Ideas Web App Design Document

A project to replace the static ideas.xml based system for describing desired or in-progress projects that could use additional developer volunteers.

There are many drawbacks to the current system:

• Strict XML schema requires careful text editing in a tedious file format to add new ideas to the list.
• Anyone can propose an idea, but there is no feedback mechanism to separate the good ideas from the very bad ideas on the list.
  • Many senior developers have very different opinions about technical ideas. The current system does not provide an avenue for them to list alternate points of view, add detailed technical comments of suggestions or criticism, etc..
  • It is not possible to see the ideas with the most recent “buzz” of users commenting/voting positively on them.
• Notifications are limited to emails sent to busy CVS mailing lists with all other web changes, so there is no notification mechanism for just the ideas list or the particular ideas one is interested in.

I propose that we replace, or at least augment, the current ideas.xml static web page based system with a dynamic web application. This application should have the following features :

• Allow anyone to propose a new idea.
• Allow anyone to comment and vote on previously proposed ideas.
• Provide an RSS feed of the newest ideas.
• Provide an RSS feed of the comments/votes for any specific idea.
• Export the entire ideas list to something closely approximating our existing ideas.xml file.
• Allow one to sort and search the ideas list by category, proposer, votes, summary title, or full text.
• Anonymous ideas/comments are hidden by default until cleared by a moderator.
• Moderator bits to be set for certain users so that they can moderate the above (can subscribe to an rss file for unmoderated ideas and comments needing their attention).
• Import functionality to import the current ideas.xml file.

I propose that we provide this functionality with a Python/Django based application running on a jailed server somewhere with Apache, mod_python, and MySQL or Postgres. This has many advantages including high level UI libraries, strong separation between data models and views, and very quick templating for the content. A quick mockup using the CSS from the main freebsd.org site was made in a few hours and is available in Perforce with the same look and feel of the main web site, but dynamically allowing anyone to add ideas, comment on ideas by others, and sort the existing ideas by category, score, or title (no searching or import/export yet as of Friday March 21).

In order to support commenting/voting on ideas, we need to have logins. Spam will also be a concern and so we'll need to possibly consider CAPTCHAs before allowing the user to enter a new idea or comment. It is strongly desired that we not require all freebsd developers and users to remember yet another password. For this reason, the application should use OpenID or be linked with Google, Yahoo, or other popular accounts (even linked with the wiki accounts for example, would be OK if possible).

Currently I have a mock up running on my local network but have not moved this to the public web yet. Ideally I'd like to move it to the web this weekend to get wider review and suggestions.

Cookies will be used, but for this limited domain cross-site scripting should not be an issue. As this solution utlizes a database backend, SQL injection attacks are theoretically possible. In general the Django library provides strong input validation and there will be no SQL commands in the highest level application itself as the data models thoroughly abstract those details in Django and provide escaping for all input strings. Also, we should run this on a jailed server with nothing else in the same database so that there is nothing important to be lost in any event. The import/export functionality of the webapp will make it trivial to recover from accidental data loss (much more likely to happen by an administrator error, especially if I'm anywhere near it.)

The main page, which I propose be visited from http://<something>.freebsd.org/ideas/. (I'm happy with something == www, testing, webapps, or whatever) :

attachment:MainSortableIdeaList.png

The idea submission form :

attachment:IdeaSubmissionForm.png