# Presentation: 206518

## Internet Dissemination Techniques (Draft)

- Dr. Mark Rodekohr
- Energy Information Administration
- February 2003

## Overview

- Introduction
- Some Examples of Creating Simple Web Sites
- Developing Standards
- Advanced Topics (search engines, java, etc.)

## Introduction

- Start by defining a purpose for your web site.
- This should be followed with a paper outline of the introduction or home page.
- Next identify a logical file structure that is designed to:
- Support the home page structure
- Make performance tracking simple
- Be as simple but as understandable as possible

## Common Purposes

- For corporate sites the purpose can be thought of as attracting and informing investors, attracting and informing customers, attracting and informing employees and attracting and informing suppliers.
- For government sites the purpose can be thought of as informing the public, attracting and informing employees, attracting and informing potential suppliers and attracting and informing public policy makers.
- You should note that I have not listed as a purpose “the creation of a better image for public officials”.  While this is a clear purpose for these elected officials I will not discuss the creation of these types of sites.

## Some Common Mistakes

- Design a site around a organization structure (most people could care less what your office structure is).
- Having a very verticle site that requires users to make many clicks to find the information they are looking.
- Think that you only have a site if all of your information is on it.  Start small and add more data and information over time.

## Example 1

- After outlining the site start with Word.
- Create a web page in word.
- Add the hot links.
- Add some custom code to add the search feature.

## Example 1

## Layout

- Search is in the upper left (becoming a industry standard)
- Topics in the lower left.
- News on the right
- Contacts and file information on the bottom.

## Adding the Search Code

- To search all files on this site, enter words or phrases,
- separated by commas, then click the "Search" button.
- <center><form method="post" action="http://www.eia.doe.gov/search?NS-search-page=results">
- <input type="hidden" name="NS-search-type" value="NS-boolean-query">
- <input type="hidden" name="NS-max-records" value="22"><input type="hidden"
- name="NS-collection" value="EIAWEBT"> <input name="NS-query" size="22" value>
- <br> <input type="image" src="images2/VERITY.GIF" border="0"></form></center><br>

## Add Title and Meta Tags

- <TITLE>Petrobangla</TITLE>
- <meta name="description" content=“Petrobangla (Republic of Bangladesh) Petroleum and Natural Gas Production and Sales">
- <meta name="keywords" content="energy, oil, natural gas, petroleum, gasoline,
- diesel, jet fuel, distillate, Bangladesh, South Asia">

## Microsoft Can’t Help Itself

- <td width=274 valign=top style='width:205.15pt;padding:0in 5.4pt 0in 5.4pt'>
-   <p class=MsoNormal><b><span style='font-family:Arial;color:#333399'><!--[if gte vml 1]><v:shape
-    id="_x005F_x0000_i1065" type="#_x005F_x0000_t75" style='width:18pt;height:18pt'>
-    <v:imagedata src="./index_files/image004.gif" o:title="new8"/>
-   </v:shape><![endif]--><![if !vml]><img width=24 height=24
-   src="./index_files/image004.gif" v:shapes="_x005F_x0000_i1065"><![endif]><a
-   href="io\bids.htm"><span style='color:#333399'>Bids Being Taken</span></a></span></b><span
-   style='font-family:Arial'> – On January 11, 2000 Petrobangla announced that
-   bids will be taken on tracks 3 and 5.<span style="mso-spacerun: yes">
-   </span>Bidding will close on March 11, 2000.<o:p></o:p></span></p>
-   <p class=MsoNormal><![if !supportEmptyParas]>&nbsp;<![endif]><span
-   style='font-family:Arial'><o:p></o:p></span></p>
- What you see is just a small fraction of the code generated by using Word 2000 most is not necessary and will not appear if you use Word 97 leaving the task of editing the html much easier.

## File Structure

## Email Notification

- You will notice that I included a email notification feature.
- The feature has turned out to be very popular and works very well when there is relatively low bandwidth.
- On the EIA site we can send 5,000 messages out in under 3 minutes, in the past it would have taken several fax machines all night to do this.
- In a typical month we send 250,000 to 300,000 email messages.

## Why Not Use Microsoft Front Page to Create Your Site

- You can and it works fairly well for small sites.
- It will get you a certain consistency for pages throughout your site.
- It also has a habit of adding unwanted and sometimes incorrect code to your pages.
- It is next to impossible to edit pages using anything other than front page.
- It can be very difficult to add the needed server extensions to anything other than a NT machine.
- That being said we will construct another web page using Front Page.

## Slide 15

## Good Example of Asian Government Energy Site

## File Structure

## Front Page

- Using their wizard we ended up with a lot of empty space and a site that required at least one more click than necessary which defeats the three click rule (I.e. design a site that only requires people to find the information they are looking for with three of less clicks).
- A good example of a site that does not follow the three click rule is the World Bank web site.

## PDF Files and Web Sites

- The first question is why bother with the portable document format files on your web site.
- There are several reasons:
- Given the existence of any popular word processing document they are easy to produce.
- Users do not have to purchase any software to view the files.
- They are easy to search.

## Standards: A Necessary Evil

## Standards: Elements

- Policy statement for what products should be posted and how.
- Publication Styles (fonts etc.) – this could be replaced by using cascading style sheets.
- Acronyms and Jargon
- File naming conventions

- Data access (3 click rule)
- Directory structure and directory naming convention
- Graphics standards (which colors to use, the number of colors and graphics size)

## Advanced Topics: Search

- Most larger web sites include a search engine.  Since navigation of large sites is difficult this is a very important feature.
- Prices of these engines range from free to in excess of $50,000.  Often times you get what you pay for.

## Were EIA is Going 

- The trouble with Verity and many other search engines is that there are many false positive results.
- Some Stanford students came up with a interesting and unique concept base the results of searches on two factors:
- What other people look at and how long do they spend on a site associated with a particular keyword.
- How many links exist to a particular page.

## Google Search Results

## More on Search

- You can use Google for free to search only your web site if you understand and accept some vague legal requirements.
- We had to drop Google due to budget reasons and now using a French developed engine that First Gov. purchased (Google lost the bid as they were to expensive)
- Since the EIA site is widely used Google rates us fairly high for many energy related searches.

## Advanced Topics: Java

- Java scripts can be used to enhance navigation.
- Most scripts you need are free they are all over the web.
- They can be abused to produce cute affects that generally do not enhance content.

## Example: Mouse Over

## Mouse Over Code

**<HEAD><TITLE>U.S. Energy Information Administration</TITLE>**
**<SCRIPT language="javascript">**
**<!-- **begin button rollover script****
**function hiLiteOn(imgName) {**
**	****if (document.images) {**
**	****	****hiLiteImage = eval(imgName + "On.src")**
**	****	****document [imgName].src = hiLiteImage**
**	****	****}**
**	****}**
**function hiLiteOff(imgName) {**
**	****if (document.images) {**
**	****	****originalImage = eval(imgName + "Off.src")**
**	****	****document [imgName].src = originalImage**
**	****	****}**
**	****}**
**if(document.images) {**
**	****overviewOn = new Image()**
**	****overviewOn.src = "images2/overview_on.gif"**
**	****overviewOff = new Image()**
**	****overviewOff.src = "images2/overview_off.gif“**
**}**
**//-->**
**</SCRIPT>**
**</HEAD>**

## Java Menu’s (this even talks to you)

## Summary

- We created two sites using different tools and noted the advantages and disadvantages.
- The sites we created were generally consistent with the standards we discussed in the previous session.
- We quickly reviewed the need for your own standards.
- We reviewed some more advanced issues including the addition of search engines and the improved navigation through the use of Java.

## Web Site Management

## Overview

- Introduction
- Owners, groups and other methods of control
- Security

## Introduction

- For a large site management is likely to be the single largest cost associated with running the site (outside of generating content)
- Hardware can be relatively inexpensive – Sun Sparc 20 machines are going for as low as $2,000
- Almost all software can be obtained for free however free software is free for a reason

## Owners, Groups etc.

- To provide some security (and I would argue IT job security) every file on a server has a owner (generally that person who created and posted the file)
- Every owner belongs to a group (which you can think of as a common work unit)
-  A system administrator assigns and maintains these designations

## Permissions

- In addition to owners and groups each file has a set of permissions associated with each owner/group.
- There are three types of permissions
- Read permission
- Write permission
- Execute permission

## Example

- Using the ls –1 myfile command:
- -rw-r—r– 1 john1  staff  335  Jan 22 13:23 myfile
- The first (–) tells us that this is a file otherwise a (l) denotes symbolic link, (d) denotes directory
- ( r) the owner has read permission
- (w) the owner has write permission
- (-) the owner does not have execute permission

## Example (continued)

- r—r– 1 john1  staff  335  Jan 22 13:23 myfile
- The next three characters tell us if any member of the group has read, write and execute permission
- The next three characters tell us if anyone has read, write and execute permission.  For all public files on a web site this set of permissions is set to read only.

## Example (continued)

- 1 john1  staff  335  Jan 22 13:23 myfile
- The (1) how many links the file has
- John 1 is the owner
- Staff is the group
- 335 if the file size in bytes
- Jan 22 13:23 was the last time the file was modified.

## Example (continued)

- All of these attributes can be changed using the chmod (change mode) command.
- For example chmod 660 myfile sets the owner permission to read and write, the group to read and write and everyone else can do nothing (not even read the file)
- This structure allows you to hide system, password and other files from the general public

## What’s the Problem

- If you are only dealing with a few files and a small number of owners/groups this system works fine.
- I would characterize the EIA web site as consistent with a mid level size site we have:
- Over 30,000 files
- About 50-60 owners which fall into 7 or 8 groups.

## What’s the Problem (continued)

- Given the fact that our site was constructed with no plan and no documentation from day 1 trying to add some rationality to owner/group/permission structure is taking countless person hours and to this day is still not working well.
- On common problem is that if someone with higher level permissions than the author changes a file then the original owner cannot change it without having someone go back and reset the permissions.
- Don’t think using NT solves this problem it is just as bad if not worse than Unix.  Even Microsoft Certified employees have trouble.

## Security: Overview

- Some security axioms:
- There is never enough security.
- It is expensive.
- Security officials could care less if your customers every get  any information and how long it takes to get it, or if your staff can post anything to your web site in a timely manner.

## Security: Recent Events

- The White House, Justice Department, and many other (including DOE) high profile government sites have been hacked over the last two years.
- At EIA we have had hundreds of attempts to break in but only one, rather benign person, got through (I still think this was a staff mistake).
- About 300 attempts were made in the two days after to mistaken bombing of the Chinese embassy.  Most of these came from Hong Kong.

## Security and Statistical Sites

- Problems to worry about:
- The mistaken early release of time sensitive information (the Bureau of Labor Statistics had this happen twice within the same month and each time it made the papers).  Automation played a role in this.
- Someone enters your site, changes some market sensitive data and within a few minutes makes a lot of money.
- Staff post inappropriate information on your web site.

## Security: An Example I

- “The five hackers, aged 15 to 17, hacked 26 Internet service providers (ISPs) in the US and overseas. They had a list of 200,000 user accounts from Pacific Bell and were able to successfully steal the passwords for about 95,000 accounts, the BBC said, adding that the crackers used the accounts to anonymously scan the networks of the Sandia and Oak Ridge National Laboratories, both involved in the nuclear weapons program”

## Security: An Example II

## Security: An Example Email 

- Unfortunately, URLs can contain other items, including parameters that can be transmitted back to the site:
- <A HREF="http://www.stuff.com?u=foo@bar.com">www.stuff.com</A> If I take the bait and visit the site, my e-mail address, foo@bar.com, can be put on a hot list.

## Denial of Service Hacking

- Network hackers engage in several sorts of activities. Some, like "denial of service attacks" or "mail bombs," are designed to swamp a computer network's ability to respond and perform its internal functions. For instance, a denial of service attack on a Web server floods it with bogus requests for pages

## Network Invasion

- Another form of network hacking involves penetrating a secure area by subverting its security measures. Network hackers might accomplish this by setting up programs that try millions of passwords until one is accepted. A hacker may set up "sniffers," programs that check data to find encrypted or sensitive information.
- Once hackers get onto the machines that host networks, they can alter or remove files, steal information and erase the evidence of those activities.

## Security: Another View

## Security: What to Do

- Limit the number of staff that have permission to post to your web site and train these staff on correct procedures.
- Give computer generated passwords every three months to these staff do not allow them to change the passwords. Also set up a three try and your out rule.
- Do not put anything on your web site (except for necessary system files) that you don’t want people to see.
- Keep your software up to date with the latest patches.
- Invest in software designed to detect attempts to break into your site.

## Email Can Affect Site Security

- Examples of spoofed email that could affect the security of your site include:
- email claiming to be from a system administrator requesting users to change their passwords to a specified string and threatening to suspend their account if they do not do this
- email claiming to be from a person in authority requesting users to send them a copy of a password file or other sensitive information

## Monitoring: People Trying to Hack into a Hacking Web Site

## Summary

- We reviewed the file characteristics with regard to owners/groups/permissions to illustrate why site management is so expensive.
- We looked at security issues including recent events and discussed the various risks.

## Conclusion

- While this presentation has been fairly technical it illustrates some of the problems associated with maintaining a web site.  It also illustrates the reason for using a ISP if you have a fairly small site as they are responsible for dealing with these technical issues.

## Conclusion

- Before you start to code:
- Define the purpose of your site
- Define the message or information you wish to present
- Sketch out your home page on a piece of paper and perhaps even your whole site on paper.
- Look at other sites with a similar purpose for ideas.
**Now you can start to code.**