be Groovie

Where’s Single Sign-On? Part 2

In a recent Wired article regarding One Login, reference is made to a new social style network called GoingOn. The article spends most of its time focusing on one site that hopes to aggregate functionality that currently is split between Blogger, Flickr, Friendster, and Bloglines (for the most part). However, the thing it misses is what I previously discussed regarding the lack of a working distributed identity system.

After looking around more, I’m happy to say there are indeed working identity systems out there. Unfortunately the most promised of them, the Liberty Alliance doesn’t seem to have much oomph behind it, but two others that I previously didn’t know about are now out there.

The first is from the folks at Microsoft, which they’ve called an Identity Meta-System (or something like that), which is described over at vnunet. It seems to be rather tied (or at least integrated heavily) to Microsoft technology (go figure!), and will be included in Indigo and other various Micrsoft technologies. As a mainly open-source coder, this has little appeal to me, nor am I about to start using Microsoft API’s to write my websites and web code. The standards utilized by Microsoft for their Federated Identity are generally known as WS-* for some reason I’m too lazy to investigate.

The second is much more appealing (to interested users and web developers), and has actually been around for a very long time in a primitive form (2000 is ancient by web standards). The home site appears to be the identity commons, and the current sole Identity Broker is 2idi, the organization behind the standards is XDI. They’ve made the entire code-base they run the Identity Broker on, open-source under the Affero General Public License to ensure that users are never locked into just one Identity Broker (Yea!).

If you’re curious how the Microsoft and Liberty Alliance methodology differs, idcommons has a useful FAQ addressing the differences.

The most exciting aspect for me, is that all the technology behind the XDI approach is completely open-source, and geared towards maximum user flexibility and empowerment. The user gets to move data between Identity Brokers, and every care has been made to ensure the user is never locked into a single Identity Broker. Actually, the most exciting part, is that it works right now. :)

They’re currently preparing to switch to a SAML-2.0 backed code-base, however the code they have only works from PHP, Java, and Perl. If you want to try it out, here’s how to get an i-Name, and you can try it out on those two sites. Also, a developer made a ISSO (I-name Single Sign-On) authentication system for WordPress which is pretty cool.

So what’s stopping ISSO from being used on more websites? It’s free, its open-source, its standards based, its not controlled by a commercial corporation….

It needs Python libraries!

I should mention, when I first wrote this as far as I knew, there was no Ruby version. There still isn’t a public one, but Victor Grey is fairly close to a Ruby version with a full Rails rig to go with it which I’m rather looking forward to.

Anyone want to help? I’m tired of remembering a zillion usernames and passwords, and with ISSO on the horizon I shouldn’t need to, all the Python web frameworks will be a bit better (at least the sites that use usernames/passwords) with an easy way to use ISSO.

By the way, for a useful overview of SAML, there’s a very detailed write-up of SAML2 on xml.com.

Fragmenting A Framework Userbase

I’ve been thinking a lot lately about web programmers and the web frameworks they choose, or don’t choose, and why. I’m mainly going to talk about Python Web Frameworks as the majority of them have small communites, and possible reasons this could be.

I only started using Python for web development about a year ago, and it took me about a month to settle down on a web framework. In that time, I looked over at least a dozen different frameworks. There’s so many python web frameworks, quite a few people have actually setup entire pages and sections of their site just to covering them all.

I think part of the reason for the proliferation of frameworks is because of the nature of many Python programmers, as I briefly mentioned in a prior post on Making Decisions for Others.

The recent appearence of Django on the Python web framework scene I’m sure has quite a few other Python web framework developers wondering, “Why isn’t the web framework I made getting this much attention and use?”

A Common Base

Many of these same people would like to blame it on hype and good marketing. While that will certaainly boost initial usage, I don’t believe it will create a lasting user base. I think a huge driving factor behind Rails and Django, besides for the hype and marketing, is the fact that both of them make a lot of decisions for you. These decisions start the users all off at a common base of understanding.

The linear progression from:

1. Never used the framework
2. Wrote the tutorial app
3. Wrote their own basic webapp
4. Wrote an advanced web application

Makes it easy for people a step or two up, to help other new users join them. Because the steps they all take are the same steps to achieve greater understanding of the web framework, they can easily help new users get to where they are. Most, if not all the other Python web frameworks I’ve seen are so flexible its hard to have a common base of understanding amongst new users. The process looks more like this:

1. Never used the framework
2. Researched the frameworks options and choices to find a possible starting point
3. Wrote a basic web application using method X
4. Wrote an advanced web app using method X

The flexibility of the web framework becomes an obstacle to a strong user-base in this case, as it fragments the users by the methodology they’re using to build their webapp. It also reduces the common re-usable components available, since different users will utilize different options of the framework and have possibly very different starting points.

Have a Tutorial Application

Also lacking from many Python web frameworks is a clear and obvious Tutorial application. Ideally the front page of a Python web framework should be an obvious path to become an experienced user of said framework. Such as:

1. Install the framework
2. Write a basic tutorial application
3. Look here/there for instruction as need to write your own more complex application

A good tutorial should leave a user feeling confident that they know how to install and start with a common base for writing their own web applications. It’s also amazing how many problems people can have just getting a framework installed and running in a minimal configuration. Having a tutorial that leaves them with a functioning web application gives them a big leap forward.

Since many users will do the first tutorial web application, other new users can give help to even newer users that run into a problem. This is where the common base effect really provides some power.

Methods of Fragmentation

The Python frameworks I’ve tried and used have fragmented their starting points and users in various ways. All of them as a result of their “flexibility and power”. Here are a few common trends of fragmentation I’ve seen:

• Let the user choose various template language schemes (Use ZPT, or Cheetah, or…)
• Let the user choose from web paradigm (MVC, page-driven, pipelined…)
• No base or example configuration for a fully working webapp (So everyone sets up their first application slightly differently)

The last one I listed, is probably the easiest to solve, especially with useful web framework template creators like Python Paste. Obviously, removing the first two will be seen by many Python web framework developers as undesirable. I think it’d really help the users though, as it gives them more in common with each other. If they all use the same paradigm, and the same template language with your framework, their ability to help each other increases and they feel confident they made the “right” choice as well.

Assumptions

I’ve assumed for the purpose of this post, that Python web framework makers are interested in having a large user-base. This isn’t always the case, I’m sure some just want a small, very experienced user-base that isn’t going to be asking basic questions like, “I can’t connect to my database like you show in the tutorial”.

I can understand that, but for the other Python web framework makers out there, try and consider some of the things I mentioned. There are a lot of Python coders out there, and a lot of them can live without having 4 template language choices and 2 different design paradigms. So when adding that feature that’d let people get so much “power and flexibility”, will it fragment your user-base?

Web Design for Programmers?

Designing web pages is a pretty annoying task for most web programmers I’ve met, including myself. I’ll be first to admit it, I’m not too hot when it comes to web design. I haven’t even bothered changing the default theme for the blog engine I’m using.

What would be really slick is a sort of Web Design for Programmers book, ala Joel’s User Interface Design for Programmers writings and book. I’ve read quite a few books on web design that try to go over basics, but in the end for some reason it always feels like as a programmer, I’m missing those creative juices that result in an unique and interesting website.

There’s a fairly nice series with this exact title over at PeachPit.com that goes over some of the fundamentals. What I think would be ideal, is a website entirely devoted to this topic, with examples and layouts that are good starting points for your own web projects.

I searched around on Google quite a bit, and only came up with the PeachPit articles I cited above. A List Apart is a rather nice site to learn specific web design techniques, but doesn’t really focus on application of the techniques as related to the website on the whole. This part is left up to the designer, which doesn’t help a programmer much.

Having a beautiful website, or even just an aesthetically pleasing one can make a big difference even to other programmers, whether they want to acknowledge it or not. One of the clearest examples of this I’ve seen is with web frameworks and toolkits. A great looking website can get people into a toolkit/framework that might’ve otherwise moved onto a site that looked more “interesting”.

Language Specific Comparisons

I’ve read quite a bit of Paul Graham’s articles regarding Lisp, how awesome Lisp is, how much of a dufus one might be for using a language programmed for dufuses.

Now, before I start, I should mention that these posts are quite old, and I don’t really want to start a flame fest over this again. However, I couldn’t help but notice today with a problem I had in my code, how easy Python made the solution (Zach points out the Lisp solution is quite succinct as well).

Without a doubt, Lisp excels at recursion, function/code generation, and closures. This frequently leaves Lisp looking like a god when you see how many lines of code other languages take to replicate the examples Paul chooses to compare (which always revolve around the things Lisp excels at as Paul Prescod points out)

Today, I came across a fairly common case, where I had a function taking keyword arguments and collecting them all. That would look like this in Python:

def somefunc(**kargs):

Now, if I want to take two of those keyword being passed in, and set some defaults so they’re not required but will always have something set in the function body, its rather easy:

def somefunc(keyone='default', keytwo='anotherdefault', **kargs):

So in one line, I have now added two defaults that will be available in my function body for use. How succinct is this in Lisp? What about in Ruby?

I cite two languages that came off very well in the Accumulator Generator shoot-off. They Ruby doesn’t do quite as well in this case, which I’ve actually encountered far more than the code generation cases Graham is apt to cite. (I actually like Ruby and am now using it quite a bit, I’ll be quite happy when it has keyword args)

What’s even worse is where in this thread that I referenced above, Graham at the end says he has no clue how one would create a basic class to handle accumulation in Lisp. I find that rather disturbing that something so easy in Python has Graham saying, “God only knows.” how to do it in Common Lisp Richard points out below that this is because PaulG is rather keen on macros, and not so big on OO. That makes complete sense to me as Lisp did not start out with OO features, those were added later when it was all the rage. When working in an elegant functional language like Lisp I can see why one would never have to consider OO.

That alone should indicate that many technical comparisons between languages can be easily skewed towards a language by using examples that heavily favor built-in abilities of the language one chooses to boast about.

In the end, I’m left with the belief that different languages have different applications. Claiming one language is the be-all, and is always better for any task is about as false as claiming that a language has no problems or issues.

Within certain realms it does make sense to compare languages, scripting vs scripting, functional vs functional, etc. But leaping to a comparison of functional/dynamic-typed vs non-functional/static-typed is typically going to result in some strange claims.

Anyways, if you feel like commenting, try and come up with an example of where Language X (that you use) has a very succinct solution compared to Language Z (all the others). It’d be great to compare some examples and see areas in which different languages fall flat on their face when it comes to succinctness. (Ie, in most dynamic languages, you’d have to add several lines of code to ensure variables are the type you want. A feature/annoyance of static-typed languages)

Update: An anonymous user kindly informs me that there’s no foundation for my claim that some languages are better in certain realms than others, unfortunately the anonymous user fails to say why.

Ruby has no keyword arguments currently (Ruby 2 will have them and keyword collectors ** as Python does). To even approximate my Python example in Ruby, you’d first need to declare the argument as optional which has the side effect of packaging it into an Array. Wheras in Python **kargs packages up the rest of the key/vals under a dictionary. If someone would like to write out the full translation in Ruby, I’d be happy to put it up here, but I doubt its going to be pretty (until Ruby 2).

Zach was helpful and provided an example showing that the specific task I cited is fairly short in Lisp as well, looking like this:

(defun somefunc (&rest kwargs
                 &key (keyone "default") (keytwo "anotherdefault")
                 &allow-other-keys)
                 ; ...
                 )

I would like to make it very clear that my point is not that Python is better, but that technical comparisons can be warped to favor certain languages. This is the same point Paul Prescod makes, and what I’d actually like to see is more technical comparisons that make this point obvious.

Where’s Single Sign-On??

Really. I mean it. Where’s Single Sign-On?

Liberty Allienace was started 4 years ago to provide a competing alternative to Microsoft’s Passport. It’s taken Liberty Alliance years to get to any sort of usable starting point, while Microsoft has actually had developer code out there and usable since 2001. I’ve even toyed with some Passport login code in Perl 4 years ago.

Since that time, Passport is used rarely if ever on the web, and the Liberty Alliance has tons of docs to show, implementation specs, and even a Java toolkit for Liberty Alliance. Yet I don’t see many (or any?) websites using the federated login of Liberty Alliance. Where’s my single sign-on??

In the time of Web 2.0 a toolkit for the major scripting languages should exist. Why isn’t there one for PHP? Perl? Python? Rails? Has anyone done any calculations in how “good” a website or web service has to be before a user is ready to take the plunge to setup yet another username/password? This is an obstacle that gets in the way of a website having more members, and anyone in the business of getting members should want as few obstacles as possible.

I know I’m not even signing up or using some services purely because I can’t deal with yet another username/password to remember. I can’t even remember the ones I’m currently signed up for, so I have to use software that does password/site remembering for me, in my case Password Wallet.

So what are the supposed strenghts of web services/applications?

1. You don’t need to install any software
2. You don’t need to worry about upgrades
3. You can use it anywhere

Out of these, #3 is the one that has been lost nowadays thanks to a password/username program. I can’t get to any website I’ve registered on without my personal computer, because I can’t remember that many usernames and passwords. Some will say, “just use the same user/password everywhere”, and many people do. Even this doesn’t always work though, if someone else signed up using that username first.

It’s been FOUR YEARS since the big hub-bub over Microsoft Password and Liberty Alliance, and we still don’t have handy little toolkits in the most commonly used scripting languages to interact with them. I don’t know about you, but I find this pretty sad.

Technorati Doesn’t Know Your Username Either

Update: Technorati informs me that they’re working on fixing this problem.

So I figured I’d log into Technorati, update my profile tonight. Problem is, I apparently forgot my username. So I go to the login screen and don’t see anything about what to do if you forget your username. That’s ok, there’s a Lost Password link, that might help. Clicking the Lost Password brings you to a screen that lets you enter your username OR your email address to receive instructions to reset your password. (Still nothing about if you forget your username)

The email looks like this:

Greetings, !

	
We received a request to reset your Technorati password.

	
To create a new password, please visit this URL:

	
http://technorati.com/signup/lostpassword.html?r=

	
If the above link is not clickable, please copy and paste the link into your web browser.

	
Thank you for using Technorati.

How useful, clicking this link brings up a very clean, simplistic interface that lets you enter a new password and confirming that. Once you enter these two words and hit enter…. you get the same exact screen, only with the two fields empty .

Did it work? Did you change your password? No feedback whatsoever is given, except that if you try and do it again, you get an error….. which is even worse, because does this mean you did changed it or not?

Of course, at this point, lets remember the real issue is that I don’t remember my username. So I go back to the helpful screen asking me to enter my username OR email for password reset, and start guessing possible usernames I might’ve used (and for me, that could be quite a bit). Technorati helpfully returns an error screen until I finally enter a username that exists, at which point it tells me it sent the email.

Technorati, if you’re listening (they are), please fix this…

Podcasts replacing Radio?

Was listening to another Daily Source Code by Adam Curry today, it was an older show from a few days ago. I seem to have a love/hate relation to his show, on some days its really cool, and other days I’m tempted to hit un-subscribe.

This is partly because of the premise of Podcasts in general that I hear, and partly from the problems I see in Podcasting. If you haven’t listened to the Daily Source Code, its fairly good. It’s part informative (usually techie), part random mumbling about what happened to his shoulder today, and occasionally he plays some music.

One of the mantras I hear a lot, especially on this show, is how Podcasts are retaliation to the control and limits of the FCC. If Podcasts are going to challenge radio seriously, they need to effectively replace what so many people enjoy right now. The radio I’m referring to is full of music. Podcasts for the most part are full of talking.

Adam is well aware of this problem, and has helped (I’m not sure of the level of involvement) launched the podsafe music network. This is very very cool, and I look forward to when I’ll be able to get Podcasts that are 95% music, 3% ads (gotta have some way to fund the bandwidth), and 2% DJ’s telling you what you just heard (Even though it’ll be in the podcast shownotes).

I wonder what he’s doing to bring the major labels on board, and even the larger indie labels as they’ve already locked up a bunch of great talent that needs more exposure that radio just isn’t providing. The PMN is a great first step, and I can see its definitely aimed at getting artists interested in putting their stuff on it for more play.

In the end, I’m not even sure how much longer a potential market of significant size exists for Podcasts. The known market is people driving somewhere, typically to work (when I listen). The vast majority of Podcasts aren’t too hot on quality, typically have a poor script (if any), and don’t play any music that interests me. With the increasing subscriptions to XM and Sirius (both free of the FCC), and the coming of digital radio, Podcasts have quite a bit of competition for listeners.

While some people love hearing others talk or mashups (I’ll admit there’s some cool ones), will it be enough to reach the 100 million listener march?

Dissing Programming Langauges…

A friend recently brought to my attention that I seem to have a knack for insulting a language based on a quick overview without actually getting into it. After thinking about this awhile I’ve noticed it definitely seems to be more of a trend than I’d like.

The latest example of this was Ruby, but before that Python (Lisp before that). With each language, I’d find new things to nitpick on before really diving in (Which I always seemed to do anyways). As a result of this, I think its time for me to really grow up and stop picking on new languages till I’ve at least had the time to write a few apps in them and truly understand where they’re lacking.

As a quick side-note, here are the things I found to nitpick on before actually learning these languages:

• Objective-C: God, wtf is up with these [] all over the place?
• Lisp: God, wtf is up with these () all over the place?
• Python: God, wtf is up with these _____ all over the place, and who in their right mind uses white-space to designate blocks?
• Ruby: God, wtf is up with these {|| } things all over the place?

Obviously I had issues with syntax, I hope to have purged myself of these issues as of this writing. Remember, sometimes a language has a damn good reason to have crazy characters all over the place.