Secure connections to web servers have relied on the SSL and TLS protocol suites for years. The recently discovered POODLE attack has demonstrated that SSLv3 is insecure. The ALA team will have disabled SSLv3 on all of our web servers by the end of the day. We do expect some customer impact from disabling SSLv3. Some older browsers do not support the newer TLS protocol suites or have SSLv3 enabled in their browser settings by their IT departments. Some older browsers trying to reach our websites will error out with a message saying
“This webpage is not available. The webpage might be temporarily down or may have moved permanently to a new web address. Error code: ERR_SSL_VERSION_OR_CIPHER_MISMATCH.“
To fix this problem, you may have to disable SSLv3 in your browser settings, enable TLS v1.0 in your browser settings, upgrade your browser to the latest version, or contact your IT department if they control your browser installation or settings.
To address industry wide security vulnerabilities, we will be temporarily disabling website logins starting at 4:00PM CST on Friday November 21st. Functionality should be restored by 5:00pm.
Once this change has been made some older browsers will be unable to login to our websites. Affected users must use a more modern browser.
There is a critical security update for Drupal that we will be rolling out tomorrow morning at 9:30am. There will be a rolling outage where a single microsite will be put into maintenance mode while the update is installed, then it is taken live after it completes. Then it will proceed onto the next microsite and repeat the process. During testing, this maintenance window has been roughly 90 seconds per site.
Our Postini spam detection software is being replaced on December 10th, 2014. To make a new solution for spam detection possible, a change in our email routing is required for ALA’s mailing lists.
Effective Thursday, November 13th, 2014, all mailing lists will have a slightly different address: email@example.com. For example, firstname.lastname@example.org will become email@example.com, firstname.lastname@example.org will become email@example.com, etc.
This means that starting on November 13th, all messages to an ALA mailing list will need to be sent to the list’s new @lists.ala.org address.
We know this is a major communication change, so please help us spread the word.
This evening, the ALA website and all microsites will be put into maintenance mode for a critical Drupal update. The outage will begin at 7pm, and I anticipate that they will be back up at 8pm. This outage will not affect blogs, wikis, Connect, nor Moodle.
Due to an issue with a function in the new IMIS upgrade, a small number of accounts have been unable to login to the website. We have resolved this issue, and all accounts should be able to login now. Users that were having problems may need to clear their browser cache and cookies. Anyone that is still having issues logging into the ALA website through Shibboleth, please enter a TrackIT ticket with a detailed report of the problem. Thank you.
The ITTS Strategic Technology Directions Report Update Fall 2014EBD#12.4 provides an update on major projects in the ITTS Strategic Directions 2014-2017 Directions Report sent to the ALA Executive Board in April 2014. The summary blog post and links to the full April 2014 ALA Executive Board report can be found on the ITTS blog at http://itts.ala.org/news/2014/05/16/ala-strategic-technology-directions-2014-2017-technology-roadmap/
The iMIS 20 membership system upgrade is scheduled for this weekend Friday, October 17th. The iMIS database will be put in read-only mode beginning at 5:00pm CT, Friday October 17th . A copy of the database will be upgraded and put in place over the weekend.
During the upgrade:
Our members and staff will be able to:
Our members and staff will not be able to:
The new iMIS 20 desktop will be made available to staff on Monday, October 20th . The new interface is very similar to the existing one and the web front end will look the same. We will send an email to all staff when the upgrade is complete and full access is restored. There will be a note on the homepage about this before and during the upgrade process.
Check the ALA Twitter account for the most current updates over the weekend.
We want to thank you for your patience.
Director, Information Technology & Telecommunication Services
We’ll be doing some maintenance on the Connect server the evening of Thursday, October 9, 2014, from 7-8pm Central Time, which means the site will be unavailable during that time. We apologize for the inconvenience, but the work should go quickly. Watch Twitter for status updates.
I’ve been out of the office for a couple of weeks, so I’m playing catch up on the projects I’m involved in, so I thought I’d share what I’ve learned about our progress. This is hardly a comprehensive list, but it’s great to be able to share positive progress.
It was a huge project, but we now have all staff workstations in the Chicago office upgraded from Windows XP to Windows 7, including updated printer drivers and the annual cycling in of new computers for some staff. I wasn’t involved in this, except that my workstation got upgraded and I’m a million times more productive now, so yay team. Although I saw the hiccups behind-the-scenes, I was impressed with how smoothly the transition went thanks to the extensive planning and testing that other ITTS staff and consultants did.
This is another project that I’m not directly working on, but it affects my projects because iMIS is the system that manages all of our member, committee, dues, CE, and registration data. This is a big number upgrade with some behind-the-scenes changes to the setup, not just a patch. The whole project has been complicated greatly by ALA’s extensive customizations of the iMIS software, as well as the fact that our ecommerce system is 10-years old.
The team working on this has hit roadblock after roadblock trying to get the new iMIS software and web services to work with our old ecommerce system, and they’ve smashed every one of them. If all goes well, we’ll implement this upgrade later this month. Watch for more information about this because there may be some downtime associated with it since we’re talking about the system that’s at the heart of the Association’s infrastructure.
The completion of the iMIS upgrade is great news for Connect and the Conference Schedulers because it means we can move those sites to Shibboleth. This means single sign-on between these sites and ala.org. You’ll finally be able to log in to any of these sites with your regular ala.org username and password and then be logged in to all of the other sites automatically (non-members, too). Huzzah! Our goal is for this to happen in early November before the 2015 Midwinter Scheduler opens.
This isn’t really a project update so much as a reminder to fill out the ALA Connect survey if you haven’t already done so. Besides the fact you could get an iPad Mini in return for your responses, your feedback will help us improve the site. We want to hear from everyone – members, non-members, frequent Connect users, infrequent Connect users, international folks, tall people, short people, basically everyone, which includes you.
The iMIS upgrade is the first domino in a series of projects that have been unable to move forward until it’s completed. The second domino is Shibboleth for Connect and the schedulers, and the third combines ala.org and Connect profiles into a single profile that can easily be managed from either site. Phase one combines all of the data into one profile and future phases will expand the amount and types of data we make visible to you in your profile, including expiration dates for member dues (finally!), lists of continuing education activities completed, past conference registrations, and more. Our goal is for you to implement phase one in November.
And now we get to the biggest domino in the path, the ecommerce system that desperately needs to be replaced. With the iMIS upgrade almost done, we’re scheduling meetings with potential vendors for later this month. It will still be a months-long selection process while we involve all of the various stakeholders and go though contract negotiations, but if this project stays on track then we’re in good shape for a 2015 (calendar year) implementation.
So that’s a quick update on some of the things that happened while I was gone. I’m thinking I need to take more vacations.