Creeva’s World 2.0

Pic­ture from here

So I’ve taken over the posi­tion of web­mas­ter for the VCMA (Ver­mil­ion Com­mu­nity Music Asso­ci­a­tion).  This is going to start a new series as I’m going to use them as guinea pig’s for what I’ve felt non-profits need to do to sur­vive and thrive in the web 2.0 world.   They are not a big orga­ni­za­tion, and I’m sure I received this posi­tion for my back­ground and not my witty personality.

I’ve been work­ing on the site for a cou­ple of weeks and here is what I’ve found so far.   They had a pri­vate member’s sec­tion on the old site to share files and per­sonal data.  This sec­tion was pass­word pro­tected, but the user­name field was just a front, as long as you nkew the pass­word any­thing you put in the user­name field was accepted.  Since I’m a secu­rity engi­neer, this just wasn’t going to work for me.  I’ve ranted before the illu­sion of secu­rity and how illu­sion­ary secu­rity wasn’t worth­while at all any­ways.  The other prob­lem was that their mem­ber page “pass­word pro­tected” sec­tion was just a javascript that rewrote the “HTTP GET” to a file named a com­bi­na­tion of the requested page plus the pass­word.   So if the page was index.tml and the pass­word was “pass­word” the end­ing HTTP in the “HTTP GET” com­mand would be indexpassword.html.   Since it was still a plain text file with­out any encryp­tion on it, in the­ory it could still be spi­dered and stored by google, thereby com­pletely under­min­ing any secu­rity it was giv­ing them.

I’m work­ing on a bet­ter and more secure solu­tion while main­tain­ing the bal­ance of ease of use.   I don’t want to bur­den them too much on the secu­rity side.  I’m sure some of the older mem­bers would blink at me with a blank stare if I handed them secureID tokens to access their newsletters.

Pic­ture from here

The next thing I dis­cov­ered is that code each web page by hand, ugh.  There was no way I was going to main­tain each HTML man­u­ally and hope for any sem­blance of style and con­ti­nu­ity between pages (an issue they had in the past).   They had been using Front­Page and offered to buy me a copy.  First no, no and no — cur­rently I’m using Linux on my main com­puter (Ok I dual boot into XP and between WoW and Net­flix stream­ing I don’t get into Ubuntu as much as I should), so Front­page was out.  They were insis­tent at first that this is how it was done, I how­ever read­justed things.  I moved them to Word­press which I’m not using as a blog but rather as a CMS (Con­tent Man­age­ment System).

Pic­ture from here

I man­u­ally migrated the data from the old HTML files, I spent hours con­vert­ing the front page data to be “clean” data that i can migrate and copy paste any­where.   I was a dum­b­ass though, I should have just copy and pasted the text into notepad or a generic text edi­tor, then I wouldn’t have had all the back­ground crap.  This is my nore to myself to now be stu­pid next time.  I added images and a javascript nav­i­ga­tion menu, but essen­tially the page was just a cleaned up (easy to main­tain now) ver­sion of what they already had.

Now the next step is to migrate them to Google Apps for their mem­ber related information.…..

Some­how I always end up vol­un­teer­ing for Ver­mil­ion non-profits, now if only I could get one of them to pay me.…..