November 06, 2007

Ahem ... like I've been saying. There's nothing really wrong with the OpenSocial or openness or even common APIs for social applications. It's just that in practice it's pretty much impossible to square the conflicting privacy concerns, and requirements for user's control over their own data, with widgets except in a walled garden owned by one trusted platform owner.

You'd need an entirely new security model.

Currently ...

Security issues are the main problem. “At the moment security is up to the container,” Marks said. “It’s clearly something we need to work better on, authenticating between sites.”

OpenSocial could potentially have functions, such as add friend, and bridge between social networks, but security gaps get in the way. “It comes down to the permission model from Unix. It treats applications as agents of users. The model needs a bit of refinement–you don’t want to delegate read/write access permission to others.”

How much flexibility to build into the APIs is a concern. “If you delegate back to the container, a gadget can send mail. It’s different than a gadget asking to send mail itself. It’s a fine line to walk. If you protect it too much, you are making it unusable and people will walk around it,” Marks said.

OpenSocial could hook into an instant messaging buddy list, but it could allow invasive scenarios such as clicking on a friend and seeing the friends full buddy list.

1 comment:

Scribe said...

Isn't this where DRM steps in? =)

Seriously though - DRM has a bad name because of who wants it currently. But AFAICS, DRM is the natural formation of "real world" privacy in an electronic realm. I only want certain people to know certain things - that's the same as saying I only want certain people to, say, be able to listen to certain bits.

Strong DRM alone isn't a solution, though - DRM is often (but not necessarily easily) breakable. If the social side of the internet is to grow, there must be trust in this DRM. But here enters the other problem of the whole scenario - private networks that commodify this trust, and sociality in general. Competition in APIs, or in SNS functionality, is one thing. But competition in DRM is another. Jumping from one DRM system to another is possibly more dangerous - and confusing - than merely moving networks. Trust is built through time, and destroying that trust on a yearly basis is just asking for trouble.

Not sure where I'm going with this =) Basically, I think there's a weird love triangle going on: openness/portability, privacy, and economics/politics of control - which is often overlooked.

Which brings me back to my ongoing question - which ties in with your trusted platform owner point: if we really want to put ourselves on-line, do we need a public sector solution?

(I think there are 3 outcomes: 1, biggest company wins, e.g. Google. 2, a public-sector-provided security model - akin to an ID Card? 3, a completely decentralised model where the individual has control over their own bits - maybe PKI is along these lines?)