Have Facebook’s recent moves left your wondering? New TOS. Bad reaction. Old TOS. New statement of rights and new governance model. What’s going on here? Joseph Smarr and I try to make sense of it all in this week’s episode of The Social Web TV:
Have Facebook’s recent moves left your wondering? New TOS. Bad reaction. Old TOS. New statement of rights and new governance model. What’s going on here? Joseph Smarr and I try to make sense of it all in this week’s episode of The Social Web TV:
Who owns your data? Should there be DRM on the content/data you share with others? What happens to your stuff when the service you shared it on has a catastrophic failure? These and other questions of sharing user-generated content are discussed on the latest episode of The Social Web TV, as Chris Messina, Joseph Smarr, and John McCrea welcome special guest, Larry Halff, of the fallen (and soon to rise again) community and social bookmarking service, Magnolia.
I am pleased to see a major shift underway in the prevailing thoughts on one of the most important topics relating to data portability, interoperability, and the emergence of the Social Web — the question of whether the service providers need to protect us with “social DRM” or trust us to do the right thing. Microsoft’s Dare Obasanjo has an excellent post on the topic, outlining the two schools of thought, and publicly declaring that he has shifted sides in this critical debate:
The issue of what to do with content a user has shared when they decide to delete the content or attempt to revoke it is in an interesting policy issue for sites geared around people sharing content. When I’ve discussed this with peers in the industry I’ve heard two schools of thought. The first is that when you share something on the Web, it is out there forever and you have to deal with it. Once you post a blog post, it is indexed by search engines and polled by RSS readers and is then available in their caches even if you delete it. If you send an inappropriate email to your friends, you can’t un-send it. This mirrors the real world where if I tell you a secret but it turns out you are a jerk I can’t un-tell you the secret.
The other school of thought is that technology does actually give you the power to un-tell your secrets especially if various parties cooperate. There are ways to remove your content from search engine indexes. There are specifications that dictate how to mark an item as deleted from an RSS/Atom feed. If your workplace uses Outlook+Exchange you can actually recall an email message. And so on. In the case of Facebook, since the entire system is closed it is actually possible for them to respect a user’s wishes and delete all of the content they’ve shared on the site including removing sent messages from people’s inboxes.
I used to be a member of the second school of thought but I’ve finally switched over to agreeing that once you’ve shared something it’s out there. The problem with the second school of thought is that it is disrespectful of the person(s) you’ve shared the content with. Looking back at the Outlook email recall feature, it actually doesn’t delete a mail if the person has already read it. This is probably for technical reasons but it also has the side effect of not deleting a message from someone’s inbox that they have read and filed away. After all, the person already knows what you don’t want them to find out and Outlook has respected an important boundary by not allowing a sender to arbitrarily delete content from a recipient’s inbox with no recourse on the part of the recipient. This is especially true when you consider that allowing the sender to have such power over recipients still does not address resharing (e.g. the person forwarding along your inappropriate mail, printing it or saving it to disk).
And, as he points out, Dare is not alone in this shift. Mark Zuckerberg and the team at Facebook clearly appear to be shifting stance as well. In his epic post On Facebook, People Own and Control Their Information, in response to the confusion over the update to the Facebook TOS:
Still, the interesting thing about this change in our terms is that it highlights the importance of these issues and their complexity. People want full ownership and control of their information so they can turn off access to it at any time. At the same time, people also want to be able to bring the information others have shared with them—like email addresses, phone numbers, photos and so on—to other services and grant those services access to those people’s information. These two positions are at odds with each other. There is no system today that enables me to share my email address with you and then simultaneously lets me control who you share it with and also lets you control what services you share it with.
We’re at an interesting point in the development of the open online world where these issues are being worked out. It’s difficult terrain to navigate and we’re going to make some missteps, but as the leading service for sharing information we take these issues and our responsibility to help resolve them very seriously. This is a big focus for us this year, and I’ll post some more thoughts on openness and these other issues soon.
Some of us tried to get this debate started in September of 2007, with the publication of the Bill of Rights for Users of the Social Web, by Joseph Smarr, Marc Canter, Michael Arrington, and Robert Scoble. In hindsight, the world was not yet ready for that debate; few took notice, and no actions came in response. Then, in January of 2008, when Plaxo was trying to get a Facebook contacts importer ready to launch, which would have enabled social address book sync between Facebook, Plaxo, Outlook, the Mac address book, Yahoo Mail, and more, it turned by accident and miss-communication into a major incident. By then the world was ready to argue and debate the key questions, but not ready to come to any consensus.
But over the course of 2008, projects like Google Friend Connect, Facebook Connect, MySpaceID, and the quickening drumbeat of progress for OpenID and the Open Stack helped the industry to think through the issues preventing data portability and interoperability. In the end, we’re all coming to realize that rather than try to prevent anything bad from ever happening via “social DRM,” we’re going to have to trust our users, so that we can enable amazing things to happen — like all your tools and services working well together!
I’m at Facebook headquarters in Palo Alto for the OpenID Design Summit that was announced last week along with the big news of Facebook joining the OpenID Foundation. I’ll be blogging it with photos and words, as I have at previous Open Stack events. The event starts at noon, and Facebook is live streaming it via Ustream. Folks are beginning to arrive. I see representatives from Facebook, MySpace, Google, Microsoft, Yahoo, AOL, PayPal, Plaxo, Six Apart, JanRain, and Vidoop. Isn’t it great that all of these companies can work together in the open toward a common goal that is good for the web?
Luke Shepard and Dave Morin kicking it off. “The core problem we’re trying to solve is the user experience for OpenID,” says Luke, who is Facebook’s representative to the OpenID Foundation Board.
Julie Zhuo from Facebook’s user experience team is our first speaker, talking about Facebook Connect’s approach to making the experience something users can understand. How can the user understand the value? Value: Skip filling out this form or having to register if you have a Facebook account. Showing CitySearch, citing that Facebook logo is present in the UI, but acknowledging the scalability issue (number of options, logos). What is the relationship between the RP and the OP. Problem: we want to message “Hey, these two sites are going to be tied togethr somehow.” Because the popup design was so simple, we could port it to the iPhone easily. What’s being shared? Instead of describing in text, an illustration of the two sites, with arrows representing flows of sharing. Simplification is a big theme of Julie’s talk. Philosophy: keep the first screen really simple; delay deeper stuff (like extended permissions) to later flows, in context. As a community, we need to figure out how to message and simplify. Showing auth screens for various providers. Can we simplify? Can we standardize?
Next up is Max Engel of MySpace. Sharing results of testing of OAuth, OpenID, and a hybrid of the two. First, OAuth by itself. An arrow linking AOL and MySpace was found to work better once the MySpace logo was moved from the right to the left, as users thought it meant something different when it was on the right. People were generally comfortable, but the experience was not always what they expected. OpenID standalone tested with Yelp (with hacked HTML, not fully working code). Users were confused. “When ‘open’ was in the term, people had security concerns,” says Max. Another confusion point, “When we gave hint URLs, people tried putting those in, instead of their own.” People felt less secure in the logged in pop-up than the logged out pop-out. Point of confusion in Yelp example: user logs in with a MySpace URL but was then prompted to create a Yelp URL.
Max continues. OpenID/OAuth Hybrid test was done using Netflix. Big security concerns, perhaps made worse by the commerce aspects of Netflix. Nice user quote, “Once you see it and once you get it, it seems really innovative and useful.” Users liked the hybrid experience in general. Tested “granular scoping” with lots of choices. This was the “crowd favorite” but no one missed it when the choices weren’t there.
Next, Brian Ellin from JanRain (says he doesn’t have a Twitter account; gasp). About to give a history of OpenID interfaces. “The benefit of OpenID? Sign in with an account you already have.” Most users (78%) have not heard of OpenID. Brian is showing what people have been typing into OpenID sign-in boxes. OMG, “elderly,” “I HATE YOU LADY GAGA,” “Hotmail,” their email address, or far to common: nothing. This is great. Showing all different UIs. Some that show canonical examples. Interactive versions, like TypePad’s, idselector, Clickpass, and MapQuest.
Now on to OpenID 2.0, where you can input provider, like yahoo.com. Showing brand power, with results from RPX. The demographics of the site shift the mix of which providers users choose for signup. Showing RPX and Plaxo ui now. Max Engel asks if JanRain has metrics for dropoff between the RP and the OP. Brian says not yet. I whisper to Max, “Stay tuned.” (As I know that Joseph Smarr of Plaxo has that in his presentation, coming after lunch.) Brian points out two key observations:
1) Brand selectors are good at letting users express preference, but at the time of choice, user has no idea which OpenID experience will be better.
2) Knowing which one the user chose, allows that brand to be more prominent in subsequent signin.
3) Once you add a button to your interface, you can never remove it.
Google is up next, with Eric Sachs, Breno de Medeiros, and Dirk Balfanz. Not sure if all will talk, but they’re all working to set up a demo. While we wait, I observe that almost every laptop in the room is a Mac (including mine). The Google team is going to demo the OpenID Popup that they released yesterday. Ooh, that is sweet. Love the “smoky” background. Can’t wait to roll that into the Plaxo/Google hybrid experiment! Funny quote, “If you have good feedback, channel it to Plaxo, who will beat us up.”
Interesting question about the consent page. Has Google experimented with granular permissions, vs. having all the items consented to at once? “Yes. It was horrible,” says Eric Sachs. “People cursed at us when we did it one by one. They want it in a single step.” Wow. Important insight.
Next up, Joseph Smarr of Plaxo. Hilarious intro. (I’m biased.) “Hi! I’m Plaxo, and I’m in an open relationship with all of you. But it hasn’t always been easy. Sometimes it’s been confusing. And you haven’t met all my needs (for user data). By lately I’ve been spending a lot of time with…Google.” (Lots of laughs). “Experimenting with a new technique, that leverages more of the Open Stack.”
Joseph described the exeriment Plaxo and Google did, using hybrid OpenID/OAuth plus Google Contacts. Trying to prove that Open Stack onramping can be strictly better for all parties than traditional registration flows via a two-click signup.
Demo just went *great* and we’re looking at the final step. After the onramping, the new user is shown an “education lightbox” reminding the user where to look for the “sign in with Google” link.
Now, to the results. Drum roll, please. But wait! The RP/OP round trip, a.k.a “the Chasm of Death.” Asking the audience to guess the percentage of people who would survive. The crowd guesses 35%, 45% , 50%. The real answer is 92%! The crowd is wowed.
That means we lose 8% to the chasm of death. Of those that return, 8% choose “no” to the Google account signup option/consent. 92% say yes and automated address book import. Joseph says, they get higher conversion rates, higher import rates, more connections per user, and no drop-off in return visits.
“In other words, our business guys won’t let us turn off the experiment!”
Joseph says, “This is an historic movement. I’ve been evangelizing this stuff for two years, but all of the experiments before this were worse for our business. This is no longer about selling this as good for the web. This is about the Open Stack being measurably better for your business than traditional registration.”
Here’s Joseph’s presentation.
We’re back and Chris Messina of Vidoop and the open community at-large is up, sharing views about various contexts that OpenID will need to survive and thrive in, including web, mobile, desktop, API, and headless. Now, Chris is walking us through various OpenID UIs, pointing out points of confusion, also showing alternatives with better user experience. I’ll add a link to his slides when I have it.
We’re going to breakout groups now. One for Relying Party concerns, one for Providers. I’ll let the working sessions proceed without live blogging. I’ll return to the task when the groups convene to share results.
Update: ReadWriteWeb wades in on the implications of the Plaxo/Google experiment.
Summary from the OP breakout
Julie is talking. Agreement on popup as the way two go; two states: signed in or not. Have a high-level outline. Next steps real wireframes. On the white board now. Site name at the top. Below that something illustrating “what is happening”. Below that Options. Then ID and password (for not signed in). Legaleze, preferably small. Below that Okay or Cancel. Second step (optional) for getting access to more data. What’s interesting to me is it sounds like the OPs ended up with strong consensus about key elements. Max Engel from MySpace adding commentary, along with Angus Logan of Microsoft, and now Allen Tom of Yahoo. Consensus = goodness here. Second screen for the signed in state: site name, who you are, what is happending, options, okay/cancel. Same as first screen but simplified. Agreed that canceling just closes the pop-up and returns you to the site. Discussion around how to handle the different states (like cancel). Max chiming in, plus Breno from Google. Unresolved is sign-out implications between the sites. Breno sharing the need for getting RP logos from the web, with simple discovery; upload from the RP to the OP is not scalable. A little bit of back and forth on some corner case questions, but *great* to hear how MySpace, Facebook, Google, Yahoo, and Microsoft emerged from a room all “on the same page”. Facebook, MySpace, and Google “magically converged” on the same width for the ideal popup, says Julie. (450 pixels, I think.) Breno says that there should be a hard requirement that the popup can be re-sized.
Summary of the RP breakout
Luke Shepard from Facebook is sharing the findings. The big question is what to show the user: box vs. buttons vs. smart typeahead. Joseph Smarr from Plaxo chiming in: we have a set of contexts (like Chris Messina talked about before: organic signup, viral signup, return signin, lightweightm download/desktop, mobile, email validation, OAuth-only, prove affiliation, personalization, “connect”). To do these right, we have a wishlist for what we want from the OP (button, email, data access via OAuth/hybrid, discovery of services, is user logged in?, streamlined UX, email to OpenID lookout). Luke is now talking about one of the big concepts/issues: How can an RP? Eric Sachs of Google talked about doing a “third-party cookie system than (opted-in) users could reveal their identity provider. Breno says it’s like DNS. Neutral third-party. Eric had said there’s an existence proof for something similar for advertising systems for compliance with various privacy laws around the world. Joseph talking “RP Verticals” worth exploring for thinking through differing needs and UX approaches (media sites, e-commerce sites, blogs, social sites).
It’s a great day for the opening up of the Social Web. The largest and fastest growing social network, Facebook, has sent their strongest message to the world that “open” is strategically important to them by stepping up to become a corporate member of the OpenID Foundation. Sweet! Breaking coverage: VentureBeat, CNET, TechCrunch.
Given the popularity and positive user experience of Facebook Connect, we look forward to Facebook working within the community to improve OpenID’s usability and reach. As a first step, Facebook will be hosting a design summit next week at their campus in Palo Alto which follows a similar summit on user experience hosted at Yahoo! last year. The summit will convene some of the top designers from Facebook, the DiSo Project, Google, JanRain, MySpace, Six Apart and Yahoo!, focusing on how existing OpenID implementations could support an experience similar to Facebook Connect.
Here’s the official post from Facebook’s Mike Schroepfer. The best quote: “We see great opportunities to increase our contributions across the open stack.”
This news will surprise (or even shock) many, but I see this as a natural and expected move. After all, Facebook has been getting more and more involved in the open community, attending the OpenID UX Summit last Fall and the Activity Streams meetup a few weeks ago. And Luke Shepard, from the Facebook Connect team, ran in the recent election for the OpenID Foundation Community Board. Luke will now be Facebook’s official representative to the foundation.
I have to say this is a great moment in time. I am so proud of my friends at Facebook who have helped make this happen. Props to Dave Morin and to Luke Shepard. You guys rock!
In related news, Joseph Smarr of Plaxo is being added to the OpenID Foundation Community Board as a result of Facebook becoming a new corporate member. (The rules of the Foundation have the Community Board expanding at the same rate as the corporate membership. Joseph happened to be next in line, based on the election results.)
Looking forward to next week’s OpenID UX Summit, hosted by Facebook. It wouldn’t be surprising if I were to live blog it!
Recommended reading: Chris Messina’s take on the news.
The concept of an “open social network,” one that gets its news feed not from within its own walls, but rather by aggregating lifestreams from all over the open Web, first appeared with the launch of Plaxo Pulse in August 2007. [Reminder/disclosure: I head up marketing at Plaxo.
]
While Plaxo stayed heads-down focused on serving its traditional 30- to 50-year-old professional demographic with private sharing and conversations based on a family/friend/business connection model, FriendFeed came roaring into the space with a service as public and extensible as Twitter, and quickly became a darling of the early-adopter and blogger/influencer crowd.
The two services have continued to innovate down different pathways and to help map out a blueprint that we are now seeing adopted by some of the largest social networks (Facebook and MySpace) and largest of mainstream Internet companies (Yahoo, Microsoft, and AOL). So, let’s take a look at the traffic trend for these two pioneers, through the lens of the latest data from Compete.com. [Note: Compete.com only looks at U.S. traffic, and like all other tracking services, provides an approximate tally.]
While each service experienced a month here or there of sideways drift or month-over-month declines in monthly unique visitors, the clear overall trend for 2008 is one of strong growth. Plaxo in particular is showing encouraging signs of vibrancy at the end of 2008.
The key question now: with much larger players putting all their chips on the webwide lifestream aggregation model, can either of both of the two pioneers grow fast enough in their respective niches to carve out a great longterm position in the marketplace?
My belief is that the answer is “yes,” as the Web itself goes social, and the Social Web goes open, creating a wave of innovation that will favor the most agile of aggregators. And as a passionate user of both services, I sure hope I’m right!
Up in San Francisco for another open spec community gathering, this one focused on working toward standardization of “activity streams,” the flow of user-generated content which is the lifeblood of the emerging Social Web. This Activity Streams Meetup is being hosted at Six Apart, with David Recordon guiding the event. As Plaxo’s Joseph Smarr tweeted, we hope this all leads to “more structured metadata in feeds”.
As usual, I’ll sprinkle in a mix of photos and observations, but not attempt to take anything approaching full notes. In addition to Six Apart, there are folks here or from Facebook, MySpace, Google, Yahoo, Plaxo, among others. That means there’s representation for projects that span DiSo, OpenSocial, Open Stack, Facebook Connect, Y!OS, MySpaceID, among others. Sweet!
Microsoft’s Dare Obasanjo has a nice post describing the problem we need to solve, entitled, Representing Rich Media and Social Network Activities in RSS/Atom Feeds. Also recommend this post from Chris Messina, Where we’re going with Activity Streams. And for more background, here’s Chris Messina’s talk on Activity Streams at the pre-holiday Open Stack Meetup:
And now, some photos of the Activity Stream Meetup:
Lots of good discussion, trying to get everyone on the same page about the problem we’re trying to solve and what we can hope to accomplish today. As people are sharing all sorts of stuff from a rapidly growing list of services (examples just for photos: Flickr, Picasa, Smugmug, etc.). Every social network is either a webwide lifestream aggregator today (early examples: Plaxo Pulse and FriendFeed), or are becoming one quickly (examples: Facebook and MySpace). And every aggregator faces the same set of challenges that arise from the chaos of there being no standard for how to format the feed of user-shared content. No common convention for naming of objects or verbs. This is the classic problem space for the Open Stack of OpenID, OAuth, XRD, Portable Contacts, and OpenSocial.
Great to see the active participation from Luke Shepard from Facebook, who just shared some of the problems of complexity they experienced by having too much flexibility in the verb space. I think he just said “combinatorial explosion” to describe it.
Cool, just noticed that Ian Kennedy is live streaming the event via his mobile phone and Kyte. So now you can watch it so you don’t miss anything!
Chris Messina takes to the white board:
David Recordon of SixApart, who is running the Meetup, with Joseph Smarr:
Okay, now we’re about to go over a draft spec… Martin Atkins of Six Apart is now going over at high-level a review of a draft spec.
Now, Monica Keller of MySpace is jumping in, showing an alternative proposal and getting lots of feedback.
Discussion of reviving Media RSS vs. starting with Atom Media.
David Recordon is showing a demo of a Six Apart implementation done against the current draft spec in answer to a question from Joseph Smarr about how firm the draft feels, and whether we have any good insights from early implementations. It’s a demo of an API which transforms existing Atom and RSS feeds from sites like Flickr, Twitter, Digg, and blogs into new feeds (which can also be aggregated together) that include markup from the draft Activity Streams specifications being discussed. Along with the work from MySpace, this constitutes one of the first two implementations of the draft specification.
What a great working session! We’re two-and-a-half hours in an still going strong. Good discussion now about the importance (and complexities) of handing “friending” events, whether those are bi-directional or “follows”. Some differing thoughts here from the DiSo folks vs. the big social networks. Good sharing of insights from Facebook and Plaxo.
It’s after 6:00, and we’re wrapping up. Great session. Great participation from sites large and small and from folks just looking out for the open Social Web at large.
UPDATE: Check out Marshall Kirkpatrick’s excellent piece on the event on ReadWriteWeb (which also was syndicated to the New York Times) and Marc Canter’s thoughtful post, DiSo Activity Stream Standard.
When I wrote about the launch of Facebook Connect and Google Friend Connect last week, I tried to explain the similarities and the differences. One difference I suggested was ease of implementation. I knew that Google Friend Connect was really easy, that they had focused on “cut-and-paste a few lines of javascript”. But here’s what I said about Facebook Connect:
A second difference is target market. Facebook has clearly focused on major sites, like Digg, Hulu, and CitySearch, and while simple implementations can be done with very little coding, most will involve a bit more complex development.
Last evening, I learned otherwise, watching a video whose title says it all, “Add Facebook Connect to Your Blog in 8 Minutes“. Engineers from the Facebook Connect team, Luke Shepard and Wei Zhu, take you through the process with a great, straight-forward guide to implementing Facebook Connect. I’m not a developer, but I found the presentation really straight-forward. Great job, Luke and Wei! (Hey, Luke, you are welcome as a guest on The Social Web TV any time.)
(I would have embedded the video here, but hosted WordPress has severe limitations around what can or cannot be embedded. Lame.)
So, it really will be interesting to watch adoption of Facebook Connect and Google Friend Connect in the “long tail” of the Web. I wonder if we’ll start to see directories that can let us know all the sites that implement either. Would be fun to check them out and to compare and contrast.
Anyway, I stand corrected. Congrats to the Facebook Connect team on a great rollout. I note that CNET is live today with their integration.
December 4, 2008. Today may be remembered as the birth of the Social Web, as two major projects aimed at turning the Web social emerged from their restricted beta periods for general availability, Facebook Connect and Google Friend Connect. Together, these two major events sound the death knell for the walled garden phase of social networking. Early reactions to the news are quick to frame this as a head-to-head battle between Google and Facebook, but the truth requires a look at the details, and I think something much more profound is happening…
First, the similarities. Facebook Connect and Google Friend Connect share the same basic vision of the Social Web. Any site can become social, without having to build up its own social network. Users should be able to access those social features without having to experience the pain of usernames, passwords, uploading a photo, filling out a profile, importing an address book, and re-friending the people they’ve already connected with elsewhere. And, activity streams out to web-wide lifestream aggregators should become important engines of social discovery and growth for the site.
Now to the differences. One major difference between these two offerings is the technology under the hood. Google Friend Connect is built on the “open stack,” leveraging building blocks like OpenID, OAuth, and OpenSocial, whereas Facebook Connect is built on Facebook’s proprietary stack. A second difference is target market. Facebook has clearly focused on major sites, like Digg, Hulu, and CitySearch, and while simple implementations can be done with very little coding, most will involve a bit more complex development. Google, in contrast, has explicitly targeted the “long tail” of the web, sites that would never dream of writing their own social code; the focus of Google Friend Connect is to help these sites become social by cutting-and-pasting a few lines of javascript. The third major difference is one of strategy. Facebook Connect is all about making Facebook more useful to its users all over the Web. Google Friend Connect, on the other hand, is all about making the Web more social, with an approach that incorporates other social networks. For example, the current release integrates not only Orkut, but also Plaxo. (And recall that the earliest version also included Facebook, until Facebook shut that down.)
I’ve been playing around with Facebook Connect and Google Friend Connect all along the way while these services were being carefully tested and refined prior to today’s formal rollout. I like them both, but see lots of room for improvement. But that’s to be expected; this is a major shift in how the Web will work, and there’s a lot of complexity under the covers. Today marks the birth of the Social Web, and we should expect to see lots of rapid progress for this newborn.
For those who haven’t checked out Google Friend Connect yet, I’m including a few screenshots…
Oh, and you can check out the “Dive Bomber” site I used for these screenshots here.
Update: I just realized that I can now declare victory on the prediction I made for 2008, a prediction I made on December 6, 2007!
Update: The new episode of The Social Web TV is now up, with Joseph Smarr and I addressing the question, “Facebook Connect vs. OpenID?”: