Standardizing the Social Web at the W3C

Harry Halpin, <harry a! w3.org>

August 17th 2010

Starting Thoughts

gutenberg I pondered all these things, and how men fight and lose the battle, and the thing that they fought for comes about in spite of their defeat, and when it comes turns out not to be what they meant, and other men have to fight for what they meant under another name.

William Morris. A Dream of John Ball

Knowledge is (Potential) Power

Walled Gardens Knowledge may be power, but this knowledge is distributed throughout social networks of people.

Social networking users are trapped in walled gardens where they cannot share data with others unless they are on the same social networking site or use the same vendor-specific API. FOAF (Friend of a Friend) has not solved this problem and many major social networking sites (Facebook, Myspace, Twittr) are not exporting FOAF.

How can your educational, academic, non-profit, or even enterprise social network access this data!

Opening the Social Graph

facebook pic
  1. Ordinary people
  2. Developers
  3. Businesses
  4. Academics
  5. Analysts

The (Lack of) the Social Web at the W3C

As Myspace, Facebook, Twitter, and other technologies took off, the W3C officially didn't take much notice of them.

Berners-Lee thought the functionality they provided was not radically different than what the early Web provided - i.e. The Web was always social.

W3C rejected OpenID (sharing identity) as a potential W3C standard due to security reasons and belief that a URI should be enough (i.e. the Semantic Web).

Almost none of the well-known Web 2.0 companies are members of the W3C.

As such, standardization work currently in the Social Web is taking place through a number of different standards bodies, such as the IETF (OAuth),OASIS (XRD-S), and the upcoming Open Web Foundation.

Social Networking as the new browser wars...

Social Networking is very similar to browser wars... Walled Gardens

W3C, Facebook, and OpenSocial

Walled Gardens
  1. OpenSocial Alliance: Started by Google and Myspace, and endorsed by Yahoo! and virtually all the minor players. Open Source implementation: Shindig
  2. Facebook: offers "Facebook" connect and the Facebook Developer Platform. Microsoft has a large amount of shares in Facebook.
  3. W3C Work: None of these are compatible with W3C Widgets and open data standards like FOAF.

Social Networks are Global

And not just in London or Silicon Valley... Social Network Global Map

Main Questions

The two questions are:

  • Can the W3C provide a forum to help existing widely deployed technical solutions become accessible, internationalized, and decentralized? Yes. Over 70 people have joined, including experts in the above areas.
  • Can the major vendors commit to a common set of best practices? Maybe. We have contact with Facebook, Google, Twitter, and Myspace, - so probably!
  • FOAF OAuth FOAF

    W3C Social Web Incubator Group

    How's a girl to choose?

    Eduserv funded myself to initiate the first foray of the W3C into standardizing the Social Web: The Social Web XG

    Totally public and encouraging individual participation, all work done on public list-serv and all meeting minutes public, most work done on wiki.

    Open Invited Expert policy: You still have to sign Royalty-Free agreements in order to edit the specifications.

    So YOU can get involved! Weekly talks with leading edge techology from outside the W3C as well as inside.

    Right now, over 70 members ranging from industry to academia to non-profit sector..

    With myself (supported by Eduserv) as W3C Staff Contact and co-chair with Dan Brickley (FOAF) and Daniel Appelquist (Vodafone).

    The W3C Royalty-Free Patent Policy

    troll One problem is without a patent policy we might inadvertently build a software patent into our standard.

    Having a patent in supposed open standard that companies unwittingly implement is an instant business plan for troll.

    For examples, see the conflict over XNS (now XRIs) in the W3C, which led to the development of the W3C's patent policy.

    Royalty-Free might discourage both large corporations (i.e. Microsoft) with huge numbers of patents from participating...but social data portability is only going to work if everyone comes to the table honestly and openly.

    Technologies to Know

    The Social Web XG is creating a framework to conceptualize the Social Web space.

    framework

    Identity: OpenID

    Log-in once. No more "I forgot more password and username"! openid

    OpenID is a way of a user "logging-in once" to a service provider and then having their log-in details be verified by a trusted identity provider.

    Your new OpenID username is a globally-unique URI:

    a href="http://openid.claimid.com/hhalpin">http://openid.claimid.com/hhalpin

    ClaimID gave me one...so can many others...

    Sound familiar?

    Tim Berners-Lee: "The AWWW says that everything of importance deserves a URI. Go ahead and give yourself a URI. You deserve it!"

    How does OpenID work?

  • Service Provider fetches HTML from User OpenID URI to discover identity provider.
  • 
    <html><head>
    <meta http-equiv="X-XRDS-Location" content="http://openid.claimid.com/hhalpin/xrds" />
    <link rel="openid.server" href="http://openid.claimid.com/server" />
    </head><body>
    <p>OpenID identity page for hhalpin</p>
    </body></html>
    
    
  • Establishes shared secret code with identity provider, using Diffie-Hellman key exchange.
  • Redirects the user to the identity provider
  • If user can log-in or is already logged in, the user is redirected back with their identity verified.
  • See this great OpenID tutorial, from which we took this list and other details: Just the start - AOL.com and Yahoo now has an OpenID for everyone of their users, and Mozilla and Microsoft have announced OpenID support.. Estimated 120 million OpenID users

    Go use your OpenID (list from LifeWiki)

    Identity: OAuth

    OAuth is a standard way for developers to offer their services via an API without forcing their users to expose their passwords or credentials. oauth

    Built in support for desktop applications, mobile devices, set-top boxes, and of course websites.

    OAuth prevents it by explicitly asking you if you want to let Facebook grab your details from the provider. While OpenID 2.0 providers (using OpenID Attribute Exchange) may hold general information about you (avatar photo, addresses, phone numbers) that it can with your consent to service providers so users don't have to re-enter profile details, it's not really extensible on a Web-scale or meant to compete with OAuth.

    Watch WRAP (based more on SSL) being more close on the horizon...

    Identity: XRDS-Simple and WebFinger

    XRDS

    Came from OASIS XRI committee, but luckily now seized by Eran Hammer-Lahav (Yahoo!). Used by OpenID 2.0, replacing YADIS.

    After all, how hard can it be to list a bunch of URIs and add some descriptions next to each one? The only issue is agreeing on some format that everyone can understand and implement. In developing a discovery protocol, we are trying to answer two questions:
    1. How to find information about a resource through its URI?
    2. What format is this information provided in?

    Provides a simple XML format to say "The resource identified by this URI can be contacted by a phone number, they have these other identities on social networks"

    You can then use WebFinger to contact people and look at their plans in a distributed fashion.

    Content: OpenSocial

    OpenSocial Different APIs done with Javascript and HTML:
    1. People and Friends (people and relationship information)
    2. Activities (publishing and accessing user activity information)
    3. Persistence (simple key-value pair data for server-free stateful applications)
    Currently does not work with W3C Widgets and Facebook Developer Platform, so we're working on sorting this out in the XG.

    Profile: PortableContacts

    diso logo Work primarily done at Plaxo, a contact company that has lots data...

    This API defines a neutral protocol for Consumers to request address book, profile, and friends-list information from service providers that matches what most social networking sites are together.

    Also specifies an XML and JSON-based address book format. Working on making compatible with FOAF.

    Builds on top of vCard, works with OAuth, XRDS-Simple, OpenSocial...