A world of social login

We've known for years that passwords are bad.

They're bad for users because they tend to use the same weak password across multiple sites which means they're only as safe as the least secure site they use. They're bad for developers because the sign-up process loses a large portion of potential users. They also force every developer to jump through all the steps required for a world-class identity system:

• multi-factor authentication
• the forgot password dance
• a salted and hashed password database
• etc.

Despite all this, passwords and the password anti-pattern are still prevalent.

Social login isn't a panacea but in the long run the only viable solution is delegating authentication to a small set of high quality identity providers. It has to be a small set to avoid the damage to conversion rates caused by the NASCAR problem. They will be high quality since the market is so competitive that low quality providers (where quality is a measure of the experience/value provided to users, developers and publishers) will find it hard to acquire and retain users. The market will be competitive simply because various entities have realised that social login is the backbone of any successful ecosystem so they're making the necessary investments.

This is sub-optimal but the OpenId dream (where every user runs their own server and their own OpenID endpoint) ran aground on the twin rocks of user apathy and security. Even if the dream had survived that it still didn't have a good answer to the major publishers who wanted to know what they would be getting in return for the extra effort of supporting OpenID. If you think OpenID Attribute Exchange and PAPE are solutions then you may be wearing the complicator's gloves.

The only questions left are:

• who will be these identity providers
• what will be their business models
• how will we assess and choose between them
• how will we keep them honest
• how much control do they give users
• do they help developers build better and more valuable services as time passes
• will they become gatekeepers that constrain future innovations

This moves us to a world where users authorise developers rather than particular apps or web sites. As a result once you give a developer access to your information you give all of their services and apps access to your information. Technologies like OAuth2's bearer tokens mean that developers can easily pass access to a user's information back and forth between their mobile apps and their back-end systems.

In this new world developers will have to deal with multiple competing identity providers who each impose their own constraints and policies in order to protect their users. As a result developers will have to start thinking in a more sophisticated way about the way they propagate identity between their different systems, track the provenance of user data and honour the conflicting policies imposed by multiple identity providers. They'll also need more nuanced terminology. It won't be enough to think solely in such crude terms as "public" versus "private". Developers will also have to be aware of the subtle distinctions between "obscure" versus "secret" and "public" versus "publicised".

In return we get a world of social login where you bring your identity, your interests and your community to every app, service and device rather than just the ones built by identity providers with unified privacy policies.

The Google+ Sharelink Endpoint: doing it right

If your site has a Google+ sharing feature that uses this URL: https://plusone.google.com/_/+1/confirm?url= then you're doing it wrong. You're using unsupported and undocumented functionality. Don't.

You should be using a sharing URL that looks like this: https://plus.google.com/share?url=

That's our official sharelink endpoint. It is supported, monitored and maintained. The URL you're using right now is an internal part of our +1 button's Javascript API so it's subject to change because we don't expect anyone else to be depending on it.

The documentation for the sharelink endpoint is here: https://developers.google.com/+/plugins/share/#sharelink-endpoint It even offers a set of standard graphics that you should be using for consistency with the rest of the web.

In short: don't be like the guy in the photo below.

The other side of creating more value than you capture

+Tim O'Reilly likes to talk about "creating more value than you capture." The obvious logical alternative to this is "capture more value than you create."

However I suspect that this is a false dichotomy.  I think we've missed something. It's possible for a vendor to create more value than they capture and yet, by building a new network, ensure that the surplus value eventually flows back to them. This ends up primarily magnifying the value of their network rather than the wider web. 

For instance a post on Tumblr is easier to reblog, if you have a Tumblr account, than to re-post elsewhere. It's easier to 'follow' a tumblr than to subscribe to the RSS/Atom feed for that same tumblr. Tumblr's bookmarklet makes sharing to your tumblr easier than cutting and pasting it elsewhere.  By building proprietary solutions that have a better user experience than the open solutions, Tumblr created a situation where sensible people act in ways that keep them inside the Tumblr network. This is more like a gated community than a walled garden precisely because the members of this network made an informed choice and are happy with the consequences of being inside it.

The hidden assumption in Tim O'Reilly's thinking was that the network that would primarily benefit from all this surplus value was the web. But it turns out that large social networks and large blogging networks and other sites that host large numbers of activity streams are the primary beneficiaries. We can see this in Tim O'Reilly's examples from his original presentation which primarily focusses on Twitter and the benefits for Twitter users. At the time making a distinction between Twitter and the wider web would have seemed nonsensical. 

Today we realise that creators go where they can reap value and that's increasingly in networks (like Twitter, Tumblr, LinkedIn's Influencer platform, Google+, Medium, Instagram, etc) which can help them easily discover a community that cares deeply about their creations. We also realise that the necessary walls (which take the form of privacy controls and API restrictions) between these networks and the wider web means the networks can benefit from Reed's Law and grow their value in proportion to the number of such communities that are formed rather than just the number of users. 

Every creator and their audience forms a new community where value can be created and captured. Some of these communities may even be generative. They may be creating more value than they capture. So where is that value flowing?

If you own a network where people create more value than they capture then most of that surplus value flows to you rather than to the wider web. The challenge for the owners of these networks is to invest that surplus value back into the wider web in the hope that they'll reap even more surplus value in the future. The challenge for those who believe in the virtues of the wider web is to show these network owners how they can contribute to and benefit from the wider web.

Grouped & Creative Mischief

Reading Grouped and Creative Mischief at the same time made me realise that there are two main strands of thought about the future of advertising, marketing and media. They see the same phenomena but explain them with different stories.

Tyler Cowen would be proud of the sets of stories that these books tell as they project the world-views of their authors. The stories are too neat, too unambiguous and too polished to be true. However they're still educational. The difference in these two books is in the set of lessons they wish to teach us.

One book wants us to believe that the web is being rebuilt around people. Unfortunately its examples all come from one source so after a while you start to suspect he means the web is being rebuilt around Facebook. Grouped is about the benefits of homophily (being with people like you), about websites that use social proof to show their value and websites that use data from your friends to provide better services to you.

The other book wants you to believe that success in advertising (or anything else) is about your willingness to do the things that other people won't or can't. That may mean thinking thoughts others are afraid to think, seeking inspiration away from your peers and giving someone "the right answer even though you know he doesn't want it."

In Creative Mischief Dave Trott tries to teach the reader that "to be noticed, we need to do something different. To be different, we need to break the rules. To get away with breaking the rules, we need to be clever." In Trott's world "what seemed to be facts were only true if I subscribed to it being that way" and "the rules are meant to be a spring board, not a straitjacket."

His short book walks the reader through the last 4 decades of his escapades and his experiences in the advertising industry. It's fun and cheeky and insightful. It's also lacking in empirical data or research to back up his anecdotes. Adams, on the other hand, has all the data and the citations you could want.

The dichotomy between these differing viewpoints was summarised as Mad Men versus Math Men in a recent article. I think it captures something important about the gulf between researchers and storytellers. Storytellers believe it's more important to be inspiring than to be right. Most researchers disagree. Paul Adams is one of the few that sees the value of the storyteller's mode of communication. At the same time I think there's a dichotomy between a homophilous and a heterophilous view of the world.

In Adams's view we want to be nudged into making the same decisions as our close friends and families. He rejects the conventional marketer's search for influencers and tastemakers who can move the masses because

"even when there are influential people and specific situations where they can wield great influence over many others, finding them is so expensive that it becomes a poor investment compared to other available strategies."

This is a world where 'social proof' is the most important thing. This is a world where "we’re only connected to people like us" so "it’s hard for ideas to pass between groups who are separated by dimensions like race, income, and education."



In Trott's view we want to be guided into making decisions that separate us from the herd. This is a world where every appeal to the wisdom of the crowd is countered by citing the danger of pluralistic ignorance.

I much prefer Trott's world because I believe the most valuable relationships are created by the differences between us rather than our similarities. In fact I've been maintaining a Tumblr devoted to the idea of heterophily for a while. I believe heterophily is one of the key ingredients in creating groups that are creative, fulfilling and productive. Despite this I still have to acknowledge that Adams's book is the one you should read if you're interested in improving the performance of your marketing campaigns or understanding the incipient social web. However Trott's book is the one you should read if you want to dream of a better and more interesting world.

 

Implications of being post-PC

At last night's OSJam I gave a lightning talk about the implications of being post-PC.

Those implications were:
Identity: a post-PC device needs to know its owner's identity since it can't rely on obtaining that information from a PC. At the moment all the devices are building their own identity platforms but eventually they'll start to take advantage of existing identity systems like Webfinger and PGP.

Personalisation: a post-PC device can be uniquely personalised because it's not predicated on the idea that it will be a shared device. The classic example is the experience when you buy a Kindle from Amazon. It will be preconfigured with your name and the books you've already bought. It's a small step from there to a future where the moment I bought a device in a shop it would automatically know that it belonged to me.



Cloud: post-PC devices tend to be heavily dependent on the cloud in order to store persistent state and to perform sophisticated processing. The definition of the cloud that this implies comes from Simon Meacham. He says that the cloud means treating the union of all those servers/networks/services as if they were one machine available to be used by everybody. In this vision the physical devices we own are merely portals to and caches for this metaphorical "one machine."

Mobility: if our data and services live in this cloud then all the devices I can log in to are equivalent. At this point the ability to take a device to the place I wish to use it (for instance the Kindle screen is supremely legible in bright sunlight unlike the screens of most mobile phones) and the fact a given device is ready-to-hand will trump all other considerations. Photographers have long had a saying "the best camera is the one you have with you" and the rest of the world will soon experience something similar.

Devices: new kinds of devices become possible, if not inevitable, in a post-PC future. Technology will migrate to the most convenient form and place in your life. That means computers, cameras and music players will start becoming features of watches, jewelry and clothing. That's partly because people actually like their watches, jewelry and clothing whilst they mostly tolerate their computers. The early examples of this are Nike+ and the increasing variety of smart watches. In fact several of the people attending OSJam were wearing the precursors of the smart watches of the future. Furthermore once people stop expecting technology to be delivered to them in a beige box it opens the doors to new innovators such as Arduino enthusiasts and the open source hardware community.

From OSJam 19 - Post-PC: gadgets of the now

Personal Area Networks: The logical culmination of this is the personal cloud or personal area network. This is not merely a network of devices that are physically close to one person. Instead it is a network of devices that are geographically distributed but which can connect to each other (via a variety of networks and protocols including the internet, wifi and bluetooth) and prove that they belong to the same person. The devices are tied together by the fact that they belong to a single person and therefore they can seamlessly share each other's functionality.

These are merely my guesses about what's likely to happen as a consequence of these post-PC devices. Ultimately Alan Kay is right: the only way to predict the future is to invent it.

Quadriga

What is Developer Experience?

Developer Experience (#devexp) is an aspirational movement that seeks to apply the techniques of User Experience (UX) professionals to the tools and services that we offer to developers. Developer Experience can be boiled down to 4 main ideas.

1. Apply UX techniques to developer-facing products.

These techniques and ideas include:

• Personas
• Lo-fi prototyping and sketching
• Usability testing by watching people try to use your products without interfering so that you can get a realistic understanding of how people will actually respond. Some companies set up usability labs or run hackathons in order to get this kind of data.
• A wider range of techniques from UX research practitioners
• GOMS

2. Focus on the '5 minute Out Of Box experience'

The idea here is that if you provide a library, developers should be able to go from downloading to "Hello World" in 5 minutes. You should test this with a stopwatch or even a screencast to prove this is possible. Ideally they should then be able to take the code from this 5 minute experience and evolve it as their requirements grow in sophistication without having to start over. Making a library that supports the same user from unsure novice to sophisticated expert is hard but pays off in terms of increased adoption and fewer questions on the mailing list.

3. Use convention over configuration

This was most clearly stated by the Ruby On Rails community but is rooted in a simple insight. When someone first starts using your API or library they have the least knowledge so that's the worst time to ask them to make lots of complicated decisions with far-reaching implications. This is why you, the developer of the library or API, should make the initial decisions for them by establishing conventions that can be overridden with configuration options.

4. Try to "design away" common problems rather than documenting workarounds

For instance if your users struggle with getting OAuth working then create abstractions that handle it for them rather than documenting the 6 most common problems or writing up the 'simple 12 step process' for getting it working.

This is inspired by Don Norman's work on perceived affordances which says that things should be designed in ways that immediately suggest how you should use them. If you walk up to a door it should be obvious without reading any signs, whether you should pull, push or slide the door to open it. If the door needs to be documented with a sign then it was badly designed.

This theory of affordances applies just as well to developer tools and APIs. They should be designed to have affordances that encourage correct usage rather than documented to make up for deficiencies in usability.

---

The phrase (developer experience) and the hashtag (#devexp) comes from Michael Mahemoff but it's not a new idea. Its roots are in ideas and practices such as:

• Microsoft's usage of developer personas
• David Heinemeier Hansson's usage of screencasts to announce the Ruby On Rails framework and to show off the smoothness of their Out-Of-Box-Experience.
• The Ruby community's widespread application of convention over configuration
• Nat Pryce's OSJam presentation based on the insight that "programmers are people too"
• Jeff Atwood's 2005 blog post stating that "developers are users too."
  
• Steven Clarke's research and blog on the experiences developers have with development tools and frameworks.
• Josh Bloch's work on the impact of good API design
• My session at O'Reilly's Open Web Foo conference about "making APIs usable"
• Pamela Fox's crowd-sourced survey on the elements of a positive developer experience

It's a set of ideas we would like to see more people, projects and companies adopt. We don't claim to be paragons and we're looking to learn from other people's examples.

That's why we've set up http://developerexperience.org/
We hope to use it to point to examples of great developer experiences as well as aggregating relevant tweets using the #devexp hashtag.

Please join us. You can start by using the tag "devexp" whenever and whereever you write about developer experience. Over time this will help us build up a body of knowledge that will do for developers what UX has done for users.

---

Add comments on Buzz