DRM = Doesn't Really Matter

If one of the biggest items to be delivered at tomorrow's MacWorld Expo is the elimination of DRM from songs on the iTunes store, as is rumored, then we are on the brink of the biggest snoozefests in technology event history. Forget that Mr. Steve Jobs potentially is suffering hot flashes, and is instead being replaced by Cupertino's wild-haired Pillsbury Doughboy, Phil Schiller. This Macworld has got to be the lowest-anticipated in terms of new product debuts that I can ever remember. And when it comes down to it, despite all the online horror and tongue-lashings, I'd venture a bet that the supposed evils of DRM that Apple has wrought on its users haven't really effected but a small percentage. I don't love DRM, but I live with DRM, and it doesn't really matter.

When Apple introduced iTunes and marketed it with the "Rip. Mix. Burn." campaign several years ago, music labels were furious, thinking the Mac-maker was embracing piracy, a second back to back blow to the maligned monopolists following Napster's runaway success. When Apple introduced the iPod in 2001, and later the iTunes Store in 2003, it had to bend over backwards to gain the cooperation of the labels, restricting who could play what songs when on what computers or iPods, and how many times they could burn playlists to CDs, all in the name of preserving profits.

Over time, some of the DRM rules were relaxed, and the advent of iTunes Plus meant you could some songs from iTunes without rights management, for an additional fee of 30 cents a song. The additional 30 cents, in theory, meant you could do whatever you wanted with the file, just like you can with any hard copy you own, be it cassettes, CDs, etc.

Although I've been an iPod user practically since the first day they were announced, and followed the Apple upgrade path through to my current 16 GB iPhone, and I now own almost 6,000 songs on iTunes, a significant percentage of which were purchased from the iTunes Store, I almost never encounter any issues with DRM. I've upgraded my laptop a few times, moving my data from one computer to the next and authorizing the new machine. I've synchronized new iPods and the iPhone and always been able to play them. My music plays on my Apple TV, and can be streamed from my wife's computer on our same network.

That my music is slathered over with Apple's proprietary DRM is not a big deal, period. I would practically have to go out of my way to find a way that having "suffered" through DRM for the better part of eight years with Apple has negatively affected my music experience. I do know that I certainly am better off than those who chose subscriptions with music companies that have disappeared and gone out of business. I'm better off with my digital music here than in stacks of CDs around the house. In fact, I gave all my CDs away to a co-worker when the babies were born as part of cleaning house!

For eight years, I've wondered if the fact I didn't care about DRM was because I am a hopeless Apple fanboy. Maybe I've fallen under the spell of believing Apple should make the rules for how I use what is ostensibly my music and media. But seriously, the drama of DRM and its limits has been so overhyped I don't even know where to start. If you want to buy your music somewhere else, go for it. There are alternatives. But there's a reason iTunes, iPod and iPhone have been such a success. It's because of what they let you do, not what they don't let you do. It's the best combo on the market, and I don't care one bit about the DRM wars which just might be coming to an end as we know it tomorrow. I never have.

40 Key Elements to Getting Started In Social Media

By Mike Fruchter of MichaelFruchter.com (Twitter/FriendFeed)

Getting started with social media, whether for personal or professional use, requires learning the basic fundamentals. Social media is more than just creating a blog or Twitter account. The tools are great and give us big advantages, but they are simply extensions of how we engage and participate in social media, they are not the answers. The social in social media is all about the human element. This post touches upon 40 key elements to aid your success.

Branding, personal or professional starts with your domain:

1) Register your domain name. It's also a good idea to register it for multiple years. If you have extra cash up front, spend it. There is no need to be bothered with yearly domain name renewals, and, in a worst case scenario, risk losing your domain name. It's a good idea to set your domain registration on auto-renewal if you decided to renew yearly. Stay on top of the credit card you have on file as well. Auto-renewal notices, getting marked as spam, combined with an expired credit card is bad news. This happened to a friend, just a word of advice.

2) If you are an individual and your goal is personal branding, use your first and last name for the domain, and preferably a dot com extension as well. The domain spelling should be equivalent to someone typing that keyword or phrase into a search engine. It should be as short as possible and easy to spell. If you are business, be sure to register any variations and extensions of your domain name. The last thing you need to be doing is negotiating with a domain squatter, paying a premium down the road when it would have cost you next to nothing initially.

3) Find a reliable Web host, and do your homework. When you are just starting out, it’s practical and economical to go with the cheap shared hosting plan, i.e. Go Daddy.

4) Expect to upgrade your hosting plan at some point. When you have a steady flow of traffic and people are taking notice, sharing your content, digging it etc, be prepared to spend some extra coin for the next level of hosting. Do not be concerned with getting on the front page ofDigg in the beginning. If it happens, great, but there is no need to spend the extra cash beforehand. If things get really rocking at some point, perhaps you are making some coin off your blog or non blog website, traffic is flowing, server resources are being taxed, you are registering multiple domains, and establishing multiple websites/blogs, then you should look at a basicVPS server. The bigger you get and the faster you grow, the quicker you need to be thinking about moving away from shared web hosting.

5) Familiarize yourself with the basics of web-mastering. If you have not already done so, learn how to use FTP. Learn the basics of HTML, and how to configureDNS for your domain names. Learn how to configure a POP email account, and how to take a screen shot and edit and resize images. The less you have to rely on someone for these basic tasks, the better off you will be and you might even save some out of pocket expenses.

Blogging:

6) There are a number of different blogging platforms available to choose from. They all pretty much do the same thing, but your first obvious choice should be Wordpress . The majority of blogs on the Internet are all powered by Wordpress, and for good reason. It's a stable, proven platform and it's highly customizable. There are also a few thousand readily available themes and plug-ins made for it. There is also a huge developer community behind it, and plenty of resource sites dedicated toWordpress users. This one is a no brainer folks.

7) You should self host your blog on your own server. I would avoid using a web-based blogging platform. There are limitations to what you can and cannot do with these services. If you must use a web-based blogging service, you must be able to mask your blog to a domain name. There is a price to pay for this though, and you should ask yourself, is it really worth it? For the $10.00 priceWordpress charges, add five dollars more and you can buy a domain name and cheap self hosting. I see little value in using a web-based blogging platform, and not masking it to a domain name. Do you want people to remember mikefruchter.wordpress.com ormikefruchter .com? Brand yourself, not the blogging platform. Trust me they are making enough money, why make them richer? Most hosting companies who offer even the cheapest hosting packages offerWordpress installs for FREE. Take advantage of it. You need to be in full control of your blog, starting with owning it on your own server.

8) Keep your blog simple, avoid the clutter at all costs. Clutter equals slow page load times for starters. The more third party widgets you install, the more you are pissing off your readers and potential customers. Only install widgets that instill some value to your blog. Widgets such as MyBlogLog allow for referral stats on the backend, and on the front-end allows for community building. Twitter widgets show your present status updates and or allow people to follow you. This is the value I'm referring to. Keep the junk for your personal blogs, or if you must, put it on an entirely separate page altogether.

9) Find and install the necessary plugins that will benefit your blog, such as SEO plugins. Installing a caching-system plugin is also a good idea. You need to optimize not only just for search engines, but also page loading time. Find a simple theme and build around it. KISS is always a good rule of thumb. Appearance is everything, and your blog is no different. You never get a second chance to make a first impression.

10) Change your blog permalink structure immediately. By default, WordPress uses web URLs which have question marks and lots of numbers in them. This will severely limit the amount of traffic you will see from search engines. You need to be thinking SEO at all times, and this is the first step you should take with your blog. Your permalink structure should look something like this, www.myblogontechnology/this-should-be-your-permalink-structure. Do you see what we did here? We inserted the relevant keywords into the url. This is crucial in terms of optimizing for search traffic. With the practices of some additional SEO basics, there is a good chance we could achieve higher rankings for the keyword phrase of (this-should-be-your-permalink-structure.)

11) Tell people what your blog is about, and most importantly what you’re about. Create an about page. When I find a blog I like, and want to know more about the author, the first thing I will look for is an about page. A big turn off for most people is finding a great blog and not knowing anything about the person behind it. This can also lead to wasted business opportunities. The about page is just another extension to sell yourself, your credentials, your affiliations, your experiences and so forth. Show your readers you are just like them. Show them your personal side. This is what social media is all about.

12) Show your human side by using visuals. Add a real picture of yourself on your blog and on all of your social networking profiles. The picture should be of you and not of some silly cartoon character. As with real life, image is everything. The same rule applies to social media. A clearheadshot of yourself is all that you need. Choose one where you are feeling confident and perhaps smiling. Take it a step further if you really want a polished image, and use a picture of yourself in a business suit or some type of professional attire. If you are going to establish yourself as a leader, you need to play the part.

13) Blog only when you have something to say that is of importance, and that is useful, resourceful, and relevant to others. Why blog otherwise? If you want to rant about the latest meme, or blog about what you had for dinner, do it on a personal blog or message board. This is why I don't blog everyday, or blog about regurgitated new stories. This is not my style and should not be yours. If it's going to be your style, let people know beforehand or create a separate entity for it altogether. It all comes down to quality NOT quantity.

14) Your blog does many things for you, but the number one thing it does is establish authority. Establish yourself as an expert on a particular subject matter, after all this is the reason for blogging. Blog about your expertise, your passions, what you and only you do best. Your audience will find you eventually, and that is who you should be catering to. Focus and be consistent with your blogging. Don't be all across the board. You will learn in time, by trial and error, what works and what doesn't work.

15) Leave the introverted mentality at the door. That's not social media, that's just media, plain old ignorance. Ask for help when needed, be verbal, speak up and ask questions. We all were newbies at some point in time. Educate yourself first and foremost, read, read and read. When blogging always link out to others, credit fact sources when applicable. Make it a practice to link out in every blog post you write, and do it positively. Bloggers succeed only with the help of other bloggers, and the relevant communities they are catering to and participating in.

16) Find the top 25 blogs in your space, and subscribe to their RSS feeds in Google Reader. Consistently be on the lookout for new blogs, and the voices behind them. This also helps with the creative workflow and process. It also gives you linking out opportunities, build your brand awareness and most of all helps build authority. Don't expect recognition right away, and don't get discouraged if no one notices your efforts right away. You must first establish the foundation before you can build on it.

17) Quality content speaks for itself, and is recognized. Your content defines you and the message you are trying to convey. Quality gets noticed above anything else. Let others promote your content and you should only promote your best work. It may take days, weeks or even months to establish a close network of friends. When I mean friends, ones that you have a genuine relationship with.These are not simple quick click followers who you have no intention on having any level of communication with. Your true friends will be the ones promoting your content and helping you get the word out there. The old saying is true, patience overcomes perseverance.

18) The content that you create should be something that people want to share. For the most part, it should be relevant to your networks’ interests. Create newsworthy, thoughtful, intelligent content that has immediate usefulness. Don't expect a home-run all the time, and do not be disappointed if certain posts do not get enough coverage. It's the nature of the beast. It often takes time for things to get picked up.

19) Leave thoughtful and constructive comments on other blogs. This promotes good practices in social media. It also gives you an opportunity for more exposure and additional places for people and fellow bloggers to discover your blog. This can lead into new networking opportunities, and potential new friendships and networking opportunities. The best way to reward a fellow blogger for their hard work is by leaving comments. This will also get you on their radar screen a lot faster. There are no negatives to this, only positives.

20) Never fly blind. You must know where your traffic is coming from. Install analytic software, such as Google Analytics. It’s a good idea to have at least two stats packages installed and running. All analytic software is not created equal. They all have the same purpose, but vary in their reporting and tracking methods. Results will vary to an extent, and comparison of multiple data sources is vital.

21) You have linked out to many bloggers, some are noticing and linking back. But how do you know? The answer is simple, set up Google Alerts to track mentions of your blog. This is a requirement not an option. Blogging software such as Wordpress will track inbound links, but it's not always accurate and lots of inbound links are missed. In addition to alerts, you need to be doing Google Blog searches and Twitter searches. These are the first tools you should be using, but there are plenty more listed here, and they are all free. Wouldn't you hate to miss a moment of recognition? Put yourself in the other blogger shoes. They might get the wrong impression with no acknowledgement back, these things need to be avoided at all costs. You can't please everyone all the time, but at least make the effort to no matter how big or small.

22) Promote others, even more than you promote yourself. Retweet good content, Stumble it, Digg it, share it and so forth. The "others" first and foremost should be your network's content. Everyone else comes after that, plain and simple. Your online network is family and need to be treated as such. Sharing, self promotion is always a two-way street.

23) I'm going against the grain on this one, but it's something I still practice to this day. Ask for link exchanges, the worst that will happen is that you will get declined or you wont get an answer at all. I'm not saying to stick links on your site to every blog out there. Look for quality link exchanges from blogs that focus on your subject matter. The real benefit from this is purely from a search engine perspective. A link from a blog with a higher pagerank could be very beneficial to you, in turn boosting your pagerank in the process. It's also a nice way of showing support and appreciation for a blogger as well.

24) Interaction with your readers is crucial for long term success. Encouraging commenting is very important if you are seeking sustained long term repeat traffic. Ask questions in your post. Ask the readers for additional tips or thoughts on the story subject. Do not require registration. Make commenting easy and not a chore. Make time to reply to comments that require an answer. It's not feasible to reply back to every single comment, but at least put forth the effort.

25) There are two types of bloggers. One way bloggers and two-way bloggers. You need to strive, and pride yourself on becoming a two-way blogger.

26) Establish a Feedburner account. Provide easy visibility for new RSS subscribers, use text links in addition to graphics to promote your RSS feed You can also add an email subscription form on your site for people who do not use RSS. You should also give people the tools to promote your content. Add to your blog and postings promotional tools such as social sharing and bookmark services. Addthis.com is a good starting point. It's a few simple lines of code and your done. You should also take full advantage of Feedburners Feedflare.

Twitter:

27) Establish a Twitter account and learn how to make it beneficial not only for you, but for others. There is no right or wrong way to use Twitter. There is one wrong way, which I will highlight next. Twitter is a powerful tool for listening and more importantly broadcasting. You may not spend countless hours on it, but the time you do spend on it, use it effectively.

28) Do not use Twitter for spamming. This is a perfect example of how NOT to use Twitter. If your intent is to spam and add no value whatsoever, consider going back to the basics, email-spam. Don't waste your time and others with this crap.

29) If you are going to use auto-replies for new followers, do NOT include any self-promotional text and or affiliate marketing links. You wouldn't do this in real life with people you first meet, the same rule applies here. It's a waste of time, it does not work, and it pisses people off. If you are going to use auto-replies, there is nothing wrong with sending a friendly thank you for following note.

30) There is nothing wrong with announcing a new Blog post on Twitter. Do it in a tasteful and respectful manner. If this is all you are going to be using Twitter for, you won't see much results. Contribute to Twitter first before you use it solely for self promotion. A good way of adding value and contributing is re-tweeting your followers tweets. When you come across quality content, promote it to others by broadcasting a link to it on Twitter. You should also practice being resourceful and helpful as much as possible on Twitter.

31) Take full advantage of Summize, Twitters built in search function. This is a great resource for research, and keeping track of who mentions your content. This is the perfect tool for performing blogger ego searches.

You need to be where it counts. Establish and build power passports, profiles.

32) Passports are the social profiles that we create on other social networking sites and platforms. You need to have Omnipresence in social media. Your Facebook, LinkedIn, Twitter and Google profile are all passports. More importantly, they are all sources that generate search engine traffic. It's very important that you maintain a recognizable, uniform presence across all social networks, professional and personal.

33) Consistency needs to be practiced and applied to every area of your involvement in social media. All of your online profiles should share the same information. Make sure to use the same user names. If possible, use the same profile pictures (if applicable), logos and contact info.

33) Be consistent with blog posts. Try to establish and maintain a schedule for posts and stick with it. Be consistent with tagging your images, bookmarks and blog postings. Be consistent with commenting on other blogs, as well as with comments left on your own blog.

34) Stay consistent with the latest trends and technologies. Think about how they can impact or improve your successes online. Things are quickly changing on the Internet. Failure to adapt with the times has consequences.

35) Experiment with new mediums. Try your hand at creating videos, of course this depends on what your objectives are. People love visual aids. if you are selling a product, create a short video about it. Video tutorials, screen casts and so forth are priceless. You could also ask your users for video testimonials. Bandwidth is not an issue for most people nowadays, take full advantage of it when and where you can. Here is an idea, create a short video for your about page on your blog. When you find good videos that are relevant to your subject matter, embed them on your blog posts.

Friends, followers and family, without them you are a rowboat without a paddle.

36) Hopefully friends to you are people you have some level of engagement and conversation with. Friends in social media or for that matter in social networking are not equal to what we classify as friends in real life. Friends in social media are followers who take the next step, which then evolves into some level of general interaction. Friends in time will morph into members of your core network. Choose your friends wisely, this is the army you will need for the battle you are about to embark on. While you have the option to friend people back, it's all about your objectives using social media. If you want a mass audience, then friend everyone who friends you back, but if you have no intention of ever having any level or engagement, then you are just fooling yourself, and all your doing it list building. You need to be receptive with friends who are trying to engage you positively. It's impossible to interact with hundreds or even thousands of friends, but the ones who reach out to you, by commenting on your blog posts, sharing your content, tweeting your content and so forth, you can not neglect.

37) Followers are your audience, always remember that. Without them you are a rowboat without a paddle. Never lose sight of this. As I mentioned before, followers evolve into friends, be cognizant of that fact. Never take them for granted.

38) Family is your core network. Your core network is your power, your network is connections. These are the people that will be there time and time again. They are your support through good and bad times. These are relationships that are built up over time. These are genuine relationships. Never lose sight of this, and do what you can for them at all times when applicable. This goes beyond just sharing or promoting their content. You are only as good as the network you align yourself with, make sense?

39) Always give the little guy a platform and a chance to shine. Your followers, and friends may also run blogs. When the chance presents itself, offer guest postings on your site. Link out to them when possible. You can also leave them recommendations on LinkedIn if you know them well or can vouch for their work ethics. Look for opportunities to expose others in a positive light, no matter how big or small.

40) Whether your goals and objectives in using social media are for professional or personal reasons, the outcome will still be the same. The outcome depends on what you put into it. Be prepared to commit a lot of time, devotion, patience, and understanding. You must crawl before you can walk, it's that simple. Be passionate about your initiatives. Have fun and always show your human side. Contribute and give more than you ask for in return, at least in the very beginning. Do onto others as they do onto you. These best practices will reflect on you, and in the long term will come back tenfold. This is what social media is about, now roll up your sleeves and start laying the foundation.

Image by Ricardo under Creative Commons License.

Read more by Mike Fruchter at MichaelFruchter.com.

Hey Twitter, It's Not Just a Worm, It's an App

By Jesse Stay of Stay N' Alive (Twitter/FriendFeed)

There's no doubt that the worm making its rounds on Twitter is a nuisance and a huge problem for all. The fact of the matter is, somebody has collected your usernames and passwords, and many of your accounts are now Zombies, spamming each friend on your friends list through direct message, turning more unsuspecting accounts into zombies, and spreading like wildfire. Louis has talked about the worm which has surfaced on Twitter, and the urgency of the situation and potential implications for OAuth and security for Microblogging.

I suggested plain text passwords could be to blame - after all, any application out there that collects your usernames and passwords could theoretically use those passwords to start such a worm, in order to gain access to people with similar bank account passwords and more. That would be the fastest way over, say, a single user trying to amass friends to dm. We're already seeing several of those compromised accounts sending iphone-related spam, so it would appear the worm developers could now be monetizing this, through your friends. At the same time, I keep seeing others criticizing the possibility that OAuth could have prevented this. I'd like to share my thoughts why.

Disclaimer

First of all, let me preface this with the fact that I am not a security expert. I have been developing software since I was 10 (I am now 31), and have plenty of real-world experience writing secure software. I've worked in health organizations requiring software to respect privacy around your health data, with e-commerce protecting your money, and I've written APIs. I understand what it takes to keep software safe. I also run my own business in which I also have to protect my users' data. I also understand that nothing's perfect. While security has not been my sole focus, I hope I can at least make some sense of the matter.

First Things First - This is an App

Let's set things straight here. Now, I could be wrong, but all evidence seems to suggest that this "worm" is actually an application, or possibly multiple applications, running on multiple servers around the world (the IP range also suggests that the same developers have targeted YouTube and Bebo in the past). After all, the only other way to log in on behalf of users and DM others would be to screen-scrape Twitter, simulating a user actually logging in via the Twitter.com interface. This is possible, but I would imagine we would see Twitter very quickly implementing some form of Captcha to slow it down. We haven't seen this yet so the most logical conclusion is that someone has written an App somewhere, which is taking advantage of the fact that you can login via plain text usernames and passwords. The same application is taking those usernames and passwords, and programmatically logging in on behalf of each compromised user and direct messaging their friends to collect more usernames and passwords.

Currently, the Twitter API makes it completely possible for anyone with your username and password to log in on your behalf, programmatically. Essentially, Twitter has given developers the key, and all keys open up the same lock. The only way to shut this down would be to kill the lock, which would shut off all developers. This is why the topic of OAuth continues to be brought up - to start off, OAuth forces any developer to use a protected key or token in order to log in on behalf of the user. The developer never has the user's username or password. The user himself keeps their own keys to Twitter without having to give a copy of those keys to developers.

It's not that simple though.

Why They're Saying OAuth Wouldn't Have Fixed the Problem

Assuming Twitter had implemented OAuth, let's assume no developer has your username or password and your information now feels secure. There is still nothing stopping those users from using those tokens to log in on your behalf. Essentially, while the developer couldn't screen scrape your data to log you in through Twitter with such a key, they could still use the API, just as these current Phishers are probably doing, to continue to send DMs and messages on your behalf. An OAuth token is just like another username and password essentially, intended just for API use.

The other criticism they're giving OAuth is that it still doesn't stop the Phishing. When the end-user authenticates through an OAuth-enabled website, they are taken back to a page on the originating site that, if they aren't logged in, asks them to log in, and that site in turn returns them back to the third party site with an OAuth token that can be used for access. Nice and simple, right? Well, the problem (which I've only seen theorized, but it is definitely possible) is that any third-party developer could create an app that redirects the user back to a page that just looks like the originating site (like Twitter.com, for instance), and pretends the user isn't logged in. The site could then collect the username and passwords of unsuspecting users, just as the current phishing scheme is doing now. The potential is still there to collect usernames and passwords, just as before.

The Advantage People Keep Forgetting

Let's ignore the last paragraph and just focus on the one before it. Even though an application can easily login on behalf of the user via the API, with OAuth, a site like Twitter now has full control over each and every application that runs on the API. OAuth has controls which allow API providers like Twitter to cut off any application using the API. So, assuming Twitter sets up some sort of manual approval process similar to Facebook's (I suggested this to Ev and Biz in the interview I attended with Scoble last year (end of the article), and they said they were working on this) to weed out the sketchy applications, it becomes much easier to just cut off the offending application. They now have record of the exact application sending these DMs, and can cut it off immediately. Currently, they're stuck chasing IP addresses, and trying to block various IP ranges, which are tough to block and easy to switch.

Back to the Problem

So, let's assume Twitter had implemented OAuth. We now have two possible scenarios: Scenario 1, said Phisher signs up to have an app on the API (or buys an app like Twply), and sends out DMs on behalf of users. (Note that the Phisher couldn't start as an individual and collect usernames and passwords in the manner this Phisher did in the current scenario because they couldn't send plain-text usernames and passwords via the API) The Phisher gets users' friends to login via OAuth, he collects the tokens to send out DMs on behalf of other users. Twitter's in-house alarms go off of such activity. Twitter shuts down said Phisher in a matter of minutes, and only a few people even see the worm.

Scenario 2 is a little more difficult, but less motivational for a Phisher on a site like Twitter. In this scenario, a Phisher creates a fake 3rd party app, accumulates a lot of followers somehow, and gets users to somehow think they are going to Twitter to login, and they collect the users plain-text usernames and passwords. The said Phisher can't do anything through the API, because it doesn't allow plain-text usernames and passwords. All they can do with it is screen-scrape Twitter, login on behalf of the user, and go about it that way. They also have to accumulate a decent sized following.

First, let's face it, there's not a ton of information that's not already public a Phisher can gather on such a site as Twitter, other than their username and password, which could also be used on other sites like banking sites. I really think most of these Phishers are more interested in spamming you, trying to make a quick buck off the unsuspecting sending spam to their friends (like the iPhone example above) - selling the data to spammers I'm certain is big bucks (at least $1,200, according to the sale of Twtply). Second, Twitter could easily implement a captcha system in such a case, and by that means they could at least slow down the Phisher or spammer. At that point, if the Phisher or Spammer is still diligent enough to get through, they have a much more controlled system, and they can then play the IP blocking game. Let's face it though - this isn't a banking site, usernames and passwords only go for a meager $1,200 from what we know, so most spammers ought to give up at that point. It's much less of a problem, and much easier of a problem to deal with than what Twitter is seeing now.

The Purpose of Security is to Make it Harder

As I said earlier, no security plan is a perfect plan, but the harder it is for a perpetrator to get through a system, the more secure that system is. Currently, there is no barrier between Twitter and those than can potentially misuse your usernames and passwords, other than you. As I said earlier, Twitter has only one lock for each user, and each developer you share your information with has the same key to that lock as you do.

However, despite the continued risk for phishing OAuth poses, as Lachlan Hardy suggests at the end of his piece here, it is still a step in the right direction, and I think would have prevented this particular worm. OAuth would have given Twitter the capability to revoke the keys of the offending phishers, enabling them to shut the worm down when it happened. After all, this isn't just a worm, it's an app, using the API, like any other developer, but in this case to spread malicious websites. I want to suggest that Twitter stop skirting around this issue, stop pretending OAuth wouldn't have solved the problem, and just implement something, quick.

Read more by Jesse Stay at Stay N' Alive.

Geek Leading Fantasy Football League During Playoff Push

At the end of August, I told you how I manage to take what should be an enjoyable, brainless, activity like fantasy football, and still 'nerd it up', reverting to laptops, Excel spreadsheets and Web-based databases. (See: The Even Geekier Approach to Fantasy Football) Now more than four full months later, the NFL regular season has ended, as have most fantasy football teams, who wrap things up before the playoffs begin. But not the one I'm in. The top four teams in the 12-team league completely start over, redrafting from the playoff rosters, and battle it out in a prolonged contest that lasts through the Super Bowl.

I thought I'd catch you up.

As I mentioned back in August, one of the benefits of not having a favorite team is that I can put my biases aside and pick who I think will do the best, not just who I wanted to do the best. Luckily for me, this led to a quick start, where I scored more than 100 points in 3 of the first 4 games, and at one point had a 10-2 record, having won seven straight head to head contests.

Despite a late-season fade that saw me finish 11-5 overall, a full game behind the league's first-place finisher, I won the division, and was among four teams that got to participate in the playoffs, which started yesterday.

Unlike Yahoo! Sports, ESPN and other online leagues, which use the regular seasons' last weeks as the playoffs, we completely reset and start from zero - adding a new level of strategy, where which teams you pick are just as important as the players. Picking players from teams that get eliminated in the first week means you lose them from your roster, and there are no pickups - so choose wisely...

As a two time winner, having collected trophies in the 2001-02 season and 2005-06 season, I took on this week's draft hoping my experience would have an advantage. (See: Three And Out Takes Fantasy Football Title from February of 2006) But, after taking two full years off from the game, there was always concern I'd had my head so deep in playing tech blogger that I'd forgotten how to do it right. (See: An NFL Season Without Real Fantasy Football?)

Luckily, so far, things look good.

I filled my 13-person roster with three Carolina Panthers, including the red-hot De'Angelo Williams and Jonathan Stewart, three Arizona Cardinals, including the veteran Kurt Warner at QB, and a handful of players with huge upside, including the San Diego Chargers' Darren Sproles, who could score points for me as a rusher, receiver and kick returner, the Eagles' Brian Westbrook and the Falcons' Michael Turner at running back. (See: Roster with Scoring History)

Saturday and Sunday's games played out practically as I would have liked. San Diego staved off the favored Indianapolis Colts. The Cardinals beat out Atlanta. And the Eagles defeated the Vikings at home in Minnesota. As our league playoffs progress, this means I've lost a bare minimum of players after the first weekend, as my opponents lost some key talent. And as most sports fans know, Darren Sproles had an amazing game, garnering 42 points (in fantasy land). Warner contributed 18, Westbrook 17, and Larry Fitzgerald a solid 16. This helped propel my team to 129 points in the first weekend, with none of the other three teams breaking 100. (See: Standings)

My previous years in the league tell me that an early lead is good, but not enough. In order for me to sustain the momentum, I'll have to see my players stay active. If next week is a disaster, and is as bad as this weekend was good, it could be over in a matter of hours. But the start is good.

If you played fantasy football this year, how did you do? How did your league handle the playoffs?

See: Kiss of Death League Reloaded Playoffs

Twitter's OAuth Target Slipping Amid Increased Security Pressures

Over the weekend, more than one exploit, sent by way of Twitter's Direct Message feature, has made it around the Web. As Twitter's growth has continued, the microblogging service looks to be a new domain for scammers and spammers, previously contained to traditional e-mail. And as the shenanigans gain in momentum, so too does the call for Twitter to implement OAuth, the open protocol that allows for secure API authorization, which has become popular among many Web tools in use today. But Twitter employees' postings in the service's development group, and their own notifications on the site, show a shifting roadmap, while they also try to divert criticsm by separating the need for OAuth from the weekend's incidents.


An example of one Twitter phishing attempt.
Twitter's success has seen a groundswell of applications being developed that require users to enter their user name and password on third party sites. Given Twitter's lack of OAuth support, Twitter users have grown used to posting their data whenever they are asked, and in the rare case a site has been found to malicious, it forces them to once again change their passwords to protect their account.

The OAuth Web site spells out the reason behind the project's development, saying: "If you're storing protected data on your users' behalf, they shouldn't be spreading their passwords around the web to get access to it."

The weekend's activity featured a mock Twitter login page, where users were prompted to enter their credentials. (See: CNet: Twitter phishing scam may be spreading) While this specific attack would not have been solved by OAuth, but instead by users simply paying attention to where they were logging in, you can see Twitter's attitude on the current process.

Alex Payne, a lead developer of Twitter told one user on Saturday: "Right now, you can't see which apps are using your requests. You can change your password, though.", and later told another user, "We're trying to discourage against clicking on the link." Pretty basic stuff.

When pressed on whether Twitter was going to implement OAuth, and reduce users' growing too comfortable with posting their passwords everywhere, Alex said, "OAuth isn't a panacea against phishing and other web security issues. We're still going to support it," and following on, echoed the OAuth site by saying, "A main benefit is that OAuth limits the scope of activities that can be done with a user's credentials," while also linking to a post from April of 2008 that showed how phishing scams could not be stopped by OAuth. See: Phishing Fools?

So, we get that the phishing problem won't get solved through adding OAuth, but we do see more and more applications getting your password. As the New Year came in, Twply managed to get many passwords, and then was sold the same day. (See: Scobleizer: Twitter spam, effective or idiotic?)

Alex mentioned Twitter is going to support OAuth. But when?

In the Twitter Development Talk forum, you can see the target continues to move.

Alex, on November 24th of last year, wrote: "We're currently waiting on our User Experience team to put the final touches on a BETA release of our OAuth support. It's going to have bugs, to be sure, but we should have it out there soon. "

On November 26th, after being pressed for a date, he said, "As I don't know the entire schedule of our UX team, I can't. I would say less than a month and closer to a week by far, but please don't hold me to that."

On December 8th, Alex gave more specific timing: "It won't be available for testing this week, but should be available before the end of the month. I'd definitely encourage you not to launch on it, though, as it will be a beta."

Now more than a month from the first comment, amidst more developer pressure, Alex says the next major version of the API will be OAuth-only, but deflects some of the criticism by pointing fingers at other services that have not yet jumped on the OAuth bandwagon.

This afternoon, January 4th, Alex said:

"Of course, once we offer OAuth, it would be nice to see the same community pressure that's been applied to us put towards companies like Amazon. The Amazon.com iPhone app collects my username and password, and that account is actually tied to my credit card information. Where are the blog posts about their anti-patterns?"

Now, there's no question I'm no security expert. Don't forget that on November 12th, I once wrote, Twitterank Can Have My Password, No Questions Asked, and Alex looks to be feeling the strain of other non-experts, like me, pushing the team to get more robust. He commented on Twitter this evening, "It doesn't help that web folks generally have next to zero security/crypto education," a bucket I'm no doubt in.

The groundswell of demand on Twitter to improve its security measures, to get to OAuth as quickly as possible has no doubt reached a crescendo in the wake of this week's exploits - both those solvable by the project and those that are merely phishing scams. But it looks like Twitter developers' confidence has been shaken by so many promises being out there, and the deadline continuing to move.