David Recordon

Sunday, February 08, 2009 by Dave Winer.

Just had a 1/2 hour phone conversation with David Recordon who's involved with OpenID and OAuth and works at SixApart. There were no deals made, we talked in generalities, I wanted him to understand where I was at with these two technologies. In the spirit of being open and transparent, here's where I'm at: 

1. I'm a user of OpenID. If you look at the HTML source for the scripting.com home page you'll see all the OpenID information. Pretty sure I understand how it works at a technical level, and that I could if needed do a server implementation. 

2. I'm confused by OAuth, but I know I have to implement it, at the lowest level, because there's no community to do it for the OPML Editor, and that's where I do my development. I've done the Flickr pre-cursor to OAuth, and hated it, but I have it working, and it works without flaw or problem, so that's behind me. The docs that exist for OAuth are daunting. But it's high on my to-do list.  

3. Because of the inevitability of OAuth, I'm concerned that the big companies are going to start monkeying with it, and that at some point there will be many flavors of OAuth and I'll have to implement them all. This is just a fear, only based on experience with other formats and protocols. 

4. In the struggle to achieve simplicity for OpenID, I came to the conclusion that it has to be built into each web browser. Interestingly David came to the same conclusion and wrote an article about it in December last year. Imho, the browsers that need to do this are: Firefox, MSIE, Safari and Chrome. If they do it the rest will follow. I think if even one does it, all the rest will follow because it is such a compelling idea, and users will like it and insist on it from their browser vendor. 

5. He agrees that we need the ability to attach arbitrary metadata to a user ID. 

6. He and I see eye to eye on many of the same things. He's younger, but seems to be going down a similar path as I did. He's in for a lot of pain, but he's doing good work, and I told him so, and I wanted to get that out here.  

7. I still think it's trouble to support Facebook having an invite-only meeting for design around open technologies. However he says they have removed the "invite-only" phrase from the meeting description, and they may webcast it. My main concern is that the OpenID that enters the room is the same one that exits when the meeting is over.