Cameron-Burton-Castaneda-Podcast-Transcript

From Yadis

Rough Transcript of the Podcast Interview with Kim Cameron (Microsoft) and Craig Burton (Burton Group) by Aldo Castaneda

Note: This is a very rough transcript. But it's a wiki, why don't you listen to the podcast and improve the transcript?

Subject: URL-based identifiers

Follow-up from Identity Gang II (Gillmor Gang) Aldo: "Using URLs for everything might be the answer for everything, the total solution." Doc helped put interview together -- Doc and I formulated questions.

Doc to Kim: "You want the identity metasystem to not only encompass many identity systems, but many use cases. As a comemrcial company, you have many use cases and customers. Can you name some of them. I'm especially interested in some that the open source folks are not imagining for far.

Kim: "Clarify first: while MSFT has many customers and use cases, but you can flip this around and look at a person who is living through many roles in their life. They similarly have many use cases. All the use cases I deal with are the same use cases that any individual has to deal with across the different aspects of their life."

Craig: "Metaphor that a person has many roles is the use case for identity in the first place."

Aldo: "Doc might also want to indicate that MSFT also has to meet the needs of large enterprises. ... "

Kim: "Many IT companies are oriented towards large enterprises, but MSFT also has the consumer business. E.g. games. I have to go out and not just convince the server people but all people from all the other places that the solution that we are proposing makes sense. That's partly what Doc is saying, and he has heard me whining about this. ... Is hard to come up with .. hard head-butting to come up with a proposal that works across a wide range of roles that we're in, which in turn are reflected as products that people purchase."

Kim: "if you look at the guys who are doing / thinking about identity for the blogging community, and that is a very important use case, but it is a specific use case. What I'm trying to argue is -- and one of my premises is that anything that takes identity forward is good. And anybody who stops that is getting in the way. So ... let me make it really clear that I support all of those initiatives. I don't see myself as getting in the way of them. But on the other hand, another urgent requirement is that the user be given the chance to unify the experience in all these different parts of his/her life, rather than having to deal with this cacophony of technologies and mechanism and so on."

Craig: "The Burton group just put out a document that estimates that a person spends 30 minutes a day dealing with identity issues and log in. The total cost of ownership of systems is tremendously large for companies."

Kim: Time at work?

Craig: Just at work.

Kim: And there is more at home. One of the reasons I developed the InfoCard idea was that I get so frustrated just doing my purchases and having to re-enter the information many times and trying to keep my passwords straight. I really don't want, knowing as much as I do know about digital identity, I don't want to be in the position of using the same password everywhere, it's so stupid. But I don't have the mental capability of actually managing a whole bunch of passwords."

Craig: You get password fatigue.

Kim: Like a syndrom. And the you go like which one did I use at this site, and if anything doesn't work, what do you do? What I do is I go I must have used a different one and then I start running through all my passwords and so I reveal my system of passwords to anybody who has a site.

Aldo: Or you do the song and dance where they send you some kind of reminder in your -email.

Kim: So if you add up all that time trying to purchasing your tickets or going to a travel site, it's really a collossal waste of time, and so what I'm saying there to bring this back a level, we will always have different technologies, no matter how good the technology that some individual is proposing, there will be a multiplicity of technologies, let's have a single way of being able to experience these underlying technologies.

Aldo: for the end user, meaning a common interface.

Kim: A common interface, and not only for the end user, but for the programmer, too.

Craig: the developer writing code to use the structure.

Kim: If I'm writing [something], maybe I take a chance and write something that is identity-based, do I have to choose between Aldo's identity system and Craig's identity system, and say "I'm going to bet on Aldo's". No, I'm going to bet on Craig's. What we want is being able to say okay, I got a system here that Aldo's will plug into and Craig's will plug into and then, users could potentially be involved in various different identities and systems and it still would work all with my software. That the sort of condition for me participating.

Craig: Law #5.

Kim: Law #5, from the point of view of the developer. Sombody can say that's wrong because in order to create the infrastructure to do that, it's more complicated than if you all agree with my excellent system. I agree that it would be easier if everybody would agree with that excellent system, but they won't. They can't. There are too many needs. And we can get into and that's another issue what the various use cases are and why, say, a URL-based system doesn't work for all the use cases. And what that really is for is an indication of the fact there is no one perfect technology. Identity has contradictory needs. What you need in one situation you don't need in another. So for example, when I'm doing my blog, I want everybody to know that it's really Kim Cameron and I'm the guy who's on the blog.

Aldo: That's the omni-directional.

Kim: That's the omni-directional, but that's the opposite of what I want under other circumstances. That means that in one situation, you want an omni-directional identity underlying system, in other you just don't want that. I would love to use a URL-based system for my blogging identity. That's great. I don't want to use that when I go shopping, I don't want to use it when I go with the government, and when I read my newspapers. I don't want the people who sit at the newspapers going "oh this is what Kim Cameron is reading today. Microsoft must be moving in this direction."

Aldo: I'm thinking as you are speaking that there's an additional layer here, and that's aside from the technical, architeectural requirements, you have the added burden that because you come from Microsoft, people immediately have a sense of distrust. And they say "well, this URL thing could work for so many different cases, why is it that Microsoft says that it isn't a broadly applicable enough solution, that it should move forward. There's the mistrust factor, which to me means that you have the extra added burden of saying "this is specifically why the URL-type systems are good but not sufficient."

Craig: before he answers that question, the mistrust factor is actually a double-edged sword because unless MSFT buys into something, it's going to have a hard time getting ubiquity. At some point, Microsoft has got to agree to it. The problem here is that MSFT is putting forth as the way to do things, and there is mistrust in what is the reason that Microsoft is doing that. What do they have to gain? Is there a lock-in, a trick, some agenda to cause us to do this and then they drop the other shoe.

Kim: I've got this other shoe, this massive shoe, in my office with me. (Laughs)

Craig: I've known Kim Cameron long enough to know that there is no other agenda, the agenda is to ... if you could find an agenda, the agenda is to reduce the total cost of ownership so people will buy more stuff, in general. And there is nothing wrong with that.

Kim: yes, that's right. It's more than the cost of ownership, it is to reduce the distrust that people will ultimately feel towards system that don't properly express the different use cases. You can look at the browser in the current type of technology, and go "it all seemed a good idea at the time. Wasn't it a good idea?" It seems fine. The lock icon, it's perfect, isn't it? But it wasn't thought through to be protective enough from a security point of view. One of our ulterior motives here is that if people lose confidence in the internet and its ability to protect them and protect their thoughts, their autonomy as individuals and the ability to establish the limits on what they reveal to others, then the credibility of the whole internet is challenged. The whole virtual world is challenged. And so that's where Microsoft lives, that's where our future revenue is located.

Craig: So there is not only total cost of ownership, but also trust of security.

Kim: We had that whiff of that with Passport. Passport is an example where we weren't careful enough about those things, and so we learned about them and that is good for the whole industry, because we are doing the best we can to share this with the whole industry. So you look at the technology that we are talking about here, the IP relationship in terms of all of this technology is zero royalty, non-discriminatory license. Anybody can use it. So we are making it really clear that this is not intended for the Windows platform, and I can't give you exact indications of what this implies, but you will see going forward really concrete examples of that.

Aldo: Given that the genesis of this call and these questions was largely around a concern over the polarization of the conversation during the Gillmor gang, I wonder Kim if from your perspective, you are seeing enough activity outside of Microsoft's own efforts with regards to InfoCard, that may be open source implementations, or other things that issue of mistrust around what you proposing and what's being built maybe isn't so enormous.

18:00

Kim: Okay, we have one set of people in the identity gang, who have become pretty strident about positioning their technology against ours. Most of the identity gang does not agree with that. And so I would actually argue that ... I had a lot of people tell me to keep the faith and everything else because this is not ... I do get upset about this. I get upset just in the sense that we have this chance right now, this is a historical chance, to do something, to use Craig's words, that will be ubiquitous. And ...

Craig: separate from the InfoCard, the InfoCard is not what we are talking about

Kim: it's broader than the InfoCard.

Craig: the InfoCard is purely the Windows version of the interface to that system.

Kim: Yes. But by having that, by taking advantage of that ... we either take advantage of that or we don't, and if we don't, ubiquity will be ... there won't be another opportunity for this for some time. And so what you'll have is the continuation of this fracturing. And if that's what people want, that's what people want. I did my best to introduce a different way of looking at things, and to make it completely open, for everybody to participate, and if people want to walk away then they walk away. My feeling is that those who walk away will walk way from a .. a situation that is going to gain more and more momentum. And they actually will have to revisit their thinking there.

Craig: what's interesting about those who would walk away, is that if at some point a customer of theirs all of a sudden had an aha, if it merely connected to the metasystem, it would have more ubiquity. That a 3rd party or that customer could be build an interface from one system to another and have them work.

Kim: that's true, too.

Craig: without their permission.

Kim: there is really no way to walk away.

Craig: you can walk away and someone else can do their bit

Kim: you can walk away from the opportunity, but not from the inevitablity of things being worked out.

Craig: there we go.

Kim: it is really bizarrre to me that in the past, Microsoft would do things and it wasn't clear how others could tap into those and there would be this barrage of critizism that Microsoft is building a closed platform, .... in this case, Microsoft builds a platform that's completely open. And in which anybody who produces technology can have a central visibility within that platform. The equivalent of what we can do as Microsoft. And we still have people have people saying that somehow it's .. what ... I don't know, some kind of a plot. So there are limits to the credibility here.

Aldo: can you just describe what you mean by saying "they will have the same visibility".

Kim: Well, for example, when the InfoCard system is in place, which is just an identiy ... we should make it clear that it means it is an identity selector. In which you have these representations in the shape of cards that indicate which ... you click on that, and that's the identity you get. And underneath it's going out to any technology you want, any identity and security technology you want, and doing an exchange. So, for example, you can take now our internal product at Microsoft for enterprise identity, which is Active Directory, which is also another one of my products. Inside the identity selector, we can set up Active Directories ... we will in the future set up Active Directory ... we havent' written this yet, but we will, so that it has an InfoCard that appears in the system, and if I select that InfoCard, I get the Active Directory asserted identity.

Craig: which would have been Kerberos before.

Kim: Which would hav ebeen Kerberos before, and which would have been ... I won't say much, except that there are some who are suing us for the fact ... because they didn't feel that those interfaces were open enough. Now in the present proposal, Aldo could produce Aldo's identity providing system, and it would now appear on everybody's desktop with Aldo's branding on it or whatever.

Craig: your version of the InfoCard

Kim: your version of the InfoCard to represent your identity system, and it would appear right in the identity selector with equal billing to the active directory one. That's a big a change and the way in which people could think of that as lock-in eludes me. Furthermore, the concept and the technology because all the IP is RANZ, by which I mean no cost, or anything like that

Aldo: no royalty

Kim: no royalty, people can put that ... Craig can put that on a Linux system or on a telephone or an Apple, or whatever they want, and so can the vendors of those things. So there is no lock-in.

Aldo: in the case where we are picturing an end user who is interacting with that system and it has a certain look and feel etc., is the look and feel aspect also part of the IP that's under RANZ licensing.

Kim: Yes. Let me just make this completely clear. There may be something like rounded corners on Windows which is part of the Windows look and feel. If you moved it to the Macintosh you would have to have the Macintosh rounded windows. But the actual look and feel of the identity selection part of InfoCard is all open.

Aldo: because there are aspects of the UI that are just part of the general windows

Kim: there might be. I don't think there are, in this case, because we have actually made the UI for this not look like the rest of windows. Because we want people to know that they are this secure desktop away from the rest of their windows system. Because there is all this cryptography underneath, and spearation of processes and everything else. So we want them to know that this is not the browser, not their normal desktop, a virus running in a normal user context can't even see the InfoCard system when it comes up. That's why we've given it its own look and feel, ... I'm just trying ... so I don't claim something that isn't 100% true.

Aldo: It would seem to me then that a lot of the issues that some people who are arguing with that approach, have, seem to be around how long it takes to implement and the complexity of the implementation, which is not so much an issue around proprietary IP and lock-in, but they are saying if they are trying to build a solution for the blogosphere it is just hard to implement in terms of the time it takes to do it.

Craig: Yea, it's a lot easier than building 20 of them, or trying to start from scratch with your own.

Kim: I think ... I'm not without sympathy for people's concerns. I do sympathize. And I have been working to try and address those concerns. So for example, the complexity inside the Relying Party. ... I think one of the good things that Dick Hardt and Johannes and others have said ... and by the way, I ... well, I was gonna say, Dick Hardt has a more open attitude towards some of this stuff ... one of the really important things learning that I've taken from them, and that they have completely convinced me of, we really must get to this Long Tail, made of little websites and everything else. And to do this, you have to have something really simple. And we need ... once again, so the idea ... the metasystem has to be able to go down to the very lightest end ...

Craig: to an individual's computer

Kim: well, yes, but also the Relying Party. It is one thing to get it on the client, because the selector will be availabel for download, but how do I get it on your blog, Craig?

Craig: as a Relying Party, not just as ...

Kim: as a relying party, that's why I switched over to Wordpress recently, so now I'm running the pure LAMP stack, I've got Linux Apache mysql and PHP. It's really a lot of fun. And it's being operated ... I did all the worst things I could, in the sense of making it hard for myself as somebody who is more familiar with the Microsoft platform. It's operated by an ISP for me, so I can't even get on there and put on a binary. And so the challenge for is to show that that can work with InfoCards.

Aldo: I see. So it is easy enough for the ISP serving that site to install all the tools to support it?

Kim: or that I as an end user, without even contacting the ISP can install the tool that will accept the InfoCard. Not even install a tool, just install a plugin, say, for Wordpress. The usual kind of stuff. If we can achieve that, then I think it helps to deal with the problem ... the simplicity / complexity problem. What do you thikn Craig?

Craig: I'm in total agreement that you need to have somebody be able to work completely on the Linux stack without any Microsoft code at some point and still be connected to the metasystem directly if the need to . And use the same interfaces and so on. That's going to bring some power when you get that. And that's also going to relax some of the criticism that it is Microsoft.

(about 30:00)

Kim: So to make that clear, I would have ... I can see myself having an InfoCard which represents a URL ... all I'm saying that as an InfoCard user, somebody who is going to use InfoCards that work in another context, I'd like to have my blog identity in there, too. And so, I woulnd't ask OpenID and LID to not do what they are currently doing as an interface, which is a very nice, light-weight thing, but I would say, it would be really nice for them to give me the chance to install a URL-oriented thing as an InfoCard. And that's feasible, that's doable, it's easily done, then I can bring all of my experiences together inside that one common experience.

Aldo: so when you are saying, that they should give you the opportunity to use a URL as an identifier, you are speaking from the perspective of an end user in that case.

Kim: Yes. As an end user, I should be able to ... I feel that if it is really a user-centric thing, I should be able to ... and I choose InfoCards to unify my experience to pop that in. So once again, we'll be demonstrating ... it's easy to build InfoCard-oriented URL-based services. And so, undoubtedly, that will be happening. But this idea of the metasystem ... it depends on whether you think Laws 6 and 7 matter or not. To me, law 6 is a law about making sure that we take iinto account the requirements of estbalishing a secure connection with the user. It's not just secure connections with other machines. But a secore connection between the crypto system, or the security system, and the user. If you want to do that, then, if you think of what we've done in the InfoCard system, by presenting a secure desktop, which is not screen-scrapable from your normal context, and so on, which it can't have the pixels overwritten

Craig: like you can in the browser.

Kim: like you can in the browser ... why would somebody want to tell users to walk away from that? And who else can upgrade the security of that thing the way that Microsoft can? Nobody can. It's really oiur responsibility, since we produced the browser that ... everybody who produces a browser should produce means .. and everybody who produced a platform shoudl produce means of making that secure. That's one thing: you need that secure relationship to the user, and people should be taking that into consideration. Secondly, that if you consistently give the user that multiplicity of mechanism, so for example, Johannes was saying in the Gillmor Gang conversation that government identity systems are not within the scope of these things, so I mean, that's implying that there is this other whole series of technologies that you are going to have to use for these systems. At least can't we make the user experience the same? I mean I understand why he's saying that he doesn't want it in scope. That's an example for why I'm saying there will be a multiplicity of systems that have to be unified through a common experience.

Craig: and that Microsoft is providing the core technology for a common experience to occur even on other platforms and in other operating system.

Kim: Yes. Because the underpinnings of that common experience are open source.

Craig: Not open source, but they are open and free. And certainly somebody is making them open source at some point.

Kim: the idea of doing it open source, you can't do it open source because you have to think through, say, if you are building this kind of interface on Linux, the way you achieve the secure desktop on Linux will be slightly ... will require different code than the way you do it on Windows. And it's deep enough in the Operating System that you need to do that. But I mean it is totally doable.

Aldo: So that would require a separate implementation ... it would require new code.

Kim: Requires new code.

Craig: but that code could be open source.

Kim: and that code could be open source.

Aldo: Right.

Kim: And we are interested in helping that code come about. So, this isn't a case where we'd go "hey, we don't want that code ..."

Craig: I know it sounds bizarre, but think again why that is. It was ... because it helps the overall community stay from stagnation and help growth, which is in Microsoft's best interests. It's much better for Microsoft to have growth and have a piece of it than to own it all and have it stagnate.

Aldo: It's clear that the level of currents rifts due to the architecture that stands will have a significant impact not only on Microsoft but on everybody else who is using the on-line medium.

Craig: That's why it has some credibility.

Kim: Beyond that, it is that thing that what raises the ocean and all ships will rise.

Craig: exactly.

Kim: Have you ever seen your friends having an argument and one of them is trying to get over it and then the other one just keeps them in the place where they were. In that argument. They sort of can't get out of it. That's really the state that we are in with ... between Microsoft and ... a lot of others. And I understand where that comes from, and you got to look at it this way: Microsoft was going at a fantastic ... what should I say ... at a fantastic clip, it's like something propelled into space. I wasn't here at the time that the company was growing at that fantastic rate, but it was going in a certain way, and it did things and so on, and Microsoft has a very deep understanding that the ocean has to rise, the ocean can rise, the ocean has to rise, and I see my work as being indicative of a new way of approaching our colleagues in the industry. And I web services, if you look at web serivces as a whole, I see them also as being indicative of a new openness towards the industry. Where it's truly interoperation and truly by getting synergy between us instead of fracturing and distrust. That we can move forward. And I know it's too much asking people to believe but at least at the identity front they can come in and look up front and see that they are no marionettes, my sleeves are rolled up. If they aren't, Craig and Doc and everybody should just

Craig: stomp all over it.

Kim: stomp all over me.

Craig: as we had before Microsoft things ...

Kim: you're good stompers ...

Craig: we stomped hard on Passport, and it didn't ... what we stomped on came about as being so, and this is different.

Kim: But I mean, can one accept that one stomping can lead to good things ... people can learn, people can change, or we are all going to lock ourselves into always are unchanging and ultimately products of original sin.

Aldo: Wow. It strikes me to do that stomping, we could come in your office and use that other big shoe. Always ...? I think I mean my motivation again: in doing this is trying to air a lot of the underlying issue in trying to dissipate to the degree possible that level of distrust. It's teasing the issues out, presenting them and going over them probably ad nauseam. With the addition of some time, that's how these kinds of things are getting resolved and how we move forward.

Kim: And by concretely showing, if we can show the simplicity and the ability to integrate some of this stuff ...

Craig: the way for Microsoft to get over is to deliver ...

Kim: and we are delivering. You mean my day job.

Craig: yea, and that's really the tail of all tails will be delivery. Because until we have it in hand, it still is just a conversation ... we have these good intentions.

Aldo: that's where the rubber hits the road, yea.

Craig: When it's delivered and usable and the developer, for example, looks at it and says Aha, a stack of services that look like a cloud to me and not like Windows. Mon Dieu, what can I do. I have ... ?

Aldo: what's the time horizon that you see, Kim, for coming to the conclusion that it succeeded or failed. Presumably it's more than a year, I would thinik.

Kim: what do you think, Craig?

Craig: Well, I think that there's a lot that can be done between now and when Vista ships in providing technology and documentation and information about the identity system. But then, at some point, it's gotta ship. I have a hard time thinking that it ship before Vista, but I guess there is that possibility.

Kim: No, it ships with Vista.

Craig: with Vista, okay.

Kim: there's the beta, and what we call the RTM, release to manufacturing, ahead of that, so plenty of room for people to do proofs of concept and stuff like that. But hopefully what we will see is a lot of proofs of concept, or a number of important proofs of concept on the way to Vista, and it would be nice to have a couple of really good partners at the Vista launch. Big ones. And a number of people who can show that breadth of things you can do in terms of all the phantastic possibilities of all of this. So I would say there should be traction on the way between here and Vista.

Craig: a Liberty connector, a X.509 connector, and so on ...

Kim: and things by specific not the traditional identity community but people who have great relationships with customers and who want to extend that into identity. We should start to see some of that. I'd like to see some proofs of concept in the government arena, my website for sure. Maybe I can get Craig to get involved, too.

Aldo: Thanks guys.