<?xml encoding="ISO-8859-1" version="1.0"?>
<!-- OPML generated by OPML Editor v10.1a8 on Fri, 01 Jan 2010 19:57:22 GMT -->
<opml version="2.0">
	<head>
		<title>scripting.com</title>
		<dateCreated>Fri, 01 Jan 2010 17:44:17 GMT</dateCreated>
		<dateModified>Fri, 01 Jan 2010 19:57:21 GMT</dateModified>
		<ownerName>Dave Winer (Larry King)</ownerName>
		<ownerId>http://www.scripting.com/</ownerId>
		<expansionState>1</expansionState>
		<vertScrollState>2</vertScrollState>
		<windowTop>162</windowTop>
		<windowLeft>451</windowLeft>
		<windowBottom>889</windowBottom>
		<windowRight>1285</windowRight>
		</head>
	<body>
		<outline created="Fri, 01 Jan 2010 17:44:23 GMT" text="OAuth is becoming a cautionary tale">
			<outline created="Fri, 01 Jan 2010 17:44:32 GMT" text="If you want to get smart about open standards, you have to watch how these things play out in another open thing -- the market. Because it's the market that just as often shapes a standard as it is a standard that shapes the market."></outline>
			<outline created="Fri, 01 Jan 2010 17:45:21 GMT" text="And to understand it, you have to understand the often-submerged &lt;a href=&quot;http://www.scripting.com/stories/2007/11/02/whatIsItLikeToWorkAtGoogle.html&quot;&gt;motives&lt;/a&gt; of tech people who work at big companies."></outline>
			<outline created="Fri, 01 Jan 2010 17:45:39 GMT" text="For example, why are there so many iconic representations for a feed? Is it because we didn't anticipate in advance that there would be a need for one? Hardly. It's because the big companies, when they came in, ignored prior art and created their own way to do it. Once there were two, why not have twenty-two? Of course that's exactly what happened."></outline>
			<outline created="Fri, 01 Jan 2010 17:46:55 GMT" text="Last year (the one that just ended) it seemed that OAuth had finally gotten to a point where it was frozen. It was deploying in Twitter, and they were making sounds as if they would at sometime not too far down the road turn off the username-password way of authenticating users. So I rolled up my sleeves and implemented OAuth in the OPML Editor so my apps could use it. Turns out I was mistaken in believing that it was frozen, because, due to a security issue, they had to change OAuth, and I haven't revisited my code yet to adopt the change, so it doesn't work with the Twitter implementation of OAuth, which honestly, is the only one I care about. "></outline>
			<outline created="Fri, 01 Jan 2010 17:49:22 GMT" text="&lt;a href=&quot;http://en.wikipedia.org/wiki/Ouija&quot;&gt;&lt;img src=&quot;http://images.scripting.com/archiveScriptingCom/2010/01/01/ouija1.gif&quot; width=&quot;125&quot; height=&quot;83&quot; border=&quot;0&quot; align=&quot;right&quot; hspace=&quot;15&quot; vspace=&quot;5&quot; alt=&quot;A picture named ouija1.gif&quot;&gt;&lt;/a&gt;But wait -- it's even worse than it appears (one of my favorite &lt;a href=&quot;http://essaysfromexodus.scripting.com/whatIsScriptingNews#previousMottos&quot;&gt;mottos&lt;/a&gt;, a persistent disclaimer for all things technical, an adjunct to Murphy's Law). Turns out the creators of OAuth have changed their mind and think it should be stripped to the metal and rebuilt around HTTPS. So not only do I have to throw out all the work I've done, but so does Twitter, and even &lt;s&gt;better&lt;/s&gt; worse, my environment doesn't have glue for HTTPS so I'll have to get that together. When will all &lt;a href=&quot;http://groups.google.com/group/oauth-wrap-wg&quot;&gt;this&lt;/a&gt; happen? Heh. That's the rub. My guess is that, based on past experience with the tech biz, it'll never happen. The people pushing this stuff are young, they haven't been around the loop before. Doesn't matter. Big companies are like &lt;a href=&quot;http://en.wikipedia.org/wiki/Ouija&quot;&gt;Ouija&lt;/a&gt; boards. The people don't control them, the psychology does. In the BigCo mindset it's always Day Zero, and the value of all the implementations so far is $0. "></outline>
			<outline created="Fri, 01 Jan 2010 17:52:53 GMT" text="The entrepreneurs and the developing platforms are left with nothing to do. The old way of doing things is &quot;deprecated&quot; and the new way is a moving target, never finished, always subject to second-guessing. No one wins this game, but eventually a new thing comes along, and the problems of the last generation seem old. "></outline>
			<outline created="Fri, 01 Jan 2010 17:55:02 GMT" text="If OAuth is to have a chance at being a foundation to build on, it would need founders who  &lt;a href=&quot;http://hueniverse.com/2009/11/wrap-and-the-demise-of-the-oauth-community/&quot;&gt;say&lt;/a&gt; to those who want to completely redefine it that they should do it in a new playground, and let OAuth develop without interference. That, unfortunately for OAuth, and the people who have already invested, is not happening."></outline>
			<outline created="Fri, 01 Jan 2010 18:02:29 GMT" text="PS: The argument that OAuth is too hard to implement is moot. Imho, everyone who had to implement it had already implemented it. If I could get it &lt;a href=&quot;http://www.scripting.com/stories/2009/02/17/oauthisworkinghere.html&quot;&gt;working&lt;/a&gt; in a month in the OPML Editor, even though it was a grueling month, it may be hard, but it's not &lt;i&gt;too&lt;/i&gt; hard. Moot. An excuse to rip up the pavement and delay deployment, it seems to me."></outline>
			<outline created="Fri, 01 Jan 2010 19:56:31 GMT" text="Update: After writing this post I decided to look into what it would take to unbreak the OPML Editor's support for Twitter's OAuth implementation, and was able to fix it in about 45 minutes. I released the parts and documented it on the &lt;a href=&quot;http://frontiernews.org/2010/01/01/updated-oauth-support-to-work-with-twitter/&quot;&gt;Frontier news website&lt;/a&gt;."></outline>
			</outline>
		</body>
	</opml>
