Lachstock

Pimping your Github Commits JS-styley

lachlan.hardy@gmail.com (lachlanhardy) — Thu, 30 Oct 2008 09:52:00 GMT

If you, like me, have developed strong feelings towards the geeky hotness that is Git sometime in the last 12 or so months, then you’ve probably also got pretty excited about the convivial oldskool swap meet for Git repos known as Github. If not, please do try to keep up. The first day of the rest of your life begins here.

For a long list of dumb reasons beginning with the fact I’ve not yet written my own roughly passable blogging engine to replace this shopworn and shabby edifice constructed with Simplelog 2, I am unable to write server-side shenanigans for my homepage and so have taken to Frankensteining it experimentally with concoctions made of HTML5 and jQuery. One of these little monsters shows glimmers of potential and thus is being released into the world to find its destiny.

You want to brag about your Github commits?

Skitchshot: Lachlan Hardy

Wouldn’t you love a JavaScript badge that looks just like this?! Me too! Boy, have you come to the right place!

I assumed such a badge would already exist. I knew, of course, of Dr Nic’s project-based badge and I quickly discovered the commit badge by Johannes Gilger. The former doesn’t show commits and the latter is targeted at the latest commit of a specific project. Neither of these met my needs in terms of function or code, thus my own Github commit badge project was born!

How does it work?

One of the current limitations of the Github API is that it doesn’t provide any methods to gain details about other people’s projects you might be committing to. Given a project, you can check that. But given a user, you can’t see what projects belonging to other users they’ve contributed to. Which is at least two thirds of the fun of Github! Luckily, they publish that kind of data in your public activity feed.

So, given a username, the script calls a specially crafted Yahoo! Pipe that converts Github’s Atom into delicious usable JSONP for processing into a badass little badge for your blog.

How do I set it up?

Here’s the juicy bit. Be sure to follow along at home for maximum enjoyment. You can download the files from Github.

Dependencies

jQuery 1.2.6 - as you’ll see in the example file, I just point to those nice folks at Google who are hosting jQuery for me.

JavaScript Pretty Date - I also grabbed a copy of John Resig’s Pretty Date to save myself long hours in front of the mirror getting ready.

The Action

github-activity.js is where the main action goes down. You’ll need that one.

Then you need to add a div with an id of ‘github’, containing a p, somewhere on your page. There’s a nice sample in the example file.

After that, you just need to call the function githubActivity(); onDOMready. I have a Go file for that, but you can do it directly in your document if you like.

I’ve included some sample CSS to get you started on prettifying the whole shebang. It includes blank selectors for every element created, just in case you want to go buck wild in Style Town.

All things being equal, you should end up with something that looks pretty much like this one I prepared earlier.

What next?

You’ll have noticed that I keep calling my commit badge an ‘activity badge’. That’s because it feels like such a waste to pull down all that other data and not use it. There’s no reason we can’t publish Follow, Gist, Wiki and Member events too. And any others Github may have up their sleeves. I plan on setting it up with defaults and options to make it easily customisable.

The glaringly ugly bit of code (to my eyes, but please point out any you see) is the parseDate() function. It’s ugly, dumb, badly written, and inaccurate. Kindly suggest replacements or write them yourselves and let me know.

I’m going to keep working on functionality, but in the interest of Just Fucking Shipping, here it is, a Github Commit Badge that’s still got some room to grow. Feel free to use it, change it, fix it, share it and abuse it.

Let me know what you think!

Gitjour: the Quickening

lachlan.hardy@gmail.com (lachlanhardy) — Mon, 20 Oct 2008 05:26:00 GMT

Back in June, a whole lot of folks in the Ruby world were getting excited about Gitjour and it’s *jour brethren. Read Dr Nic for the lowdown. He was particularly excited about the potential of using all these automated DNSSD-powered advertising services at the forthcoming Railscamp #3. And so was I.

I installed every one of those suckers, and fired them up, and had a play. They were awesome ideas but I thought they were a bit limited in their execution. Don’t get me wrong, as a quick conference hack, they’re brilliant. And for quickly sharing some cool shiz with your friends in the back of a session - perfect. Not so good for 4 days of intense hackery with 60-something coders on the one network. Not so good as a day-to-day tool in a work environment.

Railscamp #3

I spent the first portion of Friday night at Railscamp catching up with folks, as you do. Having a few beers, seeing what they’ve been doing and talking about what we’re going to build over the weekend. I think I might have pointed out the potential for new features in Gitjour just a few times. Just once or twice, you know?

Finally, Mike Bailey calls me on it and we get coding. And everybody I’d whinged to about the potential of Gitjour joins in.

By the end of last Railscamp, we’d refactored significantly, squished many bugs, added proxies for cloning and remotes as well as a search. Not to mention spawned a couple of side-projects: Gitman and Gitnotify.

All our code ended up in the Railscamp repo where, except for an excellent summary post from Lachie Cox, we all forgot about it.

Fedex IX

Atlassian has a quarterly hacking event called Fedex (“deliver overnight”). Basically, everybody gets from 2pm Thursday (in Sydney) to 4pm Friday to hack up whatever they like as long as it is somewhat associated with the company. Then they present, and everybody votes for awesomeness. You’ll have heard of similar events at other companies etc.

Fedex IX was a week ago, and Don Brown hit me up, asking for a method to allow easy local sharing of git repositories. He has a grand master plan I’m sure he will reveal in time.

That’s when I realised we never told anybody about our revamp of Gitjour. We never pimped all the badass improvements we made. That’s dumb for so many reasons, but the biggest is easily that there are hackers out there who need a sweet tool for sharing git repos with colleagues and friends and we didn’t tell them. This makes me sad.

So, my Fedex project quickly became shaping our Gitjour into something nice and stable for everybody else to enjoy. I forked Chad Fowler’s original and I worked out how to mash it together with ours. There are probably faster and neater methods, but I found one that worked. Boy, did I learn a few things about Git that day!

Then I made a couple of bug fixes, tidied things up, battled multiple methods of gem building until I got them to work and made my first ever pull request on Github. Hopefully, Chad will be happy to merge all our work in, but meanwhile you can get all that railscamping goodness on my Github account, or just install the gem:

sudo gem install lachlanhardy-gitjour

Railscamp #4

Very soon, a bunch of hackers are going to be stuck in the middle of nowhere on one network and need to share their work. And I’m going to be there, pointing out what’s wrong with Gitjour and why we should merge in Gitnotify and Gitman so that we have one seriously badass tool that’ll make working with Git the easiest thing you’ve ever done. Sharing those repos can be easier than it is now. And it should be.

And when we’ve built more crazy awesomeness, I’m going to remember to scream it from the rooftops because I want everybody to know that the tools are already here - they just need a little more work. Do you want to help?

Podcast For Your Pleasure

lachlan.hardy@gmail.com (lachlanhardy) — Thu, 04 Sep 2008 20:36:00 GMT

Photo: Local Government Web Network

The Video

The moment I’ve been dreading for the last few weeks has arrived. The footage of my closing keynote at the LGwebnetwork conference is up on their website. Diana Mounter has posted a very nice introduction to it, you can watch the full video in a few different formats and I have a post with more details and the slides.

I’ve been feeling masochistic this week, so I’ve watched it myself and cringed at the appropriate moments, like when my mic fell off. Diana promised to have that edited out, but I knew at the time they wouldn’t… and they didn’t.

I want to apologise for neglecting to repeat the questions from the audience and for the few gross generalisations I dropped in to keep things moving along. Hopefully, you can pick up the context of the questions from my responses.

In other related news, I am loving the very cool thank you gift from the conference organisers.

It was an honour to deliver this presentation. I’m really excited about the Open Web I see developing and I want to share that with everybody. Thanks to all of you who’ve contacted me with your own comments, opinions and passion. I really do believe we’re building a beautiful, free, and open web!

Local Government on the Open Web

lachlan.hardy@gmail.com (lachlanhardy) — Tue, 26 Aug 2008 01:19:00 GMT

Photo: Ben Buchanan

The Presentation

The awesome team of Diana Mounter and Reem Abdelaty from the LGwebnetwork asked if I would deliver the closing keynote for their first ever web conference, WE Believe in Community. I was honoured to accept.

I wanted to show people what I see in the web. What I see happening. Where I think everything is going. But I’m a firm believer in showing people techniques and technologies they can use right now. All of which made it very easy for me to talk about the Open Web. There’s an entire blog post I’ve been meaning to write for a long time about that, so we won’t get into it here. This is just to post my slides and to say that video and a podcast will be forthcoming at some point in the future. (I hear end of the week.) Update: Video is now available.

view presentation tags: eaut oauth microid openid

The conference

Put together in only a few months to meet a pressing need for stronger networking and more formal professional development for local government web workers, the entire experience was amazing. Both Reem and Diana radiate energy and passion and they communicated this to every attendee. There was a huge buzz of engagement and involvement. It was a real privilege to be a part of it!

The other big win of the two days was the outstanding quality of the content. John Allsopp delivered a stirring opening keynote of what constitutes the web and how you can expect to access it going forward. He delivered some concepts I’m going to be thinking about for a long time. I particularly enjoyed these quotes too:

“the web just connects stuff together, do you really think you need a screen?”; and
“local government should be be building the networks, they’re the sewers of the 21st century”.

Another presentation that I really enjoyed was Matthew Hodgson on the death and rebirth of intranets. He had a clever premise and great solid content that intertwined really well. He also managed to record himself, so he has audio up already! Unfortunately, I missed Ruth Ellison’s as she was just before me (and I was in the tea room doing the obsessive compulsive slide check), but she has her (and Adrian’s) slides up already along with a great summation of each presentation she saw. There were lots of other great speakers, so hopefully they’ll be putting their slides up soon too.

Photo: Ruth Ellison

All up, a fantastic couple of days. Thanks to all the great new people I met for arguing with me over drinks about the open web and why it’s important. And thanks again to Diana and Reem for creating such a charged event! Not to mention the incredibly generous gift thanking speakers &emdash; a customised iPod Shuffle.

See more photos and tweets on the Open Web.

Internet Gurus

lachlan.hardy@gmail.com (lachlanhardy) — Tue, 19 Aug 2008 06:30:00 GMT

Questions

A couple of weeks ago, I got an email from Nick Galvin, a Features Writer with the Sydney Morning Herald, asking if I’d be interested in answering some quick questions about what’s hot on the web for a feature in their weekly technology supplement for the “interested home user”, Icon. I jumped at the chance and thanks must go to John Allsopp recommending me.

The piece was published today and I finally got see who the other people were. I put a scan on my Flickrstream so you can read the full text at either Large or Original (bloody large). Huge thanks must go to the legendary Seng Mah for yet again allowing me to use his photo of me from last August as my publicly respectable face.

Update: Turns out the article did get published online, so it’s much easier to read there.

Answers

What I found most interesting is comparing my answers with those of Cheryl, Virginia, Tim and John. The differences are more telling than the similarities, I think. Cheryl’s answers are consumer-focused, John talks about the big picture and Tim can’t help but dish on what’s important to developers. Of the four, Virginia’s are probably closest to mine in ideas, although hers are expressed far more beautifully. (And she led me to a gorgeous new theme for my tumblelog!)

I copped a bit of a ribbing at work about the reference in the standfirst to ‘internet gurus’. Fair enough. I find it amusing too. Thing is, though, that I know some other internet gurus.

Anybody willing to spend any time at all reading my infrequent posts is automatically qualified as pretty damn interested in the internet (or related to me. Hi, Mum!). So I want to know what you would have answered. What are your responses to the three questions? You don’t have to stick to 180 words like we did!

What are the three things online that are exciting you most?
What gadget do you never leave home without? And given most everybody will say their phone or their laptop, why?
What will be the Next Big Thing?

Add answers or links to answers below.

A Twitterrific Troll Filter

lachlan.hardy@gmail.com (lachlanhardy) — Sun, 03 Aug 2008 21:20:00 GMT

Talking to some friends recently about the signal-to-noise ratio on Twitter, I realised they hadn’t seen the Twitterific readme file. It contains some “Power User” settings that you can run in your terminal. Some you may find useful; others not so much.

I only use two. The first is straightforward. The discontinuity of real names in Twitterific jars me. I prefer the consistency of usernames everywhere, so I use a simple switch to displayScreenName instead. The real value, however, lies in the tweetTextFilter command.

This command allows you to define an ICU regular expression to filter pretty much anything under the sun. My example below isn’t very complicated. It simply blocks all tweets that mention either Techcrunch, or ‘griefer’, or refer to a user by name of ‘fanboi’. The difference between the last two being that I see no references to ‘griefer’ at all, whereas I can still see when ‘fanboi’ replies to me but not when others reply to, or reference, her or him. The first file is just my .gitignore file to exclude the actual filter I use.

Update: I’ve added the ‘Olympics’ and ‘080808’ because I’m a grouch. (Well, partly because I’m stupidly busy, but mostly because I’m a grouch.)

I decided to post this after seeing Tantek's work towards a Troll Filter for Twitter searches. There are people and sites I prefer to exclude from my life where possible. Mostly because they continually take time and energy for little return.

This is a simple method for cutting those sites/people from at least one part of your life. I still follow the occasional link to Techcrunch and similar sites that’s been encoded by TinyURL et al because I’m not quite ready for a scorched earth policy, but every other mention slips me by. And guess what? I don’t miss it at all.

As for the infrequent and occasional griefer or fanboi-inspiring micro-celebrity in my life, I carry on blissfully ignorant of whatever negative emotions they typically cause in me that earned them the brand.

I've posted the commands on Github’s Gist for anybody who wants to fork it and add their own parameters (and because I wanted to try out Gist). I’d love to see anybody expand on this, or any of the other power options. If you want to confirm your regular expressions do what you planned, there is a live testing page available.

Action > Reaction

lachlan.hardy@gmail.com (lachlanhardy) — Mon, 28 Jul 2008 02:21:00 GMT

Over the last few months, people have begun asking me: “How do you do so much? How do you keep up with it all?”

Now, I don’t think I do as much as some of you think I do. I don’t feel like I’ve achieved anywhere near the things I should have lately, so I began thinking about those questions.

I do a lot of thinking. I like it. It’s one of my favourite things and I like to think that I’m good at it.

But where do thoughts come from?

Don’t worry, this isn’t going to be a blathering of random metaphysical esoterica. What I mean is: ‘Why do I have these thoughts?

On thoughts

The answer is that thoughts stem from various external stimuli. From the conversations I have with the smart and talented people I’m honoured to call my friends and colleagues; from the blogs I read (also written by smart and talented folks, as far as I can tell); from the emails I receive: personal, business and mailing lists. From all these places and more, my thoughts spring. They tumble together in little parcels of disjointed meaning, scattered threads of random thought that bounce against each other constantly and gradually weave into cogency or are discarded.

On distractions

I’ve written before that I don’t enjoy the quiet stillness inside my mind, but that’s untrue. I have plenty of other reasons to dislike being alone with my thoughts, which are neither quiet nor still.

I don’t own a portable music-player of any description, because I tell myself that would be a distraction, that my brain needs a rest from incessant stimulation. The result is, of course, that I check Twitter from my N95 approximately forty times on my forty-five minute trip to work.

It’s odd that music, which aids me in so many facets of my life, can distract me so thoroughly from the rush and scurry in my brain. Or perhaps that is precisely the point. Music abstracts me from the current flow, insulates me, and allows me to achieve particular tasks with a stronger focus than if it were absent. Without those tasks, it just distracts me.

On escapism

None of this is likely to come as a surprise to you. We all need to get away, to take a time out, a little pause to regain our breath and our focus. Therein lies the problem for me.

Why do I need to watch yet another episode of the West Wing today? Or check my email, my feeds, Twitter, Flickr, again? Why do I need to take a book on RESTful Web Services to bed at night? For that matter, why do I stay up beyond all sensible hours until I’m so exhausted that my right eye starts literally twitching? Even now I’m listening to Ten (only the best album ever) and pausing periodically in my progress with this article to lose myself in the songs.

Where is the focus in that?

In which our intrepid hero takes action

The problem here does not lie with things like checking my email or my feeds. It doesn’t come from the external stimuli. It comes from when they are applied.

What’s the first thing you do every morning? Me, I open 4 tabs in my browser: Gmail, Google Reader, Twitter replies, and Flickr recent activity. While I wait for those to load, I switch to Mail to confirm I haven’t received any work-related email overnight.

Next, I “process” all the information on those pages and that sets me up for a good long day of reacting.

Fuck reacting. Act!

Over lunch one day, one of the founders of Atlassian, Scott Farquhar, said that he had recently been trialling not opening his email until midday each day. I tried it. I think I lasted about three days.

Now I’m going to do it again. And the same goes for my feeds, Flickr et al.

But wait, there’s more!

I’m also unsubscribing from all those feeds that I’m only following because I feel I should ‘keep in the loop’, and from all the mailing lists whose communities I don’t actively participate in.

I already vigorously prune my feeds and my contacts on social networking sites I use regularly.

A challenge

I have a challenge for you. It’s also for myself. Let’s see if we can’t do it together.

I have cut all these distractions from my life. I will cut more. I will carve away every input that does not lead to action. I will push the reactive part of my day back until after lunchtime.

I’m going to start putting my thoughts to work. All those bundles of meaning have been assembled into functional parts that need structure. They need a coherent whole and I can only provide it by taking action.

I’d like to see you do it too. Maybe some of you were already on the ball with this one, but I think we probably all need a little push and a lot of pruning on occasion.

Get to it. Drop the distractions. Take actions instead.

I want people to ask you: “how do you do so much?”

Remix Australia Rocked!

lachlan.hardy@gmail.com (lachlanhardy) — Sat, 24 May 2008 20:31:00 GMT

I was very pleased to be speaking at Remix Australia this week. Thanks must go to Michael Kordahi, Shane Morris, and Nick Hodge for trusting that a guy who hadn’t done a public presentation in nearly a year could deliver the goods.

Talking ‘bout a revolution

Damian Edwards and I were asked to do the IE8 session together. The point of the session was to give an overview of the new features and capabilities, in particular the brand-spanking new standards-compliant rendering engine. We also decided to make the most of the opportunity to pimp standards-based design methodologies and concepts to the .NET and Silverlight focused crowd.

Damian took responsibility for developing solid demos to illustrate standards-based design techniques and the innovations in IE8 such as WebSlices and Activities. I delivered the historical context, the philosophy and the concepts we wanted to impart.

I think we ended up with a solidly crafted presentation that wove the themes of Internet Explorer 8’s development principles, standards-based design philosophies and best practice web innovation together. We’ve had some great feedback so far and one member of the Melbourne audience even said: That was the most concise succinct explanation of those concepts I’ve ever heard. This was the most productive session of the day for me. Obviously Damian and I are rapt that somebody felt so strongly about our work. That really made the day for me.

Huge thanks to Damian for all the work he put in to make sure we nailed it!

I’ve added the presentation to Slideshare, although it won’t be anywhere near as cool without all the demos and we used the slides for points of reference rather than as detailed content:

| View | Upload your own

Turns out Damo posted the code from the demos on his blog.

Rolling with my homies

As ever, the absolute best part of the conference was all the amazing incredible talented people I got to meet, talk with and hang with.

Mark Pesce delivered a stirring call to action for all developers in the keynote. We hold the key to the future. We’re the ones who can empower both the public and our own organisations by building the right tools. You can read his speech in its entirety on his blog and the video has just been posted. Go get some!

I met the incredibly friendly folks from Soul Solutions at the first speaker rehearsals. Bronwen Zande and John O’Brien are two of the nicest, most genuine people I’ve met in a long time and they build awesome stuff too as I discovered when I watched their demos in the Windows Live Platform sessions. I’ve been expecting to see presence indication in more and more sites and it was cool to see how they’d integrated IM into their applications seamlessly.

My favourite presentation of the conference was easily the one covering the new possibilities in Silverlight 2. Jonas Follesø built an awesome Twitter/Flickr mashup in front of us in about 35 minutes, while explaining in precise detail every step and the reasoning for it. The source and slides are available at that link. If that wasn’t incredible enough (and it was), José Fajardo demonstrated some really astonishing DeepZoom prototypes he’d built.

José decided that people haven’t recognised the true potential in DeepZoom and so he asked himself 3 questions, then tried to answer them each in code within 30 minutes. He showed us the results and convinced me, at least, that we need to be looking much further ahead than we have been with interactions on the web.

His questions went something like this:

What if every image on the web were DeepZoomable?
What if we had full control over every document on the web?
What if people could share DeepZoom images easily?

I don’t have the precise questions and I don’t want to steal his thunder for when he blogs it (you are blogging this, right, José?), but his examples were simply phenomenal. I’m going to be asking myself a lot of questions like this in future – to help myself stretch my knowledge and use of the technologies I know. And to stretch how they’re used by everyone. 30 minute prototyping exercises are the way of the future!

In combination, the presentation by Jonas and José convinced me that I need to learn Silverlight. There is much potential for awesomeness there, if used properly.

I also met the very talented, very cool Hege Rokenes. She’s a Norwegian graphic designer who’s freelancing in Melbourne for the next year or so. She won the Silverlight video clip contest with her Step Back video (Silverlight required – of course). She’s looking for more freelance or a position with a Melbourne company. If you want a talented designer with an interest in web standards and Silverlight, you’d be crazy not to look her up.

I finally got to meet Tatham Oddie, who I really should have met by now as he’s into all the same things I am, but comes at them from a Microsoft technologies angle. He was even at Web Directions South last year! Go read his post on Location Awareness to see why I’m very keen to see what he gets up to next!

And lastly, there were so many other amazing people that I ran into in hallways, stairwells and bars. I have a bunch of business cards, contact details and new Twitter followers, so I’ll be keeping in touch with them too.

Whole lotta love

Many people asked me why I was going to a Microsoft conference. The previous section of this article is why. There are brilliant talented friendly people in every community. Cross-pollination of ideas, philosophies and experiences can only help to push the web forward. Exposure to different ideas and techniques that are new to me can only help me.

I talked to people about my work, both at Atlassian and outside. I shared concepts about integrating with large-scale CMSes, modernising legacy codebases, and promoting the open web. I compared notes on Ruby, Rails, .NET and Java. I learned about new technologies and techniques. I saw cool prototypes and interactions. I think I even convinced a few RIA developers to go learn HTML!

Next time you have the opportunity to go to a conference, do it. Seize the experiences and make them your own. What you get out of a conference comes from what you put in. It’s not just about sitting in sessions and heckling via the backchannel. It’s about participating in every way you can.

I appreciated every second of this week. Remix sums it up nicely.

Ardent about Arduino

lachlan.hardy@gmail.com (lachlanhardy) — Fri, 09 May 2008 00:00:00 GMT

I’ve uncovered a deep dark secret individually guarded by many of the geeks in our local community. It’s only natural that children want to play, to explore, to… experiment. Sometimes as adults, we want the same things. Especially if we can bring our adult skills to bear on our childhood joys. Brothers and sisters, don’t hide your love away. Physical computing is not a sin. Although it can be a delight. Let me explain.

This morning, Dr Nic started tweeting about his urge for a ‘carputer’ of some description. After he started posting links to tiny hardware bits, I pointed him to the Ruby Arduino Development project:

RAD is a framework for programming the Arduino physcial computing platform using Ruby. RAD converts Ruby scripts written using a set of Rails-like conventions and helpers into C source code which can be compiled and run on the Arduino microcontroller. It also provides a set of Rake tasks for automating the compilation and upload process.

WTF is an ‘Arduino’

Arduino is an open-source physical computing platform. You can buy them, build them, and modify them. You can hack on the code or the hardware designs and share your changes with the community.

I’ve not played with them, but after reading articles and mentions of them and other forms of physical computing (such as Sunspots, Phidgets and the like) for the last 12-18 months, I’m incredibly interested.

Not knowing a lot about it, I can’t tell you why Arduino has captured the imagination of the community than I see more than the other similar products, but all I hear is Arduino. And the story was same this morning. After my next tweet mentioned Arduino, the local fans came out of the woodwork in a flurry of tweets.

It turns out that heaps of folks I know, particularly in the local Ruby community have already paid, played and procrastinated with their Arduino bits and pieces - but everyone wants to do more.

Do you need an excuse to play?

Firstly, if you’re interested in Ruby, Rails, Merb and the like, then it looks like peeps will now be bringing their Arduino gear along to Railscamp in June. I’ve added an Arduino section to the Equipment page so that you can list what you’ve got and we can collaboratively ensure we can make the most of it!

For the world outside the rosy bubble, the Australian importers of Arduino gear, Little Bird Electronics , are holding their first Australian Arduino workshop at UTS on the 31st of May.

Update! Little Bird Electronics are now offering a $20 discount to folks using the code ‘LACHSTOCK’ when buying workshop tickets. Thanks, Little Bird!

So if you’ve got a little electronic skeleton in your geek closet, unpack it and come play. It looks like you’ll be in some fantastic company!

Phishing Fools?

lachlan.hardy@gmail.com (lachlanhardy) — Tue, 01 Apr 2008 20:14:00 GMT

This morning, Flickr released a new feature. One that let’s you find your friends from your existing address books on Yahoo! Mail, Gmail and Hotmail. All without providing usernames or passwords. Aren’t APIs wonderful?

I twittered about the new black and got a reply from Amanda asking isn’t that encouraging people to get phished?.

In a nutshell, the answer is yes.

Super green

Folks who think about such things are rejoicing that there are now so many site-specific APIs and authentication protocols such as OAuth that avoid what Jeremy Keith called the Password Anti-pattern. And I’m one of them. The Password Anti-pattern is a Bad Thing™. I don’t think anyone would disagree with that.

Removing the Anti-pattern means that the authenticating site doesn’t get full unlimited access to the account in question. In Flickr’s new feature, they get access to only the details of who is in my Gmail address book - not my emails and certainly not access to any other Google products I may have enabled on that account. Google’s authentication page confirms for me that Flickr is requesting access to only my contacts and only for a one-time use:

Flickr.com is requesting access to your Google Contacts account so that it can access Google Accounts on your behalf. You can revoke access at any time under ‘My Account’. Flickr.com will not have access to your password or any personal information. Learn more.

Flickr.com is only requesting one-time access. If it needs to access Google on your behalf in the future, you will be prompted again for permission.

All of this is hot, hot, hot! As long as you’re actually on Google’s authentication page.

Phishes away!

A major argument Jeremy stated against the Password Anti-pattern is that it teaches people how to be phished, but these new authentication methods don’t fix that. They still teach users that allowing your existing site to authenticate to a third party site is a Good Thing™. It’s a simple matter to produce the appearance of following that authentication process while actually harvesting details.

The solution to this is the same it has always been. The user needs to check the URL of the page they’re on and make the call. The problem with that is also the same as it has always been. Some users, possibly most users, don’t do it.

Are we making things worse?

The new authentication methods may actually train users to phished even more readily than before because there is less of a cognitive cost to the process. Ever since computers came into use, users have been hammered with warnings about the importance of passwords. The web has damaged that somewhat with our profligate password ways, but I reckon there are still plenty of mental alarms to ring when somebody asks for your password.

Using sexy protocols and APIs don’t cause that hesitation. The process has been designed to create a neatly streamlined user experience. Just click a few buttons and it’s over.

A phishing site is unlikely to do that, of course. These days API access requires registering for a key, allowing the API providers to track usage. Providers have varying levels of diligence, but it seems unlikely that an application could do phishing on a significant scale without being caught.

The most likely alternative is that they simply pretend you’re not currently authenticated with the third party site and request your username and password. Hopefully, that’s enough to give pause. Particularly if the app is telling you you’re not authenticated with Hotmail when you have Hotmail open in the next tab over.

What’s my scene?

In the Password Anti-pattern article, Jeremy took a moral stand: even if it costs me a contract in the short-term, I will refuse to implement any kind of interface that involves asking the user for a password from a third-party site. I urge you to do the same. That was admirable and eminently reasonable. Many agreed. He provided what he thought was a viable alternative by pointing to the same authentication methods I’m discussing here.

I thought it was the right choice at the time, too. I stood with him. I don’t know if his stance has changed now, but I know mine has.

What is the alternative?

Authentication APIs and protocols have their benefits and they have their costs. Do these cancel each other out? Should we refuse to implement this functionality?

If you agree with my points here, maybe you think that. But what do you implement instead? There will be a lot of demand for this functionality as it becomes easier and easier (no more screen-scraping!).

Personally, I’m for it. I have reservations now, but the practical benefits of isolating and securing access to my data wins over the hypothetically higher risk of phishing. And on that day when I’m so tired, hungover or ill that I absentmindedly just click through the process and hand over the keys to my kingdom, I hope some small flicker of self-preservation will alert me so that I can correct it in time.