Local Government Web Network

8 Comments

1. Hey, I found you in google and glad i did, this is just the topics that I was looking for. Btw, my blog is dofollow, stop by and grab a link. Komo

   Comment by Blackhatseo — July 20, 2008 #

2. We celebrate web design but the same people are also a big way responsible for the web application security problems / security issues that affect the Internet. Most web developers have no idea about the problems they give the companies they provide a site too! We see it every day!

   I believe a pre-req to any award should be that the site should be secure and tested. How pretty it is makes for a fleeting benefit! The damage some web developers do to a business is business threatening! We see it every day!

   Sorry to put a negative here but reality is reality! Positive is that we are being engaged by some marketing companies now to train their dev team in secure coding practices. This is not a marketing thing for me. This should not be seen as something not in your sphere of work. Realities are that my company or someone else’s will rip apart your badly developed sites soon at the customers request due to good assurance practice or things like PCI DSS and your customers will question your abilities. Message; develop securely!

   Comment by Drazen Drazic — July 22, 2008 #

3. Good point Drazen, but you have to draw the line somewhere and I think the scope of the McFarlane Prize is fairly well defined to the boundaries of the front-end public interface.

   You have to draw the line somewhere … because if you start looking into security (which I guess you can argue covers front-end aspects of forms, SQL injection etc) then why not performance, with load and stress testing? That’s too much for an award like this.

   Also, hard to exhaustively security test a site without intrusive testing with the risk of breaking a production site, which is going to be hard for web development teams to get approval for. While it’s nice to be awarded the McFarlane Prize it’s not worth bringing a site down to see if you’re site is worthy … and it’s unlikely judges are going to get access to staging or pre-production environments.

   But yes, good points and I strongly encourage all web application developers to learn about the risks inherent in the various web server stacks, platforms and technologies and ensure they deliver secure sites.

   Comment by NathanaelB — July 23, 2008 #

4. Valid points and I suppose I was pretty hard with the comments. Blaming a bad day and just seeing too many organisation’s problems first hand from poorly developed sites. No offence to classy developers

   Comment by Drazen Drazic — July 23, 2008 #

5. Hi Drazen,

   fair point about security - but have you taken a look at our criteria and judging process? This certainly is not a beauty pageant (unlike a great many awards) or popularity contest (like many others are). There are two rounds of testing of adherence to best practice in the areas of coding, accessibility, usability and design, using both machine testing, and expert judges. While security is not explicitly part of this, at least one coding judge in the past has looked into aspects of secure coding. Testing how backend security works, as Nathanael suggest, is very problematic - would folks turn over their code to us? Should we try hacking the site to see how secure it is? Both of those have ethical and practical issues.

   But, it is a fair point that security is a much under appreciated aspect of best practice (and one we re covering in our conference this year in detail). We’ll give some thought as to the practicality of having a “security” judge in future years.

   Thanks

   john

   Comment by John Allsopp — July 23, 2008 #

6. Every site now requires some level of backend coding, and building an accessible and usable site also depends a lot on the scope of the site or the functionality it provides. Let’s say, if the site involves heavy form submit, ajax effects, user interaction, etc. the chance to make it accessible (or well passed the machine testing) would be much lower compared to just simple static html sites. The site might still work properly and nicely for the end users but it involves heavy js and show/hide effects which might not be very user friendly for the disabled. So it sounds like to win the price, it’s better to develop a very simple static and compliant sites although it might not be very useful and users might find it “boring”? I dont have any negative point on the prize, but just wondering which types of websites would be a good candidate and have higher chance to win. I and my mate are working on a site which we aim to the providing good user interaction via ajax form submit, google map, etc. But this is one of the concerns that we have when we’re thinking of submitting the site to the McFarlane price. Am I right? Please correct.

   Comment by Khoa — August 25, 2008 #

7. Hi Khoa,

   I would recommend getting in touch with John at Web Directions who runs the McFarlane prize, perhaps comment on his blog post

   Comment by Diana — August 25, 2008 #

8. Hi Khoa,

   while many people think so, accessibility and web applications can go together. And while it may appear a little more difficult, it’s no less important (in some ways perhaps a lot more so) that such sites be accessible.

   In Australia, web sites, like any other service or business, are subject to the disability discrimination act.

   Best practice in any web design involves accessible design, regardless of the nature of the site.

   Keep in mind, accessibility is one part of the equation for the prize - and so sophisticated web sites that are accessible are more, rather than less likely to win.

   To learn more about accessibility for web applications, we in fact have a workshop at our conference by renowned accessibility expert Derek Featherstone “Real World Accessibility for Ajax and Web Apps”

   http://south08.webdirections.org/?cat=3#post-60

   which addresses exactly these issues

   thanks, and hope this helps

   john

   Comment by John Allsopp — August 25, 2008 #

Sorry, the comment form is closed at this time.

Supported by: