Expert Texture Home Contact me About Subscribe Digipede Connect on LinkedIn rwandering on Twitter rwandering on FriendFeed

rwandering.net

The blogged wandering of Robert W. Anderson

Archive for Attention

PDC 2009 Day #2: Silverlight 4

Lots of great new stuff in today’s beta.  A few things that stand out:

  • Hosting HTML
  • Context menus
  • WCF and REST enhancements
  • Support for RIA Services
  • Drag & Drop
  • Running out of sandbox for trusted apps
  • Sharing components between .NET 4 and SL 4

Lot of other things too.  I’m excited to start using this.  Also a shout out to Tim Heuer – he has helped me on a few things before and I got a chance to meet him today.

Those of you following NewsGang will know why I am very excited about these Silverlight developments.

Tags: , , , ,

Facebook backs down

Yesterday I posted about the change in Facebook’s TOS.  I thought they might back down, but I didn’t think it would be this fast.

The old terms are back in effect: delete your account and so goes your data.

A minor success for users everywhere – even those who don’t think this stuff matters.

Tags: , ,

User-beware of Facebook

Plenty of people are up in arms about the recent Facebook TOS change. 

The change?  Before Facebook relinquished their rights to your data if you deleted your account.  Now they don’t. 

I don’t have a problem with this new policy.  I do have a problem with the new part.

Of course, I’m not arguing whether Facebook can legally make this change, but it does violate their user contract.  I’m not talking about a legal TOS, but of an understanding with their users.  What is the problem?

  • Facebook has just asserted ownership to something that they didn’t claim ownership to before.  And this isn’t future data, this is past data.  Data you already contributed to Facebook with an understanding that they wouldn’t keep it.

This is another example of what I call the user-beware contract – where the TOS can change at any time without notification. 

So, what is the user-aware way to make such a change?

  • Maintain their old policy for data in Facebook before the change.  This bifurcates user data between before and after the policy. Delete your account?  Old data goes away, new data does not.

OK, but this is still a user-beware contract.  What else should they do?

  • Require users to opt-in to the new policy.  If they opt out, either delete them or let them continue the old policy.

I’m sure Facebookians (and any one hosting a large service) is rolling their eyes at this point.  But just because being user-aware is inconvenient doesn’t make it infeasible.

And a shout out to Ned Sykes for prompting this post: no, I’m not concerned about Facebook stealing my tweets, but as a voice in user rights, I am interested in promoting TOS that are pro user.

BTW: The user-beware/user-aware terms are defined in my post User Contracts – Part II: User Beware.

Tags: ,

Live Writer 14.0.8064.206

I just recommended the new Live Writer for having a “check for updates” feature, but apparently that feature didn’t work.  From Joe Cheng of Microsoft:

Well… this is embarrassing. We just released an update that’s newer than 14.0.8050.1202. One of the two bugs it fixes, is that our “Check for updates” mechanism broke irrevocably in 14.0.8050.1202 and earlier builds. :(

If you download the new version from http://download.live.com then “Check for updates” will work again. Sorry for the inconvenience!

So, if you aren’t at least at version 14.0.8064.206, then you should upgrade again.

Tags: ,

Live Writer 14.0.8050.1202

livewriteraboutI just upgraded to the latest Windows Live Writer. 

It looks better and now it renders my blog template correctly.  Maybe there are more features I’m missing.

It is worth upgrading it just to get the “Check for updates” feature.  So you never again have to figure out how to upgrade it (see Jim’s rant here: Sighcrosoft – Why Can’t I Just Love Live Writer Without Confusion?).

Strangely enough, its now easy to upgrade here:  http://download.live.com/writer.

Tags: ,

OpenID and the Relying Party Patchwork

Recently I have been thinking and writing about OpenID.  My thoughts have centered around two topics:

  1. Sharing one credential across all of your Internet services is not a good idea.  See How many OpenIDs do I need?
  2. The OpenID vision isn’t ready because there is not yet an ecosystem for Internet services (i.e., Relying Parties) to rate the trust level of an arbitrary Identity Provider.  See OpenID isn’t ready for prime time.

This led to a conversation with Bill Washburn, Executive Director of the OpenID Foundation. He was a pleasure to talk to and receptive to my ideas and concerns.  I left that conversation with an interest in contributing to OpenID through my writing.  I have been pretty pegged lately on other activities, but found the Microsoft HealthVault announcement interesting because it is at the intersection of these two topics. 

What is the announcement?  That Microsoft’s HealthVault will become an OpenID Relying Party later this week. 

Very cool news.  Congratulations to Microsoft for becoming the first big player to be an OpenID Relying Party in a significant way.  Also, congratulations to the OpenID Foundation and Bill Washburn for their role in this.

Now how is this intersection of these two topics?

1. Sharing Credentials

I’ll start by partially answering my first question:

How many OpenIDs do I need?

Partial answer:

I need one for each health information provider; for exclusive use with that provider.

I just don’t want to share these with any other Internet service. 

So the premise that OpenID allows me to share credentials across sites is of no value to me here.  (Note: that said, there are good reasons I might choose other Identity Providers for this application).

2. How do Relying Parties know who to Trust?

There are a growing number of providers out there, new implementations of custom coded OpenID providers, established businesses, startups, etc.

So if you want to become a Relying Party, who do you trust?  Everyone?  No.  The answer is easy.  From Sean Nolan,

The deal is — as of our next release in the next few days, users will have a new way to identify themselves to HealthVault. In addition to Windows Live ID, they will be given the option of using OpenID accounts from Verisign or TrustBearer.

You, the Relying Party, choose an explicit list of trusted Providers.  This is a completely rational approach.  Especially if you are responsible for protecting confidential data. 

Before you know it, more and more companies/services will become Relying Parties.  Each service — at least those that protect valuable confidential data — will have to perform a risk analysis to determine which Providers to accept.  Each Relying Party will end up with a different set of accepted Providers — a different set in constant flux.

Earlier I suggested that I could choose how to consolidate my OpenIDs, but the reality may be much different where I have to choose OpenID providers based on the services I use.  This reality seems like a complicated, user-hostile patchwork of Identity.  Kind of like what we had before OpenID.  Only more complicated.

What do I think should be done about it? 

One answer is that the OpenID Foundation fast-track efforts to formalize trust and reputation resources for Relying Parties. Bill Washburn had some other ideas too, and maybe this Microsoft announcement is in support of that effort.

How long will any of this take?  Can’t say, but I will continue to look on with interest and write about OpenID.  Despite my criticism, I am a fan.

Tags: , , , , ,

Google Reader Misappropriated Our Shared Items

image_thumb[1]Earlier in the week I stopped using Google Reader for a few days.  Every time I started it, I would be reminded of their new sharing features (see the dialog on the left).  Then I would close the browser tab. Why?

Google changed the Reader user-contract with no notice.  This rankles me.  I’ve lost control of my shared items.  This is a dramatic change with only the weakest of opt-outs.  What’s more, any opt-out is too late.  My items have already been shared.  What kind of opt-out is that?

Oh, but there are more options.  They give us the ability to manage who gets to see our shared items.  But only after others have a chance to read them.  For example, I can hide my items from my “friends” who are on Google Reader.  Other “friends” that start using Google Reader will get to read my shared items immediately.  The onus is on me to make sure I actively manage the list. 

And the icing on the cake?  “Friends” wasn’t a word in use by Google Reader before.  Now it has been defined to mean my Google Talk contacts.  No fair.  This is not analogous to Facebook “friends”.  In Facebook, I accepted people as “friends” based on the Facebook definition.  Now my Google Talk contacts are my “friends” based on Google’s new definition.  This is clearly backwards. 

Is Google breaking their terms of service?  Almost definitely not, but they are changing a basic part of the user-contract: that user data won’t become more public without user consent. This is a perfect example of the “User-Beware contract“, summed up as: “we’ll change the user contract whenever we feel like it.”

What’s next? 

Your email contacts have been shared with your friends

Your emails have been shared with our advertisers

You calendar entries have been shared with your . . .

You get the idea.  This may seem like a joke, but frankly I don’t know what is in store for the user contract.

Steve Gillmor suggests this is arrogance on Google’s part, and he’s probably right.  Yet mostly people are ignoring this or don’t get it (e.g., Scoble doesn’t seem to get why anyone would care). 

Why is the blogosphere giving Google a free pass on this one? 

Tags: , , , , , ,

SSE to FeedSync; Spec released

Many of us our still waiting to see the positive impact from Ray Ozzie in his role at Microsoft.  Word is that is still coming, but last year we did get something: Microsoft’s Simple Sharing Extensions (SSE).  I wrote about it back then.  Well, SSE has been renamed FeedSync and a spec has been released.  Also, the Microsoft Synchronization framework supports it.

Cool extensions to RSS/Atom, though I wish they hadn’t chosen the “FeedSync” name.  That sounds like a product, not a specification.  I preferred SSE, and would have thought RSS-SE (RSS Sync Extensions) or to be more agnostic, FSE (Feed synchronization extensions) to be even better.

Jon Udell has more details here and links to Channel 9 videos, etc. 

So, who is going to support it?  For blogging applications, I’d like to see . . .

  • FeedBurner (Google)  support the history and tombstone feature right away.  Also, the ability to aggregate feeds with full synchronization would also be cool.
  • How about WordPress?   Support FeedSync directly?

Presumably Microsoft will be using this too in some new Live services.  Other applications?

Tags: , , , , , , ,

With Beacon, Facebook is not the problem

Unless you live under a rock (or don’t follow the social space) you know that there has been a big uproar of Facebook’s Beacon.  This is the feature that enables 3rd party web sites to transmit your actions (or “stories” in Facebook lingo) to Facebook. 

If you want to know more about how it works, Jay Goldman wrote the excellent post: Deconstructing Facebook Beacon JavaScript.  The title belies the fact that the article gives a good overview too (it isn’t just for developers).

An innovative idea — one that reminds me much of the GestureBank work conceived by Steve Gillmor and myself.  Given that, it should be no surprise that I don’t think Facebook did anything “evil” here. 

Now, they could have done a better job with it.  From the get-go, I would have preferred if they had

  • been more public about how it works; and
  • required that users “opt-in” to the whole program.

Not surprisingly, there was a backlash and Facebook made some changes (Official- Facebook Flips On Beacon).  Great.  I don’t think what they did violated their user contract, but the changes are more user-friendly.  I would prefer my User Aware contract, though this is a User Beware contract (User Contracts – Part II- User Beware). 

But, the problem isn’t with Facebook or their user contract.  If you don’t like the service (in total), don’t use it.

What I don’t understand is all the focus on Facebook here.  Like all silos they are capturing data, data, data.  That is what Facebook is all about.  

Why isn’t the focus on the 3rd parties who submit your stories?  They are the ones pouring user stories into Facebook. There have been reports of users not having approved their stories.  This is a bad thing, and maybe a technical flaw in Beacon, but ultimately it is the responsibility of the 3rd party to protect your data.

They should give the users control over their Beacon settings:

  1. Never send stories to Facebook
  2. Approve each story before it is sent to Facebook.
  3. Always send stories to Facebook.

If anything, Facebook should require this of its Beacon partners.

So, why aren’t people up in arms over the eBays, TripAdvisors, Yelps, Fandangos, Epicureans, etc.?

But, hey, if you don’t like the way these sites are spraying your data over the Internet, then stop using them.  

Tags: , , , , , ,

Gillmor’s Group on Facebook

Recorded a show with Steve and the Gang last Friday.  Steve says,

Last Friday we recorded a new show titled The Gang. I’m initially asking those interested in hearing the results to join this Facebook group. Looking forward to seeing you there.

See you there? 

this is Robert's profile

Tags: , , ,

Next entries »