Today, 37signals discussed how adding some padding to navigation links improves the user experience.

The end result is a feeling of comfort. It’s just really easy to click the links. It feels like the links are working with you instead of against you.

Its a simple application of Fitt's Law, which commenters were quick to bring up. Fitt's law has been around since 1954, and is used to predict how quickly someone can aim at target and its supported by a lot of experimental data.

The Microsoft Office team used it to analyze the usability of versions of Word and paid special attention to it during the redesign of Office 2007's user interface

First off, most controls in the Ribbon are labeled. This helps discoverability and usability considerably, but it also makes the buttons bigger and easier to target. As your screen resolution increases, the width of the Ribbon also increases, providing room for more labels and larger buttons.

Mezzoblue talks in detail about how it was used when the site went through its fifth redesign. More websites should use this simple technique to increase the clickable area around navigation links and buttons.

A larger clickable area means less precise mouse movement is required to focus on the link. Without impacting the design in any way (the halo is non-visible after all) the usability of the header improves. While the main goal is increased usability in this case, there are positive implications for accessibility as well. Those with motor skill disabilities may have difficulty using a mouse; larger areas to click makes the act easier, which makes a big difference to them.

Very interesting summary about how various researchers are making data available through Google Earth. Modeling the effects of climate change using Google Earth

The democratization of information, where the barrier to entry is often only an Internet connection, has seen some interesting ideas about how to best educate the public about complex issues such as climate change. One of the standout efforts has to be Google Earth. More and more individual scientists, research projects, and institutes are making their data available to the public in the form of Google Earth overlays, that demonstrate vividly their findings. The UK's Met Office Hadley Centre and the British Antarctic Survey are teaming up with Google Earth to better inform the public about their work on climate modeling.

The following links provide both guidance and analysis about how (and if) to get your Organization on Facebook. For most organizations, there are few reasons to not have a presence on the site and free to setup. The only cost might come if you find yourself spending too much time managing your presence on it (or any other social networking site.

First, read if Should Your Organization Use Social Networking Sites?

So should you invest in creating a profile or networks on social networking sites? It depends on your organization. To succeed with social networking sites, you'll likely need a staff member or consultant who has a passion for working with these types of sites. You'll also need to establish goals to understand if the time commitment is worthwhile. For instance, if you're trying to expand your community, how many new people linked with your cause would make your time worthwhile? Be open to alternative goals, too: Perhaps your primary purpose with social networks is just to get your name in front of the younger members of your audience.

SMUG makes the case for Why Organizations Should Join Facebook Group Land Rush

In reality, you can have an infinite number of groups related to your organization, each with a different purpose.

If you decide to jump on board you'll need the invaluable A Beginner's Guide to Facebook

These nine points are meant to be a starting point for you to get your nonprofit on Facebook and into the social networking world. There are also many examples of nonprofit groups on Facebook

GrowYourWiki has a pair of posts on the Pitfalls and Keys to Success for Wiki Adoption within your organization. Its a concise summary of key best practices to encourage participation when you deploy a wiki.

Internally, we've faced similar issues, its eerie that his advice that "Meetings are an especially good place to start" describes how, at least the Tech Team, makes the most use of our Intranet Wiki. He also makes the point that you should plan for success, not failure. Too often, we're worried how a few bad actors may post inappropriate content or misuse the tool in some way. The usual reaction to such a risk, is to either not deploy the tool at all, which can be a huge missed opportunity, or to overburden it with controls, reviews, and approval process so that no one is ecouraged to use it.

Managing to the possibility of failure, not success – If you are more focused on how the wiki will fail, instead of how it will succeed, you have already written your destiny.

HT: Sage advice on wiki adoption: keys to success

If you've signed up for a website in the last year or two, you're likely familiar with CAPTCHAs, those distorted images asking you to figure out some gibberish string of numbers and letters. A CAPTCHA is intended to stop abuse of a system by automated software by offering a task that only people can solve. We've often been asked by clients to "put a CAPTCHA" where we can anticipate abuse, but I've always pushed back as the effectiveness of CAPTCHAs has degraded over time. Here, we'll take a look at the problems with captchas, and suggest some alternatives to their use.

CAPTCHAs hurt usability and accessibility.

A visual CAPTCHA will not be usable by visitors using screen readers, or who suffer some vision impairment such as color blindness. An accompanying audio CAPTCHA is recommended, but now you've doubled opportunities for nefarious users to attack your web site. Even if you have good vision, you've probably encountered the visual CAPTCHA that are difficult to use, since making them hard to read is the only way to make them effective. By making them hard to read, you've made your web page much harder to use. I've run into CAPTCHA that take me a number of tries to get right because its hard to tell the ones apart from the Ls or zero's from the letter O.

CAPTCHAs have already been broken

CAPTCHAs have already been cracked through various methods. Automated programs exist to break common CAPTCHAs, and you can actually buy such software.. Jeff Atwood asked last November Has CAPTCHA Been "Broken"?, and argued that CAPTCHAs were still effective since Google, Hotmail, and Yahoo were considered unbreakable. For now let's ignore the fact that you need the resources of Google, Hotmail, or Yahoo to make "unbreakable" CAPTCHAs. Recent reports suggest that even their systems have been broken - Software Attacks Software in Security Wars.

Image CAPTCHAs for Google, Windows Live, and Yahoo! have been broken in recent months, and is believed to account for the increasing levels of spam that are coming from webmail services that those companies provide.

Security Labs even managed to dissect exactly how spammers have automated setting up Microsoft Hotmail account: Microsoft Live Hotmail Under Attack by Streamlined Anti-CAPTCHA and Mass-mailing Operations.

It is observed that unlike Live Mail Anti-CAPTCHA and Gmail Anti-CAPTCHA operations in the past, the current attack is aggressive and instantaneous in terms of CAPTCHA breaking host turn-around time.

Automated solutions are not required though, as CAPTCHAs can be solved by relaying the image to unsuspecting users through a relay attack. Just last year, a striptease program was used to bypass Yahoo's CAPTCHAs.

Trend Micro has identified the program as TROJ_CAPTCHAR.A, a striptease game wherein the player enters the letters hiding within a CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) image. For each correct entry, more clothes come off in photos of a scantily clad woman identified as "Melissa."

You can't rely on CAPTCHAs

If this technique is relatively useless, at best it'll just slow down malicious users instead of stopping them altogether, what alternatives do we have? I'll consider two scenarios where CAPTCHAs are commonly used - deterring spam on blogs and message boards, and preventing automated registration for user accounts.

Alternatives for limiting spam messages

If you have a blog or run a message board, spammers are a nuisance that drown out legit conversations with noise. One of the best solutions I've used for limiting spam is Akismet, a distributed and collaborative effort to identify spam messages. Its a web service that you must sign up for - although free for personal use, you'll need a subscription for non-personal uses. Basically, when a visitor leaves a message, your CMS or blog first sends the message, along with some information about who posted it, to Akismet which returns a simple yes or no result about the message's spammy-ness. At that point, you can either reject the message altogether or hold it for further review and approval. Akismet integrates easily with Wordpress, and their are libraries and plug-ins for many other platforms. If one doesn't exist, the Akismet API is open and documented so you can write your own.

If you are using PHP, and don't want to integrate with the Akismet web service, or simply want another line of defense, there is Bad Behavior. It uses a number of tests to try to screen out spam bots from your site before they can do any damage.

Bad Behavior runs before your software on each request to your Web site, so if a spam bot does visit, it will receive nothing, and your software never runs. This reduces the amount of server CPU time, database activity and bandwidth spent on processing robots which are just harvesting your site and delivering junk.

A third method for fighting comment spam is to require unknown users to confirm their message via email. That is, ask for an email address along with a comment - this is fairly standard already - and for unregistered users send them an email with a link for them to confirm their message. For regular visitors, you can ask them to create an account or, better still, use OpenID to confirm their identify, and allow them to skip the email confirmation step altogether. As an added precaution, you may want to review postings from new users until they reach a milestone like "5 non-spam messages".

Alternatives for protecting user registrations from bots.

Using CAPTCHAs as part of the registration process is meant to separate people from bots. Digg even asks the question Are you human? Technological alternatives here are a little less obvious. You could require users to activate their account via email, which at least makes it more time consuming for potentially malicious users to register. Depending on the sensitivity of the application, you can require even more difficult activation procedures. I know one credit card company system requires providing a phone number to call you with an activation code. Another alternative is to require invitations to join a system coupled with a way to audit invitations in case someone invites a bad apple. An overall approach that should work is to give users gradually escalating privileges as they demonstrate good behavior.

I'm not sure that a single technical cure exists for preventing unwanted user registrations. For now, I think sites will need to rely on an approval process of some kind for new registrations and a method for other site users to report people who abuse the system.