...and OAuth for Google Data APIs!

We've officially, at long last, announced OAuth availability for all Google data APIs, including Blogger's AtomPub. Which will hopefully get Tim Bray off my back: Look, standard auth!

Five Minutes on OAuth + OpenSocial RESTful APIs

OAuth Summit

Joseph Estrada demoing something extremely cool using the Google OAuth Proxy.

OpenSocial 0.7 and makeRequest

We're converging towards 1.0! There's one particular thing I want to quickly highlight: makeRequest. This goes beyond the old IG_Fetch API to allow arbitrary HTTP requests to arbitrary URLs, with full use of headers, POST data, response codes, etc. This effectively means that properly installed gadgets can talk any protocol to any server on the Internet. Now that's open.

There are controls of course. The container validates that the request is coming from a properly installed gadget, and poorly behaving gadgets can be rate limited or shut off if necessary.

You can also pass certain headers which are awfully useful. For example...

Authorization: OAuth realm="http://sp.example.com/",
             oauth_consumer_key="0685bd9184jfhq22",
             oauth_token="ad180jjd733klru7",
             oauth_signature_method="HMAC-SHA1",
             oauth_signature="wOJIO9A2W5mFwDgiDvZbTSMK%2FPY%3D",
             oauth_timestamp="137131200",
             oauth_nonce="4572616e48616d6d65724c61686176",
             oauth_version="1.0"

Which would let you do authenticated cross-domain requests.

(This assumes of course that the gadget can securely store a token for later use. Gadgets can store data securely using the OpenSocial APIs, but since the user at the browser ultimately has full control over the client side environment, this is effectively the same as a client without a very secure secret. A server side signing solution is needed if you want to to beyond more than simple scenarios involving a user looking at their own data. We're already using OAuth with an empty token to let gadgets talk to their home servers securely, so adding this won't be difficult.)

OpenID and Friends

Johannes retconned a nice title onto our panel discussion yesterday: OpenID and Friends (where the friends include OAuth, OpenAuth, OpenSocial, etc.) The panel in fact might have been a little too friendly -- maybe we needed somebody (Ben?) debating with us about phishing attacks to shake things up a bit. It was great to talk with Shreyas, Johannes, Nicolas, and George about issues and next steps. We all have a variety of goals, all of which are advanced by OpenID adoption and use.

OpenID and OAuth at WebGuild's Web 2.0 Conference

On Jan 29 I'll be on an OpenID & OAuth panel at the WebGuild Web 2.0 Conference and Expo in Santa Clara, CA. Shreyas Doshi of Yahoo will be there, which will be a great opportunity to discuss where OpenID is headed. (My former compatriot George Fletcher will be there as well, along with Nico Popp of Verisign, and Johannes Ernst will be moderating.)

Warumungu Norms, Privacy, Facebook, and Useful Friction

We could learn something from the Warumungu. Wendy Seltzer's Mukurtu Digital Archiving: digital "restrictions" done right is about DRM, freedom, and controls; I think it's also about privacy. What's private, and what's public, and what's semi-private are culturally determined no less than the Warumungu rules around who is allowed to see what artifacts:

...the Warumungu have a set of protocols around objects and representations of people that restrict access to physical objects and photographs. Only elders may see or authorize viewing of sacred objects; other objects may be restricted by family or gender. Images of the deceased shouldn’t be viewed, and photographs are often physically effaced. When the Warumungu archive objects or images, they want to implement the same sort of restrictions.

With an interesting twist:

People can also print images or burn CDs and thus allow the images to circulate more widely to others who live on outstations or in other areas. In fact, one of the top priorities in Mukurtu’s development was that it needed to allow people to take things with them, printing and burning were necessary to ensure circulation of the materials.

What, then, prevents people from violating these norms?

Because the Murkurtu protocol-restrictions support community norms, rather than oppose them, the system can trust its users to take objects with them. If a member of the community chooses to show a picture to someone the machine would not have, his or her interpretation prevails — the machine doesn’t presume to capture or trump the nuance of the social protocol.

People, relationships, and norms are fuzzy and messy, so maybe it's reasonable that a system to deal with them is fuzzy and messy too. What Murkurtu does is put enough useful friction in the way of disclosure to give community norms a chance to operate. You can't email an image out to a mailing list, but you can print it and show it to a reasonably small number of people at a time. The point is not to control distribution perfectly, but to give human-scale trust mechanisms a chance to operate correctly.

Who owns the data?

L'Affaire Scoble raised the question, who owns relationship data? Dare Obasanjo argues that his contact data is his, not Robert's. And he wants Facebook to enforce this.

I'd argue that we should un-ask the ownership question. As long as we're talking about ownership, we're heading down the road towards DRM that has worked out so well for the music business. I'd like to talk about community norms, and what kind of useful friction we should be thinking about in the pure digital realm to give community norms a chance to operate. Reputation and portable identity is part of this, as are things like limited access (E.g., OAuth), rate limits, soft constraints, and user centric norm enforcement. (What would happen if the people on Robert's friends list were simply informed, in real time, that he was copying their data for an unknown purpose?)

(Nick Carr has a great post on this subject as well.)

Internet Identity Workship 2007b

I'll be at IIW next week, talking about Blogger, OpenID, OAuth, OpenSocial, and anything else that seems interesting. I'm anticipating a great event.