Another security release for CiviCRM

In a fairly unusual move, CiviCRM has released its second security update (versions 6.16.5, 6.17.1, and 6.10.10 ESR) in two days.

A core team member explains:

This is quite unusual; but tldr -- it's very similar to another highly critical advisory from earlier today. So if we didn't fix it quickly, the odds are that someone else would recognize it soon.

If you were really on the ball and upgraded yesterday afternoon (versions 6.16.4, 6.17.0, and 6.10.9 ESR), you’ll want to upgrade again for this one. I’m re-doing some upgrades myself today.

Why this is a good thing:

First, let’s acknowledge that two security updates in two days is inconvenient. Nobody likes inconvenience.

But it’s also great to know that the CiviCRM security team is catching these things and pushing out the fixes.

Security and convenience will always be trade-offs.
In this case, I recommend trading in favor of security.

Any questions about this, pelase let me hear from you!

All the best,
Allen

A better mousetrap

Duplicate records are like household pests:

If you find one, there are probably many more you haven't seen. Yet.

The problem is: finding and removing them is usually hard.

Try this in CiviCRM:

Install the Duplicate Monitor extension.
Then, add its "Dedupe Monitor Alert" dashlet to your CiviCRM Home dashboard.

While you're not even looking, this extension will use your existing duplicate-matching rules to quietly scan your entire database for duplicates, and alert you of any it finds, through that dashlet.

You can also configure it further, but don't worry about that right now.

Just install it and let it work.

That alone will be a big step forward in clearing out those pests.

All the best,
A.

Cleanup by deletion

Should you delete old CRM contacs?

If your CRM has been around for a while, you might have considered it.

Lots of folks have strong opinions:

• “Deleting is permanent, and you may be losing something valuable. Never delete!”

• “Maintaining data you don't need is costly and wasteful. Delete them!”

If you already have strong feelings about it, congratulations.
You know what to do.

For the rest of us, there are considerations:

• Does your CRM have tiered pricing based on total number of contacts?
  That's a financial expense, with no easy workaround.

• Are you constantly struggling to eliminate truly inactive contacts from your workflows?
  That's a mental expense, but there are ways around it.

• Is a contact you haven't heard from in 20 years worth keeping? 10 years? 2 years?
  The cut-off is usually not obvious.

So:

If you must keep your total contact count below X thousand,
you may need to delete some.

If you're confident that contact records with no activity in the last X years
can't possibly contain useful information,
you could delete some.

But for other cases,
it's probably worth putting some thought into classifying them
into one or more levels of activity/inactivity.

If you can do that,
most CRMs offer tools to help you mark them as such (CiviCRM does).

Once you work that out,
you can get the inactive ones out of the way without having to agonize over deleting them.

All the best,
A.

Cleaning data is a continuous effort

Keeping your data tidy and useful is an ongoing effort -- just like with any other collection.

For example:

My wife does a lot of costuming work at our local community theater.

For decades they had a large costume warehouse space.
With patience and experience, you could find almost anything you wanted there.

But it was a mess.

Volunteers came and went.
Nobody really kept it organized.

A couple of years ago they converted that space for another purpose,
threw out more than half of the costume pieces,
and moved the remainder into a new,
shiny,
smaller
costume closet.

The result was something that could be much easier to manage.

It's definitely easier to find things now.

But there's no guarantee.
A few more seasons will tell the tale.

Whether it remains neat and tidy,
or becomes another mess
-- albeit a smaller one --
depends entirely upon how they manage it.

Somebody needs to be in charge of ensuring:
things get put away properly,
new items get filed correctly,
damaged pieces get repaired or removed,
and resources aren't wasted acquiring duplicate pieces.

It's an ongoing effort.

Because systems don't organize themselves.

Sounds familiar?

Yep.

It's a lot like your CRM. :-)

All the best,
A.

Security update, next Wednesday: CiviCRM

Be advised, CiviCRM has announced a security update to be released next Wednesday night, August 5:

There will be a small but critical security update for CiviCRM on Wednesday, August 5 (US/Pacific Time). Updates will be provided for the following releases:

• CiviCRM v6.17 (August release; for the release-candidate, see https://download.civicrm.org/latest/)

• CiviCRM v6.16 (July release; future ESR; for current download, see https://civicrm.org/download)

• CiviCRM v6.10 (January release; current ESR; see https://civicrm.org/esr)

We expect the release to become available near the end of the day (TZ conversions).

Be ready:

Operational Assurance subscribers (and others who already have an arrangement with me for updates) can rest easy — this update will be applied to your site.

If that’s not you, I encourage you to be ready for this update.

All the best,
Allen

“Inactive” contacts?

Here's one way you can begin sorting out your messy CRM data.

Tag your inactive contacts, and start using that distinction frequently.

Some CRM systems try to make this easier by letting you silo inactive contacts.
In others, you just create a tag called "Inactive", and use that in groups, searches, etc.

But the hard part here is not using the software.

The hard part is actually defining what we mean by "inactive contact."

In other words:
When a human staff member examines any given contact record,
how can they decide if it's inactive?

Is it based on event attendance? Event registration?
Last contribution date? Any activity at all?
How long ago? Is the time window the same for all types of activity, or for all donation amounts?

Before you can start marking folks inactive, you have to define those parameters.

It can be hard.

But it can be done.

And more importantly, it can be worth it,
especially if you're already noticing the mental burden (and other costs)
of having inactive contacts scattered amongst your working data.

You could probably take half an hour this week to think it through,
examine some contacts,
and write down a good definition of an inactive contact.

Once you have that,
you (or your staff) can start marking them,
and then start treating them accordingly.

It just takes that first step to get started.

All the best,
A.

Messy data? There’s hope yet.

Is your CRM starting to feel like somebody else's junk drawer?

Can't distinguish which members are most engaged,
on the verge of dropping out,
or completely dormant?
Spending far too long trying to identify the donors
who would just need a nudge to increase their annual gift?

Don't throw up your hands just yet.

You can fix this, even with your limited resources.

The "secret" to clean and reliable CRM data is probably a little too obvious. You "just" need to:

• Approach your data with a systems mindset. Don't allow anyone to treat it like a drunk drawer. Ever.

• Design an organizational system for tagging, grouping, and reporting that supports your strategy for outreach, member engagement, and donor management.

• Ensure that any staff who can edit data actually understand your system and their place in it, that they have a common vision for that strategy and how your CRM data will support it. They're not just creating records, they're building a library of useful information.

• Make a regular practice of finding and merging duplicate contacts and improving your own organizational system.

Of course the problem is: Who the heck has time for all that?

So here's the trick:

First, admit that you have limited time, staff, and budget.
They will never be enough to implement the "perfect" system.

But don't stop there.

Notice that you do have some time, staff, and budget.
You can use those to tackle some of the biggest challenges with your messy data.

Could you give this 1 hour of your time each day?
What about 1 hour per week?

If you can do that, there's hope.

So:

Look through that "secrets" list again.

Which one can you spend just 1 hour on, this week?

All the best,
A.

Should your members log in?

Letting your members log in to your CRM has a lot of upside.

• Consitutents can do a lot without your help:
  Update their own data.
  See their giving history and membership status.
  Catch up on pending payments (membership dues, pay-later event fees, etc.)

• Duplicate creation goes way down.
  They’re logged in, so the CRM knows who they are.

• You can control access to members-only features and other substantial membership benefits.

But it's not all hearts and rainbows.

• Some people just won't want to log in.

• Some people will contact you repeatedly for help with their password.

• Members-only features take careful planning to get right, and careful maintenance to keep right.

I've got clients in both camps:

• Some are getting huge value by keeping their members informed, engaged, and empowered.

• Some are just not willing to open what could be a can of worms for their limited staff.

There's one way to find out if it might be right for you:

1. Articulate exactly why you'd want it.
   How would it benefit your mission?

2. Articulate exactly why your members would want it.
   What would they get out of it that would be worth keeping track of yet another password?

3. Create a small online limited-time offering that you think your members would value.

   A handbook,
   a report,
   a simple directory,
   a printable "super supporter" membership card,
   a desktop wallpaper,
   early access to an upcoming event,
   almost anything that’s cute or fun or useful.

4. Limit that offering to logged-in members only, and run a test for 2 weeks.
   If you get traction, it's a sign that this is the kind of thing your members appreciate. Make plans for more engagement.
   If you hate the experience, or your members just don't care, you've learned something important and haven't lost months of effort.

It's another way to make small bets that could produce big wins.

All the best,
A.

Security updates

Is your system running with the latest security updates?

If you're on WordPress, you should check on that now.

WordPress released a security fix last week that has been causing lots of trouble.

Compromised sites.
New admin users created.
Sites defaced or quietly misused.

If you're on another CMS, it's still worth checking on.

Security updates are not something you want to sleep through.

All the best,

A.

P.S. If you're on Joinery's Operational Assurance plan, you're already covered. If not, check with your tech team to be sure you have a good plan in place.

Thin

The peach tress in my backyard are done producing for the year.
Results are mixed.

For one of them -- but not the other three -- I took the time early in the season to thin the fruit.

Thinning always feels wrong.
I'm literally plucking dozens of tiny peaches and throwing them into the compost.

Part of me always imagines each of them large and sweet and juicy.
Culling them seems a shame.
Maybe I should let them all grow.

But now I wish I'd thinned all four trees.

Because where I thinned, I got fat juicy peaches.
And where I didn't, I just got a bunch of hard tiny fruit.

Sometimes getting the best results means deliberately giving up on perfectly good possibilities
so the ones you keep have room to flourish.

All the best,
A.

The question is worth more than the answer

Ever try to learn a new language?
Or swing dancing?
Or to play an instrument?
Or any system that requires more than a handful of facts to operate?

Could you do it just by quizzing an expert?

Or would you need to spend time trying, rethinking your approach, observing the results, and repeating that hundreds of times?

Of course for that kind of learning, just "asking questions" and "gettting answers" isn't enough.

You have to let your mind spend time in the problem.

Form your own theories about how the whole thing works.

Test those theories; see if they match the real world; and adjust them until they do.

Repeat that process, and you'll get deep learning that goes beyond memorized facts.

Skip it, and you just get whatever it is that comes with quick answers.

All the best,
A.

The message that sticks

Every communication you send contains both an explicit message and an implicit one.

Whether you're training a staff member, reporting to your board, or appealing to your donors.

The explicit message is usually something like:

• Here's our standard procedure.

• Here's a summary of our status, strengths, and weaknesses.

• Here's how your donation helps.

But along with that comes an implict message.

How you handle questions and surprises.
Your reaction to push-back and challenges.
Your choice of analogies, incentives, and priorities.
Your underlying emotional state.

What can be surprising is this:

Long after the explicit message is forgotten, the implicit message sticks -- and pretty deeply, too.

Of course, if you're not careful, you can send a lot of implicit signals that contradict the good things you’re trying to say.

But if you're paying attention, you can communicate a lot of good things implicitly:

• I'm hopeful, and with good reason.

• I care about your interests.

• I think you're valuable, capable, and good.

• I actually believe the things that I’m saying.

Do that often enough, and you'll be building the culture you want to see.

Because culture isn't built only by what you say.

It's built by what people learn while you're saying it.

All the best,

A.

“Chasing the system”

When something unexpected happens in your CRM system, you have two choices.

You can chase the system.
Or, you can try to understand it.

"Chasing the system" is my term for hacking away at things just enough to make them look good.

A report seems wrong?
Change the data until the report looks right.

Someone didn't receive a mailing?
Add them to a different group.

Staff member gets an error?
Give them another permission.

Sometimes it even makes the symptoms go away.

But your understanding doesn't improve.

Do that often enough, and you end up with a system full of mysterious fixes that nobody understands and everybody is afraid to touch.

The alternative feels slower.

Instead of asking, "What should I change?"
Ask, "Why did this happen?"

That one question changes everything.

Every answer makes your mental model a little more accurate.

And over time, that's what makes you effective.

The point isn’t to memorize every setting in the system.

It’s to understand the system well enough that you can predict what it will do before you change it.

All the best,
A.

Delegating or babysitting?

One of the biggest jobs of a manager is delegation.

Because if every decision has to come back to you,
your organization can't really grow.

Of course, effective delegation doesn't begin with delegation.

It begins with onboarding:

• Helping someone understand how you do things.

• Giving them context.

• Teaching them what "good" looks like.

• Answering questions while the stakes are still low.

But it doesn't end there.

It continues through ongoing investment:

• Regular conversations.

• Feedback.

• Encouragement.

• More context as their responsibilities grow.

Skip those investments, and something weird happens.

You still think you're delegating.
But you're probably babysitting.

Every decision comes back to you.
Every task needs reassurance.
Every mistake becomes evidence that "I guess I just have to do it myself."

The funny thing is...

Babysitting often feels cheaper than good onboarding …

Right up until you realize you've been answering the same questions over and over for the past six months.

All the best,
A.

“Explain like I’m 5”

Every organization has things it needs to explain.

To staff.
To volunteers.
To donors.
To the people it serves.

And surprisingly often, one page is enough.

Now and then, a client will ask me to help them work up some "one-pagers" for their staff.

I almost always say yes.

Here's one I made recently for client staff who are testing a new login feature:

Sure, a one-pager isn't as flashy as a 30-minute training video.
It's not as detailed as a 20-page annual report.

But people read it.
If it's well done, they remember it.
And when they need it again, the info is right there.

Here's what I've learned:

It's tempting to try and explain everything.
But people don't usually need a comprehensive explanation.

They just need enough
to understand the idea today
and a quick way
to refresh their memory tomorrow.

Whether you're training staff,
or encouraging donors,
or helping someone reset their passord...

The one question worth asking is not,
"Am I covering all the bases?"
but,
"What do they really need to know?"

Because the goal of communication isn't completeness.

It's understanding.

All the best,
A.

Someone to show up for

We usually think coaching gets us "access to expertise." But it also gets us someting even more important: someone to show up for.

---

Big improvements usually come from consistent effort over time.

The hard part isn't knowing what to do.
It's doing it again next week.
And the week after that.

Something I've noticed in my own life:

The things I do with other people tend to stick.
The things I can do "whenever" are much easier to postpone.

My Brazilian Jiu Jitsu classes happen at scheduled times, with people who expect me to be there.
My strength training plan is completely flexible. If I skip in the morning, I can pick it up in the evening. Maybe.

Guess which one I've been more consistent with,
and made the biggest improvements in.

It's made me think differently about coaching:

Sure, you're getting access to expertise.
But you're also getting accountability.

Because "see you next Tuesday at 3:00" isn't an abstract promise to our future selves.
It's an appointment with another human being.

It doesn't just improve the quality of your effort.
It improves the consistency of your effort.
And that's what matters over time.

Because the opposite of accountability isn't laziness.
It's optionality.

Your gym is always open.
Your great American novel is always waiting.
That side project can always start tomorrow.

A coach changes that.
They convert "I should work on this sometime" into "I'll see you Thursday."

That's a much more profound shift than simply receiving advice.

If you're struggling to make progress on something important,
don't just ask whether you have enough information.
Ask whether you have enough accountability.

Sometimes the missing ingredient isn't a better plan.
It's another person expecting you to show up.

All the best,
A.

It never hurts to ask

1. Burnt bulbs.

So I'm out of town to attend support a client at their annual conference in Florida.

And my wife tells me she got pulled over last night because her license plate lights are out.

Normally, this would be "my area," but this time I'm just not available.

I figure she'll just have to pick up the bulbs herself and wait until I get back to install them.

But nope.

Next day she texts me, "I went to O'Reilly's to buy the bulbs, and he installed them for me."

2. Blocked email:

Last week a coaching client simply couldn’t get outbound email working in CiviCRM.

We looked at it together and verified everything was set as it should be, but no luck.

I suggested he check with his hosting provider to see if there might be something blocking the connection at the server level.

So he reached out to them.
He also asked on the CiviCRM Q&A site, in case anyone else had ideas.

Next day he emailed me, "I contacted the host, and they showed me the setting to change in my hosting control panel." Problem solved.

Here’s the thing:

Everyone needs help sometimes.

And there's never just one place to get help.

CiviCRM StackExchange
CiviCRM Community Chat
CiviCRM Doc Bot
Your hosting provider
Your own CiviCRM advisor

When you can’t figure it out on your own, it never hurts to ask an expert.

All the best,
A.

“Happy to help”

The past few weeks have been a rough time in the lawn-care department at the old Shaw homestead.

A few consecutive rainy weekends…
A busy travel schedule…
Commitments at work and with kids and extended family…

all meant that I had my hands pretty full this past weekend.

But the sun was out, and I was determined to restore that lawn to its former beauty, come hell or high water, as Grandpa used to say.

My daughter was in town.
She said, what are you doing this weekend?
I named about six things, including the neglected lawn.
And she said...

"Come on, let me mow that lawn for you."

Well, okay then.
Bang.
Done.

I offered to pay her.
But she wouldn't have it.
She was just happy to do it.
I was skeptical of that, but it seems to be True.

Here's the thing:

When you're very busy,
it's easy to focus on how busy you are,
and to think that the only way out
is to get busier.

But sometimes,
if you look around,
you'll find there are people
who are happy to help.

Why not let them?

All the best,
A.

It’s not always easy

I went back today and reviewed our participant feedback from the CiviCRM Admin Training in Toronto last month.

Interestingly, almost all of them highlighted something we kind of suspected already:

For such a broad topic as “administering CiviCRM,” it’s hard to find exactly the right balance between “covering everything” and “getting deep on the topics that matter to each participant.”

Even in a two-day course, some folks had questions that we didn’t have time to dig into.

Even in a small group of a dozen-or-so participants, some felt overwhelmed by all the new information, while some others endured explanations of areas they’d already mastered.

Fortunately, everyone got something out of it, and they all reported that it was worth their time and effort to attend.

My take-aways here:

• Group trainings (or generalized documentation) can make it hard to target the precise level of interest and experience of any given individual.

• Even when you’re experienced in one area, mastering new concepts can still be a challenge — there’s always something new to learn, when you’re ready for it.

That’s just the nature of things:
we learn;
we get comfortable;
we get a new idea;
then we need to learn more.

And if we can get the right kind of help at the right time, we usually find it’s worth the effort.

All the best,
Allen

Outbound email delivery: Alphabet soup

Yes, after two previous emails about configuring CiviCRM for outbound email, I’m on my third.

(This really is one of the most overlooked configuration steps among CiviCRM sites.)

So let's talk about three acronyms that most people would rather ignore:

DMARC.
DKIM.
SPF.

Sure, they sound like technical gobbledygook.

The good news is that you don't need to understand the technical details to get this right.

But you do need to get this right -- inbox providers take it very seriously.

When Gmail, Yahoo, Apple, Outlook, and other providers receive a message claiming to be from your organization, they want proof that the message is legitimate.

That's what DMARC, DKIM, and SPF are for.

Think of them as a set of credentials that help verify:
The message really came from your organization.
The message wasn't modified in transit.
The sender is who they claim to be.

If those checks aren't configured correctly, your email will very likely bounce.

Or worse, it will just be silently routed into nothingness -- no one will receive it, and you won't even get a bounce notification.

So, how to configure all this stuff?

Most email delivery services provide step-by-step instructions.
For example, SendGrid's domain authentication wizard will tell you exactly how to set this up.

And once configured, these settings usually require very little ongoing attention.
But it does make a huge difference -- and it does need to be done.

Because in today's email ecosystem, properly authenticated email isn't an advanced optimization.

It's the price of admission.

All the best,
A.