Speaking of Standards

As a “security guy“, I have been pleased to watch the emergence of the OAuth Working Group within the IETF and the work that is underway to create an actual IETF specification for OAuth. I haven’t had time to participate, but I’m glad to see that work going on.

If you aren’t aware of OAuth, it’s basically a way that you can authorize a application or service to interact with another application or service on your behalf without giving that first application or service your user ID and password for the second service or app.

For example, if you were a Twitter user in its earlier days, every time you wanted to use another application or web service with your Twitter account, you had to give that app or service your Twitter user ID and password. There’s a security issue here in that you are entrusting your credentials to some other company or application – and trusting that they won’t share those credentials. There’s also a configuration issue in that if you change your password you then have to go to all the other services and provide the updated info. Now, with OAuth support in Twitter, when you want to add a new service to interact with your Twitter account, you are prompted to login to your Twitter account and authorize or deny the access for the new service. The key point is that the new service or application never gets your Twitter credentials. (And as another example, OAuth is what our IMified service uses to allow an automated bot to interact with your Twitter account.)

Anyway, OAuth emerged out of the developer community and now there is work underway in the IETF to create official standard specifications to help in promoting OAuth implementation. As a first step, it was announced this week that OAuth 1.0 will be published as an Informational RFC. As noted in the announcement:

The OAuth protocol was originally created by a small community of web developers from a variety of websites and other Internet services, who wanted to solve the common problem of enabling delegated access to protected resources. The resulting OAuth protocol was stabilized at version 1.0 in October 2007, and revised in June 2009 (revision A) as

published at <http://oauth.net/core/1.0a>.

This specification provides an informational documentation of OAuth Core 1.0 Revision A, addressing several errata reported since that time,

as well as numerous editorial clarifications. While this specification is not an item of the IETF’s OAuth Working Group, which at the time of writing is working on an OAuth version that can be appropriate for publication on the standards track, it has been transferred to the IETF for change control by authors of the original work.

This first step will get a base level spec out so that people looking to implement OAuth will have an IETF specification they can use. The RFC hasn’t been published yet, but the draft that will be an RFC is here:

http://tools.ietf.org/html/draft-hammer-oauth

It’s good to see this work going on within the IETF and I look forward to seeing further work there. From my perspective, OAuth is a great step in helping secure connections betweens apps and services over the web… which is good for all of us as more and more moves into the cloud.

---

If you found this post interesting or helpful, please consider either subscribing via RSS, becoming a fan on Facebook, or following us on Twitter.

---

This week in New York City, Tim O’Reilly gave a keynote at the Web 2.0 event that I definitely put in my “must-see” category. Not because of anything visual… I mean, it’s just Tim standing on stage talking… but because of his message.

There is a war on out there on the Internet.

It’s a war between those who would like to keep the Internet as the open platform for innovation that it has been for decades… those who champion “The Internet Way” – and those who would like to return the Internet to the world of walled gardens from which it emerged. In his excellent piece published on Monday, “The War For The Web“, Tim speaks of the sides as “Small Pieces, Loosely Joined” and, of course, “One Ring To Rule Them All”. He concludes with:

It could be that everyone will figure out how to play nicely with each other, and we’ll see a continuation of the interoperable web model we’ve enjoyed for the past two decades. But I’m betting that things are going to get ugly. We’re heading into a war for control of the web. And in the end, it’s more than that, it’s a war against the web as an interoperable platform. Instead, we’re facing the prospect of Facebook as the platform, Apple as the platform, Google as the platform, Amazon as the platform, where big companies slug it out until one is king of the hill.

And it’s time for developers to take a stand. If you don’t want a repeat of the PC era, place your bets now on open systems. Don’t wait till it’s too late.

This IS the battle that will frame the Internet in the next years. As I wrote a few months ago in ‘Of DDoSs and SPOFs: How Twitter and Facebook violate “The Internet Way”‘, the way of the Internet is to use “distributed and decentralized” services. That’s how email works… that’s how the “web” works… that’s what excites me about the promise of Google Wave – not just that it’s a great platform for collaboration (and as I show here, it is), but that the Wave protocol has been designed from the start to be about federation… to be about distributed and decentralized services.

This war is a large part of why I work here at Voxeo, where one of our core values is “Unlocked Communications“, where we are huge believer in open standards (and chair/co-chair many of the standards committees), where we do things like open source our Tropo cloud telephony platform (“The Cloud Must Be Open!”) and where, in contrast to Nuance and TellMe as Tim mentions at 13:22, we give away our speech recognition engine for free as part of our Prophecy IVR/application platform… that’s why I’m here at Voxeo. It’s a war for openness that I believe we must win!

But listen to Tim… and then ask yourself – which side of the war are you on?

---

If you found this post interesting or helpful, please consider either subscribing via RSS, becoming a fan on Facebook, or following us on Twitter.

---