Code Enigma

More #AI learning today, finally got around to installing a Google Drive #MCP server. Selecting one was the first hurdle, ended up settling on this, as it supports Google service accounts (critically) and appears well maintained: https://lnkd.in/eeS68_gk I was hoping to stay with #Python, but the best MCP servers - for Drive at least - are all written in #node. I got it running as a systemd service easily enough, then picked my way through the LiteLLM AI Gateway settings to centralise usage and control. Once it was up and running with #LiteLLM I then created an integration for it in Open WebUI, so you could enable it in the context of chat and the agents would automatically use the available Google Drive tools. The result is pretty impressive. Silly example, we keep team holidays in a spreadsheet in Drive. Using our default model (DeepSeek 4.1 Flash hosted by Scaleway at the moment) I just prompted "Find our holiday spreadsheet and tell me who's on holiday this week". Off it went, found the spreadsheet (deduced which one it was by title and also most recent edit), realised the key information was delivered with cell colour shading, looked up the key, read the appropriate columns for "this week", figured out who was on holiday and on which days and fed me a summary in a table. It also figured out what "pending" holidays they were and gave me those. Another one, "I had a client meeting today, summarise it for me". I only made one meeting notes document today, so it grabbed that, read it and gave me a very solid summary of content and outcomes. This is a big win, as our previous Google integration relied in users selecting files in Drive, which was a massive nuisance. With this integration the agent can go and fetch documents itself. Scope is restricted by a Google Cloud service account, which is only invited to the specific folders and shared drives it is permitted to access.

Organisations judge a CMS on what it can do. The question of how to leave it tends to arrive years later, when the platform no longer fits. We looked at what that moment cost two councils, and what they learned: https://lnkd.in/eV3sHd_r Ease of exit is a feature of any platform. The best time to assess it is when you choose one. #CodeEnigma #WebDevelopment #Drupal

Ease of exit is a feature of any CMS. The best time to assess it is when you choose one. These questions come from two council migrations. The full story is here: https://lnkd.in/eV3sHd_r Worth asking whether you're choosing a CMS or leaving one. #CodeEnigma #WebDevelopment #Drupal

It's curious to see some corners of the #PHP hosting world patting themselves on the backs for taking sites down. We largely didn't, here's why: There was a fair bit of panic yesterday, not helped by various government agencies hitting the international news when their websites went dark. At Code Enigma we were carefully reviewing the situation, not just switching things off. You start with a risk analysis and some key questions: What are we hosting? If we hosted anything with truly sensitive material in, where a leak of files or a database would've been catastrophic, we would absolutely have taken that site down. But we don't. All our websites (and indeed, most #Drupal websites, period) are public information sites, so the worst case is some public information ... erm, goes public? Plus a lot of our stuff is LocalGov Drupal - citizen information - you want to keep that up if you can. Website defacing was a small risk, but it's really not that big a deal and if you take your site down it's gone anyway, plus defacing we can recover from really fast. What's the threat? We reviewed the PoC code in the wild, discussed what a successful attack might look like, how far they could get, what they could realistically do. Having gone through a number of "what if" scenarios, we decided we had enough defence-in-depth in the tools we use (intrusion protection, WAFs, rootkit protection, etc.) and our configuration (user config, firewalling, etc.) to contain an actual breach. What additional mitigations can we put in place? We've seen a lot of this over the years, we know how it usually goes. Unless you're a high-value target the first thing you'll see is a wave of automated checks to see if you're vulnerable. We figured most will just use the PoC code as is so we set custom triggers in place with our open source IPS, #OSSEC, looking for the footprint of that code. We also verified WAF configs and prepared some specific rules we could roll-out to block multipart form posts (the key vulnerability) while keeping public applications up. After all this we let our clients know that our recommendation was to stay up. We listed the reasons why in a communication to their named security contacts, but we told them they were welcome to ask us to take their sites down if they wanted to be 100% safe. One client did, which is fair enough, but most opted to ride it out. It turned out to be the right call, we patched most of our servers within half an hour of the package being made available, by the now legendary #Debian developer, Ondřej Surý - huge kudos and gratitude to him. 🙏 Shortly after that, as anticipated, OSSEC started to flag the script kiddies arriving with their direct copies of the PoC code, but we were already patched. I'm surprised it didn't happen earlier, to be honest - we set up the rule because we wanted to know if any servers had been "painted" as targets - but I guess even script kiddies have a lead time. 😂 So most of our sites stayed up. 🥳

Central Bedfordshire's old CMS left one detail out of its export: the web address of every page. That came to around 48,000 URLs, including documents and images. Residents had bookmarked them, search engines had indexed them, and other organisations linked to them. Jadu's own documented rules for generating those addresses matched about 60% of real pages. A public service needs close to all of them. So Philip Norton, one of our lead developers, built a master list from what was available: a partly broken sitemap, the council's own SEO crawl data, and addresses found as the migration ran. Every migrated page got a permanent redirect, and a report flagged any gaps before launch. What this taught us about leaving a proprietary CMS: https://lnkd.in/eV3sHd_r Phil's four-part technical guide covers the code: https://lnkd.in/egDut7x6 #CodeEnigma #WebDevelopment #Drupal

Spend some quality time with one of our lead developers. Learning is guaranteed.

A website rebrand can look deceptively simple from the outside. For Hackney Services for Schools, the visual refresh was accompanied by changes across the Drupal site, including: - New homepage layouts and designs - Paragraph and content type changes - Changes to media embedding - A new megamenu - Blog functionality - A continued focus on WCAG accessibility compliance The result was the product of a long collaboration involving plenty of Code Enigma hands along the way. Which made this feedback from Senior Digital Services Manager Amy Peters particularly good to receive: “I wanted to say a massive thank you for the work on the Hackney Services for Schools website refresh.” Feedback like that means a lot. A big thank you right back to Amy and everyone involved in bringing the refreshed site to life. #CodeEnigma #WebDevelopment #Drupal

It's really rough out there if you're a developer, lots of people are looking for work and there's not much of it about. If you're the person at your company who gets those cold emails from individual freelancers and job-hunters, people looking for an internship, please do something with their email, even if you can't help them right now. It's the little things that keep people's chins up at the moment. Do have a process, do keep their CV if they're a potential future fit and tell them you did so, or don't and tell them why. And regardless, do wish them future happiness and good luck in their search. It's not a waste of time. You can't give them a job right now, but psychologically it matters that someone acknowledged their existence, that they know they're not just shouting into a void. I accept our record hasn't historically been 100% on this, we do our best but we're busy people, there's not many of us, emails slip down the list, processes don't exist, it's a group mailbox so people think other people will do it, etc. But I've started personally making sure Code Enigma is not "that company". We will always reply. And since I made that decision, the number of people who've just come back to us and said "thank you for replying, that means so much to me" is reaffirming the fact that a little bit of courtesy goes a long way... And that, sadly, like jobs, there's not a lot of courtesy around at the moment. (Caveat: I only extend this to individuals that are not writing to us on the part of a larger company. Of course we don't reply to all the emails we get offering us cheap team expansion by off-shoring, bargain WordPress plugins, lists of Linux users, and so on...)

Behind every great digital platform is a great partner. We're proud to welcome and celebrate the latest additions and renewals in our #DrupalCertifiedPartner community. New: DrupalEasy: https://lnkd.in/eBGAjcA Renewing: CI&T: https://www.ciandt.com/ Code Enigma: https://lnkd.in/ePQBgT-D デジタルサーカス株式会社: http://www.dgcircus.com/ Zivtech: http://zivtech.com/ openup.media: https://openup.media/ Thank you for building the open source web with us. 💙 Ready to build Drupal's future with us? Become a Drupal Certified Partner: https://lnkd.in/ezGt-FkZ

We think it's only fair that our suppliers get paid for the work that they do. And that they get paid in good time. That's why we wanted to be associated with the @Fair Payment Code, and we're pleased to say we've been recognised as a Gold Awardee by them. https://lnkd.in/exsN9B2i