Angus Logan's Blog

Nice UX on AT&T around privacy policy changes

alogan — Fri, 17 Jul 2009 18:23:33 GMT

This is a pretty slick way of highlighting policy changes without requiring an additional click (if the lawyers let you do that).

Computer generated art “Un-productivity Suite”

alogan — Mon, 13 Jul 2009 21:52:50 GMT

I’m glad we announced the Office 2010 Technical Preview as I’ve been holding onto this vintage piece of computer generated art for a while.

For me Outlook and Twitter could not be further apart in terms of impact on my productivity – one keeps the trains running on time, the other derails everything.

Check out this UI glitch when feasting on dogfood. Notice the “What’s happening right now” perfectly blended with Outlook – click on the image to see a bigger version.

Brand soup? MSN, Windows Live, Bing

alogan — Mon, 13 Jul 2009 17:55:22 GMT

I went to my first Social Media Club meet up in Seattle a few weeks ago – it was great fun.

The question I got the most (aside from “I’m looking for work, do you have any?”) after introducing myself was “you will be rebranding Windows Live to Bing, right?”. Wrong.

Erik Jorgensen, corporate vice president for MSN put it nicely in an interview:

On Microsoft’s three online brands: MSN, Windows Live and Bing:

Having been around this for a long time, I certainly feel better now than I have at any other point about the clarity of what each of those three is. It passes the distant relative test — I can go and talk to somebody who is not technically savvy and pretty succinctly describe what each of those three stands for now. (MSN is online content), Windows Live is communication and social networking, and Bing is search. Earlier as we looked at some of those things, that was not as clear. The thing that we need to solve, frankly, is how to make that design and user experience more seamless across those. When we talk to users, they get the value now in each of those three — it’s really about when you traverse between them, how does that feel consistent and seamless.

My pixels aren’t free ad space for your network – ‘Connecting’ needs targeting

alogan — Tue, 07 Jul 2009 18:32:28 GMT

MySpace for music, Facebook for friends, LinkedIn & Plaxo for work contacts, Pandora & Last.fm for Music – these are what I call networks and I use them in lots of places. They are sticky and I store my data there. Every “large network” will open up – they want to be “Connected” to web sites – but how do you know which ones to Connect? (thanks Facebook & Google for the term Connect).

Why are they opening up? Aside from providing the people who use their service anywhere access, it also drives engagement minutes, more user data, and more stickiness with users in other places than just their main website (what I call 1^st party web properties).

In this post I am continuing investigation to solve what Chris Messina dubs the Nascar problem (Luke Shepard has also weighed in on this from an Open ID point of view).

The solution below will allow web sites to detect which network’s a user is on. Not only will it drive more Connectedness – people will be connecting the right network to the right web site.

One of my assumptions is: there will be a finite number of large networks < 10. A web site’s visitors are also likely to use at least 1 of 10 pre-defined networks. These networks may change per geography.

The taxonomy I’m using for this post is:

Networks = places people store chunks of data and always come back to
Web sites = sites which are “Connecting” to networks (aka Relying Parties)

My sign-in page isn’t a billboard for your network

“Connecting” is a balanced of exchange of value between the websites and the networks. Websites drive off network engagement for the network. The network provides access to data, and a user base for “targeted promotion” e.g. sharing stuff to a user’s friends hoping they’ll click back through to the web site.

Pixels are precious. A web site isn’t going to spend space on promoting someone else’s brand (in this case a network) if they aren’t sure the user will click on it (and there is a way to get value). I think of the ability to “Connect” on a site as an ad for this mutual benefit.

With any ad system, you need to know who you are targeting them to, what the intent is. The solution I propose below would drive a higher degree of “Connectedness” between web sites and networks. Aside from more connections, they would be the right connections: Connecting MySpace to your Monster.com account isn’t really smart, but connecting LinkedIn to monster.com is a great move.

The solution

To reach this nirvana of connectedness there are 3 steps:

Detect the sites a user is a member of (from a predetermined per website list)
Sell the user why they should connect X network to the current site.
Connect whatever the user came there to do (share, sign in, anything else)

Detect

Each web site should understand their user base well enough to estimate the top 10 networks they share their user base with.

When a user goes to “sign in” they can sign in with their traditional forms based username/password, or a simple lightweight call can be made to the networks.

This simple call would be made from the user’s browser (imagine a cross site JSON request) and the network would tell the site “user is signed in”, “user is not signed in but was”, “we don’t know”. The key assumptions I’ve made are:

A network allowing web sites to check if their visitor is a user of the network is not a privacy/security hole.
Most networks store a semi-persistent cookie which captures the user’s state
Something drastic like all browsers going “scorched earth” (E.g. dropping all cookies on close) doesn’t happen

The web site would include a script from the network’s website:

<script src=”http://sn1.com/?connect=www.mysite.com&type=media&callback=ConnectSN1”>

Some web purists may say “I’m not making 10 cross network requests” as it will be bad for performance. My view is this is the only way to get a solution like this off the ground, and 10 cross network requests are more likely to happen than building a centralized service managed by an independent third party.

Sell

If the network tells the web site “Yes, I know that person” some contextual information can be shown to the user. Since the user has not granted this web site permission to access their data, the information needs to be protected, that is possible with an iFrame.

The selling is done by showing the user their profile picture, showing which friends have also “Connected” with the web site and some additional key reasons to connect that site with this network.

One idea is to make the web site tell the network what type of site it is e.g. Video sharing, Media website, eCommerce etc. that way the network could return very specific value propositions in the user experience. For example: if the web site is a finance site it may be “instant message with your significant other” not “share this with your friends”.

Some users may be alarmed that a web site can access their data because they don’t understand the IFrame isolation model (if an IFrame from foo.com is on a page from bar.com, bar.com can’t read the contents of the IFrame). From a technical point of view, to show the IFrame simple JavaScript could be used:

// this function will be called if the user is a SN1 user.

function ConnectSN1()

{

// construct the iframe to a standardized width

url = “http://sn1.com/?connect=www.mysite.com&type=mediawebsite”

// show the iframe

showTheIFrame(url);

}

</script>

Connect

Do whatever the functionality provided the network is, sign in, profile, stream writing etc. This post was about the encouraging user’s to connect sites to networks, not what comes after that :)

Summary

Connecting web sites with networks requires a balanced “exchange of value”. For web sites pixels = $$$ and turning the sign in page into a billboard for other networks with little hope of conversion is unreasonable. The networks should be selling end users on “why this network for this web site” as not all networks are created equal.

Technorati Tags: Connect,social networks,web APIs,APIs,federated identity,identity,Windows Live,networks,detection,advertising,ads,ad

Where are my keys??? ask the Facebook Newsfeed

alogan — Tue, 07 Jul 2009 04:39:32 GMT

My favorite hangout in Seattle is the Noodle Ranch - Tonight it told me my buddy Benjamin had left his keys there.

Facebook Live Stream Box Test

alogan — Wed, 24 Jun 2009 22:37:00 GMT

Visit this page in your browser

Photobucket adds Sizzle and Sharing via IM to Spice Up Photo Search

alogan — Thu, 18 Jun 2009 20:36:00 GMT

Like Bing’s great multimedia search? Did you know other companies are innovating in the multimedia search space?

Today Photobucket announced their own way to push the boundaries of visual search. They combined a killer user experience (based on Silverlight) with one of the most popular sharing behaviors on the web – instant messaging.

Try it now at http://photobucket.com/visualsearch

Consumers are able to easily share pictures they find via Photobucket with their friends on Windows Live Messenger no matter where they are signed in (Messenger on Windows, Mac, or Mobile devices).

The Windows Live Messenger Web Toolkit UI Controls provides a skinable and flexible way to interact with the 320+ million people who use Windows Live Messenger monthly. The UI controls can be easily integrated (see Interactive SDK) in web sites and makes a lot of the heavy lifting (coding JavaScript) only required if you want a fully custom experience.

<msgr:contact-list word-wheel-enabled="true" sort-mode="status" hide-offline-contacts="true"></msgr:contact-list>

Sharing via Instant Messaging

Lots of web sites today allow sharing via activity streams/feeds, recently I did some analysis into the differences between sharing via Streams and sharing via instant messaging. Check it out.

Below are screens of the experience from consent to sharing

Sharing a photo with my friends

The friend I shared it with gets this experience

User acquisition: writing on a notice board vs. sending a postcard

alogan — Fri, 12 Jun 2009 00:41:12 GMT

Getting people to your website is critical (D’uh!). New people. Old people. A constant flow of sharing and content discovery is required to succeed. Recently I’ve been thinking a lot about two complementary user acquisition/engagement techniques: sharing via the stream (passive) and instant messaging (active) (I don’t cover email which is another huge topic).

Which one has the biggest impact on your web site? In this post I review the typical relationships between people and drill into each of these flavors as ways to generate qualified referrals.

An example of where these could be used together is MapMyRun: when I complete a run I like to get my time etc. posted into my twitter so all my followers can see. I usually also send an instant message to my friends who run and talk about the course, time and perhaps organize a run. This drives awareness for MapMyRun and allows people to click through to see the details.

Caring about sharing is good business

User generated actions which are syndicated to other sites/services can have a big impact on user acquisition and engagement. By allowing users on one site to share their actions with another service, the reach of people who see (awareness) and take interest (acquisition) is increased.

Ego powered friending frenzies don’t encourage influence

The better you know someone, the more likely you are to do what they suggest. When it comes to sharing content/actions online with other people, the sharer is asking the recipient(s) to do something (usually click through to see the detail).

As a result, some services encourage ego powered friending frenzies. The result is very loose relationships between people you barely know, don’t really care about, and who haven’t earned your trust. If these one of these pseudo friends asks you to do something you take it with a grain of salt.

My experience is: the friends I form relationships with in many different contexts make me behave differently. For example a friend I instant message with is different to someone I’ve friended in a social network, which is different to someone who’s commented on my blog etc.

If you are a celebrity and you have a TON of followers, writing something to your stream is very powerful. If you aren’t Ashton but have a ridiculous number of friends, do they care about your entries or are they noise?

Call me anytime, I actually know you

The people who connect with my over instant messaging are generally less in number and long time friends, not just acquaintances (in most cases, not all). Allowing a person to see when I’m online/offline and giving them the ability to get my attention anytime is convenient, but more importantly it means I trust them.

As a result, the behaviors that happen over instant messaging are generally self-regulating. If I always send a message to someone and they never respond, I’m likely to stop. If I send a message to someone and they’re always engaged (click through etc.) I’m likely to do it more often. Where there is a will there is a way, abuse is something you need to deal with: don’t be afraid to ignore (like screening a call) or block if required.

Floating down the stream (passive)

Most web sites which have a desire for viral user acquisition have the ability to publish to a stream. This piece of content is then made visible to the large number of people that I’m friends with (or are following me) in other experiences on the site, or in experiences managed by other services. Writing to the stream is an untargeted shotgun style broadcast.

When something is written to a stream it allows many people to see the content in an ambient manner. For people to connect with the content, they need to be in the right place at the right time and have strong filtering skills to separate the wheat from the chaff.

It’s temporal. Streams constantly move, when I wake up in the morning I scroll back a few hours in my stream to see what’s happening, I don’t rewind the actions back to the last thing I viewed.

A benefit of writing something to the stream is that the content is archived. If the stream is searchable it’s easy to see trends and find historical information. If I respect someone a lot and think they share great content I can easily view the things they’ve been doing in one place.

Sharing via instant messaging (active)

When I find something interesting I think one of my friends would care about, I usually have a friend (or a small) group of people in mind. Instant gratification comes with my Generation Y’ness – I share something with the people I know is available and cared about it to discuss with me.

This type of interaction can be delivered via instant messaging.

Who is online right now? (presence)
Are they likely to respond? (my knowledge)
Sending them the link
Sending some commentary and discussing

When you receive an instant message because of the deeper relationship between the participants the natural behavior is to respond. If for some reason you don’t want to respond you can always “screen” the conversation (similar to a phone call from someone you are avoiding).

Make the discussion real-time, natural and persisted

The conversations I have in instant messenger related to content are verbose and often lead down many different paths. With the caveat of being clearly made aware of what is happening: imagine being able to capture these rich real-time discussions and store them with the original content. The content of the discussions could be searched and read by others. Friend-feed is part of the way there in terms of real-time conversations, but the interaction is somewhat unnatural for the hundreds of millions of people who have instant messaging applications on their computers.

Summary

Sharing content is a weapon in the battle for user attention. There are many different ways of sharing content, all are complementary.

Publishing to a stream/feed allows me to share this with many of my friends/acquaintances on another service but is untargeted and facilitates ambient discovery of content.
Sending content via instant messenger is very focused to people who I believe will care about the content and facilitates active discovery of content.

If you want to plug into the largest IM network in the world, check out the Windows Live Messenger Web Toolkit (interactive SDK) and watch this space for real world implementations.

Technorati Tags: user acquisition,social media,instant messaging,streams,feeds,friending,friends,online marketing,TAC,viral marketing

Automating pre-registration for API/consumer keys

alogan — Fri, 22 May 2009 21:41:33 GMT

There is a weird mix of pros and cons when it comes to requiring pre-registration of API keys (where you go to a developer portal and identify yourself, agree to terms of service, etc).

Ever since Joseph Smarr and co. laid out the tangible dream of Portable Contacts: “you should be able to walk up to any web site, and tell them where your contacts are stored, and they should just go and fetch them” I’ve been wondering exactly how this will be achieved in reality when most service providers require pre-registration for their use of APIs.

A great solution requires good technology and workable business/compliance terms.

After a person responds to the question: Where are your contacts? with www.randomsocialnetwork.com the API and delegation endpoints are discovered using XRDS-Simple. This is very cool, the service provider can move the endpoints around and it won’t break relying parties.

With the ability for relying parties to dynamically discover new service providers, this makes it near impossible to require pre-registration of API keys/consumer keys.

At the Internet Identity Workshop #8 this week I proposed a session unconference style (by sticking a piece of paper to the wall) and to my surprise a big group of awesome people showed up. Representatives from big companies (Microsoft, Google, Yahoo!, MySpace and Facebook) and other smaller companies were there.

In the session we talked through the problem and talked through 3 scenarios for further investigation:

4th parties and widgets (e.g. JS-Kit, DISQUS) – a developer needs to configure the widget with API keys. The developer is present at the keyboard.
Unattended registration with services – an end-user essentially introduces the third party to the service and no developer is “present at the keyboard”
Data rights – when consuming data from any third party you need to know what is allowed with that data to in compliance with their terms of service.

Below is the notes from the session with some additional commentary/notes

We broke the session down into the following sections:

What are the benefits of pre-registration
What is the current pain
Who is already looking at automatic registration of API keys
What are the solutions
How will this be abused
Moving forward

What are the benefits of pre-registration?

There are many reasons for the service provider why pre-registration is great. I break these down into 3 areas: protecting the business, protecting against evil and providing value added services

Protecting the business : Accountability / Business Model

When a developer calls an API there is a certain level of accountability which the developer needs to agree to. This is usually done via Terms of Service acceptance and providing contact details.

I am not a lawyer, but as far as I can tell, most companies require an explicit developer action (E.g. clicking a tick box) to show agreement with the terms of service.

The service provider needs to have contact details for the developer to reach out to them. This could be things such as notifying customers of API updates, notifying of updates or even capacity planning (and removing throttling upper limits). In my opinion, using the tech-support contact information on the domain is unreasonable.

Protecting from evil: Reducing Abuse / Spammers

Opening any type of resource for programmatic access opens the door for abuse. By requiring developers to go through a manual step (and perhaps even completing a CAPTCHA/Human Interactive Proof) this drastically reduces the ability for nefarious actors to create hundreds (or thousands) of evil sites which “fly below the radar” of normal abuse detection.

This abuse could range from spamming to business model bypassing.

Providing value added services (different strokes for different folks)

Not everyone who calls API needs to be treated the same. Once you know a developer is a real person (i.e. not a bot) a smoother user interface (less warnings) may be presented to end users; access to additional “offers” / pieces of functionality can be accessed.

Providing analytics back to the developer on the number of end users who have granted permission to your application, or combining that with anonymous demographics on the audience can be invaluable to developers.

What is the pain being felt today?

Pain is relative.

Starting with the customer (end-user), the pain is: I want to be able to get to my data no matter where it is, even if the two services don’t have a pre-existing relationship.

For the developer pre-registration is sometimes challenging because:

Development/QA/Production environments often require different API keys, and managing the deployment process is often difficult.
If your service consumes data from 10 address book services, 5 photo storage services, 3 status services this is time consuming to onboard each different website (this requires a big assumption that protocols are standardized and the code is reusable for each type of service).
For 4th party scenarios, the developers are often forced into the API key equivalent of the Password Anti-Pattern, where API keys are often copied and pasted into a third party service.
The identities which are used for API key registration are essentially “service accounts” but are often just the developer’s real production account.
Proving you own the domain by putting something in the root of the domain is challenging.
Developing behind the firewall and creating “fake” fully qualified domain names reduces developer productivity.
The barrier to entry for developers who just want to “kick the tires” is higher.

For services (which expose APIs):

Getting wide spread usage of APIs can be limited due to the requirement for manual provisioning.

Who is already looking at automatic registration of API keys

No one today has the perfect solution.

Facebook are the closest for the 4th party scenario. Luke Shepard outlines the scenario where a developer is configuring a 4th party service/widget and pop’s a new window to Facebook (using their real identity) and the API keys are emitted to the screen. The developer then copies and pastes the keys back into the 4th party.

Ari Steinberg from Facebook talked about an interesting concept where all of these “programmatically created API Keys/App IDs” are grouped under a parent application ID. The scenario he outlined was there are some apps which allow you to create quizzes. The users may just want to block all quizzes from the same “manufacturer” even though they have different API keys.

Apparently there are a few other solutions which are somewhat close to working but we didn’t drill deep into them;

OAuth discovery draft 1 apparently had provisions for similar functionality but this was removed from later drafts.
Open ID / OAuth hybrid had some similar functionality

Google has a few solutions for non-provisioned OAuth : anonymous/anonymous which allowed for developers to use the APIs without pre-registration and was keyed off the domain.

What are the solutions discussed

Beyond what Facebook already has (which was agreed as the most promising for the 4th party scenario) we discussed a few more things to be investigated when provisioning is required.

The notion of providing a lightweight unprotected function (API) which requests pre-defined information (domain, email address, etc.) and returns an API key seemed like the most straight forward approach.

Interestingly, the bulk of talk about solutions was to provide a tiered approach for developers. Where if you have not been provisioned the user experience has more disclaimers and the number of calls to the API could be throttled until the developer “claims” the application. Perhaps this could be done by emailing the developer an “upsell” and they go to a web site to claim their application, or prove ownership of the domain.

Chris Messina had a really interesting point of view: instead of locking down the system, you have liberal access and when some type of abuse occurs the system could be self healing. e.g. an app deletes all of a user’s data, the user can log in and click rollback.

Aside from the technical work of “how do API keys get provisioned” the overall business issue of machine readable terms of services is a big complex problem. The position I asserted is this work should be driven by the DataPortability working group and some other people mentioned www.sciencecommons.org and www.opendefinition.org.

The outcomes/moving forward

For the 3 problem spaces the following plans set:

4th parties and widgets
- Setup and email thread with Facebook / Google and Plaxo to diff on this more
- Monitor Facebook’s progress as they are close to having a solution and provide feedback
- Enumerate all of the use cases and post to a wiki/blog
Unattended registration with services
- Plaxo will drive this with Google (Eric Sachs) as the main requirement is coming from Portable Contacts.
- Enumerate all of the use cases and post to a wiki/blog
Data rights

The Data Portability group should keep on working on this.

Remote work rocks

alogan — Tue, 12 May 2009 21:52:39 GMT

I’m currently in Denver at GlueCon and I needed to dial into my team meeting where most people are in Seattle, and Jared is in Hamburg – being able to read body language etc. is super important.

When someone else starts talking the camera auto switches.

I love this stuff!

Come to our Messenger hackathon in San Francisco 27th May, presentations, code, food/beer!

alogan — Mon, 11 May 2009 20:01:25 GMT

If you want to know how to integrate Windows Live Messenger into your web app to access over 325M+ users, and you can be in San Francisco on May 27th, register for our Hackathon.

To learn more about the Messenger Web Toolkit see dev.live.com/messenger or blogs.msdn.com/messenger.

Also – try our interactive SDK for the Messenger Web Toolkit.

Show your Windows Live friends what you do around the web (Activity Aggregation)

alogan — Mon, 11 May 2009 18:53:46 GMT

A couple of weeks ago we shipped an update to Windows Live which made it possible for people to share the things they do around the web with the people they know in Windows Live (including Messenger and Hotmail).

Here are some of the sites you can add:

Check out this video I made showing the new features.

OAuth as a sign in (to Twitter) got me thinking

alogan — Fri, 17 Apr 2009 21:57:23 GMT

Eran Hammer-Lahav just posed about Twitter’s new “Sign in with Twitter” (documentation) functionality which is powered by OAuth (not Open ID).

It is quite a neat solution, you can both authenticate into a site and grant them permission for them to party on your twitter account

If you are interested in OAuth or Open ID (or the OAuth+OpenID Hybrid) read the post and check out the comments.

Someone tried this with Windows Live ID Del Auth

This reminded me of when I recently saw a customer using the Windows Live ID Delegated Authentication SDK to capture a address book, user’s profile and a static identifier for the user.

It was interesting because they chose to use DelAuth instead of Live ID Web Auth for the authentication mechanism. This meant that instead of using the unique user id (per application) the site was using the CID/LID which is a public identifier for the user (not their Live ID) – the customer had used DelAuth for something we never intended it would be used for.

Moreover, the user experience was a little funky:

When a user lands on consent.live.com they are granting permission for an application to access their data. We think this is a pretty serious action. Currently DelAuth requires that you have entered your password in the last 15 minutes (i.e. you can’t use cached credentials via the Sign In Assistant which is installed on hundreds of millions of PCs). This meant you couldn’t be silently or one click signed in.
DelAuth cannot be co branded (Web Authentication can be). By customization I mean the relying party’s colors/logos etc. (similar to the www.xbox.com sign in).

What does the Sign In with Twitter look like

Below are screenshots of signing in with Twitter (they offer both traditional forms based auth and signing in with Twitter via OAuth).

I authenticated to twitter about an hour ago and got this screen (2nd is if I'm not authenticated)

And after I am in I see my picture, name and actions i can do.

Difference between Twitter’s OAuth implementation and Windows Live ID Delegated Auth

You may notice a difference here between the twitter consent screen and Microsoft’s consent screen:

When using DelAuth from Microsoft the third party is required to provide a privacy statement
we provide the choice of duration of delegation
on a per offer basis we may provide per item ACL’ing of which items are shared
a link to the screen where users can revoke permissions from apps

Your stuff is here, here and here. Rely on it

alogan — Fri, 17 Apr 2009 00:39:42 GMT

Luke Shepard posted about avoiding Open ID Nascar and detecting the user’s provider.

I was pitching something like to Luke, Wei and Joseph Smarr at the Open ID UX summit (without all the Open ID details).

I think there are going to be about 10 providers which people actually want to sign in with; but you can't show 10 choices.

Sniff out the ones the user has ever signed into via a JSON request or an image size hack.

Then you could also surface the "why use this provider" in an iframe (i.e. if you are visiting the WSJ and it shows):

You are a user of Facebook (3 of your friends are on the site, post stuff to your wall)
you are a user of MySpace (0 of your friends are on the site)
you are a user of LinkedIn (12 friends are on the site, share stuff with your professional network)
You can click to show way more places of where your stuff is stored.

You think this is interesting?: should i document it a bit more?

Some really slick video/event system with instant messaging integration by SharpLogic - Hulu should listen up!

alogan — Thu, 16 Apr 2009 00:25:07 GMT

Lets say you have 1 computer with 1 screen. You watch a ton of video content (like 24 on Hulu). You like to watch full screen but don't want to miss IM conversations or other stuff. Why not integrate the IM straight into the video player with a subtle glow. That is what Ed from SharpLogic has done.

---

Ed at SharpLogic is one of my heroes. He is a pleasure to work with and always goes the extra mile (debugging stuff at 4AM with you over email or IM!).

Chris (a PM for the Windows Live Messenger Web Toolkit) convinced Ed to write a guest post about how he built his rocking video/event system with IM capabilities.

Check out the post here and their site here.

Snipped from the post:

We’ve actually done this with Boost Events, a SharpLogic venture. Boost Events is a set of software and services designed to deliver great experiences for conferences. Our Silverlight UI integrates Windows Live Messenger so users can collaborate via IM while watching sessions, as well as being able to recommend sessions to each other.

In the screenshots below, two users have logged into Messenger from http://events.boostweb20.com/Events/MIX09. To recommend a session to another user, the first user drags that session’s tile onto an IM conversation. The recommendation is serialized and sent over the Messenger channel as an “application message”, which is deserialized and treated specially by the application to expose its own functionality. Messenger provides the underlying channel for messages, so there is no impact on our servers. Application messages are treated like other messages in the system, except that they’re not surfaced as text IMs since they’re intended to be transparent to all clients except those that expect them.