In my search for a replacement for Drupal, I started playing with SilverStripe over the weekend.
The site looks pretty good, the demo—while minimal (which is totally fine by me)—seems to work decently. It made my "to test" list.
The bottom line:
FWIW, SilverStripe made my "do not recommend" list today. )-:
A bunch of people replied asking "why?" This is my response to those people. My intent is not to bash SilverStripe, but to explain how it fell short of my wants and needs, quickly.
First stop: the code.
SilverStripe is built on a framework called Sapphire, which is developed by the same folks as SilverStripe (a bit like the CodeIgniter-Expression Engine relationship, I guess). A [very] quick look through the tutorials had me interested, and the actual functionality of SilverStripe seems to be something we could work with. I downloaded it, unpacked the archive, and dove straight into the code.
Again, maybe my expectations are too high.
Here's an excerpt from the root index.php.
<p><![CDATA[ // For linux $_SERVER['SCRIPT_FILENAME'] = str_replace('/index.php','/sapphire/main.php', $_SERVER['SCRIPT_FILENAME']); $_SERVER['SCRIPT_NAME'] = str_replace('/index.php','/sapphire/main.php', $_SERVER['SCRIPT_NAME']); // And for windows $_SERVER['SCRIPT_FILENAME'] = str_replace('\\index.php','\\sapphire\\main.php', $_SERVER['SCRIPT_FILENAME']); $_SERVER['SCRIPT_NAME'] = str_replace('\\index.php','\\sapphire\\main.php', $_SERVER['SCRIPT_NAME']); chdir('sapphire'); require_once('sapphire/main.php'); ]]>
The useless str_replace calls aren't a huge problem, but they demonstrate sloppiness. It's easy enough to detect whether or not we're on Windows (hint: the PHP_OS constant) without redundantly replacing everything twice.
What really got my attention was the chdir call. They must have some reason to do this, but it's almost certainly a bad one. At the very least, it should have a comment indicating why they'd do something weird like this.
Next, sapphire/main.php (excerpt; the first two executable lines in the file):
<p><![CDATA[ $majorVersion = strtok(phpversion(),'.'); if($majorVersion < 5) { ... ]]>
This raised all kinds of warning flags to me. Maybe they're worried about PHP_VERSION constant being missing from some old versions of PHP (to their benefit, the manual doesn't say when this was introduced), and that's why they've decided to use the phpversion() function. There is, however, a function built in to PHP to compare versions: version_compare(). That's the safest way to do this. A more obscure, but faster way to handle this is to check if a function or class only defined in 5.x exists.
.htaccess also hints at something weird:
<p><![CDATA[ <Files *.ss> Order deny,allow Deny from all Allow from 127.0.0.1 </Files> ]]>
"What's this *.ss stuff?" I wondered. It's SilverStripe's templating system. I didn't even bother to see how they're interpreted, but they're apparently not PHP-based, with syntax such as <% base_tag %> and $SilverStripeNavigator (the latter was not within tags of any sort).
I made it through barely a handful of files before deciding to just plug my nose and ignore the code, hoping that I would be so blown away by the functionality that I would forget what lies under the covers.
I tried the installer. It complained that I didn't have the mysql extension built. Fair enough, it's true. I didn't have the mysql extension. I did have pdo_mysql and mysqli but no, I didn't have the ancient extension installed. I expected better.
Once I rebuilt PHP with mysql-proper support, I went through the installation process, and when it finished, I was redirected to a page that said "The requested page couldn't be found." So, I gave up.
I could probably fix that problem, and none of the other problems on their own are insurmountable, but combined, they leave me with the impression that the code isn't what I'd like to commit to maintaining.
The search continues...
You should check out concrete5. I am HARDLY a non-biased participant in the debate (being the core team leader) but I read your blog post with interest. Our code is certainly not perfect, but we do a pretty good job, all things considered.
Spot on! Unfortunately this scenario is all too true with other products, too.
Andrew: thanks for the recommendation. I ran the installer and got the White Page of Death.
sarcasmic:~/src/concrete5.3.3$ grep -r error_reporting * | wc -l
48
This is just not acceptable in my opinion. I'm sorry, but I'll have to pass. Also: I won't knowingly run adodb if I can avoid it.
Once again, my standards are probably too high to actually find a solution.
S
Hi Sean,
* You're right, the index.php could do with a bit of polish. It's relatively recent, and was added in order to support web servers that don't have a rewrite engine. Because the system had already been built on the assumption that pages are handled by sapphire/main.php, we did some quick fixes like the chdir() to make its execution as similar as possible to a request handled by sapphire/main.php.
* In our experience we found that the mysql extension was the most commonly installed one. Extending the ORM to detect which MySQL connector you have installed and automatically switch would be a good thing to implement, but alas, there are many such items on our to do list.
* Yes, using version_compare() is better - I fixed it in trunk a few months back and will be released in 2.4 http://open.silverstripe.org/changeset/84142
In any case, thanks for the feedback.
Sam Minnée
SilverStripe
Sam: I really appreciate your non-confrontational and appropriately defensive comment. Thanks for the information.
S
I've critisized SS in the past (I've worked on it a lot) but the templating engine is actually really great and something that I haven't seen anything like before. The templates are aware of the data model which lends itself really nicely to simple, easy to understand templates.
Definitely worth a look, even just for the concept.
You're most welcome, Sean. :-)
Ah, I thought this sounded familiar, took a look out of curiosity a (few?) years ago.
Remember it had a problem with its encrypt_password routine, and its use of base_convert() which doesn't work the way whomever wrote it thinks it does. Ends up truncating a password hash.
Pretty sure I contacted someone about it then, but just got 2.3.3, and it is still unchanged.
Hi Sean,
Granted the install process needs a bit of polish, but I've found after one or two sites the product as a whole makes sense.
SilverStripe is great for small content managed sites, the templating is frustrating at first (it could have more logic constructs for example) but gets better and encourages you to move procedural code out of the templates and into the models.
Above all, my clients *love* the UI. They are able to just log in and straight way they *get* how it works (I love Drupal, but you can't say that about it's admin interface)
I find that I end up with a site that clients are more attached too, as they don't have to force themselves to use it and can add pages, articles, files and images (and even manage the odd online shop or two) with great ease.
I've gained clients through them being referred by other happy SilverStripe users I've built sites for.
SS is currently my #1 go-to CMS for small client sites.
Paul
@Ren: That issue has been fixed in 2.4, now in alpha release.
Thanks for the review. That crosses off that CMS from the Open Source CMS market share report 2009 that I was going to try out.
However, that still leaves Alfresco. Do you want to give that a spin for us? :)
Interesting read. Nice that the SilverStripe folks are reading and commenting too.
@Sam: if you need a very nice and kick ass developer, I have a friend from Wellington to recommend..
Echoing Sam's comment, thanks for the feedback.
If at all possible, it'd be wonderful to establish what caused your page not found error upon completing the installation. As you'll appreciate, getting the software to run on the idiosyncrasies possible with PHP environments is a case of ever shifting goalposts.
Finally, you might be interested reading Chapter 1 of the SilverStripe book. It provides background on the architecture of our software, which for instance explains why there are .ss template files. Wiley, the publisher of the book has made Chapter 1 a free copyrighted excerpt: http://media.wiley.com/product_data/excerpt/37/04706818/0470681837.pdf
Cheers,
Sigurd Magnusson,
SilverStripe
Worth noting:
Not sure if they changed the codebase to fix this issue but I tried building a somewhat complicated site with Silverstripe purely because of the look of the pre-available functionality. After building some additional modules we decided to test our application and found it to be really slow and a complete memory hog.
We then compared this to an equivalent project built in Symfony and found that there was one fundamental flaw in Silverstripe!
The way silverstripe handles it's autoloader and variables is to compile a list of all files it can find, get all variables used globally together and put them all into a manifest.php file. this file is then included and does a job load of includes itself. This file can become huge and is recompiled all the time, as in there is no caching hence the memory hogging and slow responses. The more you do with silverstripe, the slower it gets.
Symfony on the other hand compiles the configuration into php files and added them to the auto loader relying on php to handle loading as required. This is significantly easier going on memory usage and magnitudes faster.
When approached regarding this, the lead developers of Silverstripe response to how they handled the scenario of high traffic sites, his response was "we published all the pages as static html files".
Not really a solution to a failed attempt at producing a php cms/framework they say is ready for high traffic sites!
Your are right, but you find this kind of, I would call it unprofessional code in almost every php product.
hehe ... quite a funny article, i liked it.
I guess its funny because i know exactly the feeling of "WTF" growing in your head with every file you open ;- )
Well thats the reality i guess, we all make stuff more complicated than it should be, we all make 'wired' design and implementation decisions.
I actually like Drupal as comparing to other cms solutions it has pretty good structure, community and docs.
I have worked with TYPO3 a bit and Joomla ... and they are just horrible! trust me! You can read more here http://artur.ejsmont.org/blog/content/open-source-cms-systems (heheh just noticed teaser is repeated in the article ;- ) upps!) You will never find more WTF-filled system than Typo3 .... seriously ... its the number one!
Well but since you are moving away from drupal i guess you wont like it any way :- ) i know it has some painfull spots especially versioning, deployment/data migrations and publishing process.
I really hope for some good and popular CMS based on zend framework or cake php ... i guess its time to let old folks go. If you find some really good cms let me know as lately dont have time to look around too much.
Art
wow, i think that the comments from the SS guys speak for themselves...if they're willing to..
1. read your blog
2. say "yes, your write....we just fixed it"
that really really says alot!
good job SS guys!
and even better job for their tester (Sean Coates)
PHP documentation now covers PHP 4+. PHP_VERSION is in all these versions so there's no need for changelog.
Not trying to start a riot here, but you are a nitpicky nerd.
Who cares if the code isn't as beautiful as the Mona Lisa? If it works, doesn't have security holes, and doesn't unnecessarily cause major performance hits, it good enough for me. I am in the process of launching my personal portfolio site now and I built it on SilverStripe, and I love it. It was really easy to set up and theme, the UI is easy to use, and above all it just works well. A couple lines of sloppy code wouldn't even make me come close to consider throwing it out.
Don't go bashing SilverStripe for a such a inconsequental shortcoming. SilverStripe is a great product for small sites and the rest of you out there reading should absolutely consider using it. Don't throw it out because of this tiny imperfection.
Echoing Maarten: Kudos to the SilverStripe folks for reading and commenting.
@SS team: Keep up the great work, I will be watching for new features and releases with excitement, and hopefully will contribute something myself if I can carve out some time.
@David: Strangely, the SS team were much more receptive to and polite about my comments than you were. I honestly had to ask other people if you were serious or were simply trolling.
"If it works, doesn't have security holes, and doesn't unnecessarily cause major performance hits, it good enough for me."
Obviously, "good enough" for you isn't "good enough" for me. That's my point. In my experience, when things aren't right under the hood, other things suffer. Sloppiness, such as what I outlined, is often a sign that there are underlying security problems. Fine attention to detail—and doing things properly—has implicit security and performance benefits.
I'm not saying there *are* security problems. Also, I'm not saying that SilverStripe isn't useful. I'm saying that a bunch of small things add up to a value that surpasses my threshold of tolerance. Again, my experience tells me that when things are a mess, they're a pain to maintain.
There was no bashing. I'm actually incredibly impressed by the responses from SilverStripe developers.
S
@Sean
Fair enough. I respect your opinion. But until I see this cause a more serious problem with SilverStripe, I'm going to go on proudly using it. You are right, "good enough" for me isn't "good enough" for you, and that's fine.
I just think all the good things about SilverStripe far outweigh the bad.
@Sean / @David: All feedback is useful, even the nickpicky stuff. ;-)
@Harry: A few responses:
* To clarify the point you made, the code files aren't all included - only a 'manifest' file which maps class names to PHP filenames. This lets the autoloader know which file to include when a. Now, the manifest can get quite big, and a little slow to load without a bytecode cache, which is why we strongly recommend a bytecode cache.
* Yes, having full-page caching as the only option for scaling up your sites was a little limiting. We're putting the finishing touches on a partial caching system that will make it easier to dramatically improve the performance of dynamic sites by caching the static regions on the site. It should be available in alpha 2 of SilverStripe 2.4.
* SilverStripe 2.4 also has a bunch of core engine enhancements that initial reports suggest improve overall execution speed by about 50%.
We started using Silverstripe, at work, and we absolutly loved it.
The CMS is not perfect, but it's way better than drupal and the others.
Overall it was a pleasant experience, and t,s the first time I feel that I have total control about the output of my cms and my datamodel.
They way the datamodel is able to adapt the database on the fly is a big +.
My only real real is the form system which is hard to theme, since you need to subclass Fields and create your own rendering method.
I think a Decorator system like the Zend_Framework one would be welcome.
See, this is *exactly* why I wanted you to review Lithium. You are one of the only two people I know with PHP experience *and* standards higher (most likely) than my own.
Fortunately, we only just released 0.2 and I have plenty of time left to bug you before we go stable. :D
Hi Sean! Since you're searching... Why don't you try PHP Nuke?ç
Just a joke! ;-P
I also had severe issues with SilverStripe's templating. Very limiting, and it seems unnecessary to create a new system when there are so many out there already (especially when PHP itself does the trick).
I got so fed up, I replaced SS's templating engine with Zend_Layout and Zend_View (on the front-end - ignoring the CMS administration).
It's like a breath of fresh air, and didn't take too much work either.
I'm going to come right out and say this is a piss-poor review. You've looked at a single file, that is bypassed in a mod_rewrite enabled website (ie, most SilverStripe sites), completely ignored the ORM capabilities of Sapphire, the usability of the CMS, how the templating engine works, etc.
This is like bagging a Ferrari based on the number plate.
I realize you might find this comment rude, but rubbishing the hours of work put in, on such a brief and ill-informed look at the product is pretty rude too.
@Hamish: the point is that I saw enough to turn me off. Yes, I just scratched the surface, but in my experience, minor obvious problems are often symptoms of larger hidden problems.
If the Ferarri had an ugly, and non-aerodynamic number plate, I'd dismiss it, too, yes. Details are important.
I don't dismiss the hours of work the SS guys put in, and I'm actually quite impressed by their responses.
S
Hey Sean,
Attention to detail is important - totally agree with that, but I personally think SS is heading in the right direction - code is being refactored and tweaked and features from 2.4 are looking great - especially the performance improvements.
If you have some time, why not delve deeper into the SS code and give us a follow up review? Maybe you'll find some gems.
Best case scenario - for you to join the SS community and help improving it ;)
Thanks
G
Sorry to say but not to like a CMS based on the fact that a couple lines of code could have been done in a different way is proving your ignorance.
If you had even taken som time to look at the datamodel than you quickly had realised how superior Silverstripe is compared to most other CMS out there. If you ever have written some ruby code you are up and running in no time.
Sean clearly doesnt understand what opensource is about;
if you think some code is wrong, then simply change it and upload if you want.
SS is not something you learn in a few hours.
i've done quite some tweaks and coding to get SS working as i wanted for a few sites, and it is A LOT
better then any other CMS's i've ever worked with (including the very expensive stuff).
the templating system is really easy to work with if you actually have to create sites
So pls stop complaining and start coding.
I certainly do understand open source. I understand that in order to get anything done in open source, you need to be choosy about which projects you take on, and which you ignore or simply cope with. There's a really tough balance to maintain.
I'm sorry you read my article as complaint. It's terribly easy to offend people on the Web.
Since you didn't bother reading to the end, here is the closing, again:
S
Interesting read. I didn't dig deep into the Silverstripe core code at the beginning of my evaluation of it and perhaps I would have had second thoughts about it if I did.
I am REALLY glad that I didn't, though if this would have meant that I would have missed out on this (in my opinion) awesome CMS.
For anyone reading this who plans on taking SS for a test drive I'd recommend it. Sean is certainly correct in this post but my experience is that the overall quality of the Silverstripe code is pretty high.
If you're shopping for a CMS, trust me, don't pass up a chance to actually -try- SilverStripe for yourself.
SilverStripe is a solid platform with quick deployment, excellent interface, flexible, etc.
We've used it on just around 12 websites, with many more in the queue. Absolutely love it.