Fishpool

To content | To menu | To search

Monday 31 January 2011

Did common identities die with OpenID? No

About a year ago I posted here a summary of trends I expected would be relevant to our product development over 2010, and looking back at it, perhaps I should have put tablet computing on that list.. However, what prompted me to go back and look at it today was picking up on the news that 37signals has declared OpenID a failed experiment, and the related Quora thread I found. Wow, the top-voted answer there is one-sided. Here's what I think about it, to update my statement from a year ago. Comments would be welcome!

Facebook has established itself as a de-facto source of identity and social graph data for all but a few professional/enterprise-targeted Internet services. Over a medium- to long-term, it is still possible that another service or a federation of multiple services using standard APIs will displace Facebook as the central source. However, a networked, "external" social graph is a given. Majority of users are still behaving as if stand-alone services with individual logins and user-to-user relationships are preferred, but that's a matter of behavioral momentum.

This has not removed the problem of identity-related security issues, like identity theft. The nature of the problem will shift over time from account theft to impersonation and large-scale and/or targeted information theft. Consumers still remain uninterested and even hostile to improving security (at the cost of sometimes reduced convenience). Visible and wide-spread security scares are beginning to change the mindset though, and it's possible that even by the end of the year, at least one of the big players will introduce a "secure id" solution for voluntary access as a further argument for their services.

The spread of the social graph will have more impact to the scope of Internet services, however. Application development today should take it for granted that information about the users' preferences, friends, brand connections and activity history will be available and should be utilized (wisely) to improve service experience. The key to viral/social distribution is not whether applications can reach their users' network (which will be given), rather what would motivate the user to spread the message.

Thursday 13 January 2011

A last look at 2010... and what's in sight?

For a few years, I've tried to recap here some events I've found notable over the past year and offering some guesses on what might be ahead of us. I'm somewhat late on these things this year, due to being busy with other stuff, but I didn't want to break the tradition, no matter how silly my wrong guesses might seem later. And again, others have covered generals, so I'll try to focus on specifics, in particular as they relate to what I do. For a look at what we achieved for Habbo, see my recap post on the Sulake blog.

This time last year Oracle still had not successfully completed the Sun acquisition due to some EC silliness, but that finally happened over the 2010. It seems to be playing about how I expected it to - MySQL releases have started to appear (instead of just being announced, which was mostly what MySQL AB and Sun were doing), and they actually are improvements. Most things are good on that front. On the other hand, Oracle is exerting license force on the Java front, and hurting Java's long-term prospects in the process, just at a time when things like Ruby and Node.js should put the Java community on the move to improve the platform. Instead, it looks like people are beginning to jump ship, and I can't blame them.

A couple of things surprised me in 2010. Nokia finally hired a non-Finn as a CEO, and Microsoft's Kinect actually works. I did mention camera-based gesture UIs in my big predictions post, but frankly I wasn't expecting it to actually happen during 2010. Okay, despite the 8 million units, computer vision UIs aren't a general-purpose mass market thing yet, but the real kicker here is how easy Kinect is to use for homebrew software. We're going to see some amazing prototypes and one or two actual products this year, I'm sure.

In terms of other software platform stuff, much hot air has been moved around iOS, Android, JavaScript and Flash. I haven't seen much that would have made me think it'd be time to reposition yet. Native applications are on their way out (never mind Mac App Store, it's a last-hurrah thing for apps which don't have an Internet service behind them), and browser-based stuff is on its way in. Flash is still the best browser-side applications platform for really rich stuff, and while JavaScript/HTML5/Canvas is coming, it's not here yet. For more, see this thread on Quora where I commented on the same. Much of the world seems to think that HTML5 Video tag, h.264 and VP8 equate to the capabilities of Flash, that's quite off-base.

On the other hand, tablets are very much the thing. I very much expect that my Galaxy Tab will be outdated by next month, and am looking forward to the dual-core versions which probably will be good for much, much more than email, calendar, web and the occasional game. Not that I'm not already happy about what's possible on the current tablets -- I carry a laptop around much less already. An in terms of what it means for software -- UI's are ripe for a radical evolution. 

The combination of direct touch on handheld devices and camera-read gestures on living-room devices is already here, and I expect both to shift on to the desktop as well. Not by replacing keyboards, nor necessarily mouses, but I'm looking forward to soon having a desktop made out of a large near-horizontal touchscreen for arranging stuff replacing the desk itself, a couple of large vertical displays for presenting information, a camera vision for helping the computer read my intentions and focus on stuff, and keeping the keyboard around for rapid data entry. One has to remember that things for which fingers are enough are much more efficiently done with fingers than by waving the entire hand around.. 

Will I have such a desk this year? Probably not. At the workplace, I move around so much that a tablet is more useful, and at home, time in front of a desktop computer grew rather more infrequent with the arrival of our little baby girl a few weeks ago.. But those are what I want "a computer" to mean to her, not these clunky limited things my generation is used to.

Thursday 14 January 2010

Technology factors to watch during 2010

Last week I posted a brief review of 2009 here, but didn't go much into predictions for 2010. I won't try to predict anything detailed now either, but here's a few things I think will be interesting to monitor over the year. And no, tablet computing isn't on the list. For fairly obvious reasons, this is focused on areas impacting social games. As a further assist, I've underlined the parts most resembling conclusions or predictions.

 

Social networks and virtual worlds interoperability

As more and more business transforms to use Internet as a core function, the customers of these businesses are faced with a proliferation of proprietary identification mechanisms that has already gotten out of hand. It is not uncommon today to have to manage 20-30 different userid/password pairs that are in regular use, from banks to e-commerce to social networks. At the same time, identity theft is a growing problem, no doubt in large part because of the minimum-security methods of identification.

Social networks today are a significant contributor to this problem. Each collects and presents information about its users that contribute to the rise of identity theft while having their own authorization mechanisms in a silo of low-trustworthy identification methods. The users, on the other hand, perceive little incentive to manage their passwords in a secure fashion. Account hijacking and impersonation is a major problem area to each vendor. The low trust level of individual account data also leads to a low relative value of owning a large user database.

A technology solution, OpenID is emerging and taking hold in a form of an industry-accepted standard for exchanging identity data between an ID provider and a vendor in need of a verified id for their customer. A few of current backers of the standard in the picture on the right. However, changing the practices of the largest businesses has barely begun and no consumer shift can yet be seen – as is typical for such “undercurrent” trends.

OpenID will allow consumers to use fewer, higher-security ids over the universe of their preferred services, which in turn will allow these services a new level of transparent interoperability in combining data from each other in near-automatic, personalized mash-ups via the APIs each vendor can expose to trusted users with less fear of opening holes for account hijacking.

 

Browsers vs desktops: what's the target for entertainment software?

Here's a rough sketch of competing technology streams in terms of two primary factors – ease of access versus the rich experience of high-performance software. “Browser wars” are starting again, and with the improved engines behind Safari 4, Firefox 4, IE 8 and Google Chrome, a lot of the kind of functionalitywe're used to thinking belongs to native software or at best browser plugins like Flash, Java or Silverlight will be available straight in the browser. This for sure includes high-performance application code, rich 2D vector and pixel graphics, video streams and access to new information like location-sensing. The plugins will most likely be stronger at 3D graphics and synchronized audio and at advanced input mechanisms like using webcams for gesture-based control. Invariably, especially the new input capabilities will also bring with them new security and privacy concerns which will not be fully resolved within the next 2-3 years.

While 3D as a technology will be available to browser-based applications, this doesn't mean the web will turn to represent everything as a virtual copy of the physical world. Instead, it's best use will be as a tool for accelerating and enhancing other UI and presentation concepts – think iTunes CoverFlow. For social interaction experiences, a 3-degrees-freedom pure 3D representation will remain a confusing solution, and other presentations such as axonometric “camera in the corner” concepts will remain more accessible. Naturally, they can (but don't necessarily need to) be rendered using 3D tech.

 

Increased computing capabilities will change economies of scale

The history of the “computer revolution” has been about automation changing economies of scale to enable entirely new types of business. Lately we've seen this eg by Google AdWords enabling small businesses to advertise and/or publish ads without marketing departments or involvement of agencies.

The same trend is continuing in the form of computing capacity becoming a utility in Cloud Computing, extreme amounts of storage becoming available in costs which allow terabytes of storage to organizations of almost any size and budget, and most importantly, developing data mining, search and discovery algorithms that enable organizations to utilize data which used to be impossible to analyze as automated business practices. Unfortunately, the same capabilities are available for criminals as well.

Areas in which this is happening as we speak:

  • further types and spread of self-service advertising, better targeting, availability of media
  • automated heuristics-based detection of risky customers, automated moderation
  • computer-vision based user interfaces which require nothing more than a webcam
  • ever increasing size of botnets, and the use of them for game exploits, money laundering, identity theft and surveillance

The escalation of large-scale threats have raised the need for industry-wide groups for exchanging information and best practices between organizations regarding the security relevant information such as new threats, customer risk rating, identification of targeted and organized crime.

 

Software development, efficiencies, bottlenecks, resources

Commercial software development tools and methods experience a significant shift roughly once every decade. The last such shift was the mainstreaming of RAD/IDE-based, virtual-machine oriented tools and the rise of Web and open source in the 90s, and now those two rising themes are increasingly mainstream while “convergent”, cross-platform applications which depend on the availability of always-on Internet are emerging. As before, it's not driven by technological possibility, but by the richness and availability of high-quality development tools with which more than just the “rocket-scientist” superstars can create new applications.

The skills which are going to be in short supply are those for designing applications which can smoothly interface to the rest of the cloud of applications in this emerging category. Web-accessible APIs, the security design of those APIs, efficient utilization of services from non-associated, even competing companies, and friction-free interfaces for end users of these web-native applications is the challenge.

In this world, the traditional IT outsourcing houses won't be able to serve as a safety valve for resources as they're necessarily still focused on serving the last and current mainstream. In their place, we must consider the availability of open source solutions not just as a method for reducing licensing cost, but as the “extra developer” used to reduce time-to-market. And as with any such relationship, it must be nurtured. In the case of open source, that requires participation and contribution back to the further development of that enabling infrastructure as the cost of outsourcing the majority of the work to the community.


Mobile internet

With the launch of iPhone, the use of Web content and 3rd party applications on mobile devices has multiplied compared to previous smart phone generations. This is due to two factors: the familiarity and productivity of Apple's developer tools for the iPhone, and the straightforward App Store for the end-users. Moreover, the wide base of the applications is primarily because of the former, as proven by the wide availability of unauthorized applications already before the launch of iPhone 2.0 and the App Store. Nokia's failure to create such an applications market despite the functionality available on S60 phones for years before the iPhone launch proves this – it was not the features of the device, but the development tools and application distribution platform were the primary factor.

The launch of Google's Android will further accelerate this development. Current Android-based devices lack the polish of iPhone, and the stability gained from years of experience of Nokia devices, yet the availability of development tools will supercharge this market, and the next couple of years will see accelerated development and polish cycle from all parties. At the moment, it's impossible to call the winner on this race, though.

Monday 4 January 2010

Happy 2010 - it's review time

I was happily snowboarding and skiing (the latter for the first time in two decades) last week, so here comes the year-end review a week late. Last year, I harped on Facebook's closed nature, and over the the year they've tried to open more of the users' data over to the Internet. Still, there are no decent APIs for a user to pull out everything they've posted to Facebook to have their own copy, though. That doesn't seem to stop them from dominating the Internet for the time being, though, so good for them.

I'm trying to think of what would have surprised me over the year, but given I failed to make many accurate predictions myself, things just seemed to happen in pretty natural direction. Oracle's Sun acquisition over in April was a bit of a surprise at the time, but since then, I've grown to appreciate how it might make sense for Oracle. However, what still baffles me is that EC is going along with Monty's campaign of blocking the completion of that acquisition. Look, guys - the entire world does not need to agree on a commercial transaction in order for one to go through! MySQL is not the important thing here overall, Java is.

We managed to complete a few of major transitions for Habbo, most notably replacing the Shockwave client which was getting a bit long in the tooth with an all-new Flash-based Habbo Hotel and integrating Habbo with Facebook and other social networks. I didn't write about either of those launches here at the time, but these are pretty huge things for us because they make approaching Habbo much easier for a new user, and enable us to create all kinds of interesting features that would not have made sense previously.

So, what do I expect from 2010? Well, did the mobile Internet already happen? If not, at least it has a fighting chance this year. I'm having a hard time identifying any people close to me who're not using some Internet services on their phone by now, and some seem to be doing that almost exclusively on a phone. That must mean the rest of the world is close on their heels. As for more predictions, others have taken care of them by now.

One promise I can make is to try to do my part in making the Internet more fun and more social. At least now that even newspapers are beginning to think that asking their readers for money is not just a utopia, we can focus on the apps themselves, not whether they're ad-supportable.

Have a great year MMX!

Tuesday 26 February 2008

How can trackback spam be fixed?

A short while ago while chatting about something completely unrelated with a friend, the discussion took a diversion to whether blogs must allow comments or not. I offered as my point of view that anyone who has something worthwile enough to comment with is free to do so in their own blog. Today I learned that Dave Winer and Joel Spolsky made similar arguments last year.

What makes me uneasy about this opinion is that this is what trackbacks were designed for, yet most blogs have them disabled, too, for rather obvious spam reasons (well, obvious to anyone who has a blog).

Never mind how to fix comment spam -- that's easy enough, with timing, CAPTCHA or OpenID checks. But how can trackback spam be fixed? Not that this blog gets many (valid) comments OR trackbacks (nor traffic for that matter, but that's fine by me), but I do have enough of cleanup to do in the moderation/spam queue for both that I can imagine for a big blog, the TB spam filtering is way worse than email spam.