This was in slashdot headlines and is quite shocking.

MySpace and other social-networking sites like LiveJournal.com and Facebook are the potential targets for a proposed federal law that would effectively require most schools and libraries to render those Web sites inaccessible to minors, an age group that includes some of the category's most ardent users.

High Impact
What's new:

A proposed federal law would effectively require schools and libraries to render social networking sites inaccessible to minors.
Bottom line:

Law would likely affect more than just social networking sites. Blogger.com, AOL and Yahoo's instant messaging features might be included in proposal's definition.
advertisement
"When children leave the home and go to school or the public library and have access to social-networking sites, we have reason to be concerned," Rep. Michael Fitzpatrick, a Pennsylvania Republican, told CNET News.com in an interview.

Fitzpatrick and fellow Republicans, including House Speaker Dennis Hastert, on Wednesday endorsed new legislation that would cordon off access to commercial Web sites that let users create public "Web pages or profiles" and also offer a discussion board, chat room, or e-mail service.

That's a broad category that covers far more than social-networking sites such as Friendster and Google's Orkut.com. It would also sweep in a wide range of interactive Web sites and services, including Blogger.com, AOL and Yahoo's instant-messaging features, and Microsoft's Xbox 360, which permits in-game chat.

Fitzpatrick's bill, called the Deleting Online Predators Act, or DOPA, is part of a new, poll-driven effort by Republicans to address topics that they view as important to suburban voters. Republican pollster John McLaughlin polled 22 suburban districts and presented his research at a retreat earlier this year. Rep. Mark Kirk, an Illinois Republican, is co-sponsoring the measure.

The group, which is calling itself the "Suburban Caucus," convened a press conference on Wednesday to announce new legislation it hopes will rally conservative supporters--and prevent the Democrats from retaking the House of Representatives during the November mid-term election.

About two weeks ago I started making a map of the history of the community. This was in part because I knew a lot of new people were coming to the workshop and I wanted to be sure they had some context of who we were and where we had come from. I translated this into an interactive wall map that allowed people to ad their own elements to the history.

On the timeline:

• Yellow diamonds are protocols
• Pink Trapazoids events that have happened on a timeline
• Purple papers are Publications white papers
• Purple 1/2 circles are podcasts.

Clusters (ot on the timeline):

• Green Parallelograms are mailing lists
• Blue pages are blogs

There are some good photos of this but I will be taking the results and putting them into Omnigraffle and then PDF too.

Tuesday Morning we got to put together the agenda. It involves everyone who wants to present putting what they want to have a session about on a piece of paper. They speak their session title to the whole room and then post it on the wall.

It wasn't until about mid day on Tuesday that I actually landed and was able to engage in the conference. The Planetwork folks talked a lot talking about the emerging 1society project.

Dinner both evenings was great. Monday was Italian and Tuesday was Thai.

The Identity Commons crowd moved things forward we have a follow up call next week.

At the very end watching and listening to Paul and Drummond go over the relationship between Higgins two projects and XRI / XDI was a great treat.

We concluded our day listening to Eugene Rant about Wikis at Wiki Wednesday. After dinner Meng told us he had founded the Reputation Gang and we invited him to be a part of the Identity Commons.

The highlight to get the essence of what happened is the closing session recorded. Here Tuesday and Wednesday.

Some high complements were given to the conference.

From Kim Cameron:

With Doc Searls and Phil Windely navigating at the macro-level, the amazing Identity Woman Kaliya orchestrated an ”unconference” that was one of the most effective events I’ve ever attended. It’s clear that creating synergy out of chaos is an art that these three have mastered, and participants floated in and out of sessions that self-organized around an ongoing three-day hallway conversation - the hallway actually being the main conference room and event! So we got to engage in all kinds of one-on-one (and few) conversations, meet new people, work out concerns and above all work on convergence. Many people told me they felt history was being made, and I did too.

Opinity's Tom Madox reflected on the conference today.

Now, before someone reprimands me for implying that there were corporate or technical bigshots in attendance, let me clarify that one. There were, in fact, luminaries of various sorts participating: A-list bloggers, well-known corporate folks, technical experts working at the forefront of innovation in the field of identity mangement ... people like that. However, and this is the point: they were not on stage, performing. They were at the tables and in the rooms, talking, listening, asking and answering questions. In terms of social interaction, the conference hierarchy was flat.

Phil Becker wrote in the DIDW newsletter:

This week I saw a significant "state change" occur in this year and a half "Identity Gang" evolution, and it tells me things are going to start to happen. Some of those involved will be happy this is so, others most likely won't be. But for those not directly involved (i.e. most of the population) it was, in my opinion, a tremendously significant moment in the evolution of the identity conversation, and one that will have many significant ramifications going forward - though these will likely take another year to become clear to those not paying close attention.

They are working on the issues of what form identity must take
to become ubiquitously deployable, become something that will be adopted
comfortably by users, and how we can ever get there from here.

The first sign that the required significant shifts are occurring is
visible in the titles of the sessions this un-conference produced on
its first day. These titles have all subtly shifted in ways that
indicate there is no longer any question that there is a single,
over-arching story behind the identity conversation, and that the
mission now is to figure out how to converge the many efforts that
are underway. These efforts were each begun with a very different
mission and with a very different use/case and problem set driving
them, and this has previously created division and competition. This
time, however, it was clear that everyone was looking for where they
should get on board, and how to avoid having their goals left out.

Technorati Tags: conference, identity, iiw2006, iiw, workshop, XDI, XRI, YADIS

This was articulated by Marc Evans on his blog:

The Net Neutrality campaign (a.k.a. Save the Internet) to keep the Internet tollgate-free and/or tier-free continues to gain momentum. What's troubling, however, is Om Malik's contention that many start-ups and Silicon Valley companies and fairly of the issue and why it matters. One of the Silicon Valley's weaknesses is a lack of political savviness. Sure, many companies and executives donate money to politicians and political parties but there does not seem to be a well-organized and effective lobbying team that can be turned on in Washington when needed. Peter Chester suggests a reason for the lack of activity among the bigger players such as Yahoo, Google and Microsoft is they have relationship with carriers and cablecos that they don't want to damage.

This was articulated by Marc Evans on his blog:

The Net Neutrality campaign (a.k.a. Save the Internet) to keep the Internet tollgate-free and/or tier-free continues to gain momentum. What's troubling, however, is Om Malik's contention that many start-ups and Silicon Valley companies and fairly of the issue and why it matters. One of the Silicon Valley's weaknesses is a lack of political savviness. Sure, many companies and executives donate money to politicians and political parties but there does not seem to be a well-organized and effective lobbying team that can be turned on in Washington when needed. Peter Chester suggests a reason for the lack of activity among the bigger players such as Yahoo, Google and Microsoft is they have relationship with carriers and cablecos that they don't want to damage.

Consumers are so distrustful of Microsoft that Apple could double its market share due to defections from the Windows operating system, a report by market analysis firm Forrester Research says.

The remarks come in a report that looks at brand identity and the importance of a company's brand. The report also studies the effect a company's brand has on the pricing of its products and the demographics of those that purchase the products.

This article says what I have sensed for a while. This coming back to school and Holiday season could mean big increases in Apple's market share. For one thing Vista has slipped to January, if you need to do something on Windows, Apples will soon boot that OS so you can do what ever you need to in legacy land.

In the end it is the personal computer - not the corporate machine. People need to be able to get along with and bond with their computers in a personal way. You can do that with a Mac.

Technorati Tags: apple, brand, identity, Microsoft, usability

It is going to be a wonderful event that moves from a Networking social hour put on by the Urban Alliance for Sustainability to the Planet Code Symposium that Planetwork and imaginify pulled together into an evening of Eco-Activiation - transformative art music and inspiring speakers. There will be a Green Frontier Exhibition with number of green and sustainable projects presenting their work in an exhibit. Join us in a true fusion of Northern California culture, art and technology.

Here is a video that gives you some sense of the groove of the day.

5-6 Networking Salon hosted by San Francisco Alliance for Urban Sustainability

6pm - 8pm The Planet Code Symposium with several panels.
http://www.be-in.com/symposium.html (updates posted here)
Panels on Digital, Organic and Integral Solutions.

Speakers include:
Jim Fournier, Eprida; Karri Winn, Planetwork; Kaliya Hamlin, Identity Woman; Jair, imaginify; Marc Kasky, co-founder Green Century Institute; “Redwood Mary” Kaczorowski, United Nations; Melinda Kramer, Women’s Global Green Action Network; Greg Steltenpohl, Interra Project; Eric Sundelof, Stanford Digital Visions Program; Rick Tarnas, California Institute of Integral Studies; author, Psyche and Cosmos; John Clippinger, Berkman Center at Harvard Law School; David Ulansey, Mass Extinction Network Awareness; Randy Hayes, Rainforest Action Network, Oakland Sustainability Director; Gavin Newsom, Urban Environmental Accords ; Chris Deckker, Earthdance; Erik Davis, Evolver Project

Performances form 8pm on include:
http://www.be-in.com/ecoactivation.html
Live performers: LunaGroove, Foxgluv, Irina Mikhailova, Waterjuice, Living Alliance of Love, hands upon black earth, Artemis, Divasonic, 1000%, Random Rab
DJ's Cybervixen, Dov, Goz, KJ, Kode IV, Maximillian, Mozaic, Neptune, Shawna & Laura
Performance and Dance: Dreamtime Awakened Рdirected by, Davin S, Mystic Family Circus, Estara, D̩cor, Anon Salon, Trinity - Sacred Space Altars, Sacred Treasure House

Green Frontier Exhibition
Formerly known as the Digital Frontier, this edition of the Be-In will feature the “Green Frontier” – emphasizing the new initiatives, projects and products that are leading the way to a green economy and sustainable culture. In addition to paid sponsor exhibits, the Be-In each year invites a range of groups whose causes or products are worthy of broader exposure. The Green Frontier is a lively forum where leading technology creators can meet and exchange ideas with sophisticated users and professionals. It is also a place to expose forward-thinking ideas and initiatives to a community that is in the business of changing the world through evolutionary technology and social innovations. The Digital Be-In is well known as a catalyst to influence trends, spawn important ideas, create alliances, and showcase creative possibilities. The Green Frontier—at the event and on the ongoing Be-In websites—is where the tribes gather and connect.

One person has contacted me and tole me that they 'have no idea what I am talking about' and there are not enough links to create context. I am at Mix06 - in case that wasn't obvious. The Microsoft live web conference.

What kind of posts do you like best? What do you want more of? should I wait till the end of the day at a conference and post all at once? What works? Thanks for your feedback.

To comment on this blog you need to create and account on the login screen here and then click on comment.

Technorati Tags: MarcCanter, Mix06, BillGates, Microsoft

The room was a very long rectangle room with three presentation screens and 2 giant columns. It is a terrible lay out. The first morning we heard 3 ppt presentations about 'the problems' of for usable security and authentication. Maybe people are 1/2 present doing e-mail and other things.

I really wanted to interactively (as in facilitated face to face discussion) create a map of the problem space. By the end of two days I sort of got it but I know we as a room could have come up with that in 1/2 a day and then sent the rest of the time really working on ideas for solutions.

There are a bunch of constituencies.
Browsers - Firefox, Opera and IE (Microsoft)
Big websites - AOL, Yahoo, Google.
Certificate Authorities - Verisign
Banks

They all want security of verifying websites to be more usable and understandable to normal folks. So there was usability experts.

I think I understand why 'standards bodies' and processes get bogged down. They are really not very innovative in their face to face technology - presentations for a two days do not create a positive energetic vortex and community to move forward on solving problems.

I am really tuned into this need to get better at our face to face process so our ideas and innovations for the online world can actually work.

May 1-3, 2006, Computer History Museum, Mountainview CA
Workshop Wiki

The Internet Identity Workshop focuses on user-centric identity and identity in the large. Providing identity services between people, websites, and organizations that don't necessarily have a formalized relationship is a different problem than providing authentication and authorization services within a single organization.

Goals
The goal of the Internet Identity Workshop is to support the continued development of several open efforts in the user-centric identity community. These include the following:

* Technical systems and proposal like YADIS (LID, OpenID, Inames), MetaIdentity system, Infocards, and the Higgings Project
* Legal and social movements and issues like Identity Commons, identity rights agreements, and service providers reputation.
* Use cases for emerging markets such as user generated video (e.g. dabble.com), innovative economic networks (e.g. interraproject.org), attention brokering and lead generation (e.g. root.net), consumer preferences (e.g. permission based marketing), and civil society networking (e.g. planetwork)

The workshop will take place May 2 and 3, 2006 at the Computer History Museum. We will also have a 1/2 day on the first of May for newbies who want to get oriented to the protocols and issues before diving into the community. If you are new to the discussion, we encourage your attendance on May 1st because of the open format we'll be using to organize the conference.

Format and Process
At the last identity workshop we did open space for a day. It was so successful and energizing that we will be using this format for both days. If you have a presentation that you would like to make or a topic that you know needs discussion in the community you can propose it here on the wiki. We will make the schedule when we are face to face at 9AM on May 2nd. We do this in part because the 'field' is moving so rapidly that we your organizing team are in no position to 'know' what needs to be talked about. We do know great people who will be there and it is the attendees who have a passion to learn and contribute to the event that will make it.

Part of the reason for moving to the Computer History Museum is to have better space for running this kind of effort with an expanding community. We expect a large and energized community to attend and are counting on plenty of participation. Don't be put off by that, however, if you're just getting into this. Come and learn. You won't be disappointed.

Cost
We are committed to keeping this conference open and accessible. Having a venue that will support our doubling in size also means that it costs a bit more.

We decided to have a tiered cost structure to support accessibility as well as inviting those who are more able to pay to contribute. If you want to come we want you there. If cost is an issue please contact us and we can discuss how to make it work.

* Students - $75
* Independents - $150
* Corporate - $250

The fees are used to cover the cost of the venue, organization, snacks and lunch both days. We encourage you to pre-register since we will limit attendance at the event to 200 people. The IIW workshop in October sold out and we expect strong interest in this one as well.

Sponsorships
Our goal is to keep the workshop vendor neutral, but we will be accepting limited sponsorships for the following:

* Morning Break, May 2, and 3 ($800 each)
* Afternoon Break, May 1, 2, and 3 ($800 each)
* Lunch on May 2 and 3 ($2400 each)
* Conference Dinner, May 2 ($4000)

If you or your company would like to sponsor one of these workshop activities, or have ideas about other activities contact me. You will not get any extra speaking time for sponsoring but you will get thank-yous and community 'love.'

Organizers
IIW2006 is being organized by:

* Kaliya Hamlin
* Doc Searls
* Phil Windley

The Brigham Young University Enterprise Computing Laboratory is providing logistical support and backing for this workshop.

Technorati Tags: pcforum

The social venture and social enterprise communities are big into finding a balance between intention and making money.

From the article.

Is "The Attention Economy" just another way for advertisers to skewer eyeballs? And why build an economy around Attention, when Intention is where the money comes from? 

I have developed a real problem with the perspective behind what a number of people have been saying about Attention behind the podia. That perspective is sell-side. Its point of view is anchored with sellers, not buyers.

Hence my idea: The Intention Economy.

The Intention Economy grows around buyers, not sellers. It leverages the simple fact that buyers are the first source of money, and that they come ready-made. You don't need advertising to make them.

The Intention Economy is about markets, not marketing. You don't need marketing to make Intention Markets.

The Intention Economy is built around truly open markets, not a collection of silos. In The Intention Economy, customers don't have to fly from silo to silo, like a bees from flower to flower, collecting deal info (and unavoidable hype) like so much pollen. In The Intention Economy, the buyer notifies the market of the intent to buy, and sellers compete for the buyer's purchase. Simple as that.

The Intention Economy is built around more than transactions. Conversations matter. So do relationships. So do reputation, authority and respect. Those virtues, however, are earned by sellers (as well as buyers) and not just "branded" by sellers on the minds of buyers like the symbols of ranchers burned on the hides of cattle.

The Intention Economy is about buyers finding sellers, not sellers finding (or "capturing") buyers.

Even though I've been thinking out loud about Independent Identity for years, I didn't have a one-word adjective for the kind of market economy it would yield, or where it would thrive. Now, thanks to all the unclear talk at eTech about attention, intentional is that adjective, because intent is the noun that matters most in any economy that gives full respect to what only customers can do, which is buy.

Like so many other things that I write about (including everything I've written about identity), The Intention Economy is a provisional idea. It's an observation that might have no traction at all. Or, it might be a snowball: an core idea with enough heft to roll, and with enough adhesion to grow, so others add their own thoughts and ideas to it.

As for the Linux connection, I believe that The Intention Economy is, by necessity, built on free software and open source principles, practices, standards and code. It's not something that requires any company's "platform" or "environment". That's why, much as I like the services provided by companies like Orbitz (which is built on LAMP, and does a very good job), I believe no company's system can encompass The Intention Economy. The encompassing has to work the other way around. In other words, silos are fine. But the choice can't be "nothing but silos".

I think the foundational statement here is this necessity these new economic models be built on free software and open source principles, practices, standards and code.

You can see this trend happening in the face to face community gatherings of techies with the flowering of independent conferences that are built on open source principles. They don't have a high barrier to entry and people come together because they have an interest - they figure out what they want to talk about and do together. We have used these to bring the identity community together at the Internet Identity Workshop. Camps are happening etc.

The essential nature of identity systems that go to the core of who we are - or are becoming in the digital age means that the platforms that we use to exchange this information must be OPEN. Jair and I have talked about this a bunch. We must be able to see the code that our operating systems are built on if they are managing our personally identifying information. How do we know there is not an NSA back door into Microsoft vista to peer on us. Despite what MS says can we believe them - we could if we could see the code. Hopefully they will get with Jeffery Moore and understand the comodification of the stack.

We also must improve privacy protection for third party storage of information - breaking out of the 'secrecy paradigm' that the courts interpreted - if someone knows information about me then it is not secret so they can share it. This does not jive with or norms of social disclosure of information.

Technorati Tags: etech, etech06

Spime - trackable space and time

They are virtual objects first and actual objects second
We can engage with objects better throughout lifecycle.
We won't have to track our own inventory in our heads - it will be all catalogued and searchable. Where are my shoes - I will just google them.

Spime is a verbal framing device - verbal pointer because I need single sylable noun to call attention to it.

A 'theory object" passed around it is a concept that is acreating attention.
It has links and attention, website, FAQ - flash - DB and "user centric graphic web abs"

Bruce of course interject that he is a writer and likes Black ink on white paper - so I hates "all this stuff"

ThingLInk (unique idenfiers)
Can be put everywhere - [ it sounded a lot like XRI]

Blodjects - weblog objects that evoke discssion.

Technorati Tags: etech, etech06

We can't allow trust to continue to erode. Trust is the foundation of the online world.

Chair of the Board and CEO
His vision for the digital lifestyle
Any time, anyw here

• e-life
• buyit
• destintation
• package
• e-busines
• building relationships
• enabling ideas
• Drving business growth
• increating productiv ity
• Imagine a connected world
• that just gettings started

The digital lifestyle that we all live today.
The way that people access the web.
Digital interactions are ubiquitous.

• Bills, Mail - scanned and tracked.
• Groceries - plugged into supply change.

eLife is here and changing how we live and what we expect out of our lives the two are intertwined.
Expectations for us are growing everyday. To protect family photos fincaical plans. Trust is the issue and they expect that we protect this information as if it was their own.

They want companies to protect their identity and protect critical digital assets - this is a customer demand.

Protect the databases of prime target information. New compliance and regulatory demands...expensive operational changes. Risk based aproach. Shift - burden on the enterprise...each and everyone of us enterprises adn consumers must prove that we are trusted partners risk must go down.

Companies have built into business models - real time tracking managing, self service customer.
Written into assumptions about growth. Cost to process a consumer loan - $10 now, was $200. Can't go back to old way of doing business. this new way must succeed. Give business to someone they can trust.

Security becomes competative advantage. Security garatees - trump comfort of local we will hurt the whole economy...this is the real hidden threat. LOSS of consumer confidence in the digital world.

Broad adoption of firewalls and intrusion detections. Mitigating the virus and worm challenge - low hanging fruit. Today bigger challenge.

Sophisticated criminal elements. They are interested in anonymity then notoriety. Looking for personal financial information. Not that technically sophisticated.

Socially engineered attacks. Nieavate of most internet users.
150 million fishing e-mails...

Large scale data breaches. Identity theft growing threat to the digital lifestyle. 6 years top list of FTC...50 million americans exposed.

We can't allow trust to continue to erode. Trust is the foundation of the online world.

Protect the relationships of these digital interactions of this great new world we have created. We need to debunk the myth that just securing the divice. Impossible. to one narrowly focused company to secure

We must join together to solve the global community challenge.
Create a trusted online community. In the digital worlds consumers are the weakest link...we must protect them from themselves.

Customers must meet minimum security...symantec...end point solutions.
Enterprise brand is protected...More aggressive ensuring information protection. Data be retained in a secure manner. Actively look for ways to protect things.

New - Scan for anonomlyes [yuck] Managing security risk part of keeping informaiton safe. Backup and recovery...

Join togehter create trusted online community- end users convienent and safe experience. easy to walk into store get a sense of place - feeling about if it is smart to give them our business...we don't have our sixth sense....up to the business commuinty to asses what is safe. Must develop sixth sense for

Process for costomers and busiensses authenticate identities to each other. you are your...they are they...authenticated as real.

Trusted community - way to search online world safely. Does the site pose a threat to you? Click and hope. Site safty and security. sites credability in search results. credability rating updated by users as part of broad community.

We all need to develop interactions and information protection. Relationships between costomers and businesses. All of us need to take the lead in pushing for policy changes - privacy protection the business community should push for comprehensive privacy legislation.

US privacy legislation. Protecting children online. Comprehensive response. Information protect and every step along. We need one law that protects all consumers and encourages inovation in data security technology. Uniform laws. TRUST is the foundation of this new world. millions relying on the digital world for work and play. No company can ingonore the safty of there interactions. undermines the trust in brand and business.

Ease and enjoyment of digital lifestyle. Online banking...credit card...healthcare focus on protection.

• We must join together and take responsibility.
• Beyond walls of individual companies.
• Comprehensive end to end.

Continue to eductcat consmerus...

ECONOMICS MATTER!
What are the Economics of Security.
Their are Trade-Offs (Balance cost and benifits) and Externalities.

What are the costs of failure?

• Money
• Proprietary Information Lost
• Regulatory Noncompliance
• Bad Press
• Loose Costomers

The things that don't matter
"If your security guys have to work over the weekend."

What are the costs of security?

• pay one of thoes companies
• convenience

We have a very poor understanding of risk. It is very difficult to explain technical risks to non-technical people. There is real confusion in the media it seems. There is a real lack of real data on risks. You could get some good data of your risk of being mugged way home to hotel tonight? There is no good data on internet crime. CSI computer crimes survey - self selected and things people recognize.

The Problem - low risk - high cost events.
Normally you calculate the value of risk mitigation by the probability of being attacked times damage if you are attacked. This gives dollar of how much to spend to protect self. The math doesn't work for low risk high cost events. This is what makes counter terroism is really hard to talk about. The poor understanding of risks and costs.

EXTERNALITIES
They are using it behind our back.
This is an effective way of dealing with risk. effect of decision not born by decision maker. A lot of the cost of security failures are externalities choice point made tradeoff.

Choice point - spend less on security then data is worth.
There are some costs born by the vendors.
Insecure home computers (my mother has one of those - go home twice a year)
The security of all of us demends on all of us. It is in our best interest that her computer is clean - she doesn't care (why should she). For her the effects to you are largely an externality.

Badge cloning... RSA solved its security problem... They make it your problem. See this post that explains it all. When you want to manage and externality. We as a group don't want RSA to do this we have two strategies to prevent this.
1) laws and regulations
2) sue

To get people who are not affected by the risk of insecurity to address it raise cost of not being secure.

Laws...ATM fraud two different trajectories
US -> assumed to be the responsibility of the BANK
UK -> assumed to be the responsibility of bank customer.

UK banks were not loosing money due to ATM fraud
US banks were.

UK security languished

Point principle. make entity in best position to mitigate the risk responsible for the risk.

UK - customer was responsible but had no ability to improve the situation. All do not use the system.

Banks deal because it was there problem.

Rogers cel phone company - whenever phone is cloned. They charge the customer and they wait to turn phone off sooner or later depending on their ability to pay this bill.

IT ECONOMICS

• Economic incentives to get big quickly.
• Fast growing and insecure vs. slow growing and secure.
• High fixed cost and low marginal costs.
• Very different economics.
• Hard to recover capital investment...block - patent, brand, compatability wall...get people into network to recover costs.
• High switching costs. - One browser to another isn't either. PAIN.

Shapiro-Varian theorem
Net present value of software company = switching costs...
this means interesting characteristics.
Then you end up with accessory control. Third party batteries.
plugins.....
So companies are driven to make switching cost higher..less likely go to competitor.

The Market for Lemons.
Markets where lowsy products are sold.
when market with asymetric information...
bad products drive out good products...good used cars $2000 and bad used cars $1000 - equalibrium price $1500...

Software a lot like that.

• It is hard to tell good product from bad product.
• Product for lemons... good ones drive bad out of the market.
• Costomers not able to make intelligent buying decision..
• Make a bad product you can cover with Marketing.
• Monoplistic/ologopily markets...
• features low and prices high...

Address and align interest and capabilities. Entities ability to mitigate being responsible.

Italy...tax fraud as national hobby.
Tired of going after merchants. Any customer w/i of store w/o valid receipt fined. Customer demand receipts. Make the customer CARE!

Sign you see on 7-eleven. your purchase free if you don't get a receipt. Employee theft. Cash Register created to prevent employee theft. Paper tape. audit of all transactions. The way you commit fraud - transactions that don't show on register tape. put sign up and hire customer - they for that 15 seconds becomes security guard. Managing externalizes in a way that solves security problem.

Security is a process not a product.
It needs a holistic approach

To understand the security problem and the stake holders.
Understand the security and non-security trade-offs you must align the economic incentives (required - all solutions will work if this is true)
Implement countermeasures to reduce risk.
Iterate as technology changes things

If we think as society we think we need better security. Capabilities change...

Liabilities...moving them around is hard.
Regulations - absorb more of the losses...
This depends on politics..making more expensive for credit card Companies or databrokers... that is what we have to do!
Security monitorinig and loging...SOX.
Banking requires more layers of authentication.

Logging is now popular - cause it is more expensive to not do it.
Failing and audit is expensive for companies.
Are the logs good or not is not the question. What is important is that you have them.
The concern is not what we log and how long we keep the logs.

Saving something is cheaper then throughing it away. More data is collected and cheaper to collect. Much more then needed use for other purposes.

Yahoo and google...better to collect then not to collect.
Only way to deal - make it illegal.
We must make it more profitable not to collect.
Illegal to use for auxiliary purpose (euro model)
Don't mind produce books that I might like...

Companies will compete on what ever economic playing field you give them.

Project Higgins – which is being managed by the Eclipse open source foundation -- is developing software for "user-centric" identity management, an emerging trend in security software. It enables individuals to actively manage and control their online personal information, such as bank account, telephone and credit card numbers, or medical and employment records -- rather than institutions managing that information as they do today. People will decide what information they want shared with trusted online websites that use the software.

This is the first user-centric identity management effort to follow the open source software model, where hundreds of thousands of developers contribute -- and continually drive improvements through collaborative innovation. Being an open source effort, Higgins will support any computer running Linux*, Windows* or any operating system, and will support any identity management system.

"To move online security to the next level, there has to be fundamental resolve among consumers, government and business to quickly adopt a system where the individual has more control over how information about them is managed and shared," said John Clippinger, Senior Fellow for The Berkman Center. "Our aim is to construct an open and widely accessible software framework that puts the individual at the center of the identity management universe. With this framework in place, it will be easier for society to begin the migration to more secure online environments, where trusted networks can not only be easily formed, but effectively enforced. For in the end, security is not just technological, but social.”

Higgins will make it simple and secure for someone to change an address across all their online accounts with a single keystroke; delegate who can see what elements of their medical records; or change a password across online banking and brokerage accounts. For example, a person can grant their insurance company broad access to their personal information and medical records, while at the same time limiting the amount of data made available to their cable company. In turn, businesses can create new channels of communication with customers – enabling information to be shared securely across networks to deliver targeted, relevant products and services.

For sure - each of these giants will make their own decisions, in their own due time, but at the end of the day - if they don’t open up - they’ll eventually lose their customer.

At least we have a way to connect these giant worlds together (and take us small little fry along for the ride at the same time.) That’s a huge breakthough and is the foundation of us building the distributed web infrastructure. What I’ve been chanting about is our own Open Source Infrastructure and the other kinds of open standards we need.....

StructuredBlogging.org is an attempt to keep all the various formats of microcontent compatible. Our upcoming PeopleAggregator APIs will provide basic social networking capabilities - to all - and a way of inter-connecting disparate social networks into one giant distrbuted mesh.

The world of media needs standards like Media RSS and one could imagine burgeoning new standards around Tags, Reputation, Events and Musical tastes and preferences.

It is nice to see the itags included in the list of open source infrastructure. Thanks Mark.

Julian Bond was in the audience and immediately complained “they’ll never be a LAMP version of Infocards” - but what I wanted to explain to Julian was that Microsoft is in the business of taking care of themselves, just as Yahoo, Google and AOL are - as well. So don’t expect a Linux version of anything from Microsoft, but you CAN expect meta-identity compatible ID systems for LAMP - that’s for dam sure.

Julian don't be so sure about this statement.

Prateek Mishra - Oracle
What is the identity problem?
It is stuck in a few places at employwer, bank and you want to
how does your identity get from your identity provider - the places were you have defined your identity to all these business processes and services.

We want to do this across the internet. There is the protocol piece - we know how to transmit identity from point a to point b this is solved...

Governence models how to transfer identity in trusted ways from point a to point b. Folks like Liberty Alliance have white papers and frameworks for this. This is a non-trivial problem. How you maintain and create governance?

How do you have normal folks sitting at their computers manage their identities in intuitive ways. How do they have a tool

Identity is stuck it wants to be free.
Protocol - Token Representaiton - solved
Governence and Infrastructure - somewhat solved
How does a person leverage these multiple identities?

Kim Cameron - fan of SAML and Liberty
As we move to more interconnected set of systems we need an identity layer. When you have an architectural whole of this magnitude you have a huge number of kludges.

Meta System

Users have no way of predicting how they should work - knowing when they are in danger.

old days fighting over token rings vs. ethernet - we got TCP/IP that encapsulated both.

We need a metasystem (I got a tiny bit distracted here, sorry. So the transcription is not perfect)

Karen Wendel, Identrus
Metasystem - single interface from an identity perspective.
Everyone has a visa card - that folks each having a card for each store. The industry would be stuck without interoperable.
Rules used consistently throughout the world.
VISA would take responsibility for legal, technical and policy issues.

Identrus was owned by the banks. Your identity will be given to you. It takes responsibility around the policy stuff. Legal aspects of your identity - dispute resolution. Liability of relying party who maintains it and lifecycle. We run this network and commonality on global basis.

(from there website) Identrus provides the global standard for identity authentication.
As communications expand and the world shrinks, knowing who's who in the electronic universe becomes vital.
Identrus offers a full range of technology and services that support every aspect of safe eTransactions.

Rena Mears, Deloitte
Access - from a privacy point of view is different from access from a security point of view
Assertions and Claims are different

Kim Cameron..
Claims are assertions which are in doubt
everything being claimed has to be doubted so we can establish trust.

They considered using Claims but it would have become SCML (scammel)

It is to the benefit to the SAML make things secure in the browser. Shibboleth the hardest thing is home site discovery - infocards visual representation and

pick one of the 5000 higher education institutions...
or pick 'your' university identity.

Identrus: This is what we would call an identity provider.

Kim:
SAML is the transport language
SAML is used between a portal and services to the portal.

I propose we have new ways of the user authenticating to the portal.
The systems still exist.

Karen:
What constitutes and identity and the needs for security.
How does language play in this space - there are a lot of different models - identity is not the same as authentication or security.

problem blending identity and security - PKI
you get these people

Kim:
anyone who works with a protocol they get infected by the protocol and their vision blurs and and narrows.
We need more fanatics about protocols

Identrus:
one of the challenges for us as a community - identity does more then authenticate - sign things and create legal contracts - engage in business transactions, incur liability and regulatory transactions.

you can't look at the papers and not see an inherent relationship between identity and security.

Rena:
Who has stepped up to be the binder of identity to the individual.

Prateek:
there is not such thing as single monlithic identity
there are multiple notions of identity useful for different contexts
Shibolith context higher education
Identrus is a context and a governance model

We like Infocards if we could use it when we get to the line in the spec it says Identity provider discovery - out of band
authentication is out of band for SAML

Karen:
everyone is bound by
the bank that issues the identity to the person
the bank binds to the person - labile to up to 10 million dollars
issued within all the legal requirements

there all these pockets of identity - the level of binding - between issuer and relying party - it does not transfer through the bridge structure.

A lot of the federated model you don't have that level of binding between the parties.

We will work with the bridges and it is a different element.

Kim:
The government - thinking of itself as the 'binding' authority - reasons for relative autonomy.

Belgium a national identity card - but no card readers
One group was the association of mayors - they were now being asked to sign their legal documents with their individual citizen identity - they used to sign their documents with a stamp of their office - we must think of roles.

Kim:
The issue is PRIVACY.
the characteristics that really respects privacy are the characteristics of a system that really is difficult to penetrate.

All of the identity issues - any initiative that takes this forward we should all applaud.

Jazz, an application that provides audio messaging to yet another circle of friends. More invites....more buddy lists....

There were so many identity silos at the etel.

Each phone handset has one for address books -

• Motorola,
• Nokia

Telecom Incumbents

• Orange(france telecom),
• British Telecom

Cool "apps"

• YackPack
  Jazz

The Incumbent internet players

• ebay/Paypal/skype [PESk]
• Yahoo!
• Google (using Jabber)
• Microsoft

I posted my first Firefox extension. It's called 'Whois This Person' and it's a simple little right-click menu item which will query any name you've highlighted against LinkedIn, Wikipedia, Technorati, GoogleNews, Yahoo Person Search, TailRank as well as some family and address sites. It's not gonna change the world, but it may save some seconds here and there.

Thank you, we have sent you an email to confirm you are you. After you confirm who you are, you may log in.

All sending you an e-mail and clicking on a link does is prove that you own that e-mail address.

User-centric services have for UUID's (universally Unique identifier) linked to real people. I had a conversation with one of the lead technical people on this project and they are in a bit of a bind without being able to access third party identity servers. They don't want to ask people for their login to Yahoo, MSN, Flickr etc. but services like Mobido do this and (young) people give them to use.

There now doubt in my mind there is a market need for these services.

Technorati Tags: identity, geolocation, UUID

The GAP Identity today:

The Gap has become the transparent background music of fashion--the aesthetic you never see because it's everywhere (and thus effortless to imitate, undercut or adapt.) I like expansive, dramatic gestures--even when they fail, you have a lot more fun making the attempt--and I'd love to see The Gap destroy its increasingly-meaningless brand in order to save it--but I'm hard-pressed trying to think of a big retailer that's pulled off a similar trick.

Ed reflects on the evolution of GAP's identity:

At 38, I'm old enough to remember The Gap's two-stage transformation, first from off-brand denim outlet to cooler-than-Levi's, and then on to world domination via sort-of-preppy, sort-of-hip GeneriClothes. But a fundamental problem they face now is that the market's fragmented out from under them, and fewer people want to wear GeneriClothes these days--we're all pursuing our individual style muses.

"Google could easily become the poster child for a national public movement to regulate data collection," says Jeff Chester, head of the Center for Digital Democracy, a privacy advocate.

Unbeknownst to many users, privacy advocates like Chester say, Google's technology gives it enormous power to collect data on the interests and online habits of millions of Web surfers.

Google stores every user's searches in its growing database and index of websites, maps, photographs and other documents. Its free e-mail program, Gmail, stores all user messages — including deleted ones — forever.

Type someone's name or phone number into Google's search box and you'll likely turn up a home address, allowing you to see an aerial photo of their house from the Google Earth satellite photo service, started last year.

Daniel Brandt in San Antonio, creator of the Google-Watch.org website, worries that law enforcement authorities or repressive foreign governments could demand access to Google's database to examine users' surfing habits.

"Google will become bigger and bigger, and they will be a massive problem in terms of Internet privacy," Brandt says.

The Senate Judiciary Committee last month passed a data privacy bill that goes to the full Senate. The bill, whose sponsors include Arlen Specter, R-Pa., and Dianne Feinstein, D-Calif., would regulate data brokers, force more security and increase penalties for identity theft.

A breach of Google's database could be a catalyst for more lawmaker attention. "That would be the Tylenol scare to end all Tylenol scares at Google," Battelle says.

These are my tags on my photos and my bookmarks. How can we get out of pattern giant identity silos buying up other services? I want an integrated Identity on the web that I manage weaving together tools and services that are useful to me not just handy cause they are in one of the mega silos.

Hopefully they will avoid the major faux-pas that happened with Flickr where they asked users to to enter a yahoo ID instead of their existing Flickr account.

I would like to ad and expand on the list. These communities coming together are diverse and have a range of needs. It is not just 'developers' coming together to code together.

• Small business owners who are building businesses based on these platforms. This community has needs to address real client needs that can sometimes be overlooked by the 'core' developers - I hope we can create a space for these real issues to be surfaced and action to be taken.
• Individual developers who work on contract for a range of projects.
• designers who have a skill set to build sites.
• User experience people who have an enourmous amount to contribute (the FLOSS Usability sprints have gone a long way to addressing the wide gap between open source and usability.)
• Project managers that pull teams together with a whole variety of skill sets.
• Folks developing platform in specific niches that have real gifts to bring the community - remember that the margins are where the really interesting things.

Face time amongst this diverse groups needs to be used to

• Develop vision about the platform - this will help the community develop consensus and confidence in the platforms survival
• Listening to emerging needs that end users and communities using those platforms and weaving those into development roadmaps
• Learning about usability and how to meet weave this into development roadmaps
• Business models for businesses? how do we make money to eat, feed those who work for us and better yet THRIVE?
• How do we share information about development we are working on? (a new module or feature that others might also need to develop)
• What are the collaborative flows that really support the core development and meet their business goals.

Technorati Tags: Bryght, Drupal, identity, nptech, Opensource, usability

Here is the blurb from IT Conversations it is VERY Philisophical.

Computer source code has words and sentence structure like actual prose or even poetry. Writing code for the computer is like writing an essay. It should be written for other people to read, understand and modify. These are some of the thoughts behind literate programming proposed by Donald Knuth. This is also one of the ideas behind Open Source.

"Open Source" is a phrase like "Object Oriented" - weird at first, but when it became popular, the meaning began to depend on the context of the speaker or listener. "Object Oriented" meant that PERL, C++, Java, Smalltalk, Basic and the newest version of Cobol are all "Object Oriented" - for some specific definition of "Object Oriented". Similar is the case of the phrase "Open Source".

In Part 1, Lefkowitz talked about the shift of the meaning of "Open Source" away from any reference to the actual "source code," and more towards other phases of the software development life cycle. In Part II, he returns to the consideration of the relationship between "open source" and the actual "source code," and reflects upon both the way forward and the road behind, drawing inspiration from Charlemagne, King Louis XIV, Donald Knuth, and others.

Doc and I are doing a panel on the 'OpenWeb' so I hope folks come or at least tune-in via webcast or IRC. But the AO conference WILL be propogated by VCs and rich people - and I prefer hanging out with normal people the best.

That's why I love Gnomedex. I sure hope there's another one - soon - like at the end of September.

I found this in my list of saved but not posted blog posts. Seems like Marc's wish is going to come true - BAR Camp is this weekend. I just found out about it from Eugene Kim's blog (he has been posting some great stuff this past week about wikimania and collaboration patterns). Likely I will go down with Mary and share the demo of i-names sso working on wordpress that I did at DrupalCon in Porland two weeks ago.

He began with ... as I was saying

Semasiology is the science of the meanings or sense development of words; the explanation of the words.

I wonder if we can collectively do a Semasiology of Identity perhaps that is a topic we can invite R0ml to consider with us since Optaros is considering and 'identity' practice.

He returns to a quote from the princess Bride where the guy says Inconceivable 'I do not think it means what you think it means'

Summarizes last year's talkwhere he made the point that the source of open source was not 'code' but instead was the requirements.

PART II - Really it was all about the CODE

Programs must be written for poeple to read, and only incidentially for machines to execute.

APL progammling language by Kenneth Iverson it was 'easy to read' and designed for Notation an a Tool of Thought.

(check out what it really looks like - totally not 'easy to read')

Why read?
70-80% of all "software development is maintenance
70-80% of all maintenance is reading old code and understanding
49-64% of the cost of CODE

WEB originates from this work Literate Programming by Donald Knuth. It is a method of composing programs. He felt the time was ripe for significantly better documentation of program and saw them as Works of Literature. He was an essayist whose main concern is with exposition and excellence of style.

With Literate Programming there are two steps
Tangle (create the code)
Weave (create the documentation)

Hence the aphorism: Given one Literate eyeball, most bugs are shallow.

This language and its associated programs have come to be known as the WEB system.

He said: I chose the name WEB partly becasue iftwas one of the fe three-letter words of the Engligh lanauge not applied to computers

We can also invite some other words to describe the programming process from this set of words.

SPIN (create requirements) ...a ask in spining a yarn

Knit (create the test cases)

Fashion (generate the models)

We might wonder how good our spinning, knitting and fashioning are going in the identity space. Hopefully the IIW in October can help with all three.

Warning this next section has a lot of free association

Steven Roger Fischer wrote A History of Reading

How many people are computer literate?
The census bureau says there are 600,000 programmers in the US.
If you include other professions that also would read code as part of their job you reach about 1.9 million which is less then one percent. It is about 16 million people world wide which is 1/6th of one percent world wide.

Where does reading come from? All early reading involved simple code recognition very task oriented.

Sumarian writing developed
Enheduanna was the first poet in 2285 BC. and was the daughter of Kin Sargon.
Ada Byron - first programmer Countess of Lovelase is the daughter of a poet.

In Sumaria at the time this poem was written only 1% of population knows how to read in the Great City of UR.

Around 500BC.. Athenians 5% could read.

This was the Dark Ages 500 AD at it was asserted that what writing made presnet to reader pictures make present ot the illiterate.

That is the GUI...(Graphical USer interface)

Words were written down for Public Performance:

scripta manet verba volat

script remains verbal is volitle
writing is eternal, talk is ephemeral

This phrase did not mean this

To 'read' was to transmit, not to receive. Things written were written as memory aids.
To read was to speak...because of not for orators...

So this phrase really meant:

Writing reposes, speaking soars

Writing isn't any good unless you read it out loud. Existance of the book meant that the speaker could be anybody.

GPL3 - GPL is a copyright.

Copyright protects against unauthorisze copying derivation, distribution or publicly performance.

What does it mean to publically perform software?

It means to 'run the code'

The purpose of the code is to be performed.

GPL defines source code's preferred form of the work for making modifications to it.

Refrain

Voices of the Absent
The spanish theologian - Isidor of Seville (560-636 BC) - praised silent reading, too, for being without effort, reflecting on the which has been read rednering their in.

In 1999 St Isidore was named the patron saint of programmers
Why?
He wrote a treatise - Etymologiae (source) or Origines as sometimes called.
He compiled it - all existing knowledge and literature.

Authorship does not matter the collection of knowledge matters.

What happen next? In the early middle ages changes our understanding of authorship changed. Integrity of the Authors Source Code

Something changed meaning of word to read... it was now possible to read in silence...

789 Admonitio Generalis no standards improve aimed specifically at educaiton reading and writing.

Carolingian Minuscurle brought some standards in.
Alcuin of York 798-804

Words are separated use a blank space.
What 0 did for math the space di for reading.

Irish scribes created the fullstop, comma, semicolon
Standards emerged for heights (m) ascenders (b) decenders (g)

Reading went form public act to private act - reader is no longer shared the text with others.

Reading and writing was collaborative and became individual.
Reusable Software is collaborative.
will it become individual?

Readable software needs typography.

If you write scripts they will need maintenance.
If you write readable code they will soar.

Writing reposes, speaking soars
scripta manet verba volat

Programming is literature.
Reading is not performance.

Two gods of literature the reader and writer.
Rewriting of what the author has originally authored.

Moving away from respect to original author when writing became a silent and private act.

Intellectual Property is invented in 1251

So we flip back to authorship...

In antiquity we gave credit to original author because failure to respect honored ancestor.

Post renaissance -> more about legal requirement.

Couple hundred years 40-50% will read can read CODE.

When this happens will the collaborative nature dissipate?
Power of collaboration is essence of what it is about now but it may become a private act.

Symbolic manipulation skill.
Extent to writing skill - literary skill.
We have done this before.

Speaking venacular of that people are talking.

Semiotic agreement about core set of concepts.
Be liberal in what you understand.
Be strict in what in what you are trying to say.

Poetry is obfuscated.

Poetry is set in LINE.
The white space is significant.
Prose it is not.

Come to OSCON for Part III next year.