Plone's security is much higher than Drupal's and most other PHP frameworks. For some stats and analysis see here:

http://plonemetrics.blogspot.com/2009/04/plone-security.html

Whilst the analysis will be a bit biased as it is by someone who uses Plone, the stats there are all independent.

Alos both cia.gov and fbi.gov are Plone sites. Nuff said.

-Matt

This is why smart people started looking at OODBs a decade ago. Things liek the ZODB have been around for over 10 years now, and newer OODBs like Couch DB are coming onto the block now as well. For general content publishing and file sharing, they make much more sense than an RDBMS.

I don't know why people still use RDBMs for non-relational data. Then wrangle with a ORM on top just for fun. Scrap it. Use an OODB.

-Matt

I was involved with the deployment of Plone in a large UK bank (hint: now publicly owned). This was for about 35,000 commercial banking traders, so was definitely a large system, especially considering most of those users authenticated each day.

This was deployed on a cluster of about a dozen machines, including both Linux and Solaris servers, with a big EMC storage array (live sync with DR centre via SRDF). A complete replica of this at the DR site too.

The odd thing I noticed was whilst this particular division was quite progressive and willing to adopt an Open Source solution, the rest of the business was not so willing... yet very happy to develop software internally for use.
If anyone here has worked in a large (non-software) corporation they will know that pretty much every piece of software that has been developed by someone in-house goes on to become a support headache over the years. Especially once the person who wrote it leaves the organisation. Just go read The Daily WTF... these things are real.

At the start of this project, the bank did not officially support Linux, so we had to develop all our own procedures and support infrastructure. By the end of the project, the bank was asking our team to help form the bank's global Linux support policy.

So one way of explaining OSS to bosses at these organisation is by telling them that it is like in-house developed software, but has he advantage that there is a whole community of people out there to help support it. In the case of Plone (and other well established OSS projects) there are commercial support companies out there that will give you paid-for support and SLAs. Not only that, but you have a choice of companies, rather than just one software vendor in a typical commercial software scenario.

As Paul Everitt (of Zope fame) once said many years ago: 'Software is not an asset, it is a liability'. Some very true words to try and get over to some organisations.

-Matt

There are loads of lighter weight frameworks if you want to stick with python. Werkzeug, pylons, or just plain WSGI are a few. Then in the middle you have the likes of Grok and repoze.bfg that use a lot of the Zope 3 stack.

Google's App Engine uses python, and WSGI so you can wire up any WSGI app you want (within the terms of GAE's requirements). There are people working on getting Zope to run under GAE. The main issues at the moment are some of the C modules that need python equivalents.

-Matt

I just wrote a quick article on how Plone stacks up on the trivial tasks in the original article:

http://www.netsight.co.uk/blog/2009/3/3/open-source-and-usability:-plone

Short answer: Plone is just as easy to use as Wordpress, but with the power of a full CMS.

-Matt

How is this any different to a large company (think HP, Sun, IBM, etc) supporting Open Source and providing the client with the same kind of licensing and guarantees? Open Source of Closed Source has no real relevance on the level of support you get. Well in fact it does, with OSS you have the potential to choose your support provider.

-Matt