<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Striking a balance: adoption meets security</title>
	<atom:link href="http://kveton.com/blog/2006/10/27/striking-a-balance-adoption-meets-security/feed/" rel="self" type="application/rss+xml" />
	<link>http://kveton.com/blog/2006/10/27/striking-a-balance-adoption-meets-security/</link>
	<description>Father, entrepreneur, pizza maker &#38; bacon lover</description>
	<lastBuildDate>Mon, 22 Feb 2010 20:18:16 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
		<item>
		<title>By: Ja</title>
		<link>http://kveton.com/blog/2006/10/27/striking-a-balance-adoption-meets-security/comment-page-1/#comment-2953</link>
		<dc:creator>Ja</dc:creator>
		<pubDate>Thu, 09 Nov 2006 11:18:37 +0000</pubDate>
		<guid isPermaLink="false">http://kveton.com/blog/2006/10/27/striking-a-balance-adoption-meets-security/#comment-2953</guid>
		<description>I won&#039;t make an issue of it, but I find all of the stuff people are doing these days on the web to be more scary than exciting.  I know exactly the type of individuals you speak of and you&#039;re right... they don&#039;t know what a ping or a trackback is, but it doesn&#039;t keep them from blogging, etc.  The problems come into play when people that don&#039;t really know a lot about what they&#039;re doing really have no clue about the possible ramifications of what they&#039;re doing or not doing.

I&#039;d definitely be happy to help with getting a list together of potential projects to approach about openid integration.  I could rattle a bunch off right now, but I know you have mailing lists and a wiki if I&#039;m not mistaken, so those would likely be better venues.

Speaking of which, I am quite out of the loop as I mentioned earlier, but I do have more questions and always ideas so I&#039;ll be trying to do some reading and catching up as time allows.

Oh, I think I just mentioned Parakey because it seems to be in line with some goals and almost at odds with others concerning identity/security.  I don&#039;t think OpenID will play a role in it at all.  It&#039;s too early to know anything about it though... just seeing if you had any early thoughts. :)

I read about the affiliate program and it looks like a wonderful way to really kickstart this stuff... I&#039;ll be sending some people in your direction to take a look at that specifically!

Hopefully I&#039;ll be making some stops on the lists and wiki, though time is going to be extremely tight until some time in January.  Have you started on that list anywhere yet so I might tack stuff on it a bit at a time?

Regards,

Jā</description>
		<content:encoded><![CDATA[<p>I won&#8217;t make an issue of it, but I find all of the stuff people are doing these days on the web to be more scary than exciting.  I know exactly the type of individuals you speak of and you&#8217;re right&#8230; they don&#8217;t know what a ping or a trackback is, but it doesn&#8217;t keep them from blogging, etc.  The problems come into play when people that don&#8217;t really know a lot about what they&#8217;re doing really have no clue about the possible ramifications of what they&#8217;re doing or not doing.</p>
<p>I&#8217;d definitely be happy to help with getting a list together of potential projects to approach about openid integration.  I could rattle a bunch off right now, but I know you have mailing lists and a wiki if I&#8217;m not mistaken, so those would likely be better venues.</p>
<p>Speaking of which, I am quite out of the loop as I mentioned earlier, but I do have more questions and always ideas so I&#8217;ll be trying to do some reading and catching up as time allows.</p>
<p>Oh, I think I just mentioned Parakey because it seems to be in line with some goals and almost at odds with others concerning identity/security.  I don&#8217;t think OpenID will play a role in it at all.  It&#8217;s too early to know anything about it though&#8230; just seeing if you had any early thoughts. :)</p>
<p>I read about the affiliate program and it looks like a wonderful way to really kickstart this stuff&#8230; I&#8217;ll be sending some people in your direction to take a look at that specifically!</p>
<p>Hopefully I&#8217;ll be making some stops on the lists and wiki, though time is going to be extremely tight until some time in January.  Have you started on that list anywhere yet so I might tack stuff on it a bit at a time?</p>
<p>Regards,</p>
<p>Jā</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: kveton</title>
		<link>http://kveton.com/blog/2006/10/27/striking-a-balance-adoption-meets-security/comment-page-1/#comment-2795</link>
		<dc:creator>kveton</dc:creator>
		<pubDate>Thu, 02 Nov 2006 15:47:05 +0000</pubDate>
		<guid isPermaLink="false">http://kveton.com/blog/2006/10/27/striking-a-balance-adoption-meets-security/#comment-2795</guid>
		<description>Users are getting a lot more sophisticated than we usually give them credit for.  They may not know the techno mumbo jumbo that I often spout but they are &quot;blogging&quot;, sharing photos and interacting in rich social transactions like never before.  All of those users that were supposed to show up during the bubble and never did are finally here.  And they are doing things we never thought they&#039;d do.  This is the really exciting stuff IMHO.

Forums are a great place to look for more adoption of OpenID.  I had some conversations with folks at phpBB but need to strike those up again.  Can you think of any more apps that might be good to get in touch with to ask about support?  BBPress and phpBB are a great start ... I&#039;d love a list of the other projects to look at and just start hittin&#039; them up to see if they would consider supporting OpenID.

I have not seen Parakey but thanks for the link to the article; I always like to hear what Blake is up to ... :-)  How could OpenID help with that?  I&#039;m not sure yet but it seems like being able to identify yourself inside of Parakey would be a critical element.  Identity is a core requirement of just about any application out there today but its a mega-pain to have to keep re-inventing the wheel in every application.</description>
		<content:encoded><![CDATA[<p>Users are getting a lot more sophisticated than we usually give them credit for.  They may not know the techno mumbo jumbo that I often spout but they are &#8220;blogging&#8221;, sharing photos and interacting in rich social transactions like never before.  All of those users that were supposed to show up during the bubble and never did are finally here.  And they are doing things we never thought they&#8217;d do.  This is the really exciting stuff IMHO.</p>
<p>Forums are a great place to look for more adoption of OpenID.  I had some conversations with folks at phpBB but need to strike those up again.  Can you think of any more apps that might be good to get in touch with to ask about support?  BBPress and phpBB are a great start &#8230; I&#8217;d love a list of the other projects to look at and just start hittin&#8217; them up to see if they would consider supporting OpenID.</p>
<p>I have not seen Parakey but thanks for the link to the article; I always like to hear what Blake is up to &#8230; :-)  How could OpenID help with that?  I&#8217;m not sure yet but it seems like being able to identify yourself inside of Parakey would be a critical element.  Identity is a core requirement of just about any application out there today but its a mega-pain to have to keep re-inventing the wheel in every application.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Ja</title>
		<link>http://kveton.com/blog/2006/10/27/striking-a-balance-adoption-meets-security/comment-page-1/#comment-2785</link>
		<dc:creator>Ja</dc:creator>
		<pubDate>Thu, 02 Nov 2006 05:12:15 +0000</pubDate>
		<guid isPermaLink="false">http://kveton.com/blog/2006/10/27/striking-a-balance-adoption-meets-security/#comment-2785</guid>
		<description>Your comittment is appreciated and it does indeed make things less painful.  What I&#039;d really like to see in the shorter term is an adoption of Open-ID for things like forums as well as the newer things that I personally see as fads.  Don&#039;t get me wrong, I think blogs and smart social interest sharing/networking definitely have their place but the way we use things now have a lot of evolving to do and as you said, none of this stuff will happen over night.

With forums, which I&#039;ve been using forever it seems, it&#039;s such a pain to sign up for one every time I just want a post a single message.  Most forums I visit I only use once or twice and never again.  It&#039;s a matter of going and getting/giving information on specific topics in a variety of specific places... most people only have one or two they actually frequent if any.  Reputable forums are usually well moderated and don&#039;t stand for abuse from any users, so I think it could be an interesting experiment to actually have an open-id provider be a reputable forum where I have an active account.  Thoughts on that idea?  Even without that, I&#039;d definitely like to be able to avoid the situation I&#039;m frequently faced with:  spending more time signing up for forums than I do actually using them or in many cases not lending information I could because I don&#039;t want to go through the hassle of having to register for something I likely won&#039;t be coming back to.  That&#039;s where I think Open-ID could really be key in making traversing these little communities much less painful if the software devs and administrators were willing to implement it.

Do you know of any forum software with plugins or being built with Open-ID included?  You may want to approach Matt with the idea of integrating it into BBPress if you haven&#039;t already.

Speaking of which (since I saw him link to it), I&#039;d love to hear any comments you may have on &lt;a href=&quot;http://www.spectrum.ieee.org/nov06/4696&quot; rel=&quot;nofollow&quot;&gt;Parakey&lt;/a&gt; from whatever implications you feel can be gleaned from the article.

Cheers!

Jā</description>
		<content:encoded><![CDATA[<p>Your comittment is appreciated and it does indeed make things less painful.  What I&#8217;d really like to see in the shorter term is an adoption of Open-ID for things like forums as well as the newer things that I personally see as fads.  Don&#8217;t get me wrong, I think blogs and smart social interest sharing/networking definitely have their place but the way we use things now have a lot of evolving to do and as you said, none of this stuff will happen over night.</p>
<p>With forums, which I&#8217;ve been using forever it seems, it&#8217;s such a pain to sign up for one every time I just want a post a single message.  Most forums I visit I only use once or twice and never again.  It&#8217;s a matter of going and getting/giving information on specific topics in a variety of specific places&#8230; most people only have one or two they actually frequent if any.  Reputable forums are usually well moderated and don&#8217;t stand for abuse from any users, so I think it could be an interesting experiment to actually have an open-id provider be a reputable forum where I have an active account.  Thoughts on that idea?  Even without that, I&#8217;d definitely like to be able to avoid the situation I&#8217;m frequently faced with:  spending more time signing up for forums than I do actually using them or in many cases not lending information I could because I don&#8217;t want to go through the hassle of having to register for something I likely won&#8217;t be coming back to.  That&#8217;s where I think Open-ID could really be key in making traversing these little communities much less painful if the software devs and administrators were willing to implement it.</p>
<p>Do you know of any forum software with plugins or being built with Open-ID included?  You may want to approach Matt with the idea of integrating it into BBPress if you haven&#8217;t already.</p>
<p>Speaking of which (since I saw him link to it), I&#8217;d love to hear any comments you may have on <a href="http://www.spectrum.ieee.org/nov06/4696" rel="nofollow">Parakey</a> from whatever implications you feel can be gleaned from the article.</p>
<p>Cheers!</p>
<p>Jā</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: kveton</title>
		<link>http://kveton.com/blog/2006/10/27/striking-a-balance-adoption-meets-security/comment-page-1/#comment-2778</link>
		<dc:creator>kveton</dc:creator>
		<pubDate>Wed, 01 Nov 2006 16:29:39 +0000</pubDate>
		<guid isPermaLink="false">http://kveton.com/blog/2006/10/27/striking-a-balance-adoption-meets-security/#comment-2778</guid>
		<description>Thanks for the comment Ja.

I agree that the big players tie quite a bit of their valuation to the concept of &quot;owning&quot; the users.  I&#039;m really interested in empowering the sites out in the long tail; all of those sites that are doing things like photo and video sharing, blogging, social bookmarks, etc.  For every single one of these sites, getting the user past the registration screen is one of the most difficult things for them.  Its also a pain point for the users; yet another username and password to keep track of.

The benefit I seen in OpenID is that it solves a pain points for users and sites.  The secondary benefit is what it will enable for users of all of those sites.  The ability to quickly and easily communicate with friends and family, especially as social networks grow.  OpenID is a tool that will hopefully be used to give context to users across a wide range different topics.

Is this going to happen overnight?  Of course not.  But nothing ever worth doing was easy.</description>
		<content:encoded><![CDATA[<p>Thanks for the comment Ja.</p>
<p>I agree that the big players tie quite a bit of their valuation to the concept of &#8220;owning&#8221; the users.  I&#8217;m really interested in empowering the sites out in the long tail; all of those sites that are doing things like photo and video sharing, blogging, social bookmarks, etc.  For every single one of these sites, getting the user past the registration screen is one of the most difficult things for them.  Its also a pain point for the users; yet another username and password to keep track of.</p>
<p>The benefit I seen in OpenID is that it solves a pain points for users and sites.  The secondary benefit is what it will enable for users of all of those sites.  The ability to quickly and easily communicate with friends and family, especially as social networks grow.  OpenID is a tool that will hopefully be used to give context to users across a wide range different topics.</p>
<p>Is this going to happen overnight?  Of course not.  But nothing ever worth doing was easy.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Ja</title>
		<link>http://kveton.com/blog/2006/10/27/striking-a-balance-adoption-meets-security/comment-page-1/#comment-2777</link>
		<dc:creator>Ja</dc:creator>
		<pubDate>Wed, 01 Nov 2006 16:17:51 +0000</pubDate>
		<guid isPermaLink="false">http://kveton.com/blog/2006/10/27/striking-a-balance-adoption-meets-security/#comment-2777</guid>
		<description>Perhaps I&#039;m very out of the loop, but I followed OpenID for a long while and it was always very specifically stated that it was only meant to be a very simple lightweight identity protocol to do basically what you said:  this url vouches for this user.

It&#039;s always been a simple building block for trust networking and further security layers to be built upon.

The way I see it, the current problem is that it&#039;s become a new web fad and it&#039;s not being used properly.    There&#039;s really nothing in place for anything more than the very basic stuff that was there to begin with at this point.  Honestly, I don&#039;t see that changing for a while, especially with corporations in control of the web.  Their ideas of decentralization are more like disjointment and they&#039;re all very protective of letting go of their tracking/marketing abilities as well as eyes for their ad-serving abilities since the current revenue model depends on advertisements and monopoly money.

People are still thinking far too much about what will integrate with what&#039;s currently hot.  Most end users don&#039;t even know what RSS is let alone anything to do with blogging, web 2.0 (spit), nor any of the jargon you rattled off in your post.

I&#039;ve had lengthy discussions about decentralized networking/trust systems with very intelligent people of the computer generation and yet they still can&#039;t grasp how it would be any different than what they currently use their Myspace account for.  It&#039;s truly maddening.

That&#039;s where the problem is though.  We don&#039;t need people to be aware of the issues (which is an impossible task) but rather get together and build something that works transparently for these people and ourselves in a manner that&#039;s convenient for each individual.

Ja

ps.  for the record, I&#039;m more concerned with making 1-degree of seperation networking and anti/non-social media networking a reality.  Basically: decentralized networking using existing technologies to make it simple to do stuff that should be simple like keep up with friends, family, colleagues, etc while having fine-grained control over actual security permissions (exactly who can see or recieves what) and have information access really be user-centric rather than marketing-centric like it is now.</description>
		<content:encoded><![CDATA[<p>Perhaps I&#8217;m very out of the loop, but I followed OpenID for a long while and it was always very specifically stated that it was only meant to be a very simple lightweight identity protocol to do basically what you said:  this url vouches for this user.</p>
<p>It&#8217;s always been a simple building block for trust networking and further security layers to be built upon.</p>
<p>The way I see it, the current problem is that it&#8217;s become a new web fad and it&#8217;s not being used properly.    There&#8217;s really nothing in place for anything more than the very basic stuff that was there to begin with at this point.  Honestly, I don&#8217;t see that changing for a while, especially with corporations in control of the web.  Their ideas of decentralization are more like disjointment and they&#8217;re all very protective of letting go of their tracking/marketing abilities as well as eyes for their ad-serving abilities since the current revenue model depends on advertisements and monopoly money.</p>
<p>People are still thinking far too much about what will integrate with what&#8217;s currently hot.  Most end users don&#8217;t even know what RSS is let alone anything to do with blogging, web 2.0 (spit), nor any of the jargon you rattled off in your post.</p>
<p>I&#8217;ve had lengthy discussions about decentralized networking/trust systems with very intelligent people of the computer generation and yet they still can&#8217;t grasp how it would be any different than what they currently use their Myspace account for.  It&#8217;s truly maddening.</p>
<p>That&#8217;s where the problem is though.  We don&#8217;t need people to be aware of the issues (which is an impossible task) but rather get together and build something that works transparently for these people and ourselves in a manner that&#8217;s convenient for each individual.</p>
<p>Ja</p>
<p>ps.  for the record, I&#8217;m more concerned with making 1-degree of seperation networking and anti/non-social media networking a reality.  Basically: decentralized networking using existing technologies to make it simple to do stuff that should be simple like keep up with friends, family, colleagues, etc while having fine-grained control over actual security permissions (exactly who can see or recieves what) and have information access really be user-centric rather than marketing-centric like it is now.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Greg K Nicholson</title>
		<link>http://kveton.com/blog/2006/10/27/striking-a-balance-adoption-meets-security/comment-page-1/#comment-2734</link>
		<dc:creator>Greg K Nicholson</dc:creator>
		<pubDate>Sat, 28 Oct 2006 02:23:56 +0000</pubDate>
		<guid isPermaLink="false">http://kveton.com/blog/2006/10/27/striking-a-balance-adoption-meets-security/#comment-2734</guid>
		<description>I just got an OpenID. Some thoughts:

OpenID.net and I Want My OpenID! seem to be very much advertisements for OpenID, intended to persuade randomers that they want one. Which is fine, but when the randomer in question decides they do want an OpenID, these sites don&#039;t make it stupidly easy to get one.

It is fairly easy for someone with a little determination, but not stupidly easy for everyone. You can&#039;t just say &quot;Go to getfirefox.com and click Download&quot;.

For example, the randomer has to figure out what an identity provider is, and then choose one based on nothing more than how sexy each one&#039;s website is. This seems analogous to how the multitude of Linux distributions confuses newbies rather than providing choice – the newbie isn&#039;t in a position to make an educated choice, so they guess, which makes them unsure of their decision. And the easiest choice is &quot;none whatsoever&quot;.

I found documentation such as https://www.myopenid.com/help#own_domain very useful; it ought to be replicated all over the place so that it can&#039;t possibly be missed.

Also, hooking Gravatar up to OpenID would cause my s0x0rz to become thoroughly r0x0rz&#039;d.</description>
		<content:encoded><![CDATA[<p>I just got an OpenID. Some thoughts:</p>
<p>OpenID.net and I Want My OpenID! seem to be very much advertisements for OpenID, intended to persuade randomers that they want one. Which is fine, but when the randomer in question decides they do want an OpenID, these sites don&#8217;t make it stupidly easy to get one.</p>
<p>It is fairly easy for someone with a little determination, but not stupidly easy for everyone. You can&#8217;t just say &#8220;Go to getfirefox.com and click Download&#8221;.</p>
<p>For example, the randomer has to figure out what an identity provider is, and then choose one based on nothing more than how sexy each one&#8217;s website is. This seems analogous to how the multitude of Linux distributions confuses newbies rather than providing choice – the newbie isn&#8217;t in a position to make an educated choice, so they guess, which makes them unsure of their decision. And the easiest choice is &#8220;none whatsoever&#8221;.</p>
<p>I found documentation such as <a href="https://www.myopenid.com/help#own_domain" rel="nofollow">https://www.myopenid.com/help#own_domain</a> very useful; it ought to be replicated all over the place so that it can&#8217;t possibly be missed.</p>
<p>Also, hooking Gravatar up to OpenID would cause my s0&#215;0rz to become thoroughly r0&#215;0rz&#8217;d.</p>
]]></content:encoded>
	</item>
</channel>
</rss>
