0xDECAFBAD - Tag: webservices

Blog posting delegation and third-party auth

2007-03-05T22:13:45+00:00

Here's something I've been meaning to post about, brought back to mind from Kim Cameron's post on "Wrong-headed impersonation":

I wish that blog posting interfaces (ie. MetaWeblog API and Atom Publishing Protocol) offered a way to delegate blog posting to a 3rd party app (desktop or web) in such a way as to avoid providing one's login details (i.e. user name and password). For instance, consider both Flickr's and Upcoming's 3rd party token-based authentication / authorization schemes.

In particular, I'm looking at things like del.icio.us' own Daily Blog Post and others. These can be used to auto-post content to one's blog generated elsewhere - but at the price of sharing login details. Granted, you can mostly trust these 3rd parties not to do anything nasty with your credentials, but it would be nice not to have to.

I figure that something RESTful like extending HTTP authentication (ala Atom Authentication) with a token scheme could be interesting, and possibly fit nicely into APP itself. It could probably be retrofit into the MetaWeblog API by specifying a per-app user name and password. I can imagine a WordPress admin plugin that issues approved authentication tokens to restrict the categories and other activities allowed by 3rd party apps.

Just something I'm thinking about, as more services may or may not grow into delegated blog posting.

Archived Comments

fluffy
2007-03-05T22:40:26

Wouldn't openID be a better candidate for this?
l.m.orchard
2007-03-05T22:48:24

Not really, unless I don't entirely understand OpenID.

OpenID offers way to authenticate yourself. However, what I want is an easy way to delegate your access to 3rd party apps, without those apps being able to authenticate as you or performs actions outside of the permissions you approve. I don't really want Flickr Uploader, Ecto, MarsEdit to be able to use OpenID to login as me with carte blanche.

With a token-based system like Flickr has, I can approve delegation to various apps and revoke their access at any time - without ever releasing my login details.
George Hotelling
2007-03-06T17:51:55

At first I had this great idea to build a blog posting proxy service that could grant access to your blog to different services by giving them different usernames and passwords and you could revoke them at any time and it would be great and everyone would be posting to everyone's blog all the time.

Then I realized I had put on complicator gloves and that it would be way easier to just add new users to my blog without a proxy service.
l.m.orchard
2007-03-06T18:04:57

Yeah, I figured making multiple accounts is a way to go when you've got your own install of something like WordPress. It kind of gets stymied, though, if you want the same thing for a hosted service like WordPress.com, Vox, TypePad, or LiveJournal where one account = one blog.
Ian McKellar
2007-03-12T17:43:49

It seems to me that the ideal solution to this is to have your blog pull new posts from an RSS/Atom feed that's hosted by the service that is generating your content. Feedburner already has a half-assed implementation of this where they'll pull your delicious bookmarks and flickr photos into your burned feed.
l.m.orchard
2007-03-12T17:58:35

@ian: Hmm, yeah, that probably does end up being the least onerous solution - just offer an aggregated feed of one's output. I do like the idea of auto-posting to a blog, though, for the sake of something sorta like daily backups to a system I control.
Ian McKellar
2007-03-12T18:44:46

@l.m.orchard: you don't need to just aggregate you can also import posts into your own store. We could come up with a cleverly confusing buzzword acronym like Atom Pull Publishing. You just periodically poll a feed and import the items. Actually, this is kind of what Google Reader is doing. They've even got a namespace in their atom for expressing the original id and the source feed. Perhaps I should write a drupal module.
l.m.orchard
2007-03-12T19:01:45

@ian: Hmm, yeah, that does sound like the least complicated way to get outside content pulled into a blog without releasing the blog's login details. I know I've seen / used some WordPress plugins that do basically that, though I've not been happy with any of them yet. I should re-look into why that's been the case
Ian McKellar
2007-03-12T19:26:16

@l.m.orchard: in my experience the problems are with the formatting of the content (do blank lines turn into paragraphs, etc) and fragile post IDs (the upgraded wordpress and spammed all my friends on livejournal or planet problem). I'm not sure how to fix either of these problems but I think they're both problems Atom is attempting to solve...

do not taunt happy fun JSON

2006-12-21T02:55:45+00:00

Allow me to repeat myself somewhat and clarify my general opinion of JSON and its use in cross-domain browser scripting:

Happy Fun JSON is not really an API. Happy Fun JSON is not a bold declaration of side-taking in the grand war of web service specifications. Do not base business models on Happy Fun JSON. Caution: Happy Fun JSON may suddenly accelerate to dangerous speeds or stop altogether. Happy Fun JSON contains a liquid core, which, if exposed due to rupture, should not be touched, inhaled, or looked at. Ingredients of Happy Fun JSON include an unknown glowing substance which fell to Earth, presumably from outer space. If Happy Fun JSON begins to smoke, get away immediately. Seek shelter and cover head.

Do not taunt Happy Fun JSON.

Having said all that? Happy Fun JSON is pretty fun to throw around.

Archived Comments

Geof F. Morris
2006-12-21T03:34:19

Did it hurt when Happy Fun JSON fell from Heaven? ;)
Robert Sayre
2006-12-21T03:55:47

Obviously, the new del.icio.us JSON url feed is crushing blow against XML Web Enterprise Services Declarative Net Neutrality.
jamesv
2006-12-21T15:14:24

I only wish you could pass Happy Fun JSON into Flash via FlashVars in IE. FF and Safari seem to have no problems with it.

It would make authoring a richer content version of sIFR much, much easier.
Jim Plush
2006-12-22T19:22:48

You should be banned from talking about JSON if you think you have to choose one or the other. A place for everything and everything in it's place.
Danny
2006-12-31T18:11:19

All this lynch talk - I just got throttled!

Running the script here on a series of URIs got me the 999 error (no sure how many had run). There's a 2 second pause between calls, I thought that would be polite enough. Still throttled now, maybe 10 mins later. Any suggestions for what would prevent throttling? How long it needs to recover?

btw, I think Happy Fun JSON is great, and not unreasonable for interop. But what isn't so good for interop is inventing a new HTTP code when there's 503 Service Unavailable (and a Retry-After header would be handy).
Damian Cugley
2007-01-22T14:16:27

@jamesv: The first thing I did with JSON at work was pass it in to a Flash movie via FlashVars. This used a JSON decode written in ActionScript grabbed from JSON.org, plus a JSON encoder written in C# (it did not take long to write because I did not attempt to serialize arbitrary objects). Some gratuitous URL-encoding was also involved. Compared with passing the same data structure via URL-encoded XML to be picked apart by ActionScript's DOM support, it was easy and much more like fun.

correlation is not causation

2006-12-21T02:01:38+00:00

By the by: Correlating the new del.icio.us JSON URL feed with Google's recent deprecation of the SOAP Search API is about as effective as noticing how often the clock reads 12:34 when you just happen to be looking at it.

Archived Comments

Joe Grossberg
2006-12-21T13:10:16

Because ... you say so? :)

Also, I think you misuse the word "correlation".

And I think there is a correlation -- both are indicative of a trend in "web services" today.

JSON and YAML are getting more popular in that arena and XML (especially SOAP) is something that a lot of programmers dislike workign with.

Amazon EC2 emerges

2006-08-24T12:58:04+00:00

Amazon Elastic Compute Cloud (Amazon EC2) is a web service that provides resizable compute capacity in the cloud. It is designed to make web-scale computing easier for developers.
Just as Amazon Simple Storage Service (Amazon S3) enables storage in the cloud, Amazon EC2 enables "compute" in the cloud.

Source: Amazon.com Amazon Web Services Store: Amazon EC2 / Amazon Web Services

This seems like the sound of the second shoe hitting the floor. Although I tried signing up for this as soon as I saw the email, I was already too late to get in on the beta and start playing. Maybe I'll get in on a second round.

EC2 seems a lot like User Mode Linux virtual hosting, but it charges ~~by the CPU hour~~ by the hour of uptime instead of month-to-month. I'll be very interested to see how this shakes out, and what sort of web app architecture it encourages when used in conjunction with S3 - say AJAX-based queues for instance? - or if it just gets used as a straight LAMP host in general.

Archived Comments

Sencer
2006-08-24T15:27:46

it charges by the CPU hour

Just to prevent confusion: They call it instance hours and mean the hours a vm/instance has been running (independent of utilization). Only saying this, beause some hosts, like dreamhost, use(d) the term CPU-minutes for keeping track of "how much time a processor spends working for your username" and allow(ed) sth. like 60 CPU-minutes a day.

At least that's how I understand the amazon offer.

And thanks for the pointer! It'll be intereting to watch what people are going to come up with. Given that the instances are not "persistent", i.e. data is gone when you stop them (unless you move things int S3 or elsewhere), I am assuming that they will be used differently from regular dedicated machines.

It reminds a little bit of DSL (Damnsmalllinux) which boots/runs of a CD, but allows you to save all your data and customization to an external storage (usb/ftp/etc.) and does auto-restore when you boot into it again. This is nice for people afraid of viruses or getting hacked etc.. I wonder whether this will turn out to be a plus for amazons offer as well. At first it does make things a bit more complicated wrt to usual linux way. But I guess tose things can be solved...
l.m.orchard
2006-08-24T16:29:44

Sencer: Actually, I think your reading is the right one. It's charge per hour of uptime of the instance, and not a meter on CPU cycles.
So, to do a quick napkin calculation - $0.10 per hour x 24 hours x 31 days = $74.40 per month to keep an instance running around the clock.
That makes me think that applications using this service will need to be designed around some clever resource usage, either through scheduled tasks or some interesting way to respond on demand. Simply running a straight PHP app would seem a bit wasteful in many small-scale cases.

If I were to run a blog from it, say, I'd lean more toward the Movable Type school of static publishing than the WordPress school of live PHP pages. Of course, that could all be done from a behind-firewall personal desktop machine, so I need to think of a better example.

Then again, being able to add and drop instances at will is a big, big deal for larger scale applications.
Jonathan Boutelle
2006-08-24T17:12:09

Let's see, back of the envelope calculation ... that's a 10-machine cluster for 720$ /month + bandwidth. With redundant storage and firewall included. Holy crap! Web 2.0 apps just got a LOT cheaper to deploy.

I am also stuck in limbo land: they sent the email out at 3AM PST, which is just rude: a west-coast company should at least wait until California and Washington wakes up before sending out a limited beta. Methinks the geeks in NYC and boston and the research triangle got all the slots.
l.m.orchard
2006-08-24T17:57:58

Jonathan: Yeah, I think your calculation is a better one. Mine just reflects the fact that EC2 doesn't scale down to piddly little apps like I've been playing with. But scaling up, it looks like a much better value.
Daniel Néri
2006-08-24T19:04:19

It appears to be based on Xen, judging from the sample hostnames in the docs.
Alex James
2006-08-25T11:27:19

I agree, you need to band together with a couple of mates to make it worthwhile for really small sites. But at the high end it is amazing value.

Perhaps then there is an opportunity for someone to use EC2 based websites, you could easily create an sort of ISP or ASP model using this, by putting about 20 little websites/application servers on one Image.

BTW Jonathan... I'm from little old New Zealand and I managed to nab a slot!
Website Nepal
2007-08-31T17:23:53

I checked out the Amazon EC2 since I am planning to offer web hosting solution somewhat similar to what EC2 are doing.

Templates: Good or Evil?

2005-09-26T01:12:46+00:00

This cry and whine that draconian handling will break your page and make your users suffer for you if you have a single error is just another legacy of HTML we’ve gotten used to: our toolchains tend to be of the “glue strings together” (aka templates) variety. ... There should never be any part of your publishing toolchain just gluing strings together. Ever.

Source: Aristotle Pagaltzis in a comment on "The Future: HTML or XHTML"

There’s no rule that says templates must only be used to generate HTML. Indeed, many of the RSS and Atom feeds in the wild are generated from some form of template. They are never automatically-generated-behind-the-scenes using language bindings and are very rarely generated using some kind of DOM/SAX API.

Source: Web Services Infrastructure: Kid Templating

I've been meaning to write about this for some time now, though I've never had my thoughts together to any degree to mount a decent case for either side. Problem is, I haven't gotten much closer now, but I figured I'd at least post a few thoughts and conjure up a vague sketch of the issue.

You see, I think it all goes back to thoughts about which I posted almost three years ago. On the one hand, producing something like XML using "proper" DOM invocations and handwavings seems like the "correct" thing to do. Yet, on the other hand, using a templating system lets me get down to business much more quickly and with much more clarity and succinct code.

Yeah, templates provide a range of flexibility sufficient to aim the barrel at your own toes, while an API like the XML DOM keeps everything on the rails--but sometimes you know where you're going and don't need the rails to get you there. Furthermore, isn't it possible to make a template system that Does The Right Thing?

Anyway, it's rather apparent that I'm solidly in favor of templates: After all, a book of mine just hit the shelves which is just rife with template-based generation of RSS and Atom feeds.

My only issue, really, is that I feel vaguely guilty about it.

Archived Comments

rick
2005-09-26T02:27:37

Ruby has the nice Builder module for this (http://builder.rubyforge.org/). Ruby on Rails uses it for it's rxml templates. So, you still get the speed of templates, but you don't have to worry about those pesky xml rules. Here's a sample Atom 1.0 template used by Typo, a rails weblogging system: http://typo.leetsoft.com/trac/file/trunk/app/views/xml/atom10_feed.rxml
Aristotle Pagaltzis
2005-09-26T03:52:50

Using the DOM to build documents is awfully awkward. Don’t do that. Check Henri Sivonen’s suggestions just published in his HOWTO Avoid Being Called a Bozo When Producing XML. Instead of building a DOM, generate SAX events, using the program structure to ensure proper nesting – or instead of generating the SAX events all manually, generate them by parsing a static XML document and using certain interesting points in the stream (such as Processing Instructions) as hooks for inserting payload. The emission of synthesised SAX events can be generalised by writing a datastructure-to-SAX serialiser, so that you can build your data within your language’s native datastructures prior to outputting it, for maximum comfort. (Of course you serialise piecemeal too, f.ex. by outputting the head of a feed manually, then for each item, building the data structure and immediately serialising it, then emitting the final events to complete the document.) Depending on the complexity of the output, you could directly emit the otuput format or feed the events into to an XSLT transform that generates the full-blown thing from an easy to generate document structure. In both cases this can be done with or without the involvement of a serialiser as middle man. There are plenty of ways to make sure that the entire toolchain from one end to the other consists only of steps that conserve well-formedness, and they need not be any less convenient than using templates.
l.m.orchard
2005-09-26T04:16:35

or instead of generating the SAX events all manually, generate them by parsing a static XML document and using certain interesting points in the stream (such as Processing Instructions) as hooks for inserting payload.
Aristotle: Now here's where I think certain templating technologies get interesting, and may Do the Right Thing. My so-far-favorite templating kit, ZPT, wants well-formed XML as templates--although I think that restriction is unfortunately relaxed as a nod to HTML. On the other hand, my possibly-new-favorite templating kit, Kid, [demands well-formed XML as templates](http://lesscode.org/projects/kid/wiki/KidFaq#must-templates-be-well-formed-xml). In case you haven't played with them, these two template languages center around the idea that certain attributes on elements define where content provided in a data structure should be inserted / swapped in by the template engine. The engine handles character encodings and such to ensure that the well-formed template results in a well-formed document. Does this match up with what you say up there?
l.m.orchard
2005-09-26T04:28:49

I guess the other thing that bugs me about constructing documents via DOM or via generating SAX events—which I'd first discovered in this XML.com article by Uche Ogbuji—is how awkward and removed it is from the view-source XML I've gotten used to hacking around with. Of course, my distaste for programmatically generating things like this goes back to CGI.pm in my perl-hacking days. When I start writing code to generate data that could be mostly done with a template, it strikes me as tangling Model/View/Controller elements and introducing weird context shifts. (ie. h1() vs <h1 />) Not sure if that made sense...
Bob Aman
2005-09-26T05:40:24

Yeah, I was gonna say, Builder for Ruby solves most of the issues with using templates and xml. For RSS and Atom, there's also my Ruby FeedTools library, which makes it even more rediculously easy to get a valid feed up and running. I'm also very tempted to play around with Kid and see how I like it, and perhaps port it to Ruby. From what I've seen so far, it looks like perhaps the nicest templating system yet.
Aristotle Pagaltzis
2005-09-26T05:59:08

It does. I confess I actually kind of liked CGI.pm – because nesting is automatically taken care of without so much typing of end tags, and you can seamlessly weave maps into the code for output loops. I have to note though that I used it as a sort of template language in its own right – I never littered prints all over my code, I kept all the calls in a single place, in fact, usually a single expression. That is also why I find it strange that people create template languages for PHP, which was itself born as a template language. What matters is that the output generation is separate from the processing logic, whether or not the template and the code are in different languages. Anyway, I digress. What I wanted to say is, no, I hadn’t seen either ZPT or Kid. I had put off reading the lesscode.org article you quoted and went back to it after responding here. Now that I’ve read it, I admit I’m intrigued. I’ll have to look into Kid; it sounds like an interesting take.
l.m.orchard
2005-09-26T13:39:00

What matters is that the output generation is separate from the processing logic, whether or not the template and the code are in different languages.
Ah hah, yeah, that's what I was fumbling toward with the sleepy tail-end of my comment. Logic and presentation in separate blocks / files / etc. And then, my take is that if you're going to have your presentation/view separate from the logic/controller, you may as well code the presentation in a form as close to the goal as possible (ie. in XML or HTML, not in s-expressions or the logic implementation idiom)—especially since oftimes you've got separate people or teams working primarily on each. I suspect, however, that a templating system like Kid goes quite a ways toward solving the problem of "gluing strings together". I almost wish it had been further along / I'd been more aware of it before I'd reinvented my own wheels for my book using Python string templates and funky map classes.
Ryan Tomayko
2005-09-26T19:00:44

I suspect, however, that a templating system like Kid goes quite a ways toward solving the problem of “gluing strings together”.
That's the idea. The correctness of DOM/SAX based contruction with the ease-of-use of templating. The future of Kid is somewhat uncertain. I'm hoping to wrap up 1.0 and stabalize it for Kevin and TurboGears but what I'd personally really love to see is the general concept of "structured templating" reach a wider audience.
Ryan Tomayko
2005-09-26T19:02:17

Oops. Sorry about the rough formatting. For some reason I thought comments were in markdown. Edit away, Leslie.
l.m.orchard
2005-09-26T19:11:20

Ryan: Grr. Funny you should mention that—I thought comments around here allowed markdown, too. I think I need to fix that *and* display some copy explaining markdown availablility, since I think that was something about which Aristotle expressed some confusion/surprise before as well.
Aristotle Pagaltzis
2005-09-26T20:29:12

if you’re going to have your presentation/view separate from the logic/controller, you may as well code the presentation in a form as close to the goal as possible
Oh, I don’t disagree at all. I have been annoyed at the state of XML generation at large, myself. Kid looks very nice, except I have no use for it, being that I’m still a Perlista. (Python just doesn’t feel right to me – like wearing a badly fitting tuxedo.) I’m wondering how much work it would be to port it or a close copy to Perl…
I think that was something about which Aristotle expressed some confusion/surprise before as well.
Heh, yeah. Your MT installation permitted Markdown but no literal tags, which caught me off guard once or twice until I noticed. But thankfully it had a preview button, so I could figure it out. I hate how WordPress does not ship with preview button available and enabled by default, and the default configuration doesn't even mention the expected formatting anywhere either. I just suspected that your WordPress was vanilla and used HTML on that hunch – and it worked. Phew. Maybe you can install the gagdget that Ryan uses on lesscode.org? I love that.
l.m.orchard
2005-09-26T21:38:08

I just suspected that your WordPress was vanilla and used HTML on that hunch – and it worked. Phew. Maybe you can install the gagdget that Ryan uses on lesscode.org? I love that.

Your wish is my command. At least, in this instance. I pawed through Ryan's HTML source and got sufficient clues to install this thing and shamelessly steal a snippet or two. Let's see if this preview works and if it accurately reflects what this will look like when I post...
Alex Schröder
2005-09-27T11:22:06

I maintain Oddmuse, a wiki engine written in Perl, using CGI.pm to generate the HTML. Often people want me to switch to templates. At the moment, when you want to radically change the HTML for the stuff that is not the wiki content, ie. headers and footers, you need to override the Perl subs that I provide. Somehow that strikes me as natural and easy, but many of my users seem to disagree, preferring to learn a templating system instead of learning to write Perl code. I'm still undecided about the issue. At the moment I'm still sticking to the "write Perl code instead of templating" because being able to write Perl code will make so many other task easy.
l.m.orchard
2005-09-27T11:31:23

Alex: Well, from my perspective, I've worked on a lot of teams where you've essentially got two roles—software engineer (SE) and interface engineer (IE). Depending on the company and the team, the SE might understand Perl/Python/Java/SQL while the IE might understand HTML/CSS/Javascript/Flash. There's usually overlap, of course, but these are the roles on paper at least.

When you're trying to come up with an overarching framework which accomodates collaboration between these two sorts of people and their respective skill sets, it helps to have a bridge between the logic and the presentation which can keep the Perl out of the HTML and the HTML out of the Perl.

On the other hand... A project like Oddmuse likely has an entirely different user and developer base than the projects I work on at my day job :)