Branding and error messages

[BioALIEN]

Hi All,

I had a few thoughts about the state of ispCP and it's branding. Please bear with me while I explain further.

Firstly, there are places where the ispCP OMEGA name is revealed that should not have been there. For example, if an admin/reseller/user damages their website and leads to any of the standard error pages shipped with ispCP, they will see an ispCP error (and the title of the page will be in the form: ISPCP OMEGA <insert error number here>.

This is very bad for corporate environments and other sensitive industries as it gives their competitors and customers privileged information on the client's technical setup. Furthermore, the errors are also misleading as it's a problem with the website rather than the control panel software itself!

Secondly, I don't see any logic in having valid HTML and CSS compliant error pages (with links to w3c). They are not part of the main website branding. I feel that promoting compliant error pages will only highlight the bad foundations of the control panel design as it's still using tables.

Third, I don't ever encourage using Javascripts in error pages! What if the site was viewed on a mobile device, TV, screen reader?

Fair enough, most of these issues can be resolved easily by modifying the code. But I wanted to post this message here so that developers and the community at large can start thinking about 'out of the box' usability, accessibility and branding of this great software.

I will be uploading a modified set of error pages for ispCP depending on the outcome of this thread.

[raphael]

Quote:Third, I don't ever encourage using Javascripts in error pages! What if the site was viewed on a mobile device, TV, screen reader?

what do you recommend to use then? php (again?)?
PHP was dropped because it might not be enabled on all the accounts and using PHP on error pages for such a dummy task (display the path) is not something I like to do.
If you provide a better solution (e.g. shtml) feel free to open a ticket and I'll take care of it

[ephigenie]

No i think he just meant having clean error pages without reference to ispCP would be a better choice for hosting environments with mission critical content.

So that if a security issue exists in ispCP maybe the attackers have a list of targets by the hand ...

Now my opinion :
I think this makes only little sense - to me to change that per default everyone is invited to upload nice error-pages or themes that can be used instead of the standard ones. If you think in term of security, then keep in mind, that even ssh/apache/smtp/ftp/imap etc daemons are very noisy about its current version.
If a real attacker would like to know which panel is running on that certain host there are enough possibilities to find out.
And special customers can have special error-docs as well ... everybody can change them on a per-project-base as he likes... so i see not real trouble in that...
Maybe advertising on a error page is not always a good idea... but hey pls show us your ideas about it.

maybe we can just put them up here and offer as an addon ...?