securedrop-docs

securedrop-docs copied to clipboard

Problem

Not sure how orgs are supposed to know they should customize the default logo on their SecureDrop install, if it's not explicitly called-out to them in the installation checklist—which today, it is not. #whompwhomp

This may be mentioned in best-practices pointers, and in the Admin Guide, but it cannot be assumed orgs will read either (carefully) and naturally identify the logo task as a must-do to-do, given how resource-constrained most orgs are... and how time-constrained most of the IT and Admin resources are.

Much as FPF may desire prioritizing customer-centricity in configuration agency towards instance hosts, FPF also has a responsibility to steward org practices as they may impact Source choices. Sources may be risking their personal safety, their lives, or their careers, by sharing sensitive information. There is an ethical imperative to force instance-org hands to at a minimum, be clear in identifying who they are to Sources—or, to be clear in their choice to obfuscate their identity. Both can be done, and should be done, with clear guidance... and as a priority task to tackle in documentation.

Solution

Edit the "Configure The Installation" page, accordingly:

• Capitalize all letters that begin sentences in the bulleted list items at top of page (nit!)
• Add bullet before user-name items, regarding org logo
  • Recommended text: The .png image file to identify your organization to Source users (see the <a>Create Logo Image Guide</a>)
• Create Create Logo Image Guide page.
  • Page will be minimal to start, and will offer basic co-branding guidance to orgs.
    • Nina has written many such pages, and will be happy to compose text that Erik/Kev can then refine. Nina also wrote these guidelines for news orgs to use for co-branding with HotJobs, and from that project gained insight into control news orgs desire for co-branding w/ tool/service vendors (which tbh, wasn't much... for a jobs section, at least).
    • Note: this is not a "SecureDrop Logo/Trademark Use Guidelines" page. It is purely an instructional page to guide on best practices for orgs to slap their own logo into the PNG we provide—and to then save that PNG as a PNG-24. It may additionally guide Admins in the rather obvious workflow of updating that logo.
  • Page will evolve to outline self-identification mandates and richer co-branding governance.

Create stand-alone page for Add Logo Image

• Step should follow Create Users page w/in Installation guide.
  • Currently the page labeled Updating Logo Image is buried in the Admin guide, and is not identified as a step-to-go-live. It would be better to have redundant content, or to have it in the installation guide, than to live here.
  • Using 2 images of the SecureDrop logo is waaaay confusing. Please use FPF logo as an example logo to customize to.
  • See explos Nina created in un-related co-branding & default-logo study.

Solution Priorities

• MUST: Add bullet w/ "Image PNG file" to artifacts at top of Configure Installation page
• MUST: Capitalize those doggone sentences in the bullets at top of Configure Installation page
• MUST: Create stand-alone page for Add Logo Image w/ existing page content (or create new content if y'all really want).
  • Add-in page as an installation step after admin and journalist users have been created w/in Configure Installation pages. This task is imho a priority step for instance setup, moreso than as a chapter in the Admin Guide... as this is one of the few things w/in the Admin UI that is very self-explanatory.
• SHOULD: Create Create Logo Image Guide page w/ new content guidance in co-branding for clarity & PNG-24 creation.
• SHOULD: Update screen images w/in Add Logo Image guide, to use FPF logo image.
• COULD: (related but new issue) Update default-logo to more clearly demonstrate to users that it is a default ship-with logo that needs customization.
• COULD: (related but new issue) Update all logo images in screens w/in Source, Journalist, and Admin guide(s) to demonstrate co-branding w/ FPF logo.

User Stories

1. As a Source, it is very important to me to know where I am submitting information to...
2. As a newsroom Admin, I probably need it included in the checklist of setup instructions, to customize my org's logo. Additionally, some guidance on how to do this, would be very nice.

Discussed w/ @eloquence... TL;DR, docs be complicated. Action item(s) agreed to = make existing text more emphatic, and add a coupla screenshots. So of course, I'm also recommending we create a whole other page and make a few more text edits.

Everything below, overrides everything above.

• [ ] Text towards the end of this page wrt landing pages; re-frame as directive. "Best Practices" is too jargon-y, and feels too optional.
• [ ] Mention in Before You Begin page
• [ ] Remove "note" blue box thingy at bottom of this page
• [ ] Create new page titled Brand Your Instance and position it as a step between Create an Admin Account on the Journalist Interface and Test the Installation.
  • On said new page, outline governance rules for customizing the logo-img
  • No SD/Me mashups, should include your name written-out, should save as PNG-24 at 4x, and some "Do This" and "Don't Do This" examples.
    • New footer will negate co-branding need w/in product
  • Create page content and distribute to existing instance owners via RedMine BEFORE adding into RTD, to solicit feedback to consider before adding content into RTD.

This still needs a bit more discussion/agreed upon scoping to be actionable, but making the logo selection a more explicit step in the docs makes sense.