After the software has been installed, you might want to customize it. How you customize an application varies, depending on the tool and its functionality. For example, templates let you change the “look and feel” for wikis and blogs, but you cannot customize how RSS feeds display. Some applications, like collaboration software suites, wikis, and hosted blogs, let you apply standard themes, changing the “look and feel” without having to modify any files. You might need to use the services of an expert for some customizations. For example, the changes you want to implement might require someone who knows HTML, cascading style sheets, PHP, or Perl. For more information on customizing a specific application, see the Help file, the user documentation, and the user forums for the specific application. Implementing Security These days, everyone is concerned about security (and rightly so). Most web-based applications typically include some type of security that you can implement, such as:

-  Challenge emails

-  CAPTCHA

-  Verification

-  Whitelists

-  Role-based permissions

Some applications, such as Yahoo! Groups (http://groups.yahoo.com), use both challenge emails and CAPTCHA to prevent computer programs called “bots” from registering accounts. Yahoo! Groups then goes a step further by letting group owners set different permissions (which are similar to role-based permissions): public (searchable) or private archives, approving new members or automatic acceptance to the group, moderated posted privileges, and more. Challenge Emails Challenge emails are emails sent to new registrants automatically so that they can prove who they are.

Many sites now use challenge emails to reduce the number of fake users and to prevent bots from registering numerous fake users automatically. When a user receives a challenge email, typically he or she just needs to reply, although some systems require that the email’s body content be cleared. Once the system has received this acknowledgment, the user can access the system. Challenge emails do not completely stop spammers from attacking a site, but it requires more time than spammers want to spend, as they want to “hit and run.” For example, someone registered an email with a dubious email address on a wiki. Shortly thereafter, one page on the site was spammed by that user. However, the account was quickly deleted and the page was restored within minutes. Most spammers do not want to go through that much effort. They want to take advantage of any loopholes in security so that they can modify the largest number of pages in the shortest amount of time (and, preferably, automatically). Our wiki (at http://www.wikiwackyworld. com) uses a challenge email system to register users. CAPTCHA CAPTCHA stands for “Completely Automated Public Turing test to tell Computers and Humans Apart.”

CAPTCHAs display distorted text as a graphic or display an icon to play a sound file (which tend to be more accessible to non-sighted users) that must be interpreted before proceeding, typically with a registration process. Like challenge emails, CAPTCHAs help prevent automated registration from computer programs. However, many visitors have found CAPTCHA codes difficult to read, and some systems require that the CAPTCHA code is typed exactly as it is shown (using the same capitalization), while others do not. CAPTCHA sound files can be hard to understand. Verification Some applications require verification before one user can accept information from another user. For example, many chat programs let buddies transfer files to one another. However, you can customize your chat program to prompt you when someone is sending you a file so that you can approve it.

Some also allow you to specify an anti-virus application that scans all incoming files. Microsoft Outlook has added a type of verification by preventing graphics from displaying until you explicitly allow them. You can approve graphics on a case-by-case basis or by approving all graphics in emails from a specific domain. Whitelists Whitelists indicate the email addresses of the people who are allowed to contact you. A whitelist includes email addresses or user names that will not be blocked by various spam traps. Most whitelists let you specify either a domain name (*.example.com) or an email address (person@ example.com). Many spammers take advantage of free email accounts, and as a result, many spam trap applications automatically block those domain names. You can add a friend’s email address at a free account domain to your whitelist, which allows email from that account to get to you.

Another type of whitelist is the contact, or buddy, list in chat applications. Chat applications include options that let you set global controls based on your contact list. For example, you can specify that only folks on your buddy list are allowed to contact you, and others must be approved. You can specify that anyone can contact you, but that tends to lead to trouble. Role-based Permissions Role-based permissions control what users are allowed to do by assigning permissions according to their role. Many web-based tools (and some desktop tools, too) use role-based permissions to easily define security settings. For example, our wiki uses the following roles:

-  The authors belong to the group “authors,” and we can do anything: post, upload files, delete members, hide pages, and so on.

-  Visitors belong to one of two groups: “registered” users are allowed to read and post, while “anonymous” users are allowed to only read the content. Role-based permissions are assigned by an administrator, who creates whatever groups are necessary.

For example, we have seen systems with groups for administrators, writers, editors, legal, QA, and more, and we have seen systems with administrators, registered, and anonymous. Each group (and therefore every member of the group) was assigned high-level permissions. In some cases, specific users in a group were assigned more permissions than others in the same group. Users who are assigned to multiple groups function under the least restrictive set of permissions. For example, if a system were set up with groups for writing (can create new information pages) and editing (can only edit existing pages), then a user assigned to both the writing and editing groups can both create new pages and edit existing pages.