Should universities be OpenID providers, consumers, both or neither?

JISC commisioned a report on OpenID which was published last December. There were comments at the time, in particular thinking about the differences between Shibboleth and OpenID. Since then many more providers have announced support for OpenID in some form, but I'm not aware of much activity within UK HE.

One criticism is that OpenID providers typically give no guarantee that a user is who they say they are, so we wouldn't want to use it to authenticate resources of real value. However a university could use it as a mechanism for public resources - for example external users could log in with OpenID to comment on a public university wiki.

I think there is more benefit right now in us becoming an OpenID provider. This is a way to "internalise external web services". When experimenting with Web 2.0 services I often find that colleagues are reluctant to try something. An important reason given is that remembering another username and password is a hassle. It's a fair point. We've worked hard to combine internal university services into one single sign on, and expecting different logons for external services is a large step backwards.

Notable services which allow you to log in via OpenID include:

• 37signals.com - several web services including HighRise simple CRM
• Zoho Office - web-based office software
• comment on blogs at Blogger (but you still need a Blogger/GoogleID to create a blog)
• Log in to Facebook via OpenID (but you need to have created a Facebook account without OpenID first)

Unfortunately that's almost it, out of what I would call notable services. Other organisations make the same judgment as us - there is more value in being an OpenID provider than an OpenID consumer. They don't want to lose the direct customer relationship. It tends to be the less established companies that fully support OpenID. 37Signals produce excellent webapps but are quite a small player. Zoho is also excellent but plays second fiddle to Google Apps. Those are two of the better companies who are OpenID customers. If we integrated their webapps into our portal I'd be happy that they aren't going to disappear overnight, but I would worry about a lot of the others. I worry when looking at the OpenID directory that I've never heard of most of the sites on the list.

None of these popular web services allow you to log in with OpenID:

• YouTube
• Flickr
• Slideshare
• Evernote
• Eventbrite

Due to the importance of network effects I firmly believe you are better off using the market leading Web 2.0 services. I wouldn't encourage staff or students to use a Flickr clone just because it does OpenID. Building university services that tie in with Flickr itself is more likely to be successful, as that is where the content and users are already.

So what should we do? I think there is benefit for individual universities in becoming OpenID providers. A mechanism for staff and students to comment on externally hosted blogs under their university ID sounds useful. We could even let students log on to Facebook through their university portal - or would that horrify them?

We could become providers at a national level by creating a gateway between OpenID and UK Access Federation, but which acts the opposite way round to the existing gateway. Should we start to think about reconstructing UK Access Federation on top of OpenID?

Or is all this just too soon - should we sit on our hands a little longer and hope more OpenID consumers emerge?

How to make your social software succeed

A colleague recently pointed me at Microsoft's Community Clips. It is a community-driven website where users share training videos about Microsoft Office. Why, he wondered, would anyone want to freely document Microsoft's profit-making software?

I was intrigued, so I had a poke around. It didn't look like a vibrant healthy community to me. The most popular featured videos had all been added over a year ago and there was nothing at all within the last 30 days. I then played a few clips. Each video started with a banner "Attention! The Soapbox service will be discontinued as of 31st August 2009!".

No surprise then that Community Clips has the aura of a ghost town. Soapbox launched in 2006 as Microsoft's equivalent to YouTube, and it powered Community Clips. On July 21 2009, MS announced the demise of Soapbox, and on 31st August it will vanish.

A sad story, but despite many such examples I'm sure that collaborative, social Web 2.0 services are here to stay. I expect the audience for this blog will agree with me, but many people within HE remain unconvinced by Web 2.0. If asked I point them at Facebook. Some thought (still think?) it is a passing fad. The hype may have peaked, but at Bristol our student IT survey 2009 shows that more students are using it than in 2007.

Ah, they say, but we did that once. Our organisation tried a project with this social software thing, and it flopped. So it's all a bit pointless isn't it? Well no. Most social software experiments don't work out. I've launched one or two of them myself (so long ResNet Chat!). Suw Charman-Anderson has a great piece explaining why most social software doesn't work out, why this is the normal state of affairs, and not necessarily a problem.

For every success like Facebook, Flickr or Youtube there are another dozen similar ventures that flopped. Why do some fail and others succeed? If you can understand why then you have the best chance of stopping your service becoming another Soapbox.

This fell into place for me through reading Here Comes Everybody by Clay Shirkey. Two examples Clay gives are Linux and Wikipedia, and he draws out three rules for social software: the plausible promise, the effective tool, and the acceptable bargain.

Linux and Wikipedia were both announced to a relevant mailing list of like-minded people who might well contribute. They were intruigued by what the project offered, it gave them a plausible promise - something they wanted, but wasn't too ambitious.

Here is Linus' original Linux announcement from 1991:

I'm doing a (free) operating system (just a hobby, won't be big and
professional like gnu) for 386(486) AT clones.  This has been brewing
since april, and is starting to get ready.  I'd like any feedback on
things people like/dislike in minix, as my OS resembles it somewhat
(same physical layout of the file-system (due to practical reasons)
among other things).

I've currently ported bash(1.08) and gcc(1.40), and things seem to work.
This implies that I'll get something practical within a few months, and
I'd like to know what features most people would want.  Any suggestions
are welcome, but I won't promise I'll implement them :-)

Linus says "this is just a hobby"! People liked this approach. If it had been a big commercial project people wouldn't have been attracted to join. I give you my labour for free and you exploit it, giving nothing back isn't an acceptable bargain. Group of hobbyists together, sharing under a free software licence, is.

Wikipedia illustrates another point - make it as easy as possible to get started and to use it. This is completely crucial - even a low barrier is too high. Anybody can edit wikipedia, you don't even need to sign up for an account. You must provide effective tools - lightweight, simple, that encourage, not discourage collaboration.

Inspired by Clay Shirkey and others, here are my suggestions for successful social software within a university:

1. Seed your site with useful, relevant content, so it isn't starting from a blank slate. Content you can't get anywhere else is great if you can manage it. This helps make it obvious why the service is useful.
   
2. Announce it simultaneously to a large, relevant group. Promise something useful but not undeliverable.
   
3. Make your tool extremely easy and effective to use, so your users can get results quickly.
4. Use single sign on with an ID most people will already have. Your University ID is great, or perhaps something else from a huge common provider like Microsoft or Google. Use no sign in process at all if you can possibly manage it.
5. Don't make it too official/corporate/commercial - people need to share ownership of the tool. They won't contribute if they feel they are being exploited and there is nothing in it for them. Students may trust the Students Union more than the university. Consider getting the support of your union and putting the service out under their branding.
   
6. Nurture your first few users. The founders of Flickr commented personally on the photos of their first few thousand photographers, to make sure they'd come back.
7. Build your social software on top of a larger network, in order to benefit from the larger network's beneficial network effects.

I'll expand on this - especially on how you can pick the winners and avoid the losers amongst third-party services - in a subsequent post.

A domain driven design for the University Web

I wasn't at IWMW2009 last week, but I've been reviewing the conference thanks to a colleagues writeup and slideshare. The highlight for me was How the BBC makes websites (also in a more accessible text version BBC Radio Labs - how we make websites).

In the words of Michael Smethurst, "there's very little original thinking in here. For those familiar with the concept of one web, the importance of persistent URIs, REST, Domain Driven Design and Linked Open Data it'll probably be old news."

Michael is being modest. Personally I was familiar with some but not all of those. Even the most basic concept - having a single, unchangeable URI for an item - is rarely implemented. Bringing them all together makes the BBC Programmes site a powerful demonstration of how to do the web properly. More importantly it is a pleasure to use.

We are currently rethinking the University's web strategy and CMS requirements. To do this step back and think not about the web but about the activities the university undertakes.

What do universities do? They teach and they research. I'll use real-world data in two examples to show what I mean.

First teaching. Here's a course hierarchy:

(this would be clearer as a table or diagram but I'm limited by the tools in this blog)

• Course Family: LLB Law
• LLB Courses: LLB Law (UCAS course code M100), LLB Law with Study Abroad, LLB Law with Chemistry, LLB Law and French, LLB Law & German
• year started the course: 95, 96, 97, 98, etc
• Programmes of Study: 1st year, 2nd year, 3rd year
• Year One Units: Law of Contract (Unit Code LAWD10008), Law of Tort, Law and State, Constitutional Rights, Criminal Law, Law of Property
• Law of Contract Lectures: lectures 1 though 6
• Lecture 1: introduction to contract law

The URI for that lecture would be http://www.bristol.ac.uk/courses/law/m100/1999/year1/lawd10008/lecture1

Every level in the hierarchy has a web page with a permanent URI. So every course family, course, year, unit, and lecture has a webpage with a single, permanent URI. Ideally we would have a recording of the lecture but as a minimum each lecture must have a presence, at least a placeholder.

Now look at research. Think about web pages for each of the following (again real world examples)

Department of Computer Science
Computer Science Research Groups: Computer Vision, Cryptography, HARE, Intelligent Systems, Interaction & Graphics
Research Group: Cryptography
Cryptography Staff: Elisabeth Oswald, Dan Page, Nigel Smart, Bogdan Warinschi
Person: Dan Page
Dan Page: list of all publications
Publication: Manuel Barbosa, Andrew Moss, Dan Page, Constructive and Destructive Use of Compilers in Elliptic Curve Cryptography . Journal of Cryptology, 22(2), pp. 259?281. April 2009

URIs for the above would be

http://www.bristol.ac.uk/compsci
http://www.bristol.ac.uk/compsci/groups
http://www.bristol.ac.uk/groups/cryptography
http://www.bristol.ac.uk/groups/cryptography/people
http://www.bristol.ac.uk/people/dan_page

http://www.bristol.ac.uk/publications/dan_page
http://www.bristol.ac.uk/publications/2009/constructive-and-destructive-use-of-compliers

So every department, research group, person, and published paper has a webpage with a single, permanent URL. Even if the paper itself isn't available electronically it must still have a presence.

Note that in this case the urls do not follow a strict hierarchy as they did in the teaching context. Why? Hierarchies change. Right now the faculty of engineering is merging its departments into larger schools. The URIs for the research groups, people and papers should not change. Our internal organisational structure is completely unimportant in the web context. Breaking a web link pushes us lower in search engines, hides our research and damages our reputation. It should be avoided at all costs!

Each webpage should be about an obvious, real-world thing. If it isn't about an obvious thing, split the page up into smaller pages, until the subject of the page is now clearly one thing. Then give each thing a single URI, and make sure it never changes.

Simple really. Now how do we do it?

Mobile Learning: Telling Tales

On Thursday I attended Mobile Learning: Telling Tales (#mimasmob09), a one day MIMAS event on mobile devices in education. This was an interesting day - lots of frustration but flashes of genius. There are many interesting developments in the field, but few of them are sustainable.

Graham Brown-Martin was very engaging. I always warm to people with a foot in many camps - he's very much the entrepeneur, but also a self described geek with an arty side who ran off to join the circus!

Graham gave a clear explanation of the importance of gaming in learning, as a way to engage learners and experience learning. I've been dismissive of this in the past, as I couldn't see past all the hype over Second Life. I'm still convinced Second Life in particular has little value but Graham's demonstrations of games / virtual worlds for young children were fantastic. I have no idea how we could apply this in a HE context though, and it looks fantastically expensive.

Graham was also very clear in his condemnation of closed VLEs such as Blackboard, and believes that in future the educational technology market will be dominated by consumer industries rather than educational-specific providers. He had a moving anecdote to demonstrate that unless your VLE is accessible on home devices you a disenfranchising vulnerable parts of society.

John Traxler had the wisest words of the session - that we should "stop funding good projects in the hope that they become sustainable, and instead fund sustainable projects in the hope that they become good". Mobile learning currently has two many amateur enthusiasts. It's difficult to scale stuff up. Few if any projects evaluate their pedagogical impact.

We are teetering on the edge of allowing users to provide their own mobile devices, and designing learning around that. This is difficult with mobile platforms in flux. There is no stable infrastructure to build on. [Perhaps the mobile web - HTML - is the best we have?]

Geoff Butters referenced the Demos report Their Space in his explanation of how young people learn [I must read it]. He then described the EU funded Emapps project. This was interestingly conceived, but by the time it was implemented the project was already out of date. Much of the money was spent on devices and mobile data bills. Sadly an example of the unsustainable approach to mobile learning.
Hilary Smith had a very different approach- using childrens' own mobile phones and free tools such as Youtube, blogs and wikis for Key Stage 3 science. I like the approach, but there were huge practical barriers. Too much time was needed to install third-party software no childrens own mobiles. More fundamentally, almost all schools ban children owning mobiles! Many also block sites such as Youtube. The willingness of teachers to cede control or comfort using technology which may let them down was also an issue.

I missed my ex-colleague Andy Ramsden's presentation on QR codes, as I was in a parallel session. I remain to be convinced that QR codes are the right solution to any real problems - the readers aren't built-in to mainstream mobiles, and they are just a bit too geeky! I hope they get leapfrogged by some other technology.

I also missed Stuart Smith's presentation on the hairdressing.ac.uk mobile website, but I like it as a very practical example of the real-world benefits of mobile learning - taking education out of the classroom and into the salon.

Gary Priestnall's presentation on the SPLINT project was fascinating. This used PDAs on geography field trips. I saw for the first time how augmented reality - display additional data overlaying the real world - can be of educational value. I also now understand why Apple have a digital compass in the iPhone 3GS.

James Clay of Gloucestershire College wrapped up the event and gave the best presentation of the day. He is passionate about learning, understands technology, and is an excellent speaker. His presentation really deserves a blog post of its own - but better still watch The Future of Learning on his own blog.

News of the World phone hacking: how did they do that?

The media was abuzz last week with allegations that investigators working for the News of the World 'hacked' mobile phones belonging to scores of public figures.

How did they actually do it? Graham Cluley, Sophos guesses that they simply accessed the voicemail boxes of the phones concerned. This could be done by a little social engineering. Simply contact the phone provider claiming to be the individual concerned, with a little 'personal' information to convince them. Even easier, try the default PIN code - many people don't change it.

Some suggestions to stop this happening to you:

• Change your mobile phone PIN code from the default to something only you know.
• Keep your private personally identifiable information (things like your mother's maiden name) secret. That's difficult to do I know...
• Do you really want voicemail anyway? Many people find it frustating - often a text is more useful. In that case, just disable it.

On a broader point - mobile phones are one important function which most corporations have already outsourced. Remember the News of the World story when considering outsourcing other services to cloud providers. Obviously similar risks could exist on in house systems, but such problems are easier to fix if in house.

Finally, read confessions of a tabloid hack for a revealing insight into the illegal activities of the press.

Why did JANET Talk fail?

A couple of years ago JANET(UK) announced a pilot VOIP service for UK HE, JANET Talk. The pilot has now finished, and will not be extended to a production service, as there is little apparent demand for it. It was obvious to me from the start that JANET Talk wouldn't be a success. I remember pointedly suggesting as much at the Networkshop session where it was launched. The reason? Network effects - or the lack of them.

Imagine you owned the first telephone in existence. It is completely useless - there is nobody to call. It only becomes useful when someone else bought the second telephone. More precisely, as a telephone network grows, its usefulness increases in proportion to the number of potential connections between people in the network - the square of the number of people. 

JANET Talk was only for people in UK HE to talk to others in UK HE. In todays world - a networked, global world - there is no way that a communications service for such a small group of people will be successful. It will inevitably be overtaken by other services with a larger network of users. People will choose to join the larger, more successful service, as that is what their contacts already use.

There are ways you can let a small network benefit from network effects - by connecting it to other networks. The Internet itself came into existence as exactly that - a network of networks. For a VOIP service, the best way to do this is to allow calls to and from the PSTN. Unfortunately JANET Talk was restricted so that you couldn't receive calls from the PSTN. JANET did this deliberately. They don't want to become a public telecommunications provider, as that would potentially open them up to more regulation. It's a very understandable decision from their point of view but sadly it made JANET Talk irrelevant.

Why is this important? Network effects don't just apply to telephones. Everything these days is networked. Web 2.0 is all about social connections & communications. The same factors explain why only a minority of colleagues at Bristol use our calendar service. It's internal only. This is no help to you if if you collaborate with people outside the University. Instead people choose to use Meetup.com - a free, web-based service which individuals adopt of their own accord, with no involvement from the institution.

I've instinctively understood network effects for years. I learnt my lesson launching ResNet Chat. I watched the small, lonely procession of users log in to the chat room one by one, saw the tumbleweed howling through it, and log off, never to return again, while MSN beckoned brightly. 

Don't let it happen to you. When planning a new service, see if it has built-in positive network effects. It is doesn't have these naturally, find a way to connect it to larger networks so it can benefit from theirs. If you can't find a way to do this then you are dooming your project from the start. You're better off doing nothing, unless you want to see your service become irrelevant, pushed to one side by a larger, more popular one.

(image of network effects courtesy of Wikipedia)

Keep Calm and Carry On - or not?

Image by scottroberts via Flickr

I have a t-shirt I'm fond of wearing with the now cult British wartime slogan Keep Calm and Carry On. I'm very fond of this particularly British message, but when is it appropriate? When do we buckle down and carry on as ever? When do we recognise that the world has changed and we need to change with it or get left behind?

It has been both invigorating and depressing to read a new report from JISC & Demos: The Edgeless University: why higher education must embrace technology. This is a pretty bleak wake-up call to HE in general and IT within HE in particular.

"British Universities have world-class reputations and they are vital to our social and economic future. But they are in a tight spot. The huge public investment that sustained much of the sector is in jeopardy and the current way of working is not sustainable. Some are predicting the end of the university as we have known it."

...that’s just the introduction!

Brian Kelly contributed to the report and highlighted the main themes on the UK Web Focus blog. He picks out one striking quote from a participant:

‘This seminar feels a bit like sitting with a group of record industry executives in 1999’.

Napster launched in 1999. It provided quick easy and illegal access to popular music in MP3. The record industry fought and squashed Napster, but other, impossible to control peer to peer filesharing services sprung up in its place.

Eventually legal music stores arrived, notably the iTunes Store in 2003. Rights holders were properly compensated, but the music was encumbered by DRM and wasn't portable between different MP3 players. Consumers were being asked to pay for a worse experience! It wasn't until 2008 - nearly 10 years later - that the industry finally licensed legal, DRM-free MP3 stores for the most popular content.

It's not just the music industry either. Newspapers are currently going through the same convulsions. They misunderstood the web - they thought that websites were an advert for their product, but it was their product. Now they are desperately struggling to find a new business model.

What about UK HE? As a culture we still don't get the networked economy, and are slow to understand the implications. Again from UK Web Focus:

"A few weeks ago the “Higher Education in a Web 2.0 World” report was published. And today we see another report which provides a similar top-down view on the importance of Web 2.0 in higher education. If you encounter resistance to change from senior managers in your institution I’d suggest you beat them over the head with these two report[s] until they realise that Web 2.0 is changing the higher educational environment."

To understand the implications of the edgeless university start with Brian Kelly, or better still read the original report (I've also ordered a paper copy which I'll leave in the Bristol Computer Centre staff room). Other good commentaries are from Sarah Bartlett on the Xiphos blog and Chris Sexton, director of Comupting Services at University of Sheffield.

I'll be following up soon with my take on this, starting with reference to another long-sighted Kelly - Kevin Kelly.