I share your opinion of Joomla. Unfortunately, I have sort of similar feelings about Plone/Zope. I operated a Zope, and then Plone, site for about three years. You may note that despite that, I don’t run it for Virtualmin.com.
Security-wise, it’s solid, but upgrades are horrible, and they’ve reinvented every wheel (including the database) so the learning curve is huge. I’ve met several of the developers of Zope and Plone (I did contract work for Zope Corporation for quite a while several years ago), and I have an extremely high opinion of all of them. But, it’s a very intimidating system for anyone that can’t devote full-time effort to understanding it.
As you note, Plone and Zope are somewhat difficult to make go fast. That was actually the work I was doing for Zope Corp…I helped them with their Squid deployments for customers. In the end, it’ll scale pretty well, but again you have to know what you’re doing and devote a lot of effort to the task. Zope runs Boston.com, for example, which is a very high load environment.
But scaling was never the most difficult problem for me. I could just never wrap my head around the system…when I tried to develop for it, I got completely lost.
Our new website is built on Drupal 6. I’m finding it pretty solidly designed. Upgrades, so far, have been astonishingly nice; I did an upgrade from 5.x to 6.x, which worked flawlessly and exactly according to the documentation. I can’t emphasize enough how important upgrades are. Joomla is a nightmare in this regard. Current Virtualmin.com is a hodgepodge of old and new versions of stuff held together with chewing gum and baling wire, and it barely works at all (and anyone that has used the forum, bug tracker, or shop, has seen at least one of its major warts). And, of course, it will never run Joomla 1.5, since you must “migrate” rather than upgrade…since that’s the case, I decided it was worth “migrating” to a system that wouldn’t make my life a living hell.
is it Plone or python that gives it its bad rap?
Anyway, I can’t really tell you what the best choice for your requirements will be. But, I can say that I’ve been very pleasantly surprised by how well Drupal works and how well it is designed. The learning curve has been very short, for me, and I’ve been able to get working code written in a few afternoons worth of experimentation. It also has a powerful and elegant content model which makes building new applications pretty easy, relatively speaking. I wish I’d chosen it over Joomla a couple years ago when I switched us off of OpenACS.
Oh, and we’re using UberCart for the shopping cart. I don’t have an opinion of it, just yet, as I’m still figuring it out, but it appears to integrate very cleanly into Drupal (unlike the shopping cart options for Joomla, which are mostly poorly bridged in non-Joomla apps, or forked from non-Joomla apps and have never really been fully integrated in), and uses the Drupal content model. It also seems to have a nice hook system for doing custom development, which was something that was really difficult in Joomla with VirtueMart (the license manager here at Virtualmin.com was way more difficult to build than it should have been, and it works very poorly; partly that’s my own incompetence with PHP…but it’s also really difficult to hook into VirtueMart reliably).