Giter VIP home page Giter VIP logo

report-a-cybercrime's Introduction

Report a cybercrime / Signalez un crime informatique

Exploring a service that makes it easier for Canadians and businesses to report when they encounter or are victims of a cybercrime and that helps police analyze and investigate reports.

Explorer la possibilité de mettre en place un service permettant aux Canadiens et aux entreprises de signaler plus aisément les crimes informatiques et facilitant le travail d'analyse et d'enquête de la police.

Installation

Requires node.

cd f2
npm install

Configuration

A number of environment variables are used to configure different parts of the back end. These can be set locally in a .env file. As in .env.example we have the following.

Data storage

As our app is currently running in Microsoft Azure, we are using storing the reports in Azure CosmosDB (using a mongodb api) and uploaded files in Azure Blob Storage. Set the following environment variables:

# database for reports
COSMOSDB_NAME=
COSMOSDB_KEY=

# Blob Storage for files
BLOB_STORAGE_NAME=
BLOB_STORAGE_KEY=

Self harm words

We use a comma separated list of keywords to attempt to detect any user in serious crisis.

# self harm words
SELF_HARM_WORDS=

File scanning

Files are scanned with Clam AV, an open source virus scanner we are running in the cloud. We also use Azure Content Moderator to detect adult images.

# file scanning
CLAM_URL=
CONTENT_MODERATOR_SERVICE_KEY=

Encrypting the reports for the RCMP analysts

Currently the reports are sent to the RCMP via encrypted email. We use the HERMIS IDs of the RCMP staff to fetch their public key certificates.

# encrypting email to intake analyst
LDAP_URL=
LDAP_UID=

Sending the encrypted reports to RCMP analysts

We use an SMTP server directly to send out reports.

# sending encrypted emails
MAIL_HOST=
MAIL_USER=
MAIL_PASS=
MAIL_FROM=

Notify

We are using the Government of Canada's Notify tool to send confirmation emails to users as well as to send feedback to the team developing the app.

# Notify configuration
NOTIFY_API_BASE_URL=
NOTIFY_API_KEY=
NOTIFY_ENGLISH_CONFIRMATION_TEMPLATE_ID=
NOTIFY_FRENCH_CONFIRMATION_TEMPLATE_ID=
NOTIFY_FEEDBACK_TEMPLATE_ID=
FEEDBACK_EMAIL=

Google Analytics

Google Analytics is being used to help us get insight into how the different parts of the app are being used.

# Google Analytics
GOOGLE_ANALYTICS_ID=
REACT_APP_GOOGLE_GTM_ID=

Rate limiting

Finally, we are currently soft launching the app and so are rate limiting how many reports it generates.

# rate limiting
SUBMISSIONS_PER_DAY=
SECONDS_BETWEEN_REQUESTS=

Running locally

Note that you must be in the f2 directory to run the code.

Just the frontend

npm run dev

Frontend and backend

npm run prod

Run project with Docker

docker build -t rac .
docker run -p 3000:3000 rac

Getting the analyst email yourself

It is often useful to quickly see what the analyst email looks like. If the LDAP_UID environment variable is not set and the user provides their email address on the contact info screen then the server will send the analyst email unencrypted to the user. This is solely for development purposes. Note that the review apps are configured this way.

To do this locally:

  • ensure that LDAP_UID is not set in your terminal environment nor in your .env file
  • run npm run prod
  • fill out the report and include your email address on http://localhost:3000/contactinfo
  • you should receive the generated report email

Load testing the frontend

There are simple scripts to load test the frontend. They use the k6 package, which must first be installed (see (https://docs.k6.io/docs/installation)

To run the tests, set the environment variable LOAD_TESTING_BASE_URL to the url of the website, for example

LOAD_TESTING_BASE_URL=https://report-a-scam.azurewebsites.net

and then from the root repo directory run

k6 run -vu 150 -d10s utils/loadTesting.js

Notes:

  • the http_req_duration line shows how long the requests took (from sending request to receiving response)
  • the iterations line shows the number of requests per second (should be approximately 100/s bor both)

report-a-cybercrime's People

Contributors

amazingphilippe avatar anikbrazeau avatar cds-snc-pre-flight[bot] avatar danprime avatar davidheerema avatar dengcn avatar dianeliu2019 avatar justinr86 avatar keithiancolbourne avatar kevinyang06 avatar khalidelaggan avatar lchski avatar lmcbhvu avatar maxneuvians avatar naomiseminega avatar ngosset avatar nmakuch avatar samsadasivan avatar sastels avatar sdzhangtao avatar sleepycat avatar snyk-bot avatar taowa avatar ying-chen-cds avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

report-a-cybercrime's Issues

Tag your releases after you incorporate user feedback

@danprime - Our friends in policy would like to measure how often we incorporate user feedback in our code. One way we can easily do this is everytime we include a feature based on user-feedback we cut another release on GitHub. We did this in VAC (https://github.com/veteransaffairscanada/vac-benefits-directory/releases) and it would be great if we could get a start on this with RCMP as well. Please let me know if you have questions or concerns.

Language toggle

Manual testing with a keyboard + voice recognition I am unable to active the language element.
A screen reader user may be able to access this by pulling up a list of links/buttons on the page, but a keyboard user will be unable to do so.

language button broken

possibly related to Apollo changes in #185

Seems that we're trying to call the API to get the language rather than the cache.

Did you have some thoughts @sleepycat ?

Serve fonts locally

Currently we are loading fonts from https://fonts.googleapis.com/css?family=Roboto
Fonts and other assets should be served from the public directory.
External resources like this make our performance dependent on more that one system, make offline development painful, and create trust boundaries that are hard to reason about.

Disabled next button - (Contrast + Why disabled buttons are issues)

I recommend that the green or text on the disabled next button meet a minimum contrast.

Ideally we would not use disabled buttons, and instead would have the button post a proper error message if selected without the proper information being filled in first. It's a good opportunity to improve the user experience.

Here is a good blog post on this by a user tester with a disability.

[https://axesslab.com/disabled-buttons-suck/]

screen shot 2018-12-06 at 9 44 33 am

Content not included in landmarks

Content not included in landmarks
1.3.1 Info and Relationships

HTML5 or WAI-ARIA landmarks are used on the page, but not all content is included.

When using HTML5 or WAI-ARIA landmarks it is best practice to include all content on the page in landmarks. In this way users of assistive technologies can use the landmarks for navigating the page without losing track of content.

Make sure that all content on the page is included in HTML5 or WAI-ARIA landmarks.

How do I meet this criteria?
Use one of the following techniques from WCAG 2:

ARIA11 Using ARIA landmarks to identify regions of a page
These references are taken from the Web Content Accessibility Guidelines 2.0.

screen shot 2019-03-06 at 5 56 19 pm

Mobile styling issues

Screen Shot 2019-03-25 at 5 51 16 PM

Noticing some issues in the mobile styling of pages, especially on pages with forms

Scroll bars on landing page

The landing page is longer than the browser window resulting in scroll bars.
The culprit is min-height: calc(100vh - 55px); in src/App.js, but finding an approach to sticky footers that doesn't require fixed pixel heights might be worth exploring.
offscreen

Return better data to feed summary graph

Currently the identifier visualization used in our prototype is powered by the following data:

{
  "data": {
    "stats": {
      "identifierFlaggingsWithin": {
        "identifier": "555-555-5555",
        "summary": [
          {
            "date": "2019-04-01",
            "total": 1
          },
          {
            "date": "2019-04-02",
            "total": 2
          },
          {
            "date": "2019-04-03",
            "total": 2
          },
          {
            "date": "2019-04-04",
            "total": 1
          },
          {
            "date": "2019-04-05",
            "total": 5
          },
          {
            "date": "2019-04-09",
            "total": 1
          },
          {
            "date": "2019-04-15",
            "total": 1
          }
        ]
      }
    }
  }
}

This data is a naively generated list of days we have data for, rather than a report count for dates within some time period. The result is a misleading chart suggesting continuity that would not actually exist if all the dates were represented.

image

Suggested fix: modifying identifierFlaggingsWithin to accept start/end dates along with an identifier (it's name suggests that this was the intent of that function anyway):

query {
  stats {
    identifierFlaggingsWithin(startDate: "2019-04-02", endDate: "2019-05-02" identifier: "555-555-5555") {
      identifier
      summary {
        date
        total
      }
    }
  }
}

We may want to limit the date range to something reasonable, but if we do that we might be better off making an explicit query for it:

query {
  stats {
    flaggingsWithinTheLastThreeMonths(identifier: "555-555-5555") {
      identifier
      summary {
        date
        total
      }
    }
  }
}

WAI-ARIA group is missing a name

WAI-ARIA group is missing a name
1.3.1 Info and Relationships
A group created with the WAI-ARIA role="group" or role="radiogroup" is missing a name.

Use either the WAI-ARIA attribute 'aria-label' or 'aria-labelledby' to name the group.

Code

Have you or someone you know encountered a cybercrime?

Tell us your story in three easy steps:

  • Describe what happened.
  • Select where you encountered the cybercrime.
  • Share how you were impacted.
  • <title style="transition: none 0s ease 0s;">icon important</title>
    Please do not provide any personal information.
    Share your story→

    How do I meet this criteria?
    Use one of the following techniques from WCAG 2:

    ARIA17 Using grouping roles to identify related form controls
    These references are taken from the Web Content Accessibility Guidelines 2.0.

    screen shot 2019-03-06 at 5 49 06 pm

    Trigger a compliance API check when you app deploys

    The intent is to trigger a compliance API check whenever you app has deployed and ready. Because this is a non-deterministic event, the requirement is for the app to decide when the best point in time for that is.

    The compliance watcher application exposes an internal kubernetes endpoint (https://github.com/cds-snc/report-a-cybercrime/blob/master/compliance/watcher-deployment.yaml#L34), which can be triggered by a POST request.

    In other words, you need to make a POST request to:

    compliance-watcher.symmorfosi.svc.cluster.local:3000/run_compliance

    to trigger a compliance run. I would recommend putting it in here or thereabouts:

    https://github.com/cds-snc/report-a-cybercrime/blob/master/frontend/src/index.js#L22

    Bypass blocks, no ability to skip links

    No option to skip repeated content
    2.4.1 Bypass Blocks

    A means of bypassing blocks of content that are repeated on multiple web pages must be provided.

    One of the ways to ensure this is to have a link at the top of each page that goes directly to the main content area. (The link should be the first focusable control on the web page and be visible when it receives focus). Such a link is not present on the page. If you have not ensured this by providing this type of links or by other means, this criterion is failed. Another way of ensuring conformance is to provide a heading for each block of content that are repeated on multiple web pages.

    How do I meet this criteria?
    Use one of the following techniques from WCAG 2:

    G1 Adding a link at the top of each page that goes directly to the main content area
    These references are taken from the Web Content Accessibility Guidelines 2.0.

    VAC implemented this: https://vac-benefits-finder.cds-snc.ca/ please note you can have more then one skip link.

    Disable PWA for dev

    It's a big pain in development (ex if the dev server gets messed up then the app will happily use older, cached content). We should only enable it for production.

    Refactor tests!

    refactor the component tests to use react-testing-library

    Add third language option

    ensure that things work with three languages, not just two
    (for example, are we assuming not English === French)

    Recommend Projects

    • React photo React

      A declarative, efficient, and flexible JavaScript library for building user interfaces.

    • Vue.js photo Vue.js

      🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

    • Typescript photo Typescript

      TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

    • TensorFlow photo TensorFlow

      An Open Source Machine Learning Framework for Everyone

    • Django photo Django

      The Web framework for perfectionists with deadlines.

    • D3 photo D3

      Bring data to life with SVG, Canvas and HTML. 📊📈🎉

    Recommend Topics

    • javascript

      JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

    • web

      Some thing interesting about web. New door for the world.

    • server

      A server is a program made to process requests and deliver data to clients.

    • Machine learning

      Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

    • Game

      Some thing interesting about game, make everyone happy.

    Recommend Org

    • Facebook photo Facebook

      We are working to build community through open source technology. NB: members must have two-factor auth.

    • Microsoft photo Microsoft

      Open source projects and samples from Microsoft.

    • Google photo Google

      Google ❤️ Open Source for everyone.

    • D3 photo D3

      Data-Driven Documents codes.