OAuth 2.0

Posted on May 20, 2010

I’ve been updating my OAuth library to support OAuth 2.0 mostly so I can add Facebook to Announce.ly and Sproozi, but more on that later. OAuth 2.0 is similar to 1.0 but changes a few key things fundamentally and isn’t backwards compatible.

What’s wrong with 1.0, doesn’t it work?

It does, but probably the biggest issue is the fact that you have to sign the message knowing all it’s content beforehand. This works well if the data is on the querystring in a GET request or for simple operations but isn’t optimal if your data is part of the POST body. It also means you have to construct your requests in a certain way, which is a bad thing.

Take photo, audio or video data – to post that you’ll need to sign the whole request and it’s not clear how it should work with multipart data. There are several extensions to the spec that deal with some of these issues, but the fact that there are non standard extensions to do something pretty standard kinda says it all.

Even if you’re not dealing with these issues you still have to work with your requests as units where you know the whole content beforehand.

What’s new in OAuth 2?

OAuth 2.0 in it’s simplest form works over HTTPS connections and simply asks for a token – the security and trust are built in to the protocol. It’s that easy.

OAuth 2.0 sill lets users sign messages to transmit them over insecure channels, plain HTTP, but the signing methods are much easier to implement. Gone is the complicated parameter normalisation algorithm and in it’s place is a much simpler version that doesn’t require POST data in the signature. So even with multipart submissions it should just work.

At the moment I’m cleaning things up and preparing the oauth library to work with oauth 2.0 and changing the way it works to reflect the simpler way oauth 2.0 does. You can check it out on GitHub [http://github.com/andrewmccall/oauth]

Another Open Source Library.

Posted on April 6, 2010

I’m having a bit of a clear out, taking a look at some of the code I’ve written and I’ve been pushing some of the stuff I’m currently using up to GitHub under and Apache 2 licence. I’ve used things in Announce.ly, Sproozi and some other small projects and figure they may be useful to someone else. My only criteria has been to ask If I’m using it now in a project, if so I’m actively supporting it and I’ve started pushing that stuff to GitHub, everything else is dormant and I don’t want to release something I’m not actively supporting- it also occurs to me that if even I’m not using it, it can’t be all that worthwhile.

I’ve just pushed some code I’ve been testing for a few months in a couple of projects to GitHub. It’s an accounts package written for Spring, that ties my oAuth library and Twitter together with either Hibernate or Hbase as backend storage. In it’s simplest form when you login with twitter it creates you a new user and persists it and the oAuth access tokens you need to act on behalf of that user.

I’ll write some more about it, better documentation and probably throw a little more code up on GitHub over the course of the next couple of weeks as and when I get a chance.

Signups via twitter API

Posted on December 7, 2009

This is possibly big news, something I’ve hoped they would do for a long time and something Fred Wilson voiced his support for a few weeks ago: Creating user accounts via the twitter API.

Both the projects I’m working on full time could benefit from this. Sproozi of course because we could create user accounts for them and help users find interesting local people to follow. My oft promised side project which at it’s most basic level [the one I'll launch first] aims to make making announcements easier could benefit by making the signup process seamless – users wouldn’t have to already have to have a twitter account, they could create it all in one step with us.

That I think is what makes this such big news, sites that rely on users already having a twitter account to do something useful will be able to create that account as a seamless on site process. That will help drive users to the sites and drive users to twitter. Let’s hope they start rolling it out to other developers!

Related articles by Zemanta

• Twitter Extends Sign-Ups Off-Site As It Seeks New Users (mashable.com)

Twitter Spam, is it really an issue?

Posted on January 28, 2009

Andrew Hyde posted “A Message to Twitter Spammers” suggesting that something needed to be done, but does it really? In my comments to his post I asked if it was really necessary for Twitter to go that far, and weather it was really a problem at all. 

I’m not sure they need to go so far as to ban users that do it. As twitter grows communities are going to form around the speakers that have the most to offer. If the people mass following then unfollowing have nothing to say eventually their followers are going to move on.

The problem I have with wanting Twitter to do something about this is that it seems to me to be an argument by people who feel like they’ve earned their following against people they feel haven’t. An argument you could interpret at elitst and at it’s most base level it’s just users upset that they’re now having to deal with their 

Now I’m not suggesting for a second that Andrew Hyde or anyone else is churlish, childish or elitist. I wouldn’t follow him either on Twitter or his blog if I though so. I think it’s far more likely that most users are just seeing an increase in people following them as Twitter becomes more and more mainstream. They’re also seeing a lot of followers who are plainly gaming the system to inflate their perceived influence; dealing with that on a daily basis is frustrating , I’m sure.

In my comment I tried to make the point that all these users were gaining a thin perception that at a glance they matter. But that I don’t think it makes any real difference and I don’t think it’s worth wasting time lobbying for change because these users really aren’t building a following at all. Despite what the numbers may indicate.

I don’t see an audience on twitter as being any different from an audience anywhere. Any idiot can get one, just walk into a crowded room and start shouting. Keeping them is what matters. An audience that isn’t engaged or doesn’t care, doesn’t matter.

I could show up in the houses of parliament and shout my message out at MPs, get on the news in the process and have it heard by hundreds, even thousands of people of influence – but they’d label my message the ravings of a lunatic and even if they were amused would quickly move on with their lives. 

Nothing twitter can do will stop the type of people that only care about the number of people listening to them from caring about that. What might be better is if tools like http://twitter.grader.com gave weight to the longevity of your engagement with a follower and took churn rates into account. These are in my mind more important numbers for the people that want to measure things to pay attention to. In my mind someone who is steadily gaining and keeping followers at the rate of one a day has a far more compelling message than someone getting a thousand and losing half within a week.

The solution is to focus on numbers that matter, if you’re going to focus on them at all, and the key to any social network or service is to care about how engaged your are with that network. High proportionate churn rates are a pretty clear indication that users are not engaged and if they’re not engaged, they’re not listening.

I’m not part of the twitter elite, my opinion doesn’t really matter. If someone follows me I tend to follow them back, but since I’m not a person of any great influence I probably don’t get quite the level of requests some do. I’m doing my best to follow people interesting and working in similar fields, to me some level of engagement with a hundred followers would be better than shouting at ten thousand.