Microcosm security issues?

Thank you velocio for agreeing to allow TABS to use (and test) microcosm starting next month. TABS would wish to use the microcosm as a tool for membership engagement, consultation and discussions on policy, training issues, elections etc. One issue occurs to me that may be relevant to other users. This is security and features that limit access to some forums (and social media) within schools and public sector workplaces.

Many TABS members will be local authority (LA) employees who have limited access to the internet and their LA ICT departments often need some convincing that sites are 'safe' for their systems. Same would go for health service and other government orgs. (I know also that there is a separate issue with access to social media at work for other reasons)

I am trying get LA members views regarding this and thought it worth flagging up this issue in case you need to take this into account at this stage.

The way Microcosm works is that you start by getting a site allocated on our domain name, for example:

http://tabs.microcosm.app/

That creates the site, but it's on our domain.

Then, you can adjust your DNS entries to create a CNAME that allows a subdomain of your domain to appear to be our site:

http://talk.tabs-uk.org.uk/

That is... if you decide to call it talk... you could call it forums, boards, whatever you want really.

So if the issue is that the ICT departments need to whitelist a domain, and you already have tabs-uk.org.uk white-listed then it should be fine.

None of Microcosms's features will require access to social media.

Oh, and it should be noted that the use of custom domains like this also means that if one site (let's just say 4chan) were to use Microcosm and have their domain blocked... other sites (let's say TABS) would continue to work.

The only similarity between the two sites would be that they use the same software... but that's no different from a porn site using Wordpress and a government site using Wordpress. One would obviously be blocked from workplaces, schools, etc... the other wouldn't be.

I can't access those links at Islington Council at present. I will make enquiries with IT. I understand council IT departments can lift bans on sites on a case by case basis.

That sounds fine Velocio. Thanks
David Shannon from Islington council will be speaking to his tech people to see if there is anything else beyond the whitelisting of domains that may be an issue.

Shannonball those sites don't exist yet Velocio was just demonstrating what we could use with the .tabs-uk.org.uk that we already own

I can't access those links at Islington Council at present. I will make enquiries with IT. I understand council IT departments can lift bans on sites on a case by case basis.

I just invented both of those URLs, at this second they both do nothing and will result in a DNS error.

But the gist is... every site will have it's own domain, and any domains whitelisted would usually affect the subdomains too, so it's possible to make Microcosm appear on any existing whitelisted site without needing to change ICT policies.

Oh, I feel so stooopid!

LA users just need to put a business case forward ti IT for the use/whitelisting of a site, if they are blocked. Disclaimer: Council policy can vary from authorty to authority.

Velocio, you are making an assumption that they block on CNAME... but it's possible that they might just block the IP of the server.

Are you planning on providing (for cost?) bespoke IP addresses for hosted forums?

There will be a number of front-end IP addresses, mostly determined by IP AnyCast and sending requests to a geographically local IP... so if a local one is blocked you could always point to a remote one.

But, having said that, the front-end is delivered as a separate package and will be easily and trivially installable anywhere... so it's very easy to actually use a custom IP if someone wanted to.

sounds good :)

*puts in for sf-fixed-not-pretentiousness-invite-only-group.microcosm.app hehe *

Did you need an invite to sffixed?

aye that would be handy, ta :)