Hey Justin, al-

I'll send a more complete email this afternoon with the details of the Facebook OAuth deployment. For now I just wanted to respond to your questions:

>  Is Facebook committed to tracking the spec in its development

Yes. Our main focus right now is stability and bug fixing for what we just launched, but as the working group releases drafts we will participate and upgrade accordingly. We have been very vocal on the list the past month, mostly because we wanted to get the core areas right before we launched. I'm pretty happy with where we are as a starting point.

>  If so where does that put developers that need to change their libraries?

Now that it's in the wild, we must support backwards compatibility so we don't break existing apps. For that reason, we will likely support only a subset of the spec for some time. The parts that are still churning quite a bit (desktop flows, signatures, etc) we will probably not launch until they have stabilized, but the flows we do support (web server, user agent, client credentials) we will maintain backwards compatibility.

>   I can't help but fear that we'll end up in situation where the largest vendor's extensions become better supported than the real standard

I agree that this is a risk, but we are doing everything we can to mitigate it. The version of OAuth we pushed on Wednesday is up to date as of Eran's Monday draft - I think that should be taken as a sign of honest good faith to stay in sync here. There will no doubt be some churn as the spec evolves. I promise to try to raise any issues we see early so that if Facebook ends up not supporting some piece of the spec, the reasons are obvious.

I think the real way to prevent that is to have multiple interoperable implementations by different vendors so that library makers can test across platforms.


-----Original Message-----
From: oauth-bounces@ietf.org [mailto:oauth-bounces@ietf.org] On Behalf Of Justin Richer
Sent: Friday, April 23, 2010 7:55 AM
To: Greg Brail
Cc: OAuth WG
Subject: Re: [OAUTH-WG] New service provider that supports OAuth 2.0

I was surprised that this announcement didn't garner more commentary
from the list here, as this decision worries me a little bit. There are
a lot of components of the OAuth protocol that aren't stabilized into a
real standard yet, and I'm worried that the Facebook implementation of
"OAuth 2.0" will become the de-facto standard before the IETF group can
come up with something final. 

Is Facebook committed to tracking the spec in its development? If so,
where does that put developers that need to change their libraries as
the underlying spec changes? If not, where does that leave the official
OAuth spec?

I will say that I am absolutely *thrilled* to see Facebook at the table,
and Luke and David have done some great work here. I am ecstatic that
Facebook is pushing away from a proprietary stack into an open standard
at all. Even so, I can't help but fear that we'll end up in a situation
where the largest vendor's extensions and quirks become better supported
than the real standard, like with HTML and CSS.

 -- Justin


On Wed, 2010-04-21 at 16:05 -0400, Greg Brail wrote:
> Whoa, it was!
> 
>  
> 
> So, does anyone know what Facebook is planning to do when the spec
> changes, which I assume it's going to keep doing for a while? 
> 
>  
> 
> I mean, the part of the spec that they're describing on the page has
> been pretty stable, but if I were building an app for the Facebook
> platform I'd be wondering.
> 
>  
> 
> From:oauth-bounces@ietf.org [mailto:oauth-bounces@ietf.org] On Behalf
> Of Allen Tom
> Sent: Wednesday, April 21, 2010 3:01 PM
> To: OAuth WG
> Subject: [OAUTH-WG] New service provider that supports OAuth 2.0
> 
> 
>  
> 
> Well that was fast!
> 
> http://developers.facebook.com/docs/authentication/
> 
> Allen
> 
> 


_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth