How (not) to make friends

Image by Chewbacka via FlickrRegarding the social web and linking of 'friends', the currently available implementations such as Facebook etc. take the following approach:

First you identify who is your 'friend' (within the same network or application), this in turn determines which attributes they are allowed to see. Other classes of relationships like 'acquaintance', 'co-worker' 'school-mate' 'best friend' are now being proposed on the Data Portability forums to manage this.

This not only smells like bad design, but it appears to me to be an inversion of what happens in reality.

It is not the appointing of a 'friend' class to someone which determines who can see which of your attributes. It's the other way around: by allowing different identities to see different subsets of your attributes (gradually and over time), you define your relationship with these other identities. In other words, someone might become a friend after you decide he may see some of your attributes.

You don't have to decide on the relationship type upfront if you could granularly disclose attributes to various other identities (and maybe have the favor returned to you).

Off course people don't want to be bothered continuously with such fine-grained control over their individual attributes. As usual, software programs can ease the burden and help with common tasks.

Not many people currently craft their HTML documents and HTTP requests by hand to publish or read on the world-wide web. Still, inter-operability of all the different software is possible, thanks to the underlying standards. Sadly, we don't have these for identities and their attributes yet.

Information sink vs information source

How Sticky Is Membership on Facebook? Just Try Breaking Free - New York Times

Another example of how most applications act like information sinks. It's easy to enter your information (data about you), but once you do, you lose control. The Facebook application (like almost any other online application) is an information sink.

To me it seems the only approach to preserve control over your data is to leave those applications alone. That's why I'm not on Myspace, Facebook or others (Linkedin being the exception, for some reason).

Ideally, I would like to have the ability to create an information source, totally under my control, in which I design and edit my profile. A generic protocol for addressing and disclosure would then allow other applications and people to use this information source for many different applications (which would then basically become views on my data, and that of others in the aggregate).

What do you think?

The Profile Problem

Image via WikipediaProfiles are used extensively on the web and in the enterprise. With the rise of 'the social web', the number of profiles you can use to describe (parts of) yourself is greatly increased.

On the web, each site or service needs to know something about you. This is your profile (for that site or service). In an enterprise setting, a company keeps a profile about all their employees or customers (i.e. you) in their identity management system.

When seen from a perspective of personal freedom, the current practices pose a few problems, which will be discussed next.

Problem 1: You don't have control over the data that describes you.

This is the most important problem. Apart from the specific elements you are allowed to store (see Problem 2), the data you entered is stored on a system beyond your control. It might be difficult to make changes, or to correct errors. You might be dependent on the service provider or others to have your data changed or deleted. You don't control the security that surrounds your data. You can't choose the systems on which your data is kept. You're not allowed to re-use your own self-representation.

Problem 2: Profiles dictate what you can and cannot tell about yourself.

Most online services and enterprise identity systems come with a prescribed set of properties (like your name, favorite music etc.) that you need to populate with values concerning yourself. The profile dictates what is required and what is optional. There is often no room for extra information.

Problem 3: Lack of sharing control.

You often don't control who sees the profile, and, in cases where sharing is relevant, you can't control the parts to disclose in enough detail.

On the web, you are stuck with the options the site or service offers you for sharing with other users (as is common in many online community services). Can you share all, nothing, or parts of your profile? Which parts?

Problem 4: Duplication of effort.

This is not really a problem related to individual freedom, but it is worth mentioning anyway.

Each service has its own profile page for you to fill out. This is a duplication of effort for you, since you have to maintain the same set of properties over and over again at each site. It also is a duplication of effort on the part of all the service providers, who build and maintain a profile infrastructure, user interfaces and the data it holds.

Admitted, the enterprise identity management system solves the duplication of effort problem by using an enterprise-wide profile management system, so the duplication of effort is mainly seen on the web, not inside the enterprise. However, the first two problems remain. Do you have any more influence over your profile (say, as a customer or employee), now that it rests in an enterprise identity system?


What needs to be done?

Nowadays, with the proliferation on-line services an social media, the need for a solution for these problems is needed more than ever. The challenge lies in identifying what an acceptable solution looks like.

We should take a step back from technical issues, and investigate the essence of self-representation, since a profile for an on-line service is just that. Taking the person being represented as the starting point, issues of personal freedom, privacy and control become relevant.

In any case, to prevent the problems identified above, the proposed solution should minimally have the following characteristics:

It should work with arbitrary attribute collections. It should allow for fine-grained disclosure (sharing) options under the users control. The data should be stored with a provider/technology of choice.

Starting from there, one can see the need for standards which allow an individual to manage the the definition, modification, querying, and disclosure of personal attributes.