Planet OpenID

July 02, 2009

David Recordon

Sign in to Sears and Kmart with OpenID!

A lot of the major adoption successes for OpenID have been in the tech industry, though as of yesterday you can sign in to MySears.com and MyKmart.com using an OpenID. Beyond Interscope Records offering OpenID sign in on artist sites like Snoop Dogg's, Sears is really the first major retailer adopting OpenID. More on the OpenID blog and congrats to the team at JanRain that helped make this happen:

“We’re constantly looking for ways to stay innovative in our online initiatives by identifying and implementing technologies that help our users navigate our communities with ease,” says Rob Harles, Sears’ vice president of community. “Our adoption of the OpenID technology helps simplify our customers’ online experience and ultimately helps us meet our goal of ensuring our customers have the most efficient shopping experience possible.”

July 02, 2009 06:12 PM

OpenID.net

Sears and KMart Adopt OpenID to Simplify Customer Registration and Login While Enhancing the Shopping Experience

Yesterday, Sears Holding Company (SHC) announced it has adopted OpenID technology, enabling website visitors to easily register and login at the MySears and MyKmart communities using existing accounts at Google, Facebook, MySpace, Twitter, Windows Live, and Yahoo!. This is exciting news for for online retailers and follows shortly after the OpenID Foundation hosted the first Retail Advisory Summit this past April in New York.

Sears OpenID SigninMySears and MyKmart community sites are online destinations that give consumers a variety of ways to share in-depth information about products, helping make their purchase decisions easier. Visitors to these websites have the opportunity to write product reviews, post comments on the reviews of others, participate in discussion boards and post ideas for the community to vote on. Customers also have access to special offers and coupons in return for their participation in the community.

Read what Sears and Viewpoints (a technology partner) had to say in their press releases:

“We’re constantly looking for ways to stay innovative in our online initiatives by identifying and implementing technologies that help our users navigate our communities with ease,” says Rob Harles, Sears’ vice president of community. “Our adoption of the OpenID technology helps simplify our customers’ online experience and ultimately helps us meet our goal of ensuring our customers have the most efficient shopping experience possible.”

“As the social web becomes a bigger part of our everyday interactions and the boundaries separating the myriad of social networks blur, portable online identities will become critically important,” commented Matt Moog, Founder and CEO of Viewpoints Networks, a SHC technology platform partner.

By building on top of OpenID and related technologies, Viewpoints allows its clients’ websites to offer a more intuitive and customized user experience that uses existing profile data a consumer brings to their site from various OpenID Providers. Viewpoints and Sears have taken advantage of much of the ongoing user experience and usability work that is one of the two main focuses of the OpenID Foundation this year. Viewpoint and JanRain continue to show that by implementing OpenID in an innovative manner, companies such as Sears will increase registration and login rates while also enabling instant engagement with the consumer.

Sears and Kmart’s adoption of OpenID demonstrates its fundamental business value; it makes things easier for web users. In this case, OpenID makes the online shopping experience richer and simpler for customers. While much has been made of the impact of the social web, the action taken today by Sears and Kmart shows how relevant OpenID is becoming to mainstream retailers. This adoption is another example of the groundswell of interest found across a wide spectrum of today’s online user experiences.

This announcement represents a major step forward in OpenID adoption by a top ten retailer outside of the technology industry. Deployments like these continue to build on the ongoing usability and user profile management work being championed and facilitated by the OpenID Foundation and its membership. Sears and Kmart have provided a great example of how OpenID can dramatically facilitate quicker, easier, and richer online engagement.

by Brian Kissel at July 02, 2009 08:16 AM

June 29, 2009

Kaliya Hamlin

Facebook Organizing

http://personaldemocracy.com/blog-entry/breaking-down-barriers-facebook-organizing

http://facebookorganizing.blogspot.com/2009/02/breaking-down-barriers-to-facebook.html

by iwoman at June 29, 2009 01:40 PM

Kaliya Hamlin

India says it will be creating National ID for Citizens

I found this last night on Slashdot – it was to important not to blog about. “India to Put All Citizen Info into Central Database

Reading the article in The Independent this stood out for me

The creation of the ID or Unique Identification Number (UID) was a major plank of the manifesto of the ruling Congress Party during the recent election.

India is not a western democracy where “everyone” has papers and certificates of birth. As the article highlights

“This could be used as a security measure by the government which leaves migrant workers, refugees and other stateless people in India in limbo, without access to public services, employment and basic welfare.”

Our identities don’t come from government – they come from our social interactions and relationships.

The other issue that comes from this is “everyone in one database” is a giant honey pot.

by iwoman at June 29, 2009 01:21 PM

June 24, 2009

Santosh Rajan

Federated Identity in your Browser

In this post I am going to discuss the background information that will make a case for Federated Identity Management in Browsers. With the advent of new Browser capabilities, and leveraging the new technologies that will be adopted by Federated Identity specifications, I hope to show how Federated Identity Management can be achieved using Browsers.

Federation of Identity serves to enable portability of Identity information across otherwise autonomous security domains. In other words Federated Identity is about using a single Identity to sign into different web sites (over simplifying a bit here). This is not only about your "username" and "password" but also a about other information that identifies a person like, real name, address, nick name, email etc.

Examples of common Federated Identity usage are, using your Google or Yahoo Account to Log in to other sites like Blogger, Youtube etc. In this case the web site allows authentication via any "Provider" that follows a Federated Identity standard like OpenID eg. This is different from using your Facebook or Twitter Accounts to sign into third Party sites. In the latter case it is called Delegated Identity. In other words the web site you are signing into has delegated authentication to Facebook or Twitter.

The way Federated Identity Log ins work is that, when you visit a Site you are redirected to your Identity Provider, eg. Google. You Log in at your Provider, and also "allow" your provider to provide additional information (your name, email etc), and then you are redirected back to the web site. For one this method is prone to Phishing. If a user inadvertently visits a untrustworthy site, the site could redirect the user to a site that appears to look like the users provider and steal his user name and password.

Another problem is that when you visit a site that supports Federated Identity, you cannot log in to the site just by clicking a button. The site for various reasons will choose to support a selected list of providers from which you have to choose from, leading to what is called Nascarization.

Another problem is that of data portability. Let us say you have your identity, profile and social contacts at Google, and you want to change to Yahoo. There is no way to do that seamlessly as of now.

All this begs the question where is the best place to keep your identity information? With You! That's the obvious answer. And the closest that can get to "You" is your Browser. Unfortunately in the current state of affairs of Federated Identity, the browser only plays the role of via media or broker, between the Identity provider and the web site. If the Browser were to manage your identity you could solve all the three problems above in one fell swoop!

However there are two reasons why browsers do not play a greater role in Federated Identity Management.
  1. There is no commonly accepted standard that will allow browser vendors to support this. This would require a specification to allow the browser, identity provider, web sites to speak a "common" language.
  2. Another solution would have been to implement browser plug ins. This would still require the common standard but at least we do not have to wait for the browser vendors. But the problem here is developing plug ins for all types of browsers is not easy (at least up to now).
New browser developments like Jetpack from Mozilla Labs allows you to develop browser plug ins very easily using Javascript. Opera Unite is another effort to empower the browser. All browser vendors are moving in the direction of empowering the browser. What all this means that extending your browser to support a Federated Log in standard is going to be trivial.

So what we really need is a "Federated Identity Standard for Browsers". There must be a working group for this at one of the standards bodies like OpenID, Open Web, Kantara etc. I have not seen such a working group yet.

I intend to demonstrate how a simple Federated Identity standard can be implemented using Mozilla Jetpack, and some minor tweaks to existing Federated Identity provider and consumer software, in a future post of mine.


by Santosh Rajan at June 24, 2009 08:52 AM

Kaliya Hamlin

IIW & Identity Community Bumps in the Road

This is cross posted on the IIW blog .

When we first started meeting (the early “seedling” meetings of community) at other people’s conferences, there were Microsoft people, Liberty Alliance/SAML people, Shibboleth implementers, user-centric folks (OpenID, LID, sxip, i-names/xri), big idea folks (Doc Searls), etc. We met for a couple of hours at a time and knew there was common ground, but knew we needed more time to really understand each other: to have more of a shared language and develop enough strength in the relationships in the community to work together. We figured we needed to have more time to meet together, so we convened the Internet Identity Workshop. That first event was amazing and quite formative – kicking off the conversation that would lead to OpenIDv2 via Yadis. Kim Cameron presented his 7 laws of identity that have become foundational to community thinking and introduced the idea of information cards and selectors; much work is now happening around this.

Soon afterward Brett McDowell the ED at Liberty Alliance approached me and Phil about having an Internet Identity Workshop (IIW) next to (the days following and in the same location) an upcoming Liberty Alliance meeting. We thought this was a great idea to create more space for people to meet about user-centric identity technologies and issues. When Microsoft got wind of this, boy did I get an earful – they felt that the neutrality of IIW would be totally compromised if it came to be that closely associated with Liberty Alliance (remember Liberty Alliance was originally formed by Sun and others in response to Microsoft Passport).

IIW had provided a forum for anyone working on user-centric identity technologies to come together without anyone making an “agenda” for the meeting or creating a “technology road map.” Literally anyone who came could put a subject on the agenda on the day of the event. All parties did want to increase dialogue and cross-pollination among the groups, and we found a way through by jointly (IIW and Liberty Alliance) producing what we named the Identity Open Space (we also said we would be open to co-producing with others who asked – we did two with Digital Identity World). It was in Vancouver Canada and Kim Cameron along with several Microsoft folks along with many in the user-centric community attended and because it was the two days after a Liberty Alliance meeting many Liberty people were also there, and it was a good event that moved the industry forward.

Right in the middle of getting this worked out – I on a personal level had a very intense experience being caught in the middle – a giant trade association on one side and Microsoft on the other. We (me, Phil, Doc, Kim, Brett) managed to navigate this as a community and do the right thing and we became stronger as a community for having done so.

We continued to have IIW’s every 6 months and in 2006 it was clear we were going beyond just IIW and needed a community home/container to connect community efforts and provide common services (blogs, wikis, bank account for doing common work like holding events). We held a series of conversations and decided to create a community organization, drawing on an existing one, Identity Commons – the community liked the purpose and principles approach for bringing people together. As a codition of brand transfer to a our nonprofit organization we worked on our version of purpose and principles. There were some delays in actually getting the organization legally formed and the brand transfered, but in 2007 we were an official organization: a network of organizations, initiatives, and projects all working on different aspects of a people-centric identity layer of the web. There are several places you can read about community history and background around Identity Commons. I wrote “What the heck is Identity Commons?”.

Next fall we are hosting our 9th event. Many things have move forward significantly in the community – OpenIDv2, OAuth, Venn of Identity paper, OSIS Interop, Concordia use-cases, Information Card evolution including Augmented Browsing with Action Cards, Portable Contacts, Open Social, OpenID/OAuth hybrid, Activity Streams, Distributed Social Networking, Discovery particularly XRD. So what has made IIW work so well in fostering the kind of collaboration and innovation that has emerged from it?

  • We have kept the space free: no one has the ability to buy time at the conference.
  • All ideas are welcome: there is no committee controlling the agenda, so politics about what is “on the agenda” or “not” just doesn’t happen.
  • It is a working workshop to solve real problems, move technical projects forward and discuss interoperability among them.
  • We put attention towards creating the space for relationships between people to form naturally over time and thus enabled trust to grow.

by iwoman at June 24, 2009 12:06 AM

June 23, 2009

Martin Atkins

A Protocol for Batch HTTP Requests

There's been murmerings of discussion about the possibility of doing batch HTTP requests for some time now. Some folks maintain that it isn't necessary for one reason or another, while several popular web services provide batch request mechanisms that are tailored to their specific API but are not generally applicable.

A while back I wrote up a draft spec for a general-purpose batch request protocol, loosely based on James Snell's proposals. I've discussed this with folks at various conferences and people seemed generally receptive to the idea. I notice that since then he's posted HTTP Multipart Batched Request Format, which is also based on his initial thoughts but he went in a different direction to me. I regret that I didn't post about my draft sooner so that we could have potentially worked together on this.

My approach is to mimick the behavior of an HTTP proxy server. Although in practice I expect many implementations won't be acting as proxies in the traditional sense, it was my expectation that this would make it easier to adapt existing implementations that already know how to deal with proxies.

Simon Wistow wrote a Perl implementation of this spec (now living on my Github) and there's a Python library implementation based on httplib2 as well as a standalone proxy server written in Python using Twisted done by some of my Python-speaking colleagues, both of which will hopefully be released soon.

As with many of these things, the main win in having a standard here is that it should cease to be necessary to write a separate implementation for each new web service. Of course, until more than a couple folks adopt a standard it's just another proprietary request format, so I hope to have some discussion about this to figure out where we can meet in the middle of the various proposals and come out with something that multiple services would be happy to support.

by Martin Atkins at June 23, 2009 06:59 PM

Kaliya Hamlin

Cultivating Community

Communities don’t usually “just happen” there is idea, or vision that attracts people, and there are community organizer(s) or catalysts that proactively seek out others who share a vision and help bring a community together.

Growing community, cultivating community, nurturing community, weaving community, building community, creating community – all slightly different metaphors describing this process that happens when people make the effort to create space (an environment) for people to meet, inviting people into the space and encouraging conversations that help connections and foster relatedness.

Community is what unfolds when people come together voluntarily, learn about one another, begin to care about one another, and start to do things together. In doing things together that are successful, trust develops and people begin to work and act together IN community, doing progressively more difficult things, becoming strong and more resilient.

Thanks to Malcolm Gladwell’s The Tipping Point we know about Connectors, Mavens, and Salespeople, social archetypes that play different roles, each with their own value in helping information flow, networks form and communities emerge.

It was great to have him articulate this i finally had a label for my own activity/passion – I have become a maven of a few things throughout the years. user-centric digital identity was a subject I really got into in 2003-4. I read everything I could about the subject as I began to meet some of the people thinking about it. I became passionate about the topic and applied my connector skills and started meeting finding people who were interested in the subject. Those who didn’t know about the subject I sold them on the idea :) . I am not by nature a sales person about “anything” but only those things I believe in.

One can also see a community as the evolution and maturing of a network, that is the relationships between people. When beginning the links might be very weak, but in time as the potential community members get to know each other and take action together and the ties strengthen; they become a stronger and more resilient “real” community. A paper that was very influential in my understanding was Building Smart Communities through Network Weaving by Valdis Krebs and June Holley that I read in 2003 (along with every popular science book on network science out then: Linked, Sync, Six Degrees, Emergence, Nexus)

This paper investigates building sustainable communities through improving their connectivity – internally and externally – using network ties to create economic opportunities. Improved connectivity is created through an iterative process of knowing the network and knitting the network.

Knowing the network and knitting the network have been foundational in my practice of community weaving. I regularly meet with people in the community and help them get connected to others who’s work is related to their goals. Two examples first RSA as often happens those new to the community “knock on my door” and ask to meet for lunch or coffee to share what they are doing and learn more about who they should connect to in the community. Mike wanted to meet with me he to share about his new company Gluu that does inter-domain identity. It was great to learn what he was up to and also share papers/doc’s/projects relevant to his work and people he should meet. Yesterday I followed up with someone I invited to/and attended IIW. I spent 2.5 hours talking with Joe Johnston who attended about his efforts to bring interoperable identity (OpenID and other things) to Pachamama Alliance and other organizations with similar missions.

In terms of knowing and knitting networks between different communities/standards bodies/consortia/projects I wrote a post about Community Diplomats and Community Diplomacy last year thinking about different community-connecting roles and how if they are named they can be seen better and foster inter-group collaboration and communication.

Another essential but often un-named aspect/milestone of community development is communities development is shared language and then shared understanding. Shared Language is a prerequisite to collaboration enabling what were different perspectives and world views to sync, and then out of that it is much easier to work together. Eugene articulates three elements needed to create shared language:

  • Share individual contexts
  • Encourage namespace clash
  • Leave enough time and space to work things out

An example of shared language that was developed in the community was the identity gang lexicon that Paul and others worked on in 2004-2005 so that when discussing different identity technologies there was at least a common language to talk about them.

Another example of the evolution of the communities shared understanding grew out of Johannes original presentation at IIW2006 with the identity triangle with three pillars – user-controlled, company controlled and then microsoft controled. He did an updated it almost a year later explaining of the community language and understanding had evolved. This starting point was moved forward by Eve Maler creating the Venn of Identity and became an IEEE paper written by her and Drummond Reed. Johannes has continued to be a wholistic thinker about the landscape and in 2008 he articulated an onion to think about which identity technologies are applicable where.

Space and Spaciousness for community to form is a key part of what the Internet Identity Workshops have been about about. We have never “set the agenda” there but instead allow anyone attending to post a session idea. We encouraged dialogue with space rather then having an agenda.   

We have an amazingly rich community fabric of working relationships that is both resilient and delicate.

by iwoman at June 23, 2009 04:12 PM

June 22, 2009

Kaliya Hamlin

Making ID/Social Web Products Better

This Friday I am going to be co-facilitating a day of learning and exchange about Innovation, Design and Serious Games Exchange this Friday in San Francisco. I would like to invite you all to participate. It will be an open space style unconfernece – with attendees creating the agenda – it is open to all.

Last September I took a training with the founder of Innovation Games Luke Hohmman (to be a game facilitator) and it was amazing set of fun “games” to play with the users/customers of one’s products. Quite different then a focus group in terms of the kind of information that you get about how to shape/design your products. (wikipedia article – details all 12 games and information about selecting the appropriate game)

I know what you are asking how is playing games going to help with my products, workplace or process. I wondered this too….her is a simple example.

I explained one of them (Buy a Feature) this way at the Online Community Unconference – say you have a next generation set of features to build for your product – you have 10 potential features but only time to build a few of them – how do you prioritize/decide about which ones to put in the next release?
Buy a Feature is a game you can play o do this (and it is both online and face to face)
You bring in 10 current customers together and give them each $200 of play money. You give each of your features a cost totaling $3000-$4000 (one might be $100 (really easy to build) $500 (harder/more time) etc.) They must amongst them selves figure out how to spend their $2000 to by a limited set of the 10 features. You could play this with several sets of customers and then gather information about what they want. It helps you make decisions about what to build AND it is fun for them to play the game of “buying” the features they want.
The conference is not limited to “just” innovation games but also includes other design and “serious” games.

  • Design games: Offering collaborative design activities within a game format improves idea generation and communication among stakeholders. By shifting focus to the game, power relations and other factors that might hamper idea generation, are downplayed
  • Serious games: Ranging from theater improvisation to interactive games technology within non-entertainment sectors, serious games have uses in education, government, health, military, science, corporate training, first responders, and social change

You don’t have to be an expert to attend – if you are just exploring these things we invite you along.

There have been a few companies in the identity space that have used these tools – I just can’t say who.

I am also happy to talk with folks if they are interested in using games to innovate and do better product design in the identity and social web space.

Here is the book if you are interested in learning more.

“Innovation Games: Creating Breakthrough Products Through Collaborative Play” (Luke Hohmann)

by iwoman at June 22, 2009 08:50 PM

June 20, 2009

Scott Kveton

The Funniest Thing on the Internet

If you’re looking for the funniest thing on the Internet, move along. Just like you, I couldn’t find it either.

I used Google to try and find it. Guess what happened? I got a bunch of crap.

I don’t blame Google. I love Google. But not when I want to find something subjective like the “funniest thing on the Internet” or “the most awesome burrito in Portland” or “the best membership management software for a non-profit”. Nope. I’m using Twitter for that now.

Blah, blah, blah. This isn’t another one of those ra-ra-ra stories about Twitter. Twitter’s got issues. I’m pretty sure we all know that. But it works. In the immortal words of Biz Stone, its not about a business model, its about creating value.

* mostly instantaneous
* need lots of “followers” to work
* twitter now has “real” celebrities joining the club
* dave morin and garyvee are at $160k followers … err … 160k followers
difference between lexapro and celexa Clomid Pdr accutane timeline
Symptoms of zoloft working sie effects of lexapro 568. Buying Nolvadex lipitor drug cost
prednisone stopped taking side effects Levitra Medicine difference between lexapro and celexa
accutane timeline Penis Growth Pills Symptoms of zoloft working sie effects of lexapro 568.
lipitor drug cost Subaction Showcomments Propecia Archive Newest prednisone stopped taking side effects
difference between lexapro and celexa Average Dose For Zoloft accutane timeline
Symptoms of zoloft working sie effects of lexapro 568. G Postmessage Cialis Subject Online lipitor drug cost
prednisone stopped taking side effects Zoloft Thin Blood difference between lexapro and celexa
accutane timeline Nexium Side Effects Symptoms of zoloft working sie effects of lexapro 568.
lipitor drug cost Buy Lasix Without Prescription prednisone stopped taking side effects
difference between lexapro and celexa Prednisone 20mg accutane timeline
Symptoms of zoloft working sie effects of lexapro 568. How Does Cialis Work lipitor drug cost
prednisone stopped taking side effects G Postmessage Propecia Smiley Reply difference between lexapro and celexa
accutane timeline Buy Cialis In The Uk Symptoms of zoloft working sie effects of lexapro 568.
lipitor drug cost Treatment Of Ocd With Zoloft prednisone stopped taking side effects
difference between lexapro and celexa Canine Prednisone accutane timeline
Symptoms of zoloft working sie effects of lexapro 568. Buspar Zoloft lipitor drug cost
prednisone stopped taking side effects Prednisone 10 Mg difference between lexapro and celexa
accutane timeline Accutane Before After Symptoms of zoloft working sie effects of lexapro 568.

by kveton at June 20, 2009 07:16 PM

June 17, 2009

Chris Messina

Microsoft Internet Explorer 8 at the height of cynicism

Ten Grand is Buried Here | Microsoft Australia

I shat on Opera yesterday, and I did the same thing to Mozilla a couple years ago, and while I’m not about to go headlong into another tirade on Microsoft, I do have to point out why this contest out of Microsoft Australia is, actually, as stupid as it sounds (contrary to what they’d have you believe).

First, my memory isn’t so short as to have forgotten that it was Microsoft and their browser (Internet Explorer 6) that held back the web for so many years.

Second, promoting a contest that is based on the very same problem that lead to IE6 stifling innovation on the web is not just in poor taste, but surpasses the height of cynicism — just as Microsoft is trying to be perceived as an increasingly productive “web citizen”.

To reiterate my point, making entry to the contest contingent upon using Internet Explorer 8 not only limits participation to Windows users, but suggests that designing pages to favor IE8 over other browsers is somehow okay, or condoned by Microsoft — completely antagonistic to their recent successes in supporting web standards in the browser!

Here’re the relevant rules of the contest (again, emphasis mine):

  1. To enter the competition, the entrant must follow clues released by @Tengrand_IE8 on Twitter and on www.tengrandisburiedhere.com. The clues section on www.tengrandisburiedhere.com is only viewable in Internet Explorer 8. These clues will lead the entrant to the hidden webpage.
  2. The hidden webpage can only be viewed in Internet Explorer 8. The entrant must have download Internet Explorer 8 to successfully view the hidden webpage. Upon discovery of the hidden webpage, the entrant must register his/her details, via the hidden webpage ‘Claim’ button.

Third, spending $AUD10,000 seems like a complete waste of money when it could have been put towards promoting web standards by basing the contest on building some sweet non-Silverlight, non-IE8-specific web application. But no, they chose not to seize that opportunity.

Yes, this really is as stupid at it sounds.

On the upside, here’s an awesome CC-licensed graphic by John Martz that, in the spirit of this contest, you could serve to all your IE6 visitors to remind them how out of touch their browser vendor can be (click for full size):
IE6 denial message for Momentile.com

by Chris Messina at June 17, 2009 06:15 PM

Scott Kveton

Launching the Urban Airship

I’ve been a busy guy in 2009. Launching Bac’n, joining the SAO and now today, launching

by kveton at June 17, 2009 10:50 AM

June 16, 2009

Chris Messina

Thoughts on Opera Unite

Opera UniteI met today’s news about Opera’s new initiative — called Unite — with a mix of shock and awe.

On the one hand, I was sickened by the lack of analysis from the echolalic blogger news corps. It appeared that Opera PR had successfully reached out to all of them, shoved a news release down their throats and waited to give them the go-ahead to regurgitate it on their blogs, using the same screenshots, same content, and differing only in the pithiness of their post titles.

Of course, I could have gotten the same depth of analysis from half a dozen tweets.

Maybe they long ago wrote off Opera and aren’t interested in providing any kind of depth of insight but whatever, who knows — the nouveau press corps blew it. Social media proves its vapidity once again.

But, I digress. I’ll tell you what I think, since there’s a lot in the details of Opera’s announcement that bear inspection, even if I’m the only one to do it.

I’m going to talk about six topics:

Let’s get to it.

What is Unite?

Like Flock before it (Disclaimer: okay, I’m just stroking my own ego here. Note to self: get over yourself), Opera is attempting to take advantage of the rise of social networking (the verb) and bake it into the browser, as a personal extension to one’s computing experience.

They accomplish this by embedding what amounts to a web server in the browser, and making it possible to share files, music and photos and to post notes or chat directly with your friends (or anyone who knows the URL to your account and in some cases, has the right password).

You can download an Opera Unite alpha build to try it yourself.

The Marketing Pitch

Opera Software

The marketing hype for Unite started recently, with a bright red page (above) hosted at opera.com/freedom. Of course this inspired a bit of buzz, and Kas Thomas from CMS Watch even guessed correctly what it was all about:

Folks, let me tell you what’s going to happen. I have a pretty strong hunch (but no inside info, I assure you) on this one. This is something I’ve thought about for years — it has needed to happen for years — and I’ll be thrilled if Opera pulls it off, although whether people will flock to adopt it is another question.

The answer is that Opera is going to embed a web server in itself.

When you fire up Opera, you’ll be operating a secure server and you will be able to serve all kinds of content (whatever you want, basically: bookmarks, contacts, cached content, arbitrary files from a roped-off area of your local storage, web pages of your own) to other Opera users, at the very least, and maybe all browser users, at the very most.

The mystery seems to have paid off, as Unite is topping Techmeme today.

They released a stylized video explaining Unite, remniscent of the Data Portability promotional video from several months ago:

What I find so fascinating about this marketing message is that it presumes that owning one’s own data and “connecting directly” with friends is somehow relevant to people — as though it’s a big problem that people have been complaining about for years, and that Opera has finally answered the call.

But I think they’re missing the big picture here — or intentionally obscuring it — which is that, while the idea of owning your own data may be attractive to neo-libertarians and open source geeks — most people really don’t care and are happy to outsource storage of their data to someone else who can be responsible for backing up their data and fending off hackers. 200 million Facebook users can’t be wrong, right?

People have embraced social networks because they make it easy to share and collaborate using the browser that they already have — and answering the question: “what do I do with all these stupid digital photos sitting idly on my harddrive?”

Let’s face it, bookmarks were pretty lame before we could peak over our friends’ shoulders at what they were reading.

So while Opera is right to seize on to the social networking meme, they’re doing so largely to increase the waning relevance of their browsernot to support freedom as they claim — especially at a time when Google’s Chrome and Apple’s Safari have entered the ring as the new twin contenders for the browser crown (even though no one knows what a “browser” is).

Furthermore, their whole pitch about owning your own data and disintermediating the large social networks will likely resonate much more with a European audience (i.e. one that would give 7.1% of their vote to the Pirate Party) than a mainstream, social network-obsessed American one.

If you consider how Lawrence Eng (Opera’s product analyst) puts Unite into context talking about “the Internet’s unfulfilled promise”, you’ll see what I mean:

Our computers are only dumb terminals connected to other computers (meaning servers) owned by other people — such as large corporations — who we depend upon to host our words, thoughts, and images. We depend on them to do it well and with our best interests at heart. We place our trust in these third parties, and we hope for the best, but as long as our own computers are not first class citizens on the Web, we are merely tenants, and hosting companies are the landlords of the Internet.

Social networking is important, but who owns it — the online real estate and all the content we share on it? How much control over our words, photos, and identities are we giving up by using someone else’s site for our personal information? How dependent have we become? I imagine that many of us would lose most of our personal contacts if our favorite Web mail services shut down without warning. Also, many of us maintain extensive friend networks on sites like MySpace and Facebook, and are, therefore, subject to their corporate decisions via “Terms of Service” and click-through agreements. Furthermore, what does it mean anyway to be connected to hundreds of our “closest” friends? What about our real social networks, the people we want to interact with on a regular basis (like once a week, or even every day)? Why are online solutions to help us with our real-world social needs so few and far between?

We are connected to a Web that has democratized much and is an amazing source of information. However, “the wisdom of the crowd,” along with the notion that our data ought to live on other people’s computers that we don’t control, has contributed to making the Internet more impersonal, anonymous, fragmented, and more about “the aggregate” than the individual. In fact, quite the opposite of the original promise. For too long, we’ve been going online to connect to each other, but sacrificing intimacy as a result.

With Opera Unite, I think we can start moving in a different direction.

Now, it might sound ironic coming from me that I think Opera was wrong to paint their pitch with the paint of libertarian ethos, but if they’re going to succeed, they have to go beyond “owning your own data” to talking about why owning your own data is better or easier. Philosophical rhetoric will only get you so far, as I’ve learned.

Speaking of…

Why isn’t Opera open source?

So, with all that raging neo-libertarian angst, why isn’t Opera open source?

Quite frankly, I have no fucking clue. And with Webkit giving everyone — including Mozilla — a run for dominance over the personal viewport to the web, I simply don’t see why anyone would build on the Opera platform (albeit, their platform is largely the web — though their rendering engine remains proprietary).

Could it be failure of imagination? Is it that Opera hasn’t figured out that the future of the web is in hosted and delegated services? Or, is it that they did figure that out, but desperately want to defeat that future in order to write an alternative future with their browser at its center?

In 2006, Opera didn’t see a business model for open source browsers. Little has changed since then, except that they now have three formidable open source challengers to contend with that have shipped “cloud services”: , Google’s Apps and Apple’s .

So, although you can build widgets for Opera Unite, you’re still relying on a third party to stay in the room with you… namely, Opera. And Opera isn’t exactly an organization that has behaved favorably towards the open source community in the past. Though that seems unlikely to change, it still begs the question why they believe there is more value is staying proprietary than opening up their browser to outside contributors.

Still, regardless of the decision that they make for their business about open source, there’s a bigger elephant in the room that needs to be addressed:

Is Opera Unite really decentralized?

Opera United

Opera’s CEO Jon von Tetzchner claims that “Opera Unite now decentralizes and democratizes the cloud”, illustrated like this:

Data sharing with Opera Unite

I call bullshit.

Opera Unite does indeed rely on a P2P-like network to function, but the big problem is that you must push all your traffic through Opera’s proxy service:

The set up when using the Opera Unite server in your browser

Not exactly “decentralized” (more on this in the next section).

Furthermore, if you read through the Opera Desktop End User License Agreement (which you had to if you installed the browser — shame on you if you didn’t!), you would have read section 7: USE OF SERVICES (emphasis mine):

Opera Unite and Transmission and Receipt of Content: Certain features of the Software and Services, including Opera Unite, may allow you to post or send content and/or links to content stored on your computer, that can be viewed by others (”User Generated Content”). Opera Software ASA exercises no control over User Generated Content passing through its network or equipment or available on or through the Services. You agree that Opera Software ASA is not liable for any loss of data. YOU MAY ONLY POST OR SEND USER GENERATED CONTENT THROUGH THE SERVICES THAT YOU CREATED OR THAT YOU HAVE PERMISSION TO POST OR SEND.. You agree not to use Opera Unite to upload, transfer or otherwise make available files, images, code, materials, or other information or content that is obscene, vulgar, hateful, threatening, or that violates any laws or third-party rights, hereunder but not limited to third-party intellectual property rights. We do not claim ownership of any User Generated Content. However, by submitting User Generated Content to us, you grant us and our affiliates the right and limited license to use, copy, display, perform, distribute and adapt this User Generated Content for the purpose of carrying out the Services.

You agree that we are not liable for User Generated Content that is provided by others. We have no duty to pre-screen User Generated Content, but we have the right to refuse to post, edit, or deliver submitted User Generated Content. We reserve the right to remove User Generated Content for any reason, but we are not responsible for any failure or delay in removing such material. We reserve the right to block any user’s access to any content, web site or web page in our sole discretion. Opera Software ASA reserves the right to terminate your account if you use your account privileges to unlawfully transmit copyrighted material without a license, valid defense or fair use privilege to do so.

Disputes may arise between you and others or between you and Opera Software ASA related to content or commerce, including User Generated Content. Such disputes could involve, among other things, the use or misuse of domain names; the infringement of copyrights, trademarks or other rights in intellectual property; defamation; fraud; the use or misuse of information; and problems with online auction or commerce transactions. You agree that all claims, disputes or wrongdoing that result from, or are related in any way to, the content of information that you post, transmit, re-transmit or receive through the Services, Opera Software’s network or Software are your sole and exclusive responsibility. Opera Software ASA may at it’s discretion, block certain web sites or domains and re-route you to other pages. By accepting these Terms of Use, You hereby consent to this.

Besides this hands-on approach to their centralized proxy service, Opera also reserves the right to filter the apps that you can install, a la Apple and their approach to the AppStore (because everyone wants an AppStore, right?):

What are the guidelines for approval of an Opera Unite Service?

These are some of the guidelines that apply to services:

  • The service must have a sensible name and description
  • The service must not have obvious bugs, so ensure that you test it before uploading
  • The service must not contain malicious or destructive code
  • The service must not contain or use copyrighted information for which you do not hold the rights
  • The service must not contain or point to adult or hateful content
  • The service should comply with the Opera Unite Service UI guidelines. Any reason for diverging significantly from the guidelines should be documented in the submission
  • The service should serve standards-compliant HTML pages that are viewable in all modern browsers on a variety of devices.

I fail to see how this changes our reliance on “large corporations — who we depend upon to host our words, thoughts, and images” of whom Lawrence Eng spoke so disparagingly.

Owning Your Namespace

So, if it isn’t enough that you have to tunnel your connection through Opera’s proxies and place your service’s existence at the mercy of Opera’s filters, they also want to own your identity, something that everyone also wants to do lately.

In order to use Opera Unite, you have to have a my.opera.com account — perhaps not a big deal until you realize that you’ll be assigned a URL like http://notebook.username.operaunite.com/ to access your “self-hosted” outpost on the web.

Chris Mills, Opera’s Developer Relations Manager, explains:

To use Opera Unite Services, you need to log into Opera. This is the same login that you use to log in to My Opera, Dev Opera, or Opera Link.

Choosing an Opera Unite name for your computer

This name is basically your computer’s identity on the Opera Unite system — this is the URL that your contacts can go to if they want to make use of your Opera Unite Services, and share them with you.

So, while it’s true that your friends can access your Opera Unite homepage without an Opera account, if they want to host their own Unite server, they’re going to have to both download Opera and obtain an Opera account (and no, they don’t support OpenID).

While there are technical reasons that why this makes some sense (mostly to make it easier to get things up and running), it contradicts the whole promise of obviating central control. Indeed, AllPeers (now defunct) and others offered similar solutions previously. Why did Opera not launch with the ability for me to choose my own URL, or at least mask my homepage URL with something that didn’t tie me to Opera…? Oh yeah, that’s right — it’s all about owning the namespace.

At least Google was smart enough when they launched Wave to build in true decentralization from the start, and to choose a patent license for the Wave protocol that demonstrated that their desire was not to own the network, but to compete on it.

Unite & Activity Streams

Now, I know I sound like a curmudgeon, but I’m mostly just disappointed that few other people took Opera to task over the reality distortion field that Opera’s PR machine generated around this technology launch. But, as someone in the office said to me today, maybe no one cares enough about Opera to bother. Yeah, exactly, like I said before.

Still, there is a silver lining to this cloud computing fiasco which NO ONE else covered: Opera Unite supports activity streams!

It turns out that tucked within the Opera application is a directory called “unite” (on the Mac you can find it at Opera.app:Contents:Resources:unite) which contains a bunch of files with the .us extension (presumably for “Unite Service”). Like Mozilla .xpi files, these .us files are just zip files and can easily be decompressed by changing the extension.

In just about every bundle, there are several pertinent JavaScript files either in a folder called “asdstream” or with “activityStream” in the filename. The one that’s most interesting to me is the “activitystreamparser.js” file in the fridge.as bundle, which starts like this:

activitystreamparser.js — unite

Now, I’m not sure how this is being used, but I imagine it’s being used to output updates on the personal homepage of the site… which is awesome.

I wish that Opera had reached out to the Activity Streams mailing list about this work, but I can also understand that they probably didn’t want to jump the hype stungun. Anyway, it’s a huge opportunity (in my eyes!) for them to join the discussion about the open social web (since they have been essential proponents of web standards on the open web to date) and I invite them to share their goals and ideas for this work.

Conclusion

Okay, so I shit all over Opera Unite, but you can’t come out and promise all kinds of world-changing, freedom-enhancing goodness and then not deliver! — worse, to do so when their newest competitor (Google!) is schooling everyone with the perfect example of how to do it right (see: Wave).

While I have problems with Opera’s marketing approach, I do think that it’s useful to have Unite in the marketplace so that I can point to it as an example of what I want to see happen with the Diso Project — though I’m not willing to rest my success on the fate of any particular browser.

Through a combination of technologies like OpenID, OAuth, XRD, Portable Contacts, Activity Streams and microformats, we’ve been moving in this direction for some time, without having to alter the browser. Of course that’s meant that the browser has been conspicuously missing from the conversation, but that too is changing (see Mozilla’s experiment baking OpenID into the browser with Weave), and with Unite, we have yet another vision to contemplate — though I would have loved to have seen Opera embrace more than just Activity Streams out of all the technologies from the Open Stack.

I’ll give Opera some credit — both for using Activity Streams instead of inventing their own protocol — and also for launching a fairly polished demonstration of Unite concept as an alpha. If they really want to offer transformative technologies, though, I think it’s critical that they align their business policies with their marketing rhetoric and technological objectives, down to the code level. Anything less will result in confusion and worse, more posts like this one!

by Chris Messina at June 16, 2009 11:52 PM

Kaliya Hamlin

Personal Anchors on the Web for Digital Identities

I have been evangelizing about user-centric identity on the web 5 years. I talk about the ideas with people constantly explaining and re-explaining different developments in the field, forward looking projects and visionary ideas community members talk about. I watch what I say carefully and I notice when I start thinking and explaining something differently.

The new term that has emerged for me this week is “anchor on the web”... as in Where is your anchor on the web? or People have an anchor on the web – this is there “identity” – the question is do they control (owning a domain name) it or is it controlled by the company that does.

200906160037.jpg

I link this metaphor because it evokes the image of a boat that is you and an anchor that is linking you to somewhere – do you want this to land in a stable place that you have control over? Likely yes – if you anchor to someone else’s ship (have your name in their domain space) you are literally tied to them. Rather then being able to visit them on your own terms and leave if you like.

200906160058.jpg

You can get copies of these images under CC license here.

In my last post I talked about facebook URLs and people getting their own domain name along with the contrast of usability with each. Chris Messina also wrote about facebook URLs and correctly points out that this is a battle over your digital identity.

I got a comment today from IWantMyName.com (they also have a blog) saying I was absolutely right about usability issues that domain registrars have.

You are absolutely right. It’s a common problem of domain registrars / hosting providers. They’re too focused on up-selling other services and the secondary market instead of serving the actual internet user. We’re watching the identity community closely with iWantMyName and will definitely provide identity management features in the future. For now, we already made the domain registration process easy and are helping users setting up apps like Gmail, Tumblr, Posterous etc.

Coincidently – today at SemTech the CEO of Nombray presented as part of Chris Saad’s talk about DataPortability. They let you very easily create a website under your own domain name that aggregates your information from around the web. I haven’t paid the $10 yet but I was very impressed with the usability of the sign up process and you can see my the 1/2 working site here.

There is of course Chi.mp too – but some how it feels a bit more like being tied to somewhere then actually owning your own domain (paying for it) and setting up the services under it.

The next level of interoperability and user-empowerment will be the way these systems map/document your online life and how they give you the data in a standard way when you leave their service to go to a different one.

I am hopeful these sites are the basis of what will become personal data stores that project VRM has brainstormed about and people/companies are developing.

UpDate: Wow and that was Post: 1000 for this blog!

by iwoman at June 16, 2009 11:50 PM

Kaliya Hamlin

Personal Anchor on the Web for Digital Identity – CC Images

I got a request for the images I posted in “Personal Anchors on the Web for Digital Identity” from David Larlet to use in a slide presentation in France. I decided to open them up and post them here.

Below are versions with english text and a version without english text.

I would request that presentation of the image include a translated version of the english text.

When sharing please link to the original blog post where they appeared. – http://www.identitywoman.net/personal-anchors-on-the-web-for-digital-identities

If you use the image you send a copy/link to your version with your language text – I will post it on this page and link to you.

The point of the image is NOT an attack on Facebook. Facebook is in the image but is just emblematic of the overall issue because MySpace, MSN, Google or Yahoo also have their own “large steam boats” that people are “anchoring” themselves to.

200906161449.jpg

200906161448.jpg

————–

200906161448.jpg

200906161454.jpg

by iwoman at June 16, 2009 11:45 PM

Santosh Rajan

Opera Unite, will I really use it?

Opera has released its new web server in a browser called Opera Unite. This is not a new idea, and the idea of running your own server, is I guess only appealing to geeks. Having said that, it does give the lay user an ability to run some basic services like picture sharing, chat etc from his own PC.

I can't see a killer application from among the ones they have available now. So we have to wait and see what applications developers will come up with.

Also we have to consider why people don't usually run web servers from their PC's. One reason is of cource bandwidth. If you are connected via ADSL or something like that this is a bad idea. You can do some limited stuff with a small group of friends. But nothing for public consumption.

The second problem is discovery. User's may just have temporary IP addresses. Opera solves this by being your proxy server that allows users to connect to your PC. That means you have to sign up for the Opera Unite service. The part I dont like is accepting their terms of service "By uploading Content to Opera’s site, you grant Opera an unrestricted, blah blah blah ....".

So I don't think this is going to replace my blogger, facebook, twitter etc etc accounts. But I can see where I could use it. For one, to delegate my OpenID. So my OpenID could be something like
http://home.mynickname.operaunite.com/openid.

Now before you run and download Opera I would say hang on. I haven't figured how to do the above my self yet. Its 45 mins since I have downloaded Opera. So its not like just editing your "index.html". Looks to me somebody has to do a "OpenID" Opera Unite Service. So my Opera unite OpenID is actually pointing to a Opera Unite Service by adding a "/openid". And he has to upload the service and Opera has to approve it! Or has anybody figured how to edit index.html yet?

But you see, there is potential here. If you have an application that stores your personal profile data and provides it to applications as and when required, we have the beginnings of data portability. But now the problem is to port your data from browser to browser instead of from web site to web site!

Update.
To set up your openid on your browser do the following. You cannot set it on your default home page. After downloading Opera Unite, Install the web server application by clicking on web server tab. Select a folder to be your web server root. eg C:\openid. Click on automatically create index.html file. Set Access control to public and save. Edit the index and add the following in the HEAD part. Change the href's accordingly to point to your provider.

<link rel="openid2.provider" href="http://www.myopenid.com/server"/>

<link rel="openid2.local_id" href="http://myname.myopenid.com"/>

Your OpenID is
http://home.mynickname.operaunite.com/webserver


by Santosh Rajan at June 16, 2009 02:19 PM

June 15, 2009

Kaliya Hamlin

FU – The Monday After, Facebook Usernames and Your Domain on the Web

Last week it was announced that on on Friday Night at 9pm Pacific Facebook had a name space land rush. Everyone was free to pick for themselves their username that would appear in their URL. facebook.com/username

I actually found this a bit surprising – remember the big debate on the Social Web TV I had with Josh Elman about “real names.” He was against handles completely and felt that the big value facebook brought was “real names”. I argued for handles and the freedom to choose one’s “identity” on the web. I made the point that free society – having the ability freedom to have the option to have and use handles on the web NOT linked to our given/ in real life names. Another thing is that handles help us navigate namespace clash from regular names. Max from MySpace is 8bitkid not some other Max in a sea of Max’s.

I ran into Josh Elman at the Building43 party and we agreed I kinda won the debate with this latest development. It seems that having peoples pages rank higher in google is helped by having readable URL’s.

They of course “strongly encouraged” people to just pick a URL with one’s real name and did so by “suggesting” names that were derivatives of one’s name. You could override this and type in your own name choice (however defaults matter so most people will end up with names similar to their real name – rather then being asked to think up one). They give users an addressable identity.

Max Engel of MySpace became /8BitKid – his handle “everywhere”

David Recordon surprisingly didn’t go with DaveMan692 – his handle most places – he is /DavidRecordon

My friend Jennifer became /dangerangel as she had originally signed up for in Facebook but they disallowed her to have it.

I just became /Kaliya (I am hoping I can get enough fans to claim /identitywoman for that persona)

What is particularly interesting is the layers of identity in Facebook.

With a Facebook URLFacebook has the one’s username is not one’s e-mail address as it is with Google profiles and one also has a common name (or as they say “real name”) that is presented to throughout the system.

Google ironically enough they ask if you want a “contact” me button on your page that does not give away your e-mail address when the profile URL gives away your e-mail address.

Twitter has /usernames AND another display name of your choosing that is changeable (the /usernames are not). However most twitter clients display one or the other. If you are used to seeing the display name and then are on your phone that is only showing @handle /username then you don’t know who is talking.

Facebook usernames is another example Twitter feature adoption by Facebook others being activity streams becoming much more like twitter streams.

I said when I first “got” twitter about 18 months ago – a big part of the value it provided was its namespace. It gave me a cool anchor on the web that allowed communication between me and others via the web.

So how is it going so far? Inside facebook reports that over the weekend 6 million folks – 3% of their userbase gut URLs. 500,000 in the first 15 min, 1,000,000 in the first hour and 3 million in the first 14 hours.

There were several examples of FaceSquating. Mike Pence took Obiefernadez’s name.

Anil Dash has the funniest post ever about the whole thing. Highlight the point that users don’t need facebook URL’s they can just get their own domain name. He repeats this throughout the post about what these services are not telling you:

None of these posts mention that you can also register a real domain name that you can own, instead of just having another URL on Facebook.

I completely agree with him – he also misses a key point the usability of facebook is vastly higher then the usability of domain name registration, cpanel management and other things involved in getting ones own personal web presence going. DiSo isn’t hear yet so we can’t link to our friends without linking capability that a facebook provides. I suppose Chi.mp was trying to

He links to a post of his from December 2002 called privacy and identity control.

I own my name. I am the first, and definitive, source of information on me.

One of the biggest benefits of that reality is that I now have control. The information I choose to reveal on my site sets the biggest boundaries for my privacy on the web. Granted, I’ll never have total control. But look at most people, especially novice Internet users, who are concerned with privacy. They’re fighting a losing battle, trying to prevent their personal information from being available on the web at all. If you recognize that it’s going to happen, your best bet is to choose how, when, and where it shows up.

That’s the future. Own your name. Buy the domain name, get yourself linked to, and put up a page. Make it a blank page, if you want. Fill it with disinformation or gibberish. Plug in other random people’s names into Googlism and paste their realities into your own. Or, just reveal the parts of your life that you feel represent you most effectively on the web. Publish things that advance your career or your love life or that document your travels around the world. But if you care about your privacy, and you care about your identity, take the steps to control it now.

In a few years, it won’t be as critical. There will be a reasonably trustworthy system of identity and authorship verification. Finding a person’s words and thoughts across different media and time periods will be relatively easy.

What people don’t quite get is that if they anchor their whole online life around someone else’s domain they are locked in. When I first started paying attention to user-centric identity online this was one of the meta-long term issues that the first identity commons folks (Drummond Reed, Fen Lebalm, Owen Davis, Andrew Nelson, Eugene Kim, Jim Fournier, Marc Le Maitre, Bill Barnhill, Nikolaj Nyholm, etc).

A few of them wrote a paper about it all – THE SOCIAL WEB – Creating an Open Social Network with XDI.

They liked the XRI/i-names architecture because it addressed the URL recycling problem with a layer of abstraction. All i-names also have linked to them a conical identifier – an i-number. This number is never reassigned in the global registry. However one could “sell” one’s i-name (mine is =kaliya) and that new person could use it but it would have a different i-number assigned to it for that person.

This past week at the Online Community Unconference we were talking about the issue of conversation tracking around blog conversations. How an one watch/track the conversation about one’s work if it is cross posted on 10 different sites OR if it is just posted in one place and one is distributing a link through 10 different channels? We never did get to an answer – I chimed in that the web was missing an abstraction layer – that if one could have a canonical identifier for a post that was up in 10 different places this would make it easier to track/see conversations about that post. What we do have now that we didn’t have 3 years ago for helping track conversations across multiple contexts is OpenID at least so you can see if someone commenting in one place is the same as someone commenting in another.

There is an additional layer of abstraction in the XRI architecture that supports several things are key to helping people integrate themselves and information about themselves on thew web.

One is cross referencing – so I could have have two different (URI) addresses for the same information (in the identifier – not just mapped over one another leaving me with one address OR the other) and also have one version of my profile be the one I controlled and a different be a version that appeared in a certain social context.

There is also a concept of much finer grained data addressability and control – so I could have my home address in one place and instead of entering this into each website/services/company portal that I want to have this information – just hand them a link to the canonical copy I manage and then I don’t have to change it everywhere. This is of course where the VRM folks are going with their architectures and services.

We shall see how it all evolves. That is what we do at the Internet Identity Workshop is keeping on working on figuring this all out.

by iwoman at June 15, 2009 10:21 PM

June 13, 2009

Simon Willison

Facebook Usernames and OpenID

Today’s launch of Facebook Usernames provides an obvious and exciting opportunity for Facebook to become an OpenID provider. Facebook have clearly demonstrated their interest in becoming the key online identity for their users, and the new usernames feature is their acknowledgement that URL-based identities are an important component of that, no doubt driven in part by Twitter making usernames trendy again.

It’s interesting to consider Facebook’s history with regards to OpenID and single sign on in general. When I started publicly advocating for OpenID back in 2007, my primary worry was that someone would solve the SSO problem in a proprietary way, irreparably damaging the decentralised nature of the Web—just as Microsoft had attempted a few years earlier with Passport.

When Facebook Connect was announced a year ago it seemed like my worst fears had become realised. Facebook Connect’s user experience was a huge improvement over OpenID—with only one provider, the sign in UI could be reduced to a single button. Their use of a popup window for the sign in flow was inspired—various usability studies have since shown that users are much more likely to complete a SSO flow if they can see the site they are signing in to in a background window.

Thankfully, Facebook seem to understand that the industry isn’t willing to accept a single SSO provider, no matter how smooth their implementation. Mark Zuckerberg made reassuring noises about OpenID support at both FOWA 2008 and SxSW 2009, but things really stepped up earlier this year when Facebook joined the OpenID Foundation Board (accompanied by a substantial financial donation). Facebook’s board representative, Luke Shepherd, is an excellent addition and brings a refreshingly user-centric approach to OpenID. Luke was previously responsible for much of the work on Facebook Connect and has been advocating OpenID inside Facebook for a long time.

Facebook may not have committed to becoming a provider yet (at least not in public), but their decision to become a consumer first is another interesting data point. They may be trying to avoid the common criticism thrown at companies who provide but don’t consume—if they’re not willing to eat their own dog food, why should anyone else?

At any rate, their consumer implementation is fascinating. It’s live right now, even though there’s no OpenID login box anywhere to be seen on the site. Instead, Facebook take advantage of the little known checkid_immediate mode. Once you’ve associated your OpenID with your Facebook account (using the “Linked Accounts” section of the settings pane) Facebook sets a cookie remembering your OpenID provider, which persists even after you log out of Facebook. When you later visit the Facebook homepage, a checkid_immediate request is silently sent to your provider, logging you in automatically if you are already authenticated there.

While it’s great to see innovation with OpenID at such a large scale, I’m not at all convinced that they’ve got this right. The feature is virtually invisible to users (it took me a bunch of research to figure out how to use it) and not at all intuitive—if I’ve logged out of Facebook, how come visiting the home page logs me straight back in again? I guess this is why Luke is keen on exploring single sign out with OpenID. It sounds like the current OpenID consumer support is principally intended as a developer preview, and I’m looking forward to seeing how they change it based on ongoing user research.

As OpenID provider implementation is an obvious next step that can’t be that far off—I wouldn’t be surprised to hear an announcement within a month or two.

HTTP redirect codes

As an aside, I decided to check that Facebook were using the correct 3xx HTTP status code to redirect from my old profile page to my new one. I was horrified to discover that they are using a 200 code, followed by a chunk of JavaScript to implement the redirect! The situation for logged out users is better but still fundamentally flawed: if you enable your public search listing (using an option tucked away on www.facebook.com/privacy/?view=search) and curl -i your old profile URL you get a 302 Found, when the correct status code is clearly a 301 Moved Permanently.

One final note: it almost goes without saying, but one of the best things about OpenID is that you can register a real domain name that you can own, instead of just having another URL on Facebook.

June 13, 2009 05:01 PM

June 11, 2009

Kaliya Hamlin

Surfacing back into Cyberspace at Building 43 today

Basically this post is to say I am “back” – I have a bit more time on my hands this summer to pay attention to Cyberspace and want to give attention to expressing my thoughts and ideas in text online again. I am inspired by this mention by Scoble around the launch of  Building 43 that is happening today. I thought it was an actual physical space when I got the invitation. Turns out it is a website that Robert Scoble is leading. It is focused on what he calls the 2010 web and others call Web 3.0.

Here’s another way to put it. When you look at Techmeme and see all the tech bloggers yammering on about the latest cool things, the way they were this week about Facebook’s new URLs that are coming out tomorrow, or Apple’s new iPhone, do they look backward and think about the average businessperson? Not in my experience. We don’t have an industry conversation about how to actually use all this cool stuff to improve lives, make businesses stronger and closer to their customers, and have some fun.

A few people here and there are trying. I watch what Chris Messina, David Recordon, Marc Canter, Joseph Smarr, Kaliya Hamlin, and a group of others are trying to do by pushing a more open web. Those are the kinds of efforts that inspire me and are inspiring Building43. Can we build on what they are trying to do and take it to main street?

This actually impresses me cause I thought Scoble had just become an internet micro-celebrety for its own sake. I look forward to contributing to the conversation about the future of what is becoming a very social web where peoples identity online matters deeply.

Here is where I have been since my last post.

Since Social Web Foo Camp and posting the 80% complete article about communities context and online life. I haven’t blogged. I have been very busy though.   

Immediately following I attended the “identity day” at RSA on Monday April 20th -  talks were given from the front of the room for a day. Liberty Alliance put the day together along with the Information Card Foundation- The Kantara Initiative was “launched”. I am not clear that the format of the day actually provided greater understanding by those outside our community that are confused by all the activity.

The exciting thing that happened leading up to this day was the launch of the new Information Card Foundation Website – I gave some feedback that was included in the core language and messaging. It has great Flash animation explaining the cards along with featured projects including the GSA Demo.

RSA was fun – I didn’t spend to much time in sessions mostly talking to people in the community. I led a peer-to-peer session on Business Models for Claims Based Identity. A good group attended however the room layout was cold and stale. (I will be writing about it on my unconference blog shortly).

Penguin Day followed on April 25th. This is a super fun day facilitated by Allen Gunn focused on Non-Profits and Open Source. I learned more about TikiWiki as a content management system (I am considering it as the platform for She’s Geeky). I also was impressed by how much CiviCRM had improved. I also talked to a college registrar very interested in how information card technology might play a roll in getting them out of paper based management of student records and certification.

The Nonprofit Technology Conference followed – they had a large exhibit hall and I talked to many of the vendors there about OpenID and Information Cards – about 1/2 had heard about OpenID and almost none about Information Cards. It was great to talk to my friends in the industry (I have been attending this conference since 2004). Social Actions is progressing and is creating a way to aggregate action information for social good.

I flew to NYC to facilitate the Creative Unconference on May 7-8 put on by the One Club for Art and Copy collaborating with the Society for Digital Agencies.  This was during Creative Week. The One Club gives out bronze, sliver and gold pencil’s – some of the most prestigious awards in the advertising business. They attended their interactive awards on Friday night – I brought Robert Tolmach along as a guest and he told me about his new project – Class Wish.

I went to DC and spent the day at the Sex 2.0 conference at the intersection of social media, feminism and sexuality. I was particularly interested in how this community was thinking thinking about and dealing identity online and off. Many people had names they went by within the community that were different from their “every day” names. Several presenters talked about having two facebook profiles (one for their sex life and one for regular life) I pointed out that this against facebook policy and they were surprised – it seemed very natural to have two persona’s. Other presenters talked about being fully “out” completely linking their sex life.

I attended the Anita Borg Institute for Women in Technology Women of Vision Awards. It was a very inspiring evening. Padmashree Warrior the CTO of Cisco was the key note speaker – she was super inspiring and gave ideas about how to connect to the community 2.0 audience.

I spoke at Community 2.0 about identity technologies. I covered OpenID, OAuth and Information Cards and at the end mentioned project VRM for those who were very forward looking. It was a relatively small conference and I spent a lot of time preparing for the talk with my speech coach. My issue has been having to much to say – I can talk about identity for hours and in great detail. Lura helped me figure out what to say. I did a good job clearly communicating and had several people say they enjoyed my talk and it gave them some practical information not just social media guru hype.

I went to the first day of the VRM workshop and was totally impressed by the quality of projects and companies working in the space. Several attendees didn’t know about IIW and a few signed up to attend.

The Internet Identity Workshop was AMAZING. We had the same number of attendees as we usually do. I am going to write some more posts about the event soon. The next IIW is November 3-5 in Mountain View.

I went to the Maker Faire on Sunday the 31st of May – it was fun to see all the stuff people are making. I also got a LiveScribe Pen. I will be using it for diagrams on this blog in the coming months.

June 1 was CommunityOne where i saw Jono Bacon talk about Community there were 10 people to see him speak in an auditorium that held 1000.

I flew to Boston and met with Fabio Carara of the Venice Project Center and Venice 2.0 – they are considering how to leverage 20 years worth of geo-data. We are discussing building a community including a few unconferences.   

I had dinner with Mary Ruddy and we continued progress on Identity Commons infrastructure – particularly our new blog/website.

I facilitated the Mass Technology Leadership Council Spring Meeting that asked the question “What is the future of Software and the Internet” I lead a session on identity – they asked good questions and were impressed by all the activity in the space.

I flew to San Francisco – to make it back for the 2nd Scala Lift Off. Scala is a programming language – some describe as Java++, Lift is a web framework. This is a great programming language community with an healthy online community life. I work supporting them in community building when the meet face-to-face.

Yesterday I was working with Forum One facilitating the 4th Online Community Unconference. This is a great community of online community managers (the folks who moderate online community), platform providers (software providers) and hosts (companies that have online communities). I presented a session about OpenID, OAuth and Information Cards – I even got a bottle of wine during the closing from one of the attendees thanking me for the quality of information that I shared.

Today it is the Building 43 party at Tech Crunch and next week is SemWeb in San Jose – I will likely make it to the Personal Democracy Forum. The next “identity” event is Burton Group Catalyst at the end of July in San Diego.

I look forward engaging in this medium again with a post every few days.  

by iwoman at June 11, 2009 07:05 PM

Simon Willison

Exclusive: The Future of Facebook Usernames

Exclusive: The Future of Facebook Usernames. I have to admit I was planning to just let Facebook get on with it, assuming that the OpenID provider part would show up of its own accord—but maybe I should write a thoughtful and persuasive essay about it after all.

June 11, 2009 09:46 AM

Martin Atkins

Streaming JSON Parser and Generator

My contribution to the ongoing trend of reinventing the entire XML toolchain for JSON is a pair of Perl libraries which allow JSON to be produced and consumed in a streaming manner, rather than requiring the data to be represented as a complete, in-memory data structure.

For many applications a traditional on-shot JSON library is more than sufficient, but a streaming JSON parser might be useful if you already know what data structure you're expecting because you can skip over or reject parts of the data that do not conform to the expected structure without them ever manifesting as real objects in your program.

The JSON generator has more limited utility but might be useful for serializing large data structures without them needing to exist in memory in their entirety: you can load data in stages, producing the relevant output and then freeing the memory before moving on to the next part.

Much as with a streaming XML library, the programming model is more awkward than with a library that loads everything into memory, but as JSON becomes the web's de-facto data serialization I think having the ability to stream it will be important for more and more applications.

I'd love to see others implementing similar functionality for other languages, hopefully with a similar API. When it comes to Perl, you can download JSON::Streaming::Reader and JSON::Streaming::Writer from CPAN today. The latest versions, 0.03 and 0.02 respectively, are winging their way through the CPAN indexer as I write this.

by Martin Atkins at June 11, 2009 12:19 AM

June 10, 2009

Aaron Van Kaam

Rick, you’re a jerk (also known as: OpenID Phone Numbers)

Sometimes I’m very late in getting the latest and greatest. I wait until I can say “I need” something rather than “I want” something. My last cell phone lasted me about 5 years to become the only one on the block with an antenna in its old age. Aww, I loved that phone — it was so punk rock! A speaker volume so loud that entire city blocks knew I was getting a call. Tough as nails it had been dropped, thrown, slammed, burned, drowned, spit on, knifed (yes, I said knifed), and still worked flawlessly without a single scratch on the screen. Alas, while the iPhone might be a physical pansy compared to my old friend, it was more attractive for the apps to be more productive. So I got an iPhone, gave my old friend a proper burial, and was given a new number and the start of the problem known as “Rick.”

So who’s Rick? That’s part of the problem, I don’t know. Through my powers of deductive reasoning I can only surmise that he is a jerk face that left me with his number while he is reclined on a yacht drinking fairy beverages out on the pacific somewhere while watching me with his spy satellites and laughing hysterically with two gorgeous babes on his arms as all of his jerk friends call me completely baffled that I’m not Rick!! For the past 6 months, I’ve received a call asking to speak to Rick between 3 to 15 times a week. I kindly inform the callers that Rick is a jerk face who probably hated them too much to remind them to update their contacts. Perhaps Rick is Mr. Astley and this is his way of saying he’s never going to give me up.

Maybe I’m being too hard on Rick. After all, I got a new number too and I had to notify all my contacts. The real problem is that we’re still using phone numbers — an identifier invented where teller operated switch boards would use the numbers to drill down to a specific state, city, or neighborhood. The OpenID community thinks URL’s are difficult for people to understand! Imagine a series of seemingly random numbers that actually point to locations on a grid. Phone numbers were invented to point to a machine but I want an identifier that will point to me. My phone number is just an attribute to my identity. This would be like trying to find your best friend in a crowded restaurant but you’re only able to identify him by what shoes he’s wearing. What we really need is an OpenID.

If phones were actually “smart” phones capable of taking an OpenID, Rick would not be a jerk. He would have changed his phone number attribute and all of his friends would never know the wiser. Maybe even that luxurious example is missing the mark though. Why bother with phone numbers at all? I mean, when was the last time you went to Google by typing their IP address? What Rick really needs to do is allow his phone service provider to respond on his behalf and the only identity attribute Rick needs to handle is “Current Phone Service Provider”. I’m getting ahead of myself, though.

This illustrates a subtle point to why URI-based identifiers are so powerful and superior to other identifiers (such as e-mail, imho). Just like the DNS system itself, there are no special guarantees of application support. A registered domain does not necessarily have the ability to respond to website requests through HTTP nor does it necessarily have the ability to respond to SSH, FTP, SMTP, or any other number of applications. It does, however, provide a human-readable identifier that can be used by applications that need to point to that machine. In the context of a web browser, we’re informing the application that we expect the domain to be able to respond to HTTP requests. In the context of a mail client, we’re informing the application that we expect the domain to be able to respond to SMTP requests.

Following that logic through to fruition, I believe my iPhone Contacts application should know that the OpenID I am supplying should be able to respond to HTTP requests following a “Get-Phone-Number” protocol yet to be defined. So Rick, if you’re out there and you read this, I understand. It’s okay. I forgive you … you jerk.

Technical Note: XRD would actually be the more important technology in the scenario described here. OpenID is not necessarily a requirement to something like this existing but I would imagine some form of identity attribute ownership authentication would be needed.

by Rabbit at June 10, 2009 11:31 PM

Chris Messina

Facebook usernames and the battle over your digital identity

Techmeme is buzzing with the news that Facebook is finally going to provide custom usernames — and hence web addresses — for its 200 million users. The land grab begins in just over three days at facebook.com/username/.

Facebook | Username

If Dustin Moskovitz were dead, he’d be rolling over in his grave.

For those of you who don’t know who Dustin Moskovitz is, he’s one of those infrequently mentioned co-founders of Facebook that prevented Facebook from offering usernames or friendly web addresses (so-called “vanity URLs” in the industry) from the beginning. It was his insistence that people should go by their real names on Facebook — and should thus perform under their true identities — that I posit has accounted for much of Facebook’s success with non-digital natives. Of course, competition makes institutions do crazy things, and I think that includes getting into the domain-slash-namespace game.

Arguing that Facebook shouldn’t get into the vanity URL business, I still think that they had it right the first time around. Digital identity should change to adapt to humans; not force humans to refer to each other in more computer-friendly ways. But the allure is simply too great. I also can’t say that I blame them, even though I think it’s a distraction along the way towards more widespread real identity (and thereby reputability) online.

Let’s stop to consider what’s going on here.

As we migrate from the desktop to the web, the way that we want to be perceived by our friends will determine where we also spend most of our time “performing” or constructing our identity (through what we “do” — i.e. activity streams). The easier web services like Facebook make it for us to pass around some kind of universal identifier that points to our account, the more likely we’ll actually hand out that identifier. The author’s byline on that Facebook post makes my point for me:

Blaise, a designer at Facebook, is letterpressing his new business cards.

This is not unrelated to Google’s recent business card promotion where, after you set up your own Google Profile, you could compete to get a set of free business cards printed with your name on them, like so: