Htacces and WCAG 2

[W Reagan]

Please take a look at http://www.javascriptkit.com/howto/htaccess5.shtml and http://www.javascriptkit.com/howto/htaccess14.shtml. My security team thinks that we need to block certain people and/or website.

 

How can I comply with my security team and the corresponding Succesion Criteria?

[bhawkeslewis]

On 12/08/2009 07:07, W Reagan wrote:
> Please take a look at http://www.javascriptkit.com/howto/htaccess5.shtml
> and http://www.javascriptkit.com/howto/htaccess14.shtml. My security
> team thinks that we need to block certain people and/or website.
> How can I comply with my security team and the corresponding Succesion
> Criteria?

You say "corresponding".

Which of the success criteria listed at http://www.w3.org/TR/WCAG20/ do
you think might conflict with blocking HTTP requests by IP or referrer?

--
Benjamin Hawkes-Lewis

[W Reagan]

If I knew which rules were applicable, I would not ask.

--- On Wed, 8/12/09, Benjamin Hawkes-Lewis <bhawkeslewis@...> wrote:

From: Benjamin Hawkes-Lewis <bhawkeslewis@...>
Subject: Re: Htacces and WCAG 2
To: "W Reagan" <wreagan1@...>
Cc: w3c-wai-ig@..., gv@...
Date: Wednesday, August 12, 2009, 6:58 AM

On 12/08/2009 07:07, W Reagan wrote:
> Please take a look at http://www.javascriptkit.com/howto/htaccess5.shtml
> and http://www.javascriptkit.com/howto/htaccess14.shtml. My security
> team thinks that we need to block certain people and/or website.
> How can I comply with my security team and the corresponding Succesion
> Criteria?

You say "corresponding".

Which of the success criteria listed at http://www.w3.org/TR/WCAG20/ do you think might conflict with blocking HTTP requests by IP or referrer?

--
Benjamin Hawkes-Lewis

[bhawkeslewis]

On 12/08/2009 13:28, W Reagan wrote:
> If I knew which rules were applicable, I would not ask.

I didn't ask which Success Criterion was applicable, I asked which you
thought /might/ conflict. Answering my question would involve you
reading the list of Success Criteria and asking yourself the simple
question of whether each one might conflict and why.

For instance, do you think -

"1.4.1 Use of Color: Color is not used as the only visual means of
conveying information, indicating an action, prompting a response, or
distinguishing a visual element."

- might conflict with blocking HTTP requests by IP or referrer and, if
so, why?

Is it your intention to ask the same formula question ("Does X conflict
with WCAG 2.0?") of this Interest Group for every single design decision
your company makes with this website, or do have special reason to think
that blocking by IP or referrer would reduce the accessibility of your
website to people with disabilities?

--
Benjamin Hawkes-Lewis

[Patrick H. Lauke]

Benjamin Hawkes-Lewis wrote:

> Is it your intention to ask the same formula question ("Does X conflict
> with WCAG 2.0?") of this Interest Group for every single design decision
> your company makes with this website, or do have special reason to think
> that blocking by IP or referrer would reduce the accessibility of your
> website to people with disabilities?

To expand on that (and at the risk of being uncharacteristically rude),
this list is not a WCAG helpline. If you have some very specific
concerns because, even after best efforts on your part, you're having
difficulty understanding how a Success Criterion or a non-normative,
suggested technique might affect a very specific aspect of your site,
then people here are glad to give their opinion (again, mostly
non-normative). Otherwise, may I humbly suggest that you get an external
consultant who specialises in WCAG 2.0 audits/assessments to help you?

P
--
Patrick H. Lauke
______________________________________________________________
re·dux (adj.): brought back; returned. used postpositively
[latin : re-, re- + dux, leader; see duke.]

www.splintered.co.uk | www.photographia.co.uk
http://redux.deviantart.com | http://flickr.com/photos/redux/
______________________________________________________________
Co-lead, Web Standards Project (WaSP) Accessibility Task Force
http://webstandards.org/
______________________________________________________________

[W Reagan]

Ben, the company security team is using an IP blocker. Think about this (without it, you can see my site), If the security team knew your IP address and used as added in to the existing list, you will get a Forbidden error message.

This is only being used for those who have caused security problems with our site.

 

Most of them visitors we blocking are from Europe and Asia (They will get a Forbidden error) instead of actually seeing our homepage.

 

If the security team removed the lists, the risk will come back, or increase.

 

We need to protect our security and maintain accessibility.

 

My job is accessibility. The Security Team wants to know what can they do.

--- On Wed, 8/12/09, Benjamin Hawkes-Lewis <bhawkeslewis@...> wrote:

From: Benjamin Hawkes-Lewis <bhawkeslewis@...>
Subject: Re: Htacces and WCAG 2
To: "W Reagan" <wreagan1@...>
Cc: w3c-wai-ig@..., gv@...
Date: Wednesday, August 12, 2009, 1:22 PM

On 12/08/2009 13:28, W Reagan wrote:
> If I knew which rules were applicable, I would not ask.

I didn't ask which Success Criterion was applicable, I asked which you thought /might/ conflict. Answering my question would involve you reading the list of Success Criteria and asking yourself the simple question of whether each one might conflict and why.

For instance, do you think -

"1.4.1 Use of Color: Color is not used as the only visual means of conveying information, indicating an action, prompting a response, or distinguishing a visual element.."

- might conflict with blocking HTTP requests by IP or referrer and, if so, why?

Is it your intention to ask the same formula question ("Does X conflict with WCAG 2.0?") of this Interest Group for every single design decision your company makes with this website, or do have special reason to think that blocking by IP or referrer would reduce the accessibility of your website to people with disabilities?

--
Benjamin Hawkes-Lewis

[bhawkeslewis]

On 12/08/2009 15:39, W Reagan wrote:
[snip irrelevant detail]
> We need to protect our security and maintain accessibility.

You're asking us for help. But you need to help us help you.

Please answer my simple questions:

1. "[Do you] have special reason to think that blocking by IP or
referrer would reduce the accessibility of your website to people with
disabilities?"

2. "Which of the success criteria listed at http://www.w3.org/TR/WCAG20/ 
do you think might conflict with blocking HTTP requests by IP or referrer?"

It's not obvious why you would think this, so please explain your
thought process.

--
Benjamin Hawkes-Lewis

[W Reagan]

Ben, if we denied /googlemail.com you could not see our site. This is the type of information our security team has set up. Does it conflict with any accessibility standards?

 

As I mentioned earlier, our security team keeps track of users by IP address and also check out other sites where our domain is posted, but should not be.

 

What can we do to maintain security while maintaing accessibility

 

What criteria(s) are in conflict, if any?

--- On Wed, 8/12/09, Benjamin Hawkes-Lewis <bhawkeslewis@...> wrote:

From: Benjamin Hawkes-Lewis <bhawkeslewis@...>
Subject: Re: Htacces and WCAG 2
To: "W Reagan" <wreagan1@...>
Cc: w3c-wai-ig@...
Date: Wednesday, August 12, 2009, 4:32 PM

On 12/08/2009 15:39, W Reagan wrote:
[snip irrelevant detail]
> We need to protect our security and maintain accessibility.

You're asking us for help. But you need to help us help you.

Please answer my simple questions:

1. "[Do you] have special reason to think that blocking by IP or referrer would reduce the accessibility of your website to people with disabilities?"

2. "Which of the success criteria listed at http://www.w3.org/TR/WCAG20/ do you think might conflict with blocking HTTP requests by IP or referrer?"

It's not obvious why you would think this, so please explain your thought process.

--
Benjamin Hawkes-Lewis

[W Reagan]

I recently discovered the corresponding rule at WCAG 2.0; SVR2. The difference between SVR2 and what the security team has set up is to cause certain users a general failure, even if the page was AAA accessible.  Some users are getting a Forbidden error message, while others users are welcome to the site..

 

The security team implemented an IP blocking address in some parts of the U.S., all of Asia, and all of Europe. So only specific regions in the U.S., all of Asia, and all of Europe have been a security risk to our site. Therefore, we are using deny IP address, and deny by domain.

 

What can the security team do to maintain security while I mantain accessibility?

--- On Wed, 8/12/09, W Reagan <wreagan1@...> wrote:

From: W Reagan <wreagan1@...>
Subject: Re: Htacces and WCAG 2
To: w3c-wai-ig@...
Date: Wednesday, August 12, 2009, 5:16 PM

Ben, if we denied /googlemail.com you could not see our site. This is the type of information our security team has set up. Does it conflict with any accessibility standards?

 

As I mentioned earlier, our security team keeps track of users by IP address and also check out other sites where our domain is posted, but should not be.

 

What can we do to maintain security while maintaing accessibility

 

What criteria(s) are in conflict, if any?

--- On Wed, 8/12/09, Benjamin Hawkes-Lewis <bhawkeslewis@...> wrote:

From: Benjamin Hawkes-Lewis <bhawkeslewis@...>
Subject: Re: Htacces and WCAG 2
To: "W Reagan" <wreagan1@...>
Cc: w3c-wai-ig@...
Date: Wednesday, August 12, 2009, 4:32 PM

On 12/08/2009 15:39, W Reagan wrote:
[snip irrelevant detail]
> We need to protect our security and maintain accessibility.

You're asking us for help. But you need to help us help you.

Please answer my simple questions:

1. "[Do you] have special reason to think that blocking by IP or referrer would reduce the accessibility of your website to people with disabilities?"

2. "Which of the success criteria listed at http://www.w3.org/TR/WCAG20/ do you think might conflict with blocking HTTP requests by IP or referrer?"

It's not obvious why you would think this, so please explain your thought process.

--
Benjamin Hawkes-Lewis

[Christophe Strobbe]

Hi W Reagan,

At 08:05 14/08/2009, W Reagan wrote:
>I recently discovered the corresponding rule at WCAG 2.0; SVR2. The
>difference between SVR2 and what the security team has set up is to
>cause certain users a general failure, even if the page was AAA accessible.

Using IP blocking to prevent access to a complete site has nothing to
do with WCAG. It also has nothing to do with technique SVR2
<http://www.w3.org/TR/WCAG20-TECHS/SVR2.html>.

If a user's IP address is blocked for the whole site, he can't reach
the site. The question whether the site is accessible or not (in the
sense of "accessible for people with disabilities") then becomes a
meaningless question for that user.

You can check if your site meets WCAG 2 without knowing the ranges of
IP addresses that are being blocked. These issues are independent of
each other. (Except if the security team decided to allow access to a
non-conforming part of the website and block access to the conforming
part, but I don't see why they would do that.)


>Some users are getting a Forbidden error message, while others users
>are welcome to the site..

WCAG is not about comparing one person's access rights versus another's.
It's about accessibility for people who can actually *reach* the
site, and then use it regardless of disabilities.


>The security team implemented an IP blocking address in some parts
>of the U.S., all of Asia, and all of Europe. So only specific
>regions in the U.S., all of Asia, and all of Europe have been a
>security risk to our site. Therefore, we are using deny IP address,
>and deny by domain.

That issue is irrelevant to this list.


>What can the security team do to maintain security while I mantain
>accessibility?

These issues are orthogonal to each other, unless the security team
enforces methods that make it harder for persons with disabilities to
use the site (for example CAPTCHAs). However, until then, your
security team can focus on security, while you focus on accessibility.

Best regards,

Christophe

>--- On Wed, 8/12/09, W Reagan <wreagan1@...> wrote:
>
>From: W Reagan <wreagan1@...>
>Subject: Re: Htacces and WCAG 2
>To: w3c-wai-ig@...
>Date: Wednesday, August 12, 2009, 5:16 PM
>
>Ben, if we denied /googlemail.com you could not see our site. This
>is the type of information our security team has set up. Does it
>conflict with any accessibility standards?
>
>As I mentioned earlier, our security team keeps track of users by IP
>address and also check out other sites where our domain is posted,
>but should not be.
>
>What can we do to maintain security while maintaing accessibility
>
>What criteria(s) are in conflict, if any?
>
>--- On Wed, 8/12/09, Benjamin Hawkes-Lewis
><bhawkeslewis@...> wrote:
>
>From: Benjamin Hawkes-Lewis <bhawkeslewis@...>
>Subject: Re: Htacces and WCAG 2
>To: "W Reagan" <wreagan1@...>
>Cc: w3c-wai-ig@...
>Date: Wednesday, August 12, 2009, 4:32 PM
>
>On 12/08/2009 15:39, W Reagan wrote:
>[snip irrelevant detail]
> > We need to protect our security and maintain accessibility.
>
>You're asking us for help. But you need to help us help you.
>
>Please answer my simple questions:
>
>1. "[Do you] have special reason to think that blocking by IP or
>referrer would reduce the accessibility of your website to people
>with disabilities?"
>
>2. "Which of the success criteria listed at
><http://www.w3.org/TR/WCAG20/>http://www.w3.org/TR/WCAG20/ do you
>think might conflict with blocking HTTP requests by IP or referrer?"
>
>It's not obvious why you would think this, so please explain your
>thought process.
>
>--
>Benjamin Hawkes-Lewis
>
>

--
Christophe Strobbe
K.U.Leuven - Dept. of Electrical Engineering - SCD
Research Group on Document Architectures
Kasteelpark Arenberg 10 bus 2442
B-3001 Leuven-Heverlee
BELGIUM
tel: [phone]
http://www.docarch.be/
---
"Better products and services through end-user empowerment"
http://www.usem-net.eu/
---
Please don't invite me to LinkedIn, Facebook, Quechup or other
"social networks". You may have agreed to their "privacy policy", but
I haven't.

[Shawn Henry]

"W Reagan": This thread is not appropriate for the WAI IG mailing list. Please see my direct e-mail message to you from yesterday, and refer to the phone call.

Others: If you want to reply, please do so off-list (that is, directly to the poster and not sending to the WAI-IG e-mail list).

Regards,
~Shawn Henry, WAI Outreach Coordinator
On behalf of the WAI IG Chair


-----
Shawn Lawton Henry
W3C Web Accessibility Initiative (WAI)
e-mail: shawn@...
phone: [phone]
about: http://www.w3.org/People/Shawn/