Island Web Works is a Douglas based e-business solutions specialist.  We require a skilled web design and development all-rounder to join our dynamic development environment.  The successful candidate will work on a variety of client projects – involving web, CRM and Business Intelligence.

Minimum Requirements

3 years Web Development experience with working knowledge of XHTML, CSS, JavaScript and strong .NET skills

Education/Experience Requirements

You will ideally possess a Degree or other professional qualification, and be able to demonstrate strong analytical, interpersonal and communication skills.

Please forward your CV to Charles Douthwaite

Island Web Works Limited

4-8 Hope Street, Douglas, Isle of Man IM1 1AQ. www.island-webworks.net
email: charles@island-webworks.net

The challenge set by the e-Privacy directive is that any web site operating within the EU will have to clearly state what cookies they want to set and how they’re to be used. Only after getting explicit consent by the user would a web site be allowed to set any cookies¹ on the users machine.

So, in order to use cookies you now really need to set another cookie to store the user’s preferences, which ironically means that if the user denies the use of cookies, you have no legal way of storing that user preference in a cookie and will have to keep nagging those users every time they visit your web site.

Unobtrusive nagging

Taking the above into account, it was clear that an unobtrusive method of alerting the user was required – something that could be displayed on every page without impacting on the user experience. After some thinking we decided to use a discreet info bar appearing at the bottom of the web page.

An info bar appearing at the bottom of the page to highlight that cookies might be used.

The info bar would state that we wish to set some cookies and ask if the user would be ok with that. By clicking the ‘Tell me more’ link an information window would appear.

On clicking the information bar's 'Tell me more'-link, a window with detailed information appears and gives the user the option of accepting or denying the use of cookies.

This information window is where the user either accept or deny the use of cookies for this site. The bottom paragraph also points out that if the user don’t accept cookies, we would have to ask them every time they visit.

Since this is a procedure the user will probably only want to go through once, the system is designed to be easily ignored. The info bar can be closed without further ado by clicking the close button, or it can be ignored completely without affecting the usability of the site.

However, the main problem with the new legislation remains: only a very few visitors will ever explicitly approve the use of cookies, which essentially means that the use of tracking technologies like Google Analytics is going to become more or less obsolete in the Eurpoean Union. That’s quite a blow to any organisation trying to improve their web sites to better suit their visitors’ needs!

1) The term “cookies” refer to any kind of file stored on a users computer in order to track that user. As such, this also includes so called Flash cookies.

Pin a web site to the taskbar to access a jump list of links to key areas of the site.

Well, with version 9 IE is much more compliant with web standards (95/100 in Acid3, up from 21/100 for IE8), which means web designers hopefully won’t need to implement IE specific code to get their web sites to display correctly in IE9. It also supports the latest versions of style sheet and markup languages (CSS3 and HTML5), so it should be fairly future proof. In addition, IE9 is much quicker to render web pages and it sports a new font rendering engine which makes text appear nice and smooth. The user interface has also been overhauled, with a slimmer and more streamlined appearance and some nice new features like pinning sites to your taskbar for additional functionality (Windows 7 only).

This all sound good, and most IE users will probably upgrade, especially as it will be part of Windows Updates later this month. However, a problem arises for users of IE6. Since IE9 is only available for Windows Vista/7, and all IE6 users are on Windows XP or older, they are stuck and can’t upgrade. This is particularly annoying since Microsoft have launched their ‘The Internet Explorer 6 Countdown’-campaign urging people to move away from IE6 and upgrade, but the only version on offer is the already 3 year old IE8.

Education - not dictation

We at Island Web Works are all for putting an end to the usage of IE6, but we won’t be putting Microsoft’s ‘Upgrade your browser now’-banners on any of the sites we produce. Getting IE6 users to upgrade to IE8 is not a solution, as they would still be stuck with an obsolete browser. Instead, we would rather educate people about the benefits of upgrading from Windows XP to Windows 7, something that is already happening in the private sector as people replace old PCs with new ones.

In the corporate sector however the situation is slightly different. Apart from the cost of upgrading multiple workstations, there might be legacy applications in use that only work in Windows XP/IE6. Luckily there is a solution available. Windows 7’s XP-mode allows you to run legacy software in a pre-installed virtual PC application, which comes complete with a licensed version of Windows XP. This makes running legacy applications a doddle, and should allow businesses to take the plunge and upgrade to Windows 7/IE9.

XP mode - old and new in perfect harmony

So, the signs for the IE9 are encouraging, and with more than 40 million downloads so far it has stopped the downwards trend of IE. It is still early days, but Microsoft seem to have created a modern and solid browser, which hopefully will replace the older IE versions as soon as possible and allow the web to become standardised.

This soon caused controversy with users panicking about their personal information being accessible to malicious web sites to track their browsing activities. In response, browsers had settings added to them allowing users to not store any cookies, or only cookies they trusted. The dust settled, the web matured and today many sites (including Google, Facebook and YouTube to mention just a few) use cookies to allow users to login to their personal web site accounts, or to enhance the user experience.

However, this is soon to change: the EU’s European e-Privacy directive that comes into effect on 25 May this year states that the use of cookies and similar technologies will need explicit permission from the web site visitor. This means that web site owners can no longer rely on the user’s browser settings to see if they will accept cookies.

What consequences will this legislation have? Well, firstly, owners of web sites operating within the European Union will have to make sure that their web sites provide clear and comprehensive information regarding the use of cookies. This includes stating why cookies are used and how the information is processed. The web site also need to give the user the option of opting out, and making sure no cookies are then dropped on the users machine.

Secondly, the web browsing experience for the user will become more complicated and cumbersome, where the user will have to actively approve the use of cookies whenever he/she arrive at a site. Expect to see a dramatic increase in popups and mandatory checkboxes all over the web. Also, if users make the “wrong” decision and block cookies by mistake, they can expect only a subset of the features on the web site to be available due to technical and/or financial limitations.

And thirdly, the only sites not affected by this are the ones who deliberately ignore regulations anyway in order to spread 3rd party tracking cookies to collect as much data as possible. Ironically, they will be the sites that are the simplest to use, potentially tricking users to believe that they are browsing on a safe site, which I don’t believe was the original purpose of the directive.

Additionally, any extended development requirements could result in extended development time, which in turn would increase project costs. A way to avoid this would be to use technologies such as ASP.NET in cookie-less operation mode. Luckily, this is the default language in use by us in Island Web Works.

Sites hosted outside the European Union are not affected by these regulations, but similar proposals are being supported by the US Federal Trade Commission, so it might only be a matter of time before this applies to most web sites. This could well be the beginning of the end for the humble HTTP cookie.

Once you have registered with the site, after convincing yourself of a certain level of trust in the site owner, you might not think that even if the infrastructure of the site is sufficiently secure that no-one could ever hack in to your personal data, that the site would then broadcast – in plain text – your username and password. That would be crazy!

This is what recently happened to me. While using a leading retailer’s online presence, I was sent a “courtesy” email containing my username and password.

But if they emailed you the details, that’s private, surely? Not at all. If someone knows enough about you they may have a good attempt to hack your email password and they then know an awful lot more than a few passwords. Equally, I often have to explain to people that email is not like a telephone conversation. Your emails get passed, bounced, redirected and filtered through any number of servers before it gets to the recipient’s inbox and it is all in plain text. Every one of those servers (and there is no policing of what servers may be allowed to route across the internet) can take a copy of your email. The recipient’s machine may already be compromised by malicious code such as viruses, harvesting personal data and transmitting it “back to base”.

So what’s the answer?

The User’s responsibility

It’s easy to say you should have different passwords for different web-sites. I’m betting you wouldn’t be able to name all the web-sites you registered with in the last month, let alone remember the unique passwords you applied to each of them!

There are options available, though. You could create a tiered list of passwords. High-security passwords for your email (distinct from your banking), moving down to weaker and easier to remember/relate for less important/trusted sites such as forums, etc. It would certainly be a good idea to keep separate passwords for your email, banking and any sites that store your credit card information. Maybe another password for your social media life (Facebook, Twitter, etc.) and “throwaway” passwords for other sites which you may not even return to.

Another option is to use a tool such as KeePass or LastPass. These securely store your password either locally on your machine in a heavily encrypted file or on the cloud, so you can access your passwords anywhere. KeePass is particularly useful when working with particularly secure passwords such as server login details as you can add multi-factor authentication (eg. a USB key). LastPass is more orientated around the web-user, providing browser extensions that help retain form information including passwords. This allows you to generate unique passwords as you need, or at least manage a larger number of passwords that you use infrequently.

The Web-site’s responsibility

The web-site’s responsibility is two-fold. First, it must store your password securely, second it must not compromise that password.

Storing your password securely ideally means generating a one-way hash from it. Your password is taken (over a secure HTTPS connection, of course) and put through a mathematical algorithm which produces a seemingly random sequence of bytes. So a password “LetMeIn” becomes “bc9d9cb353c87531f61d6f21d5cc072e”. What’s important is that this method is different from encryption because it is not feasibly possibly to reverse the output sequence of bytes back to the original password. Your imaginative password remains secure! However, depending on the algorithm used, this is not without its problems. The possibility of collisions (multiple passwords generating the same hash) and ability to authenticate using a hash (meaning you only need the hash, not the original password) can pose problems for site owners. It’s up to them how they work with these risks, if they are deemed sufficiently important. Some sites may use encryption, but encryption is reversible and all you need are the keys. There should be no reason why a site would need to know the original password.

While a web-site may be hosted in secure data-centres, with ISO certification, behind firewalls, PCI policies and the like, these measures are rendered useless if your password is compromised. Unfortunately, this happens a lot in sites, as we have seen above. Many sites send your details out in an email, which may be hacked into or “wire-tapped” by an intermediate server or process. (Paradoxically, it is actually more secure to display your password back to you on the screen over an SSL connection than to send it in an email. The downside for the site owner is that this often requires a lot more effort.)

As the site owner doesn’t “know” your original password, actions such as emailing you your forgotten password become impossible. This is why sites send you “activation links”, which have time limits. You request your password using known information (essentially publicly available) such as your email address, which is used to send a unique code that may be clicked on for you to enter a new password. This is protected by your email password (you need access to your email to click the link), is often time-sensitive (the link will only work for an hour or so) and when using SSL is encrypted. This is always the method Island Web Works recommends our clients to use.

Remember, it only takes one compromise in security to trash a brand.

Come on! That's too easy!

CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart, and it is used to prevent web bots from using the form. If you own/manage a web site with a web form you are probably aware of the problem of spam - non-valid posts that range from annoying to damaging. Since spam posts are generated automatically by web bots it can easily outnumber the valid posts and drown out any useful information. In extreme cases over 90% of all the posts from a web form can consist of spam. This makes managing the responses from your web form very demanding, so different methods have been used to filter out non-human responses.

A study in spam

Recently, we hit that particular problem with our own web site. We have a ‘call to action’-form where the visitors can request further information about the services we offer. As expected, without any kind of filtering mechanism we got a huge number of spam posts, so we decided on adding a CAPTCHA to the web form.

First, we wanted to try a more transparent version, with no obvious CAPTCHA visible to the user. Method one consisted of a invisible input field which – if filled in – would invalidate the form post. The logic behind this was that web bots would see the invisible field as just another form field, and since they usually fill in all fields in a form to make sure they covered the required ones they would inadvertently expose themselves as bots. This worked to a degree, but we still got too many spam posts through.

The next solution was based on a time delay filter. Even the fastest human being would not be able to fill in and submit our web form in less than 5 seconds. By contrast, a web bot would typically complete this task in a fraction of that time, so by filtering out posts generated in less than 3 seconds we should get rid of most spam. Again, this did reduce the amount of spam, but not enough to bring it down to acceptable levels. We’re guessing that web bots might be using a delay of their own before submitting the form in order to mimic a human response.

Final CAPTCHA

In the end, we resorted to implementing a classic text-based CAPTCHA. However, in order to avoid frustrating our users we’ve made it as simple as possible, with only a few characters and very little background noise. Interestingly, even such a basic CAPTCHA has stopped 100% of all spam so far!

How long is a piece of string?

Even if the results of our little test speak for themselves, we are not suggesting that the only good CAPTCHA is a text-based CAPTCHA. It is more a matter of what works for each particular site. What’s more, there are compliance issues with text-based CAPTCHAS where screen readers could potentially struggle to help the user submit the form. Adding an audio code function which reads out the CAPTHCA code would help, but it’s not an ideal solution.

Another method which we want to test in the future is image-based CAPTCHAs: the user would be presented with a collection of images, and then asked to click on a particular image. This could prove to be the least frustrating CAPTCHA for the user, but it requires a huge database of pre-vetted pictures which might make it unsuitable for smaller projects.

In the end, any type of CAPTCHA will make the submission of your web form more difficult, so it is important to strike a balance between acceptable levels of spam and sufficient levels of human form submissions. We’ll keep testing different approaches and post the results, so watch this space!

Thinking about the size of our company, I was reminded of how other businesses find time to blog on a regular basis, work on the latest in technologies and maintain their customer relationships and investment in projects. This can be a challenging proposition, and it has a lot to do with how large the company is and how the cost of that time is passed on to the customer.

I had cause to go across to the UK last weekend and I was able to meet with former colleagues. Former colleagues that work within the same industry sector as ourselves and have essentially developed their careers alongside, though independently of, mine. What was interesting was how the size of the company plays a large part in the ability of the company to blog and work on projects that may not have a direct financial benefit to the company.

Through our discussions, it was clear that we represented businesses of a small, medium and large nature. The larger multi-national company was able to work on technologies such as Java that have a greater impedance in terms of speed of development, but had the staff to support these changes and development of internal procedures and software. The other two smaller companies were clear in their commitment to using Microsoft technologies due to the speed of development that they provide, resulting in a lower cost to the client. The relationship between project cost and project price is clearly more closely aligned within the smaller development company.

What was clear that each one of us, regardless of size of business, was excited and motivated by the possibilities the technologies we employed offered us. While this had the negative effect of boring the non-technical people with us, it is clear that the industry moves fast and it is every company’s responsibility to keep up with the latest developments and technologies and to achieve this requires employing enthusiastic developers. Though this enthusiasm often “leaks” into our social circles reducing our ability to adequately hold a conversation in everyday life (!), it is clear in the work we produce and writing around the subjects we work in that our businesses are committed to providing a great product for clients. How the business gets there depends on size to a large extent, but this in no way affects the quality of the result.

While it would be nice to have departments we can allocate to certain projects, or individuals charged with solely developing internal processes and software that the client will never see in a bid to improve efficiencies, the reality of most businesses is that project cost directly influences project price. As such the client must be respected insofar as they should not be expected to absorb this cost. At Island Web Works, we have put various systems in place including a support-ticket system, structured automated testing programmes and a continuous improvement process with regards our code, documentation and client contact. These improvements go alongside our existing work and as such directly influence the result in a positive manner but at minimal cost.

Bringing together people within the team who are individually motivated within their area (customer relations, design and programming) we can each bring the very best of our areas to the table. My own contribution has been of formalising procedures, improving quality assurance and introducing appropriate technologies into the business’ portfolio of skills. These have come from my own enthusiasm for these areas both within and without the working day. Our lead designer Andreas can put life in the most dry of topics and as a comprehensive portfolio of work. Finally, our managing director brings a passion for working with individuals within companies rather than faceless users behind a series of board meetings.

It is clear that while size can matter, the enthusiasm for the employees within a software business is the key to successful project delivery for clients. Island Web Works may not have the assets of larger multi-national software consultancies, but we have just as much enthusiasm and are all the more agile in responding to requirements of us. From the excitement of having the initial whiteboard sessions within the office to delivering the final product, pride and commitment remains a constant.

Smart-phones are phones that try to provide much of the functionality your laptop or desktop does, but in a mobile footprint. With features such as emailing on the go, synchronising with your desk-bound computer’s contacts or playing games for time-suckage they were very definitely a niche market for power-users and geeky-types. They were never really easy to use, and industry politics fragmented the market just as much as they did with the browser wars of the 90’s. If you were a Microsoft user, you’d use Windows Mobile, if you were in Europe, you’d remain loyal to Nokia and if you were a business user, you’d use BlackBerry.

Apart from the trickiness in setting up their internet with your network provider, internet access was difficult. Browsing web-sites on mobile devices was not a very enjoyable experience. Web site developers didn’t think (or care) that people would access their site on a mobile device, with a 3inch screen, so didn’t put the thought into how their site should behave. What resulted is a mess for both the web-site and web-browser. The web-browser would try to accommodate the developer’s shortcomings and try to make sites work, often by mimicking a desktop browser interface. Zooming pages down, resizing pages, etc. were some of the techniques which, in my opinion, were wrongly used to fix what was essentially a problem of the web developer. In much the same way, Internet Explorer can often be a horrendous development experience because of the little “fixes” added to the browser to overcome deficiencies in the web-site mark-up.

Since the Apple iPhone, web-sites have started to do things how they should be done … properly. When developing a site, some consideration should be made for alternative platforms (mobile phone, tablet, projection, television) and sites are approaching this using one of two techniques:

• Developing their site according to web standards and mobile-aware stylesheets. Therefore, a mobile user sees the same site as a desktop user, but with an optimised layout. This is the preferred method.
• Developing a specific web-site for the mobile interface. This essentially doubles the work, but can result in a more optimised experience though confusion between two essentially different web URLs may result. This is a method employed by the BBC, Twitter and Facebook, all complex sites so reducing the “noise” (and therefore data charges).

The down-side of the Apple iPhone/iPad/i* model is the concept of the “app”. An App is an application that fulfils a discrete function, and tends to be small, cheap and easy to install for the user. Brilliant idea.

This is where I must be missing the point.

Apps are essentially proprietary. If you have an Apple device, you can only use apps on the Apple app-store. If you have an Android, you can’t access the apps on the Apple app-store, due only to the developer’s decision - which may be due to resource, device accessibility, preference or ability. The user suffers. A web-page (maybe an “HTML5 app“) is accessible by all.

Apps are difficult to update. If an app is released and a security hole is identified, or a bug found that requires urgent attention, it becomes difficult to “push” that update out to the users. The app becomes subject to the politics and workflow associated with its respective store. In the case of the Apple App store, updates are particularly difficult to deploy, even for minor fixes. Issuing a fix on a web-page is done exactly once and is visible to all instantly. Users suffer with bugs.

Apps require wider skill-sets. Developing apps requires a programmer able to access the development skills and resources of the target device. For Apple, it’s Objective-C, for Windows Phone, Silverlight and .NET, for Android it’s Java. These tools are essentially free, but for how long and how much did it cost to train up that programmer? Users suffer if the developer isn’t completely “clued-up”, businesses have to pay for same functionality many times.

Apps are political. The politics behind the respective app-store for the device will ultimately define your user experience, the delivery of your app and your ability to effectively support your users. Politics and the freedom app-stores create for developers range from the “open” Android store to the dictatorial Apple store. “Thou shalt not use any environment other than Objective-C” meaning iPhones can’t access Flash or Silverlight content. (Though Apple are not alone in this restriction.) Users suffer due to missing content. Income streams may be wiped out, overnight.

Many apps require internet access for functionality to be available, and there are many examples of this. The BBC iPhone/iPad app - isn’t that just sucking in an RSS feed? Facebook for iPhone - again, just using an internet data-source and rendering content? There is surely no need for these apps? Why isn’t a web-page sufficient, particularly as both sites have dedicated mobile sites. The only reason why I would imagine that they would need an “app” would be for offline access, a “cache content and look later” model - but HTML5 defines a standard for local file storage which is implemented on iPhone which would achieve this.

Perhaps the app offers an improved user experience using the native user-interface API, but that itself is not a strong enough reason. If the user is browsing using an iPhone, use an iPhone skinned CSS stylesheet, likewise for Windows Phone, etc. If it’s accessibility of the web-site that’s the issue, the phone OS should allow bookmarks of sites to become first-class citizens within the OS user experience. Windows Phone 7 does this excellently with pinnable “tiles” representing bookmarked sites on the Start screen. Thumbnails instantly identify the purpose of the site.

For me, the only reason an application should be developed is if the functionality is not available within a web browser. And that would be access to local resources or OS features. The Facebook for BlackBerry application integrates with the phone’s Contacts application to allow access to Facebook profiles, for example. This would clearly not be possible from within a web-browser but offers a seamless user experience. Facebook for Windows Phone 7 is similarly a first-class citizen within the phone itself, though not via an “app”.

So what explains this tendency for every site to reproduce identical functionality and content to the original web-site? I can only think that “sex sells”. The “there’s an App for that” model is seen to be sexy, cool and easy to use. Few companies are as guilty of over-marketing the banal and simple as Apple, and they have achieved it right here. They have developed an eco-system, a culture and a platform that stifles innovation, widens the gap between the developer and the user and acts anti-competitively towards key rivals. I remember another company getting its hands very publicly slapped for similar practices, but Microsoft just weren’t “sexy” enough.

Redesigning the Island Web Works site

When we started discussing the requirements for the new Island Web Works site, we quickly agreed that the new site needed a new look.  The old site had been online for quite a while and had started to look a little dated.  We wanted to make the new site feel more open, which meant abandoning the old layout with a centered column down the middle of the page.  Instead we opted for a design that spanned the whole width of the page, although we kept the content to the center part to give the site some white space in the margins.

Another issue was the Island Web Works logo.  As you can see at the bottom of this post, it consists of a yellow band with the company name in blue on top.  Whilst the logo is eye-caching and has served us well, its colour scheme limits how it can be placed in a design.  Our solution was simply to reverse the logo and remove the band, which made it possible to place it in the carbon-fibre textured header.  The colours were instead represented by a yellow line running through the header and the blue in the cloudscape below the header.

We also made the decision to get rid of the Flash animation and replace it with standard Javascript.  The reason for this are the SEO (Search Engine Optimisation) limitations of Flash and - more importantly the meteoric rise in the use of smart-phones for browsing the web.  Even though some phones support Flash, many - such as the Apple devices do not. Additionally, by using Javascript instead we wouldn’t require a special mobile site.

Designing the Circle² web site

The new Circle²site use a similar layout, but has been designed in a more corporate style to fit its main purpose - promoting our business intelligence services and products.  Since the Circle² logo is in black and orange (or white and orange when inverted), we chose to balance these energetic colours by using a calm dark blue backdrop for the header and footer sections.  And, again, we opted to not use Flash animations to maintain smart-phone and SEO compatibility.

Connexions™ Content Management

Both sites are built using our new Connexions™ Social Content Management solution, which offers full control over all content.  Also, as a matter of course, we made sure that the sites work in all major browsers, including Internet Explorer 6, 7, 8 and 9, Firefox, Chrome, Safari and Opera.

Visit Island Web Works

Visit Circle2

Defining countries can be a sensitive issue, with some countries not being recognised by others and local usages and naming styles also causing problems. That is why we lean towards the formal when we work with lists of countries. We use accepted international standards as a source for our lists, which allows us to take a widely accepted view of country names around the world, hopefully without causing offence.

This list presents us with problems, however. Consider the screenshot below from a list of countries for a large site we are currently working on:

'Leaking' drop down list with wide country names

The first problem is the large amount of horizontal space used by the entries, which causes the drop down list to be expanded artifically. This makes it difficult to fit in some designs. This is highlighted by the purple arrow. This width is determined automatically by the longest entry in the list, in this case “MACEDONIA, THE FORMER YUGOSLAV REPUBLIC OF”. Far be it from us to assert our right to change a country’s name, we need to hit a compromise. This can either be changing the design to accommodate the wider data or - at a last resort - changing the data (in this case, we could use the commonly accepted “FYR” abbreviation).

I was asked why all the countries are in capitals. “Well, that’s how they come in from the original standard”, I replied. The thing is, capitals require wider horizontal space and it does feel like you’re shouting. I imagine the ISO standard is capitalised to avoid another thorny issue; what exactly should be capitalised in a country name? While “Macedonia, The former Yogoslav republic of” may be technically correct, it may not be politically correct. We decided to stay with the CAPS. Another reason to stick with the CAPS is because users are traditionally used to seeing country lists in capitals. When was the last time you entered your country and it was lower-case? By retaining capitals, we build on this albeit uncomfortable convention.

Semi-recognised Countries and transient states are also difficult to navigate. The world is constantly changing and countries are born, extinguished and forgotten even in modern politics. On The Isle of Man, we are in a position that is little understood away from its shores. While we are a crown dependency, and a country, we are not regarded as a sovereign state. So, we tend to be lumped into “United Kingdom”, even though technically, we’re not actually in the UK. Web users on the Isle of Man have become used to going for “United Kingdom”, as opposed for hunting down the Isle of Man within the “I”s.

I remember this being particularly contentious when I was working for an e-Commerce web-site provider. While we should provide “Isle of Man” as a country option for reasons of correctness, postage, etc., we couldn’t rely on that data being correct because Isle of Man users may just be used to using “United Kingdom”. If we avoid including “Isle of Man” from the selection, we might have incorrect data, but at least it isn’t inconsistent.

It can be a minefield, as you are always keen to avoid offending your users at the very least in trying to create a positive web experience. It’s also important to lean towards convention when designing user experiences, as your experience is only one in hundreds that may have used and millions on the wider internet.