Seems like I’m far from the first person this happened to. It’s common enough to make it into Facebook’s FAQ.

So – no big deal, right? just had to wait a while with uploading photos from today’s trip with the kids, a little annoyance, nothing more. Then I wanted to check in the meantime what’s up on another site. Guess what I used as a login there? yep, Facebook connect. No login for you!

Facebook may be getting away with it for now, as it seems like these “maintenance” downtimes didn’t create negative buzz for Facebook connect’s position as the identity of choice for many avid FB users. But watch as more of these incidents start raising awareness to the implication of relying on Facebook as an identity provider. We’ll then realize it’s another point of failure on our way to our favorite sites, and one with no simple workaround.

Truth be told, this is not a Facebook issue, it’s an issue for centralized identity providers. If WordPress.com were down, my OpenID identity would be down just the same. With unified identity comes a unified point of failure…

Details were scarce, but the general message coming out of Facebook is that the Open Graph API will allow any site to embed a Facebook page in it, allowing the site owner to set status messages, share links etc., without visiting Facebook itself, and more importantly without sending its visitors to Facebook.

That sounded like a feature aimed primarily at brands, or as Ethan Beard of Facebook presented it: “This will be good for brands like Coke.” Makes perfect sense, as these brands are already using Facebook as part of their social media efforts, but would prefer to have it done on their site rather than on Facebook itself.

Thinking deeper into where Facebook is heading, though, I would think there is a more major endgame to all this. We already know that Facebook wants us to consider it as our online identity. So it allows you to reuse that Facebook identity on other websites and sign in using Facebook Connect. That’s one side of the coin. And then the other side of it is, you have your own website or blog where you may publish thoughts, links and photos that you didn’t publish on Facebook. Facebook would clearly want to bridge that gap as well.

Half a year ago, Facebook adopted the emerging Activity Streams standard for publishing and consuming an individual’s lifestream events to lifestreaming frameworks, a standard promoted by open standards evangelist Chris Messina. So that fits in nicely into the puzzle now: wouldn’t it be nicer if you could publish all this non-Facebook activity into your Facebook’s page, which will now be embedded into your personal website, courtesy of the Open Graph API?

The API then is just the funnel through which your activity stream is published back into Facebook. You get to leverage the social graph you already defined and came to like on Facebook, and Facebook gets tighter integration with your life outside of Facebook, if you still had any. Smart move for Facebook.

One of the many issues Chris writes passionately about is our online identity. That little link I added to his name in the opening words of this post triggers an entire domain of debates, ideals and evil plans to take over the world. Should I have linked to his Facebook page? or Twitter? perhaps MySpace or even Google? all these companies beg us to choose them as our “identity providers“, so that we will let them be our companions when we visit other websites, thus helping their “social colonization” efforts.

So in a way, those companies are trying to become the global “people namespace“. On the web I may be http://facebook.com/ofer.egozi, or http://linkedin.com/in/oferegozi etc., and as Dave Morin of facebook tweeted, “/ is the new @“ (hence their PR extravaganza on vanity urls). Our identity is associated with the domain on that url, much as our email domain.

An interesting corrolary I can suggest here is that the “commitment” of that company to your identity is reflected in the extra padding next to that ‘/’. Companies such as twitter and facebook say “profiles are not just another application for us, they ARE our application”, whereas others such as linkedin and google still interject a /in/ or /profiles/ in between, just in case something else becomes more important…

So why not use his Facebook then? with social networks being such a relatively new entities, we seem to forget the temporariness of a business organization. We also tend to forget that those network accounts are only as free as beer, and the organizations behind them can arbitrarily delete a user or change their policies any time, and your anchor on the web which you built over the years is suddenly at stake.

My own identity is this blog. I own the domain, I maintain an OpenID on it using WordPress.com, and I can always decide to modify that identity, take it elsewhere or remove it altogether. The control over that identity, how it’s portrayed and used remains with me, even if many other aspects (think social graph) are still locked up elsewhere. That’s a start.

Fake reviews suck.

In the most recent example, an employee solicited paid reviews for his company’s products on Amazon’s Mechanical Turk – got to appreciate the progress.

How can you tell which reviews to trust? Trust is built out of relationship. You trust a site, a person, a brand, after your interactions accumulated enough positive history to earn that trust.  With review sites, you may learn to trust a specific site, but that still doesn’t mean you trust a specific reviewer. I usually try to look at the reviewer’s history, and to look for the “human” side of them – spelling mistakes, topic changes, findings flaws and not just praising. But naturally, the adversary here is also informed, and will try to imitate these aspects…

Review sites attempt to bestow trust of their own on their members, to assist us. Amazon uses badges, and encourages users to provide their real name, using a credit card as the identity proof. Midrag is an Israeli service provider ratings site I recently used, that attaches identity to a cellular phone, with a login token sent over SMS. But when you want to attract a large number of reviews, you want to allow unvalidated identities too. Epinions, for example, builds a “web of trust” model based on reviewers trusting or blocking other reviewers. But with Epinions (and similarly Amazon) keeping their trust calculation formula secret, how can users be convinced that this metric fits their needs?

In reality, my model of trust may be quite different from yours. Two Italian researchers published a paper in AAAI-05 titled “Controversial Users demand Local Trust Metrics“, where they experimented with Epinions’ data on the task of predicting users’  trust score, based on existing trust statements. Their findings show that for some users, trust is not an average quantity, but a very individual one, and therefore requires local methods.

Trust metrics can be classified into global and local ones (Massa & Avesani 2004; Ziegler & Lausen 2004). Local trust metrics take into account the subjective opinions of the active user when predicting the trust she places in unknown users. For this reason, the trust score of a certain user can be different when predicted from the point of view of different users. Instead, global trust metrics compute a trust score that approximates how much the community as a whole trusts a specific user.

Have you spotted a familiar pattern?… Just exchange “trust” with “relevance”, and the paragraph will all of a sudden describe authority-based search (PageRank) versus socially-connected search (Delver). Local metrics were found to be more effective for ranking controversial users, meaning users that are assigned individual trust scores that highly deviate from their average score. The search equivalent can be considered queries that are for subjective information, where opinions may vary and an authority score may not be the best choice for each individual searcher.

To read more about trust metrics, see here: trustlet.org

The horror! the horror!!

What happened here? a quick check on SGAPI led to some strange findings. Turns out that Robert Scoble’s old blog at scoble.weblogs.com is listed as strongly conncted to Tantek’s blog identity. I then went on to check out that blog – no XFN or FOAF to Tantek there. So where did that come from?

A more elaborate dive into SGAPI’s more detailed output showed that Scoble was listed as referencing Tantek with both XFN attributes of “me” and “met“. In plain English, this means that Robert Scoble said “I am Tantek Çelik, plus I also met him in person!”. So what could cause this, except for some serious case of schizophrenia?

My humble guess is that Scoble, some time ago, listed Tantek as a “met” contact on his old blog, but with a magnificient little typo, left out the ‘t’.  He then discovered the mistake and fixed it. But the Googlebot caught both cases, and added them both as relations. Now why would they do that? shouldn’t new data replace old data? well, that’s what other users of SGAPI are asking, see the discussion over at the group. Turns out the SGAPI data is not yet as timely as the main index, and Brad Fitzpatrick promises this will improve soon enough.

Considering the upcoming social diet, it better will…

Update: Hadar pointed out another example, where Chris Messina gets identified with TechCrunch UK… it’s indeed reflected in SGAPI, and I tracked this down to erroneous XFN tagging in an obscure 2006 TCUK post. Indeed demonstrates a weakness of the unmoderated, inherently decentralized XFN-based graph building. Still, for now it’s the only open standard we have, until some higher, post-processing open layer will emerge.

Personally I see no reason right now why Facebook won’t pull it off. The main reason is that they have a full turnkey system in-place. As a publisher, I don’t need to adopt an OpenID library, access a few Contacts APIs (standards are still only making baby steps) and then integrate some form of postback to an aggregator. Facebook gives me the whole monty, on a very large network provider, and a simple WordPress plugin can do all that work.

That’s where an open community lags behind a concentrated commercial effort – tying it all together to a killer-app. An open content platform? well, that was boringly nice, until someone connected it to a killer-app need of an anyone-can-edit-encyclopedia and suddenly everyone’s using wikis. Firefox did not become popular because it’s open, but rather because its openness allowed open features, such as greasemonkeying and tons of extensions. Where is the OpenID equivalent? 

Personally I think blog widgets, and in particular commenting platforms, can be exactly it. The blogosphere is decentralized enough for an open product to compete fairly against Facebook’s push. There are already commercial products making use of it, such as Disqus. Now just decentralize that too, and let every OpenID user assemble their own Disqus page from an OpenID-based commenting plug-in. If you don’t like that, find another potential killer-app (David Recordon’s browser-based identity has good potential too), just don’t assume that an open technology alone makes any difference to anyone beyond the techies.

The important issue is that socially-connected search requires a comprehensive and unified social graph, which can be quite difficult to achieve. When users conduct their first search, they would expect all of their friends, friends of friends, and their respective content to be pre-indexed, for such a service to be of any use.

Skipping that part makes it impossible to bootstrap, and would be like a web search engine that includes only websites that opted-in to be included in the index, or like a FriendFeed version that shows no public profiles, and if you want to follow someone you must create their consolidated profile yourself. These can be regarded as far more privacy-observing services, but will probably never bootstrap as their real-life counterparts did. It’s all about keeping the balance right.