On the Second Life blog you can read the question “Is your password secure” followed by some hints on how to make a good password choice, to not use the same password everywhere and so on.

But the real question is: Why does Second Life still does not support OpenID? And why is the SLim-Client not authenticating via OAuth? This would actually make the additional password you have to setup with Vivox unnecessary, OAuth could be directly built into the SLim-Client. One password less to remember.

Additionally:  Back then we learned that they are using MD5 at least for the credit card hash but they are using it probably also for password hashes (assuming from the Open Grid Protocol docs). MD5 should be assumed to be broken though so I wonder if they upgraded to a better algorithm like SHA1.

I also hope that all their staff has good and secure passwords because you can do much more harm in god mode which might have been what happened to Twitter.

Here is a special XMAS present for you: More OpenID!

DailyMotion implements an OpenID login

As you can see in the screenshot below you now have quite some options to login to dailymotion.com, including OpenID. They also explain what it is, which is very very good!

OpenID coming to virtual worlds

As Justin reports on his blog, OpenSim, the open source implementation of a Second Life server, now also supports OpenID. For now it’s just an OpenID provider but I hope client code will also be added soon!

Other news

OpenID foundation members can now vote to approve the PAPE specification. Right now it’s in draft state and the 60 day review period is over so it can be made official. Voting is open between December 22th and 29th.

Also don’t forget to vote for the election of the OpenID foundation board, open until tomorrow!

After the Trademark policy change, where Linden Lab made clear that it’s indeed not the world of their customers (once known as residents) but in fact their own one, somebody remarked that the slogan “Your world. Your Imagination” was getting smaller and smaller with each iteration of the homepage. Unfortunately I forgot who said that but I with the discussion of the new homepage (in proper Linden Lab tradition announced in advance with a fixed date which now has passed without showing up the new page) I went looking for it on archive.org. So here it is:

May 2004

January 2005

SL Banner Today

So in fact it got smaller and smaller. But with the announced new homepage it now is totally gone!

So it’s of course not that customers are unimportant now, they do that in order to gain more of those. But they don’t have a say in things. Linden Lab seems happy to let them create that world but owning, thanks no! That’s sad.

Then again not too long ago there have been times where you saw this on the homepage:

That was February 2007 which was when the world was still good and you owned what you created.

As BoingBoing reports (via James Wagner Au, a journalist well known for his insights into virtual worlds), the FCC transition team has Kevin Werbach and Susan Crawford on it. Kevin seems to be a passionate WoW-player and Susan Crawford knows her way around in Second Life (as does Cory Doctorow, btw).

Of course they also have expertise in many different areas of technology but to have knowledge in these areas as well - something which is already or will be a big part of our future life - is a very good thing to have.

German politicians OTOH are still trying to understand the basics of the internet and by doing so “accidently” shutting down wikipedia.de. There is a long way to go for us!

[via BoingBoing]

Technorati Tags: fcc, virtualworlds, boingboing, obama, transition, wow, games, gaming

The Podcast

Download as MP3 (17 MB, 18:00)

So after a long time which made me forget whether how my german and english podcasts are actually called I made one again. So it’s TopfCast #7 and it’s about the problems of OpenID, the problems of the Open Grid Protocol and my attempt at redefining OGP to use more common standards (more about all this in a separate blogpost someday).

How to reach me?

E-Mail: mrtopf@gmail.com

Shownotes

The OpenID UX Summit
Facebook Connect vs. OpenID
Open Grid Protocol
alternative Open Grid Protocol
German podcast about the open web

As we all know, blogs are a great tool for a brand to communicate with their customers and community. And as we bloggers all know ourselves there is always the balance you need to find when it comes to comments. Do you require an account with your blog? Do you have some captcha on your site, do you do moderation?

Linden Lab now has chosen to lock down commenting to only logged in users. As Robin Linden writes:

This seemingly small but fundamental change will, over time, allow us to greatly expand the convenience and utility of the blog (and in the next phase, the forums).

But is this a small change? If you look at the blog you notice a very reduced number of blog posts but also comments recently. One can say, the communication between Linden Lab and their community is already declining (which is part of the discussion actually going on in the comments). Adding the need for a login will further strengthen this trend. It also means that people who don’t yet have a Second Life account cannot comment at all.

I think in order to keep a conversation going (as you know, “Markets are conversations”) you need to make this happen as easy as possible. This is especially important for brands these days. It might mean you have more maintenance work to do on the comment side but today you just need to have a budget for this.

Das meiste steht ja oben, daher die dt. Kurzfassung: Das Telekom-Paket, welches immernoch eine Bedrohung für die Freiheit des Internets und dessen Nutzer steht, steht im EU-Parlament zur ersten Abstimmung. Kontaktiert euren EU-Abgeordneten und sagt ihr oder ihm,

• für Ammendment 138 zu stimmen (besagt, dass ein Richter im Prozess immer benötigt wird),
• gegen Ammendment 34 zu stimmen (ist eine Gefahr für unsere Privatsphäre im Namen von illegalem Filesharing)
• den weiteren Abstimmungsempfehlungen von La Quadrature du Net zu folgen

Hilfreiche Links:

• Hier findet ihr euren EU-Abgordeneten
• Helft mit, diese Info zu verbreiten!
• Weitere Infos bei netzpolitik.org

Technorati Tags: telecomspackage, eu

It has been September 13th 2007 when Linden Lab invited a initial group of residents to the first Architecture Standards Working Group meeting. Liana Linden explained the goal of this group as follows:

This working group is a first step in how Linden Lab would like to open
up Second Life to being the protocol of an open, expanded platform. At
this meeting, we will discuss the next architectural framework of Second
Life, the infrastructure protocols used, and our vision for how other
people will be able to extend the Second Life Grid platform. It will be
highly technical in nature, examining both code and detailed designs.

And while Second Life back then feeled to me like the early web where everything still was possible and you could see new cool things everyday, it was even cooler to attend this meeting as it felt like reinventing the internet or what might become the future of the internet. Unfortunately though I wasn’t in SF but only participating remotely via SL which was a bit limiting, but it might still be some point in time to which we can look back in the future and say that this was the point where history was made (but maybe not ).

Lots has happened since although it started a bit slowly and the rest of the year not much really happened. It seemed to go the way many Linden Lab projects go: nowhere.

But it took of in early 2008 when Linden Lab put some resources behind this. And on March 11th Zero Linden released the first draft of the Second Life Grid Open Grid Protocol (or SLGOGP as it was called back then). After raising the issue early on that a Second Life branding of this protocol might not be too good for getting non-SL folks in (and today also in the light of this silly trademark behaviour of Linden Lab) we managed to get this called just “Open Grid Protocol” though.

What has happened since

Initially there has been lots of wild discussions about a variety of different topics, such as trust (of course), scalability, 3D data formats, communication and much more. Many of these discussions resulted in the creation of an Viewpoint Advocacy Group which’s purpose is to look at the Open Grid Protocol from specific viewpoint with use cases and see if those requirements can be fulfilled. Those groups seem not to be too active but they have some use cases which can be revisited.

The most important group which was created though was the AW Groupies group which is an informal group discussing all these issues. It’s main meeting is tuesdays at 9:30 am SLT on ThornBridgeTown. Unfortunately you need to be invited to the group but getting in should be quite easy by just sending an IM to Saijanai Kuhn or Zha Ewry.
(and quite honestly this invite only thing should be removed).

Further communication about the protocol happens during Zero Linden’s office hours, the pyOGP coders meeting (but this is mostly specific to the pyOGP library), the Open Grid Public Beta huddle, Whump Linden’s office hours and the OpenSim office hours. You can find all the dates here on the wiki.

Where are we?

Last week Draft 3 of the Open Grid Protocol has been released. It now has been structured into several sub documents describing things like the data structure, how to authenticate and how to teleport. This also describes how far we are, login and teleport is described but nothing more yet. Disussions are going on on which topic to tackle next. There has been much discussion about trust (see my blog post about it here and Inifity Linden’s page about trust) and about Instant Messaging (see the wiki page here).

On the software front we have the Open Grid Public Beta program (IMHO slightly misnamed ) which basically consists of a patched Agent Domain run by Linden Lab, a patched client to work with it and an adjusted OpenSim to work together.

We also started the pyogp project which’s purpose is to create a Python library for all sorts of OGP components. I personally also added AgentDomain support to it and created syntronik.de, an open source AgentDomain on top of Plone. The pyogp team is also working on a test harness to test OGP components.

What can be better?

It’s always debatable if progress could be faster. We have lots of very special problems to solve and to discuss and we have an existing user community to which we need to explain the changes properly. But there are of course still things which might be better (but which are my personal opinion) like:

• Use a mailing list instead of in-world meetings to discuss issues. Attending in-world meetings is always more demanding than reading a mailing list. The other problem is when you cannot attend because reading chatlogs is even more tedious and will also make it harder for new participants to get in. I noticed this now where I couldn’t attend 2 meetings and I feel quite out of the loop.
• Create a dedicated OGP list. sldev seems limited as discussions are supposed to move off the list after a while which IMHO does not really help the issues. sldev also seems to be too crowded with topics already (which might be the reason for this rule).
• Define a process on how to write the protocol. Define how a decision is made, how input can be made and also timeframes for discussions and final stages. Also define how we decide on which component to work next. Decisions usually seem to take ages.
• Define how things are deployed. As we mostly have the Linden Lab Agent Domain right now it’s important to know when things change so you can adjust your setup accordingly. Maybe a separate announce mailing list would help.
• Use a better commenting system for the OGP wiki page. The discuss links are ok but not really ideal.
• Create a foundation to own the specification, the source code and the trademark. Or use the Open Web Foundation although it’s not really about the web. This of course seems to be somewhat illusory to happen, esp. the TM thing. It’s also quite some work.
• Work more with the web scene. It seems to me that we are working behind our own walled garden and sometimes thinking about reinventing the wheel. On the web things like OAuth, XRDS-Simple and other standards are on the rise and IMHO we should see how we can use them. Additionally it would be great to build some bridge between these two worlds as in the future they need to get together, otherwise it won’t work.
• An easy to understand description of what OGP is (hopefully in different languages), what it consists of, what it means to Second Life residents, content creators, other virtual world companies, for the war against terrorism and world peace.

I think one project where it at least seems to work quite well is OpenSocial. They have some Google groups, one is dedicated for the specification work only. They have this foundation, they seem to have a very fast speed on defining things and deciding on protocol issues. You can read up on their process here.

Great things ahead

When I look at the list above we indeed made some progress although much is also ahead of us. Depending on how we manage to get other people on board and how we can integrate with the rest of the internet, many great opportunities are ahead of us. Be it scientific simulations, integrating 3D into social networks, business collaboration, education, marketing and all the stuff we cannot think of yet.

On the way we might even solve the data portability problem which basically consists of the many account/friendslist/asset problem on social networks. If we manage to make a very web compatible protocol this might even serve as an example of how to do it right. It also has the potential of wide adoption.

So while world peace might be in a somewhat distant future, an internet without boundaries might be not.

Technorati-Tags: ogp, opengridprotocol, anniversary, awg, awgroupies

While social networks and virtual worlds might share a lot of things except maybe the 3D part there is at least one thing which more care needs to be taken of when thinking about virtual worlds: Trust.

Trust in terms of which services do I trust to let the objects I created go. As there is a huge economy in Second Life around selling virtual goods, it’s very important to content creators that their content is not copied.

This issue is of course even more important when thinking about a distributed grid where everybody can hook up their own servers. We call this the Open Grid Protocol.

A lot of discussions happened already, many more will happen. That was reason for us (that’s me and Dirk Krause/Bartholomaeus Kleiber) to sit together an afternoon thinking about use cases, requirements and so on. We wanted to concentrate in general on what is needed for objects to travel the grid.

The short summary: It’s all very confusing

In this 2-part series I want to first look at the easier issues of service and user level trust before I dig into the issues of transferring objects from service to service.

But let’s start at the beginning.

Some ways of looking at things

When it comes to trust first of all we need to define what “trust” means. We also need to define between which parties we define trust.

You might look at some sort of service level trust which involves servers. One domain could wonder if it should trust another domain (e.g. if some Region Domain trusts some Agent Domain or vice versa or even AD-AD or RD-RD etc.).

Then there is something I would call user level trust which defines if user A trusts user B.

But in virtual worlds we also have objects so probably we also need something which defines if an object (representing the creator and thus a user) trusts some domain. So we could call that user-service level trust.

These are just words though but maybe it helps to have these.

Service Level Trust

So what is service level trust?

In this area questions like this come:

• How do we make sure you cannot fake some agent domain and thus maybe impersonate some other person?
• How can the agent domain be sure that it gives out some object to the region domain it thinks it is?

The answer to these questions is probably simple: Use SSL (or in more general terms certificates). Then at least you can be sure that the service at the other end has that certificate. Usually this party is also the owner of the certificate (in a legal sense).

Then there is the question: Once I identified the domain to be the one I think it is, how do I decide which services I offer to it? E.g. if I should take objects from it, or avatars?

The discussion we had at some AWGroupies meetings tended to end up in letting the implementation define this and IMHO this makes much sense.

There might be different criteria to do such a decision:

• Do we have a contract with that domain?
• Does some reputation service say that this is a good domain? (and do we trust that service?=
• Do we maybe follow some chain of trust and can ask some other domain? (sort of a reputation service I guess)

Implementations can be manyfold, using whitelists, blacklists and so on.

As for the Open Grid Protocol this does also not just apply between Agent Domains and Region Domains but might also apply between external service. IMHO it makes sense anyway to move as many services as possible out of the predefined domains to make them more interoperable and more easily exchangeable.

User Level Trust

This actually is something which is maybe more discussed in the social networking. One group which’s aim is to discuss such things is the DataPortability group (Disclaimer: While I am voting member of the Steering Group there these here are just my personal thoughts)

Things you might want to do here might include:

• not showing your complete profile to somebody
• showing e.g. your email address to only certain other users
• muting/banning users
• not showing up in searches for some particular user

Such decisions can be made by checking if it’s some contact, some specially tagged contact, an individual whitelist/blacklist, some reputation service etc. It might even involve service level decisions like that a user might want to say that he never wants her email address to be transferred to AD Y or RD X.

Of course you as a user need to trust the service you have chosen to comply to your preferences. And you need to be aware of the fact that services which have access to data (or your contacts) might spread it further. But there is no way around this except maybe adding a license to it which defines what is allowed and not. And which hopefully has some power to pursue people legal wise if you wish so. We hope to get some talk about such approaches soon going again in the DataPortability forum.

I think here is much to benefit from both scenes, web and VWs, as both have their slightly different details and demographics but also much in common. I also assume that both worlds will grow together even more over time and you maybe only want to maintain one account for all your virtual worlds and your social networks, instant messaging services etc.

And this is it for this part, please check back soon (or subscribe to my blog) to read part 2 about the issues regarding object transfers.

Technorati Tags: ogp, opengridprotocol, dataportability, trust

One idea which is bouncing around among people interested in data portability is to only have one user account and freely go from service to service, taking your data with you. No need to signup again and again, importing your data again and again, finding your friends again and again and all that jazz.

This vision seems to be somewhat away in the field of social networks (but we are fighting for it) but in the field of virtual worlds we are moving with big steps towards this goal!

Today we (that is COM.lounge) launched syntronik.de, the first native Agent Domain implementation for the Open Grid Protocol based on Plone. This might not say much to you but let me explain it.

What is the Open Grid Protocol?

The Open Grid Protocol is developed by the Architecture Working Group founded by Linden Lab in September 2007. This protocol aims at breaking down the walls between virtual worlds, think of it maybe as the HTTP for the 3D internet.

In the Open Grid Protocol there are Agent Domains which hold all the users with their profiles, groups, friends, etc. and there are Region Domains, the actual 3D environments. Given you have the permission the protocol allows you to freely connect from any Agent Domain to any Region Domain thus enabling a truly open and global virtual world.

syntronik.de is our proof of concept of such an Agent Domain and it works! You can create an account and you can then use that account to login to any Open Grid enabled region. Right now there are about 30 of these regions listed for the Open Grid Public Beta program. This list is growing.

After the initial teleport between grids done by Linden Lab and IBM engineers this is an important steps towards the goal of a global network of virtual worlds. The Open Grid Protocol is very much at it’s beginning but we are moving forward quickly.

What is it built upon?

As the basis for the actual website we used the CMS Plone. The reason is simple: An Agent Domain aims to be implemented on existing user bases such as those in social networks. Using Plone gave us the opportunity to find out how such an Agent Domain component can be developed in a non-invasive way. This means without changing much of the actual data model etc. I will write more about how we solved this in a future article.

The other component we used was the pyogp library, an open source implementation of the Open Grid Protocol as it stands today. We are also heavily involved in the pyogp project. The Agent Domain component we developed for syntronik.de will also be part of the pyogp project.

Where is the source?

The source code will be released soon. The Agent Domain component will be part of pyogp, the Plone related component will be put into the Plone collective. This will then close the gap in the open source environment where the only missing open source piece was an Agent Domain implementation (The Second Life client is released under the GPL, Open Sim which is used as Region Domain is released under a BSD license and the Agent Domain component now is released under an Apache License).

How does it look like?

Just check it out over at syntronik.de and create an account or watch this screencast:

Syntronik.de Screencast from MrTopf on Vimeo

What’s the future?

As said, this is a proof of concept. We will continue to work on this project on all fronts and would like people to join it. There is much to do in the specification of the Open Grid Protocol, in the implementation of it in pyogp and in the implementation of Agent Domains. It would be very cool of course would somebody also start a Region Domain or some sort of client based on pyogp.

Maybe we can also influence the social networking scene with this work and vice versa. This at least is my personal goal.

Thanks!

I would like to thank Linden Lab for starting this effort, the OpenSim team for creating an open source server, David Levine (Zha Ewry) from IBM for creating the initial patch for making OpenSim Open Grid compatible, the pyogp team, especially Locklainn Linden for doing a lot of coding and Lawson English (Saijanai Kuhn) for knowing everything about the protocol. And of course in general everybody helping to make the Open Grid a reality!

Technorati-Tags: opengridprotocol, ogp, opengrid, virtualworlds, secondlife, comlounge, syntronik