Plug-in policy for Confluence

Someone asked for comments on plug-in policy for enterprise installation in the Confluence mailing list. So it is time for me to share my experiences on Confluence administration.

While the plugin architecture adopted by Confluence has spawned a large number of useful extensions, there are a few potential concerns to be addressed which has been amplified by the recent 2.6.0 release.

• Whether plugins are going to be supported and continued to be updated (esp after api changes)
• whether the plugin is properly designed
• whether the plugin has been tested adequately
• whether the plugin can be extensible
• whether the plugin is safe to use (without viruses/trojans)
• the amount of effort to test the plugin for each upgrade

Although we did not come up with a official policy at the moment, there are a few criteria I am using for selection.

Functionality

• Is the plugin really useful? If it is going to be heavily used, then consider it.
• User friendliness of the macro - If it is difficult to use, then most likely it is not going to be used.
• Can the functionality achieved by existing functionality like reporting plugin or other macros?
• whether any data is being stored with the macro? If the macro only extract data or reformat the data?

Support

• What will happen if the support for the macro is stopped? Any data loss or tedious data patching?
• Is the plugin developed by big company or established developers (i.e Atlassian, Adaptavist, Customware, Gliffy, ....)
• Whether there are more than 1 release? Beta releases are usually dangerous for production environment, and subsequent release indicates likelihood of future support.
• Is the plugin compatible with the current and subsequent versions (i.e http://confluence.atlassian.com/display/CONFEXT/Tagcloud+Macro)
• Is it something very complex? If it is too complex, it will be hard to migrate or extend in future
• Is the source code being provided (to cater worst case scenario to fix personally)

Stability

• Any comments or bugs raised by users in the product page in the Confluence site and the plugin's jira site?
• Whether it is easy to understand how the functionality of the plugin is achieved. It is not recommended to use something that you are not sure

Security

• Whether the plugin requires internet connection? (i.e editgrid)
• Whether the plugin require special permission to run (eg. administrators)
• Whether the plugin will break existing permission access?

Cost

• The type of license. Whether payment is required? What happens if the price of licensing has increased and the data cannot be migrated