Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Introducing U.S. Web Design Standards

medium.com

Post reply on HN
Print view View original

81–90 of 90 posts

Re: Introducing U.S. Web Design Standards

#81

Post by lefler »

zeckalpha wrote: post #58
Animats wrote: post #3

The Medium article says to visit the site for the standards.[1] That yields: MAX.gov Application Unavailable If you are seeing this message and it is not Sunday 2AM-8AM ET then please contact MAX Support by clicking here. If you’re trying to access MAX Community, please use our snapshot site: MAX Snapshot Community Site "MAX.gov" appears to be some kind of in-house cloud service for the Federal government. [1] https:…

It's not fully in house. The idea is to centralize management of services (both in-house and external) for budgeting reasons, since MAX is part of GSA which is part of the OMB (Office of Management and Budget).

MAX.gov was kind enough to run us a proxy in order to support https, and that proxy had a bad day under load. Described more here https://github.com/18F/web-design-standards/issues/733

Btw, GSA and OMB aren't connected the way you describe. They just happen to be the respective parent agencies of 18F and USDS-HQ. Here's a tree.

  POTUS
  ├── GSA
  │   └── 18F
  └── OMB
      ├── USDS-HQ
      └── MAX

Re: Introducing U.S. Web Design Standards

#82

Post by acdha »

toxican wrote: post #78
hiharryhere wrote: post #60

There's a number of comments here about this making phishing easier. The bigger issue is that the US gov doesn't consistently use .gov domain names. http://www.ustraveldocs.com/ This is the official US gov site for applying for a visa. Given there are so many dodgy immigration agents operating with .com addresses it makes no sense as to why the official site is not just 'visa.gov'.

Can anyone think of any reasons that any and all interaction with the US Government via the web shouldn't take place via a .gov website? If something like healthcare takes place on a .gov site, visas definitely should.

Good reasons, no, but check out what getting a .gov domain looks like:

https://www.dotgov.gov/portal/web/dotgov/registration-proces... https://www.dotgov.gov/portal/web/dotgov/policy#10217335

It's really easy to imagine a lowly staffer with an unrealistic deadline or contractor deciding to register a .com to use for a demo and thinking they'll go through simply learning who the official contact is, getting the agency CIO / agency head to sign off, dealing with internal politics[1], etc. later and then never actually getting around to that part. At some point the argument probably became “Now we've advertised it too much to change”.

1. At large organizations both public and private I've seen this kind of fragmentation happen because person A wanted a project to exist and person B, who controlled DNS, thought it should be included in their application (horrible vendorware, the first big Cold Fusion project they personally managed which will be upgraded over their dead body, etc.).

Re: Introducing U.S. Web Design Standards

#83

Post by toxican »

acdha wrote: post #82
toxican wrote: post #78

Earlier quoted context omitted.

Can anyone think of any reasons that any and all interaction with the US Government via the web shouldn't take place via a .gov website? If something like healthcare takes place on a .gov site, visas definitely should.

Good reasons, no, but check out what getting a .gov domain looks like: https://www.dotgov.gov/portal/web/dotgov/registration-proces... https://www.dotgov.gov/portal/web/dotgov/policy#10217335 It's really easy to imagine a lowly staffer with an unrealistic deadline or contractor deciding to register a .com to use for a demo and thinking they'll go through simply learning who the official contact is, getting the agency…

The process looks about as bureaucratically complicated as I would expect.

Re: Introducing U.S. Web Design Standards

#84

Post by chris_wot »

Ntrails wrote: post #75
chris_wot wrote: post #73

Earlier quoted context omitted.

Disclosing the vulnerability - what law could they prosecute you under?

Depends how you found/testes/found it. In general it's a case of being uncertain what they could do if they decided to.

Holy Typo Batman!

Re: Introducing U.S. Web Design Standards

#85

Post by tptacek »

philliphaydon wrote: post #67
benaiah wrote: post #49

Earlier quoted context omitted.

Re-reading this a couple hours later, I agree. I responded to needless negativity with more needless negativity. Guess my IRC habits have been leaking into my other hobbies. I'd edit it, but it's been too long since it was posted.

There's no need to apologise for using the word bullshit. It's bullshit that we have to be PC about words we use.

This is nothing to do with political correctness. The word "bullshit" is perfectly fine; it's the way it was used here.

Re: Introducing U.S. Web Design Standards

#86

Post by acdha »

toxican wrote: post #83
acdha wrote: post #82

Earlier quoted context omitted.

Good reasons, no, but check out what getting a .gov domain looks like: https://www.dotgov.gov/portal/web/dotgov/registration-proces... https://www.dotgov.gov/portal/web/dotgov/policy#10217335 It's really easy to imagine a lowly staffer with an unrealistic deadline or contractor deciding to register a .com to use for a demo and thinking they'll go through simply learning who the official contact is, getting the agency…

The process looks about as bureaucratically complicated as I would expect.

Yeah, and I'm not even sure that's wrong: trusted top-level domains should be hard to get since they'd make great phishing sites.

There are something like 5,300 domains on the list currently:

https://github.com/GSA/data/blob/gh-pages/dotgov-domains/201...

I'm curious how many of those are actively supported and secure – I'd bet there are a least a few where almost nobody even remembers registering it.

Re: Introducing U.S. Web Design Standards

#87

Post by Symbiote »

JorgeGT wrote: post #2

That's a great initiative. Being from a country that changes the URLs of a bunch of ministries (and breaks half of them) each time a new government takes charge, I envy it! Now, for improved consistency, adopt the metric system.

I saw a presentation from the Gov.UK folk about keeping URLs working, when they migrated from the 2000s-era site.

They tried to keep everything going somewhere useful, and had examples of URLs printed on mouse mats, mugs, notebooks etc -- as well as the obvious official forms which might remain valid for decades.

Re: Introducing U.S. Web Design Standards

#88

Post by Symbiote »

noir_lord wrote: post #76
dbarlett wrote: post #53

Earlier quoted context omitted.

If you're curious, Forest Service signs are specified by Sign and Poster Guidelines Engineering Manual EM7100-15 [1]. [1] http://www.fs.usda.gov/Internet/FSE_DOCUMENTS/stelprd3810021...

That standard is incredible, I had a good flick through it just in awe of the level of specification that goes into signage, I love that type of stuff, it's a hidden world.

The British standards for road signs and markings are also online, and with much better typography :-)

https://www.gov.uk/government/publications/traffic-signs-man... (chapter 7 is best, for kerning rules, and making and face the right way).

Re: Introducing U.S. Web Design Standards

#89

Post by Animats »

lefler wrote: post #81
zeckalpha wrote: post #58

Earlier quoted context omitted.

It's not fully in house. The idea is to centralize management of services (both in-house and external) for budgeting reasons, since MAX is part of GSA which is part of the OMB (Office of Management and Budget).

MAX.gov was kind enough to run us a proxy in order to support https, and that proxy had a bad day under load. Described more here https://github.com/18F/web-design-standards/issues/733 Btw, GSA and OMB aren't connected the way you describe. They just happen to be the respective parent agencies of 18F and USDS-HQ. Here's a tree. POTUS ├── GSA │ └── 18F └── OMB ├── USDS-HQ └── MAX

GSA, the General Services Administration, is the purchasing, construction, and building operations unit of the US Government. They're a huge operation, with a $20 billion budget and operations all over the US. The Office of Management and Budget is a White House staff unit with about 500 employees, most in an office building next to the White House.

GSA has forklifts. OMB has clout.

Re: Introducing U.S. Web Design Standards

#90

Post by zeckalpha »

lefler wrote: post #81
zeckalpha wrote: post #58

Earlier quoted context omitted.

It's not fully in house. The idea is to centralize management of services (both in-house and external) for budgeting reasons, since MAX is part of GSA which is part of the OMB (Office of Management and Budget).

MAX.gov was kind enough to run us a proxy in order to support https, and that proxy had a bad day under load. Described more here https://github.com/18F/web-design-standards/issues/733 Btw, GSA and OMB aren't connected the way you describe. They just happen to be the respective parent agencies of 18F and USDS-HQ. Here's a tree. POTUS ├── GSA │ └── 18F └── OMB ├── USDS-HQ └── MAX

Thanks!
Post reply on HN