seemed to be a surprise to many organizations was that just because Drupal 7 was going end-of-life doesn't mean that that's the end of the platform. Like the name's a misnomer.
Tim Lehnen: Yeah. You know, that's another one of those things. So like within our community, we typically mean end-of-life, to mean um, sort of end of community support or sort of end of the, sort of the standard support.
But yeah, historically, just like in the Drupal 6 example, it's followed by something like a long-term support or an extended support program, or sort of some other way to try and keep supporting that. And, um doing the math D6LTS, you were the ones doing it. It was six years. Um, of support or it will be by the time it winds down in October,
Michael Meyers: It just passed six [00:45:00] years in February.
Tim Lehnen: Yeah. Okay. So it'll be six and a half by the time it finally winds down beyond, so yeah, a huge amount of support and you know, that. We'll be in a similar position, right? Whether through the extensions or through additional extended support or both for Drupal 7 where people, I think can have some more confidence, they don't, they don't need to feel the fear of that force and function.
Now that said you, you did talk about how some of these folks are like, Hey, we have plans to migrate and we just, we're not sure we have enough time. And if those people did have those good reasons to migrate well, that's great because now hopefully they do have enough time to, to move forward there.
Michael Meyers: Definitely. Yeah. If it makes sense to migrate by all means do so. If it doesn't make sense stick around and know that Drupal 7 is going to be. You know, supported for at least another five years. If, if history is any guide, you should
Tim Lehnen: Very likely it's going to keep going for awhile. Yeah.
Yeah. We've already got two guaranteed and [00:46:00] it could be three more purely in community support depending on how it works out. But at the very least they'll, they'll be some extended support after that. I'm sure. Yeah. Um,
Michael Meyers: This is really good news for the community. Uh, I can't see how it isn't. Um so, um exciting news on the Drupal 7 front.
Um, but you know, as I mentioned at the top, some sad news for Drupal 6. Yeah. Um, Drupal 6 was released in February of 2008. If, if memory serves and around eight years later in 2016, it was designated end of life. Um, if you include the pre-release development it was worked on for an actively worked on for a decade, which again is a pretty impressive life cycle.
Um, and then I, [00:47:00] I'm really proud of what we as a community have done because after that end-of-life date in 2016 we, we came out with this long term support program LTS, kind of the precursor to what's now called extended support.
Tim Lehnen: Yep. And in particular yourselves at Tag1 Consulting and then MyDropWizard were sort of two of the, the leading organizations running that long-term support program.
And I think it was sort of instrumental in doing two of the things we just talked about, allowing people who are still on six, the freedom to keep following through on their business use case while they evaluated, whether they were ready for the next step. Um, and then also giving those who were ready just the time that needed to do that upgrade process.
Um, so yeah, I think it was really crucial and I think it was a really successful kind of program.
Michael Meyers: So in active development for eight to 10 years LTS was announced. I believe we committed to a year. If [00:48:00] I remember correctly.
Tim Lehnen: I think it was a pretty, pretty basic, like early commitment at the first. Yeah.
Michael Meyers: Um, and then MyDropWizard and Tag1 said, okay, we'll do two more years, which led to three.
And then we said, well, we're just going to continue to offer this indefinitely because there continues to remain interest. Um, and yeah, it's been six years. That six years as of February that we've been offering D6LTS there are organizations have been on for 14 years, which is,
Tim Lehnen: I think the Drupal Association is one of them for one of our sub sites, group groups.Drupal.org, which we're actually almost finally finished sun-setting, was one of those sites that was 14 years on Drupal 6. Right. And speaking of continuing to use Drupal 7- drupal.org is also still Drupal 7. Although we are working on our personal upgrade set, but it's just again, it's like when we're [00:49:00] meeting our primary use case, which is providing a home for the community, tools for collaboration, a place to advance the project.
Um we can do that on the platforms that we're on and then get ready to, to be part of showcasing the new platforms, which is another part of our role.
Michael Meyers: And the users. I don't want to disclose specific names or name anyone, but the organizations that we work with off the top of my head include three fortune 500 companies, at least one or two in the top 1000 educational institutions, nonprofits, individuals, um the, the user base is, is really diverse.
Um, and you know, there's what, according to the usage statistics, I think there's around like maybe between 12 and 15,000 sites currently running D6.
Tim Lehnen: It looks like that. Yeah. And and we use our usage stats and kind of a directional way because some folks turn those that reporting back to us off. And it also picks up [00:50:00] people's development and staging environments, but it's a rough, it's a good rough yes.
And that's that's not an insignificant amount of sites, but it's relatively small compared to the the breadth of the roughly million total Drupal sites that are out there. And this is where, what we talked about at the beginning comes into play. Like ultimately there is a hard decision about when something has to come to an end.
Right. Um, and it's a combination of factors. It's how many sites, it's the nature of those sites. Um, it's also just a sense for what level of support is still there and whether there's a, whether there's a value in continuing to do that support, whether it's for the long term support vendors or even the end users whether they're choosing to contribute and things like that.
So.
Michael Meyers: Yeah, this was a really hard decision for us. Um MyDropWizard ended their support for Drupal 6 last month. Originally we [00:51:00] had wanted to keep running it and we we're talking about onboarding the MyDropWizard clients and ultimately it came down to like two factors for us.
One, offering extended support is unpredictable, requires extremely senior rare resources. Um, and so these are the people that we have on our biggest projects, our most important relationships you're talking recurring seven figure contracts and they constantly have important deadlines with some sort of executive who's interested in the project and all of a sudden a security problem comes up and we need to take like a lead architect off of this project that has the looming deadline to create a security patch.
I mean, that's brutal.
Tim Lehnen: For a 14 year old platform. Yeah, it's interesting. But it actually speaks again to that sort of maturity model stuff. Like again, when we [00:52:00] look at the metrics in terms of all the sort of community support or perhaps the talent support it's like when people talk about finding FORTRAN developers if you could still find one, there they're worth their weight in gold.
If you are one of those few places who still need one, but, but, but if that is the thing, like you need these people with high levels of expertise and they're still out there for sure, but. They in their individual careers or as the, that community, they're also likely to gradually start moving on to the, to the newer and next things.
Um, and that becomes a natural part of understanding when it's time to wind things down.
Michael Meyers: Yeah. The resources were sort of begrudgingly doing it to support the community. The company - Tag1 was taking a lot of risks with these big projects. And we just looked through this, we know we can't, we can't do that.
That's not smart for our business. Um, if you look at D6LTS we're losing money on it, we're doing it purely for the community at this point. [00:53:00] Um, and so we went to our customers and we said the only way we could viably this is to have someone the retainer model, right.
Pay a developer to always be there, always be available, that way we can mitigate the risk to other projects. And several of these fortune 500 companies are like, well great. Let's, let's, let's do that. You know, even if we were to do it together and I said, okay, here's how much it's going to cost.
And they're like, no, we're not going to do that.
Tim Lehnen: Right. Oh my gosh. You know, it turns out that wait, well, and so, and the funny thing is right. Sign of the time, maybe that, that does sort of mean, Hey it, it's, it's time, time to start moving on. But what I think is interesting here is, and what I want to encourage the audience to think is I think we should have a lot of gratitude towards yourselves, especially towards MyDropwizard and towards all those people who made it possible for 6 to have its 14 year lifespan.
Um, I think it's a tremendous [00:54:00] contribution to the community. And as you said, you weren't making money doing it. You were, you were supporting a community because you felt it was the right thing to do. And it was important for relationships to clients and things like that. Sure. But, but there's many, many people who benefited and that's kinda really worthy of the community's gratitude and certainly mine.
Um, and I think we all appreciate that quite a bit.
Michael Meyers: Thank you.
Yeah. It breaks our heart to just stop doing it because you know, we do have relationships that rely on it. We do know there's a community out there it's just long past its viability. And, um so with a heavy heart we're winding it down.
Uh, we want to give people time to transition. So what we're doing is we're not going to take on any more organizations because we just don't have the resourcing to onboard them. So unfortunately, the MyDropWizard clients we've had to tell them, no, we're sorry. Um cause we need to back out- every provider had their own patch sets.
We need to back out every my [00:55:00] Dropwizard patch set, put all of ours in like it's just, it's it's too much lift to get them on board. Um, and again, they're, they're just not going to pay us enough to make it worthwhile for them or us. Um, and so we will release all of our patches through the end of October.
Um, so we're going to continue to provide, we have some long-term contracts with our clients through the end of October. So we'll continue to release Drupal 6 LTS security patches, and updates through the end of October for free as open source. Um, but then uh, the last day of October is sort of the official, um winding down of Drupal 6.
Um, after that, there will be no support from any organization for that platform.
Tim Lehnen: Yeah, exactly. And we've mentioned on several occasions the Drupal PSA's, if you're hearing that and you actually don't know where those are, where those come from, a [00:56:00] drupal.org/security has sort of the portal for things like PSA, security, advisories information about the security team.
So a PSA about this upcoming wind down at the program is posted there. And the other ones we talked about as well, if you want to jump back in and get caught up on all those details.
Michael Meyers: Yep. The public service announcement, 20 22 0 3 0 9. Uh, the names of these things is the official formal announcement for the end-of-life of Drupal 6 LTS.
Uh, obviously that just came out two days ago and the end of an era, it's, it's sad to see it go, but we can hold our heads high that it lasted so long. Tim, thank you so much for joining us again. Um, really appreciate it. Giving us insight and walking us through all that.
Tim Lehnen: Yeah, thank you again very much for having me, um thank you for being participants in this end-of-life process and extended support [00:57:00] program. Um, and for everything you did for the, the D6 organizations out there for so many years before we sign off here, I, again, just want to encourage folks.
Do go ahead and check out that drupal.org/security page. If you're just curious about this process, for some more things do consider reaching out to the Drupal Association. If you want to contribute to the project to help support Drupal 7 we can help get you oriented if you just don't know how to get started.
So we'd be happy to talk to you about that. Uh, and also consider joining us at DrupalCon in Portland. We're back in person for the first time it's going to be in my home city last week of April. I'm really excited for that. Um, it's going to be a good experience. The timing seems to be working out with the pandemic and everything, and of course follow your, your own personal considerations about what you feel safe with, but we're looking forward to a great reunion and homecoming with the community.
Michael Meyers: DrupalCons are essential to community to Drupal so many great [00:58:00] memories and stories from, from DrupalCon. So if you haven't been, I highly recommend that you check it out. Um, and also please support the Drupal Association, um become an individual member, become an organizational member get involved in Drupal, whether it's from a resource standpoint or a financial standpoint, the health and success of the community is predicated on the health and success of the code base and the Drupal Association.
So. Um, all the links we mentioned today the security team link, the PSA link. We'll put all of that in the show notes. So you can easily access that. Uh, please remember to upvote subscribe and share this out to folks that you think might be interested in end-of-life. We want to get the word out and help everybody understand the extension and what that means for them.
You can check out our past Tag1 Team Talks at tag1.com T T T that's tag1.com/ttt and as always. We'd [00:59:00] love your feedback, topics, suggestions, you can write to us at ttt@tag1.com. Thank you to everyone who tuned in and listened. Tim. Thank you so much for joining us again, always great to have you.
Tim Lehnen: Thanks Michael.
Michael Meyers: Take care.