It’s a very vibrant space right now, with commercial vendors, open source projects, trends, and standards all vying for attention. I’m thinking here of a couple of overlapping categories:

OpenID

A standard, for which there are good open source libraries, but also commercial providers. Increasingly I’m seeing OpenID as one service (often the anchor service) provided as part of a suite. Of course the traditional mainstream web players like LiveJournal, WordPress.com, Yahoo! and AOL (through AIM) are providing OpenIDs as well.

Lifestream and Profile Aggregation

More social networks == more profiles, and more feeds. A number of services/projects have sprung up (I talk about a few below, but there are many others as well) which enable you to aggregate together all of your profiles in a single place. Some are more focused on aggregating all of your feeds – creating your lifestream and letting others subscribe to it; others are focused on aggregating the feeds of your friends, to make it easier for you to follow.

The Data Portability Project, Open Web Foundation, Open Social Foundation, Autonomo.us

These foundations are not focused (directly) on producing software, but on building awareness of and consensus about the need for user freedom on the internet, and publishing open specifications which will lead to a world in which our online identities and data streams can be more easily managed, exchanged, and even migrated from provider to provider.

It would really be a full-time job to keep track of all that is going on in this space, but here are a few I’ve been following / trying out.

Chi.mp

Chi.mp enables each user to create their own domain in the .mp TLD space. You can check out mine at johneckman.mp. Chi.mp provides OpenID, but doesn’t (yet) consume it. (I can use johneckman.mp as an OpenID to log in to other sites, but I can’t login to chi.mp with an OpenID from elsewhere).

Chi.mp also supports a number of services (currently Twitter, Facebook, Flickr, Gmail, Yahoo (mail), and Hotmail). For those which provide activity feeds, chi.mp will pull those feeds into your profile (viewable by others) and dashboard (viewable only by you). There’s also a generic RSS feed import capability, for services (like personal blogs) that Chi.mp doesn’t know.

Finally, Chi.mp also supports your social graph – your friends lists or contacts lists from various services can be imported – from webmail services like gmail and hotmail but also from services like Twitter, Facebook, and Flickr which have contacts or friends exposed via an API.

It’s very highly configurable, in terms of who can see what. You can tag contacts, and tag feeds, and use tags to determine visibility of feeds to groups of contacts. I haven’t yet really figured out what else Chi.mp will be able to do with webmail services – I don’t think I will ever want emails I send or receive showing up in my action stream or on my profile, but certainly being able to leverage various APIs for getting contacts will reduce the need to “refriend” people on each new network.

For now, however, Chi.mp has no way to identify that the “John Doe” you are friends with on facebook is the same person as the “John Doe” who is a contact on Flickr – they provide a simple way to manage contacts (and “merge” the two contacts into one virtual person) but there is still human effort (decision making) involved in reconciling these graphs.

Trufina

Trufina adds an interesting twist in that they are trying to more tightly link online identity to offline. Using a method well known to financial services companies – the ability to answer a short set of questions about your financial history which would not be known to someone who found your wallet in the street – Trufina verifies that the person using the name John Eckman is the same one who lives at a given address and has other “meat space” attributes.

You can see my default public profile here:

I have to say their focus on “criminal background checks” I found a bit creepy: I realize that background checks are important for certain kinds of employment, but it seems like the need (and even desire) to assert a record free of felony convictions should be a niche market, not the default market for an online identity vendor. (Employment verification and educational background verification are said to be in development).

They also then enable you as a user to share various parts of your verified identity with others, including inside a number of social networks. You can create an “ID Card” and show that to only specific folks. There was no way I could find, however, to not show the “Criminal Records Search” section of the ID Card – it seems to always show either “” or “ ” – neither of which makes for high confidence. How about the ability to not show that section at all, if I don’t think it’s relevant, in which case you could also dispense with the rather elaborate disclaimer about criminal record checks.

I also found it frustrating that the default “profile” view – the only one people can get to who haven’t been specifically authorized by you – shows only the Trufina user name. Obviously given the market Trufina is after, and the data that a full profile might ultimately contain, they need to be concerned about privacy. But what if I’m perfectly happy to have people see my first and last name and maybe state of residence and employment?

The key to privacy needs to be control, not defaults which prevent users from making basic data public.

Identity.net

The folks at Identity.net have partnered with Trufina, to link your “Trufina Verified Identity” to an OpenID which can be used throughout the web. It’s a great concept – to be able to demonstrate that the virtual identity a given OpenID represents is tied to a real offline person could be quite valuable.

I’d hope to preserve, however, the option to also have OpenIDs which are not linked to my offline identity. The ability to get the benefits of OpenID (in terms of single-sign-on) without necessarily having all online activity tracked directly to your offline identity is one of the freedoms the internet promises and I’d hate to lose that. (A number of OpenID providers enable you to create multiple OpenIDs that only they know are associated with each other – this enables you to project different identities on different sites).

Like many of these services, Identity.net is in beta, and was having trouble with their control panel when I signed up, so it’s possible I haven’t yet seen what flexibility they offer in creating and using OpenIDs tied to your Trufina identity.

ClaimID.com

I use ClaimID with delegation to use JohnEckman.com as an OpenID. ClaimID also provides a basic profile page on which you can enter links to web sites and verify your ownership of them, as well as display contacts, optionally marked up in XFN (with semantic data about the relationship you have with each contact).

Movable Type with Action Streams Plugin

I use the open source edition of Movable Type with the Action Streams plugin to power JohnEckman.com as a lifestream aggregator, pulling in feeds from various web services. Creating additional plugins to add services to Action Streams is relatively simple, and I’m hosting it myself so I have complete access to the data stored and complete flexibility in display.

The DiSO project has produced a similar plugin (WP-DiSo-ActionStream) for pulling action streams into WordPress (I’m using the OpenID plugin from DiSO on this blog), and there’s an Activity Streams module available for Drupal as well.

Finally, there’s Sweetcron, which I have only just started to experiment with, but which focuses on just managing the action stream aggregation without the extra functionality (and overhead) of a blog or other framework like MT, WordPress, or Drupal. It’s also easily extended.

As all of these evolve, how much ownership and control will users want to have over the content their online activity produces? How much technical understand and effort will they be willing to expend in order to exert that control?

What, in other words, will be the balance between hosted providers (they do all the work but also retain some element of control) and self-hosted open source platforms (you do more work and gain more control)?

Will the central difference between the two options lessen as real data portability becomes commonplace?

I really wanted, though, for users to be able to comment on blog posts from inside Facebook, with their Facebook identities, and have it work like the OpenID comment plugin (in the sense that the user should not need to provide any authentication info, but it should be derived from their Facebook login).

I think I’ve finally got it it nailed, at least to the point where folks can start testing it.

If you are a Facebook user, go to this application page: http://apps.facebook.com/openparenthesis/

It will require you to log in (or already be logged in) to Facebook, but you don’t have to add the application to your profile or spam all your friends.

What you’ll see is my five most recent blog posts from this blog, inside a Facebook wrapper. (Can’t include embedded videos, the styles are bit wonked, etc – but it is a start. This is basically just Dave Lester’s plugin).

You should also (this is the new part I’ve hacked in) see the ability to comment on posts – without being asked for a name or url or email address.

Please leave me a comment to test it out. It should, if all works according to plan, pull your Facebook profile pic as your avatar for the comment as well – since your facebook profile page is actually an hCard with appropriate markup (go microformats!).

I believe this will work even for folks who are not “friends” of mine in facebook – but let me know if you run into difficulty.

Once I’ve validated that it works I’ll publish the code. It required me to add at least one file to my theme, and relies on the hAvatar plugin to get the profile pic.

Known Issues:

Sometimes the “autoresize iFrame to content size” bit in Facebook fails, and you end up with a fixed size view into longer content, with no scrollbars. Haven’t figured out what triggers that yet – standard facebook javascript api.

Sometimes you’ll get the “You’re entering comments too fast” error – just wait 30 seconds. Unless lots of people are all trying to do it from facebook at once this should go away. I’ll need to figure out how to unthrottle the comment queue in wordpress for this point.

I think it’s a very useful concept, pointing out that people’s decisions aren’t binary: it isn’t a single yes/no decision but an active, ongoing negotiation, which determines which services you use and don’t use.

You can also think about the barrier to entry of a new user in a similar fashion. Any time you try out a new application or service there are a few barriers, and whatever the application developer can do to lower those barriers the more users will get over that threshold.

(One of the key benefits of open source, from my point of view, is the relatively low threshold of entry it makes possible – no need to negotiate an enterprise license, sign up for 2 years of support, and get lawyers to agree on terms – just download, install, and try out).

In social web applications, the barrier to entry is generaly sign up – authorization and authentication. Applications running inside containers like Facebook have the benefit of bypassing the authentication problem – by relying on Facebook to determine that you are appropriately logged in to your own identity – but still need to get authorization from you to “install” themselves to your profile.

The problem is that Facebook (or Facebook application developers, guided by the Facebook API) seems to treat this experience as a binary choice: you either install the application or you don’t. From the application’s point of view, you are either a user who has installed the app (in which case you’re in) or a user who has not yet installed the app (in which case you’re out).

Why should I have to install an application in order to be able to see the message my firend sent me using it?

Jonathan Terleski, from Google’s User Experience Team, posted a movie today showing a better way: allow users to experience the application and then – after they have determined it has some value to them – ask for the install.

What do you do, though, if you’re outside the environment of an open social container or the Facebook API? Use OpenID and OAuth.

Keeping the barrier to entry low:

1. Let people have a decent sense of the experience before “creating an account” (or whatever language you use to describe registering). Let ‘em try before they buy, as much as possible.
2. Use OpenID. Enable people to log in to your new service using their existing identity elsewhere. With Yahoo! and AOL on board, and the directed identity features of OpenID 2.0 (which let users click a button marked “log in with your Yahoo! account” rather than remembering a URL) we should see end user adoption of OpenID take off. (It may be “unaware adoption” in the sense that people don’t know it is OpenID being used, but that’s actually a good thing).
3. Leverage their data from elsewhere, using import via Google’s Social Graph API, hCard profiles they may have on other sites, XFN or FOAF notations from sites like Twitter which markup links with microformats, and OAuth to access third party data.

I’m looking forward to seeing more detail on the Ringside Social Application Server next week – looks to offer a very compelling path to bringing social networking features into applications without imposing a high barrier to entry. See also DiSo, Noserub, Shindig, and the Appleseed Project (which may need to change its name to avoid the other Appleseed Project).

Facebook is planning on allowing users to add activities from third party social networking site directly into their Facebook news feed, we’ve confirmed.

The problem is that their only talking about allowing users to *add* activities into the news feed, not to take their facebook news feed and take it elsewhere. As TechCrunch put it:

This is certainly an opening up of Facebook. And given that so many tens of millions of users spend so much time on the site already, it could remove the wind from the FriendFeed/Plaxo sails.

But don’t expect to see a RSS feed or widgets showing what you or your friends are up to any time soon. The data feeds that Facebook opened up last year do not extend to the News Feed. And from what we hear, Facebook hasn’t made a decision to open it up yet. Until they do, there is still plenty of breathing room for competitors.

But why is this even an opening up of Facebook? I can’t take my news feed and add it to my lifestream or use it on another site – all I can to is add data to Facebook’s walled garden.

Marc Canter, in the middle of his video about Data Portability, makes the point that our web based applications need to learn to spit as well as to suck – his choice of terms might be a bit visceral, but it does get the point across.

The scheduling application for SXSW (sched.org/sxsw2008) spits, but doesn’t suck. You can export your schedule in an iCal format, and group multiple sched.org calendars together (like this) but you can’t import an iCal schedule in, even to add events not in sched.org’s database to your calendar. (Though I guess you can pull both out to something like Google Calendar and get your unified view there). You also can’t, as Chris Messina pointed out, login with an OpenID.

Fire Eagle, right now, seems all suck and no spit. It can get my status from Dopplr, or from certain phones, but for now at least I don’t see any way to get it out. The site help says:

There are many applications that can use your Fire Eagle location! For example, you can use Fire Eagle to update your location on your Facebook profile; or embed a badge on your blog or MySpace that shows roughly where you are. Many more are coming. If you’re an engineer then maybe you could write one!

But when I go to the application directory, it looks to me like they are all coming, as in not available now.

Don’t get me wrong, I think Fire Eagle is a great concept, and gets a lot right – specifically the granularity of different privacy settings, in terms of how precise Fire Eagle can be in sharing your location. I’ve been looking forward to it since Marc Davis talked about at the Futures of Entertainment conference last November.

Check out the work in progress at johneckman.com. Read on if you’re interested in creating your own action streams.

Although it has been a while since I’ve worked in Movable Type, it was a relatively painless install (assuming you’ve got the basic LAMP stuff in place).

The challenge was creating additional “services” for this blog and goatless. There’s some basic info on writing new services in this blog post: “building action streams” – but it took some time to translate this into my way of thinking about it, including where the png file goes for the icon for the service.

Here’s what the config.yaml looks like for the OpenParenthesis service:

name: Open Parenthesis
id: openparenthesis
key: openparenthesis
author_link: http://johneckman.com/
author_name: John Eckman
description: Adds profile service and activity stream for Open Parenthesis
version: 1.0
plugin_link: http://johneckman.com/

profile_services:
    openparenthesis:
        name: Open Parenthesis
        url: http://www.openparenthesis.org/
        icon: images/openparenthesis.png

action_streams:
    openparenthesis:
        posted:
            name: Posts
            description: New Posts to the Blog
            html_form: '[_1] blogged on <a
                href="http://www.openparenthesis.org/">OpenParenthesis</a>
                about <a href="[_2]">[_3]</a>'
            html_params:
                - url
                - title
            url: 'http://feeds.feedburner.com/OpenParenthesis/'
            identifier: url
            xpath:
                foreach: //item
                get:
                    created_on: pubDate/child::text()
                    url: link/child::text()
                    title: title/child::text()

This config.yaml file goes in mt/plugins/openparenthesis/config.yaml – that is, you create a new plugin folder containing just this config.yaml.

Then you put the openparenthesis.png in: mt/mt-static/plugins/openparenthesis/images/openparenthesis.png

I suppose much of this would have been obvious had I been more accustomed to how MT plugins work.

You may also note I’m just hardcoding a pointer to my feedburner feed – so technically there is no “{{ident}}” needed – it doesn’t matter what identifer I put in.

One could translate this by changing:
url: 'http://feeds.feedburner.com/OpenParenthesis/'
to:
url: 'http://feeds.feedburner.com/{{ident}}/'

And then entering the feed name (the only part of a feedburner feed which changes) into the identifier field when adding the service to your profile from the MT admin side. That would give you a generic FeedBurner feed, to add blog postings to your action stream.

Of course, this may not make sense if your blog is itself on Movable Type, since your blog postings will be directly in your feed, but if you’re creating your action stream on separate domain, it may come in handy.

You can create extra “profile” links which offer no streams as well. For now I’ve just cheated with the link to Optaros at the top of my “Find Me Elsewhere” list.

Good video interview (about 20 minutes), if you can get past the conceit (in the rhetorical sense of the word, not the egoism sense) of the self-interview.

The Existential DiSo Interview from Chris Messina on Vimeo

Only part I really struggled with was about 16 minutes in when he starts to talk about the “Gestapo like tactics” of Facebook. I’m a huge supporter of what DiSo is trying to do, but I don’t think closing people’s accounts for terms of service violations passes into the realm of the Gestapo (Remember Godwin’s law?).

Mentions at one point the goal of having a working demo by SXSW – I look forward to seeing it!

Shindig first, direct from the OpenSocial API Blog “Let’s get this Shindig Started“:

Shindig is a new project in the Apache Software Foundation’s incubator (as per the formal proposal) that aims to provide an open source reference implementation of the entire OpenSocial stack — Shindig’s goal is to allow new sites to start hosting social apps in well under an hour’s worth of work.

This am was the initial commit to the Shindig svn repository. In other words, there’s already code, in the best open source fashion:

This commit represents initial versions of the first two components, the Gadget Container JavaScript and the Gadget Server — the latter written in Java. The Gadget Container JavaScript provides code to generate IFRAMES pointing to gmodules.com, offers some basic gadgets functionality (e.g. dynamic height), a layout manager, the edit dialog box, a cookie-based user preferences store, and an option to point IFRAMES at your Gadget Server instance instead of gmodules.com. The initial Gadget Server provides extensible scaffolding for processing gadgets: retrieving XML, parsing it, and processing it into a form that allows rendering of the gadget to a user or retrieval of its metadata.

I won’t likely have time today (or tomorrow for that matter) to dive into this, but it is great to have some actually code in advance of the holiday week.

The second project I’m excited about this morning is DiSo, which is Chris Messina, Will Norris, Steve Ivy and others working on a social networking platform “with its skin inside out,” starting with WordPress as a platform. It’s a chance to take the concept of using XFN, hCard, OpenID, OAuth, FOAF, and related microformats and open standards to create a truly distributed social network.

(See also GigaOm’s coverage from Tuesday which I just found through the news feed in my WordPress dashboard – The Next Social Network: WordPress)

Glad to see both of these projects kicking off in the transparency of the open source world – gives me good hope that we’ll actually make some significant progress on the social network portability front.