Last week Microsoft publicly admitted that CardSpace is dead. There’s a story about it at Redmond mag which mentions that although they’ve decided not to release CardSpace 2.0, they’re not giving up on federation and claims-based authentication just yet. Instead, they’re releasing a technology preview of U-Prove.

Now, I had a look through the FAQ and some of the demos for this, and I’m glad they’re working with IdCommons, and releasing open source code in multiple languages, and putting the spec in their Open Specifications promise … but I have to say: I’m pretty sure that they haven’t read Rob Connery’s rant about Open ID.

Here’s how it looks to me: OpenID is trying to solve these problems:

1. Users have to remember lots of passwords

1. Users have a different “names” everywhere they log in

But normal people don’t have the first problem, because they just use the same password everywhere. Yes, that’s bad (and they know it), and it leads to a third problem: your password isn’t secure. But users just don’t care about that, so from their point of view, it’s not a problem. Even my friends and family tend to use the same password on every site, and I harp on them continuously about using secure passwords. Insecure passwords thus become the web sites’ problem: that’s why so many websites proactively emailed users when Gawker was hacked, asking them to change their passwords.

In fact, most people don’t have the second problem either — not because they have nice unique nicknames that nobody else uses, but because they don’t really care. In fact, in many cases they don’t want their name to be the same everywhere. They want to use a different name on Facebook than they do on Twitter, and they certainly don’t want to use their Google or Facebook (or even their blog or twitter) identities as their login for disreputable sites they might visit.

So if they do use OpenID, then they have a fourth problem: they can be tracked (by their OpenID) across many websites.

From what I can see, U-Prove is going to solve those same two problems, plus the fourth problem raised by using a federated identity: they’ll give you an “Agent” to manage the dissemination of information and prevent your use of the information from being tracked by your identity provider. It looks useful … but as I see it, is that people still don’t have the first problem, nor the second problem … and since hardly anyone but hardcore geeks is using OpenID, nobody has the fourth problem either.

Maybe some of these recent attacks (like the Gawker hack, and WOW account hacking) will raise awareness of that third problem (insecure passwords) ... and perhaps trying to solve that will lead to users actually having the first problem (too many passwords), but until it does … I’m not sure there’s any value in U-Prove.

As a final note: from trying out the Contoso demo site it seems to me that this U-Prove is far more convoluted than even OpenID. It takes the involvement of three websites —some of which were loaded in popups— and involved lengthy waits for Silverlight. This solution to federated identity will only seem like a good idea compared to logging in to your bank’s website, and since in their example case, the third website which is providing the verified identity is a bank website, I can only suppose that it would be far more complicated in the real world than here, since I haven’t seen a bank with a simple username/password login in a very long time.

Visual Studio 2010 became available on April 12. To help you get started and get the most value from this release, Microsoft has picked the four technical sessions below to allow you to attend any or all sessions that apply to you. You can read more details by following the links below:

Topic	Date
Visual Studio 2010 Tips & Tricks	Thursday, May 20 12:00 PM-1:00 PM EST
Visual Studio 2010 Architectural Tools	Thursday, May 27 12:00 PM-1:00 PM EST
Improving Development Practices with Visual Studio 2010	Thursday, June 3 12:00 PM-1:00 PM EST
Streamlining Testing with Visual Studio 2010 ALM Tools	Thursday, June 10 11:00 AM-12:00 PM EST

Everyone who attends a session will entered to win a Microsoft Visual Studio logo Fun Prize Pack (ERV $60)!!

What a let-down

The headline is completely misleading. It should say: Microsoft Acquires Teamprise Assets, Promises Support for Cross-Platform Clients for Team Foundation Server. That’s what actually happened. Of course, after that disappointment, I started venting on Twitter and in IRC channels, and much to my surprise, Julie Bort (one of Network World’s community editors) emailed and asked me for some clarification of my thoughts.

Before I send you over to their blog to read what I wrote, I want to say two things:

First, the Teamprise products are great. They just aren’t anything at all like what the headline tried to make it sound like

Second, my main point is this:

Ultimately, all of these announcements are about allowing developers on Linux and Mac to use WINDOWS SERVERS — clearly Microsoft feels they’ve won the desktop war (you’ll note there’s no move here to further support for Mono or to port WPF to Linux or Mac, or even to support Silverlight on Linux — they’re leaving that to lag further and further behind), and is now moving to challenge the use of “light” Linux to serve up web apps, server clouds, and teamwork/collaboration/and source-control servers.

Read the rest of my rant

The first tool out of the gate, of course, was the Windows API Code Pack for the .Net framework. A nice library that makes it simple to write applications that take advantage of new Windows Vista and Windows 7 features like Libraries, Task panes and jump lists. Of course, that library has a major problem: it’s got an ugly and confusing license. Rather than using one of the standard Microsoft Open Source Licenses, the team used a license from the dark ages that features the vague “Excluded Licenses” clause and other ugly terminology.

More recently, Microsoft has announced a Platform Update for Vista which is intended to allow Vista to run most applications designed for Windows 7. The Platform Update is a set of runtime libraries which includes the Windows Ribbon control; Automation Manager Library; DirectX updates for hardware acceleration; DirectCompute for hardware-accelerated parallel computing support; the XPS printing library; the Windows Automation API; and the Windows Portable Devices Platform, which standardizes data transfers across apps and portable devices. This important package will be made available through Windows Update (and applications will be able to prompt you to download it) and it is in public beta with more information on the Windows Team blog. A couple of pieces of that will be made available for Windows XP; particularly the Automation API, which allows accessibility tools and test automation tools to access Windows user interface in a consistent way — this will mean that the next release of WASP will work flawlessly across Windows XP, Vista, and Windows 7.

Also in the works is the Remote Desktop Connection 7.0 (RDC7) client for Windows XP and Windows Vista to allow these older clients to take advantage of all new server features in Windows 7 and Windows Server 2008, including multi-monitor support and media redirection. There’s more information about that on the Remote Desktop team blog.

And finally, the release candidate for the Windows Management Framework (WMF) is also available. The WMF will include WinRM (Microsoft’s implementation of the WS-Management spec), PowerShell 2.0, and BITS for Server 2008, Windows Vista, Server 2003, and of course, Windows XP. This means that if you’re on Vista, or still using Windows XP, you can now upgrade from the PowerShell 2.0 CTP 3 to this release candidate and expect remoting to work!

All of these should be seeing final releases in the very near future, and some of them possibly by the time Windows 7 is released to the public.

Related articles by Zemanta

• Make a bootable USB installer for Windows XP, Vista, 7 with WinToFlash (downloadsquad.com)
• Microsoft, Intel build fast, efficient Windows 7 machines (infoworld.com)
• Free Windows 7 Upgrade (techblissonline.com)
• Users abandon XP for Vista, Windows 7 (infoworld.com)
• Fun with PInvoke and Aero Peek (huddledmasses.org)
• Microsoft: Windows 7 not affected by latest flaw (news.cnet.com)

First of all, their connection URL is: https://connect.microsoft.com/VisualStudio … as opposed to the PowerShell connection, which has the url: https://connect.microsoft.com/site/sitehome.aspx?SiteID=99 …

Secondly, I could search and view bugs without ever logging in!

And finally, imagine my shock when I found that I could actually SUBMIT a bug without “joining” their “Connection” ... all I had to do was log in to Live. All this time I thought the whole “membership” clique was just a built-in requirement for Connect.

Now, I don’t know any of the reasons why PowerShell’s connection is so limited, but I presume it’s mostly because it was initially set up as a closed pre-release testing connection and has never been “fixed.” Well, it’s time to get this thing fixed.

Please VOTE FOR: The PowerShell Connection shouldn’t require login + membership

Oh, and if anyone from the PowerShell or Connect team is reading this … you should make the PowerShell Connect front page look like the Visual Studio one too. PowerShell’s front page is a duplicate of a long blog post from the release of the last CTP — Visual Studio’s is a series of very informative button-links which help you figure out what to do next (eg: there’s a “Bug” link, instead of just a link to “Feedback”).

GotDotNet was replaced by CodePlex, and a lot of Microsoft samples are, in fact, showing up there. But the thing about sites like CodePlex and SourceForge is that they expect you to use all the services — source control, download mirroring, forums, wiki, etc. In fact, both CodePlex and SourceForge have “activity” metrics which include measurements of the amount of developer activity that happens in their source control.

Microsoft Code Gallery is for those “samples” projects and other projects that don’t need source control — If you were using GotDotNet or CodePlex or SourceForge just for the download mirroring, then you could consider using the CodeGallery. They provide download mirroring with your choice of software licenses, and even a small wiki and forum … it’s basically exactly the same as CodePlex, but without source control.

I’m not sure why the world needed such a thing separate from CodePlex. Wouldn’t they be better off just creating a special “we don’t need source control” option for CodePlex projects? I mean, maybe they were seeing a lot of projects on CodePlex that weren’t using the source-control and such — just using it as a dumping ground for downloads. (I know that happens a lot on SourceForge — they have TONS of projects which are there just for download mirroring). But I don’t see the need for a separate project, nor do I understand the desire to have it be on the MSDN domain.

The frustrating thing is that he’s upset at my post, and yet he lambastes me without even having the decency to mention me by name (or even by nickname ) . Although Don says in his blog that I didn’t make “much in the way of actionable, constructive comments” he actually fixed several of my largest concerns, and in his post he specifically addresses most of my remaining issues: specifically detailing the level of relationship between the common members of the community and its paying members, and adding a statement about the 501.3c incorporation. They’ve also fixed my biggest problems with the script repository, (although, the search is still broken — it turns out that it does work, if you click the “Go” button instead of hitting enter). There is a privacy statement at the top of their sign up page now, which I may have simply not noticed missed when I signed up — I’m used to seeing a link for the Terms of Service and Privacy Policy, rather than having a simple statement on the page. I commend Don for keeping that simple.

The clarification of ownership and the privacy statements are vital, ‘cause now I can encourage you to sign up. Actually, signing up is basically a prerequisite for getting anything out of the community, since unlike on this blog where there is an open comment form that anyone can fill out, the contents of which are emailed directly to me (yes, Don, I got your note this morning, thanks) — it really is impossible to provide any sort of feedback on the PowerShell Community site without first signing up. As a personal side note, considering I had already signed up on the community site (despite the lack of a privacy policy), and that he posted a comment on my blog, I’m rather surprised Don said I was so hard to get in touch with. :’(

Now, all of that said, I will repeat three of the things that I said before, which are still true.

I expect this to succeed

In fact, go, sign up now! ShellTools have jumped on board 100% since I last posted, actually shuttering many of their forums in such a way that half my Google searches last night returned hits on pages that no longer exist on PowerShellLive.com (kind of frustrating, by the way). Karl’s started a blog there (no content yet) and is moving everything he can to the new community.

It is a commercial junta

For those of you who don’t speak Spanish, the word junta comes from a Spanish word meaning ‘council’ and it’s use in English refers to governing councils which rule after taking power by force. Don said this:

The community is not a “commercial junta.” The members of the business league do not control community content, only broad direction through an advisory board.

I never said they would control content. In fact, it’s quite clear that those of us being asked to “help” (translation: give them our scripts and answer questions on the forums to build traffic for their website) are the ones expected to provide all of the content, in the form of blogs, taking the time to add links on the community site to any content outside the community, and writing scripts. Nevermind the fact that we were already providing this content on our blogs and various forums already … please come join the central one. We weren’t asked should be in charge. The “business league” sprang upon the scene without so much as a “do you think it’s a good idea” to the community at large (the only people clued in were the MVPs and financial sponsors which were felt to be crucial to it’s success) ... I think it’s quite fair to call it what it is. You tell me: am I wrong? (Oh, in case I’m not being clear, tell me means fill out the comment form at the bottom of this page).

To be clear (especially for those of you who aren’t familiar with Latin American politics and the implication of the word), a Junta isn’t necessarily a greedy dictatorship that interferes with personal liberties — usually you have a Junta as a transitional government with the idea that you will eventually have elections and democratic rule. Sadly, it doesn’t always work out that way — sometimes a Junta gives way to a military dictatorship instead … which eventually leads to another coup d‘état and another temporary military junta … who said politics are dull?

They launched it too early, and with too little content

Personally, I’ve been sort-of waiting for the site to mature before diving in. That’s the answer to the question Don asked: Will you help… or just sit back? When it comes to participatory websites, I prefer to wait until they have some of these glitches worked out and at least have the various sections working before I jump in. I think PowerShell Community (the website, and the amorphous collection of users and developers) could have benefited a lot from a short invitation-only stealth period during which they could have build up some content (scripts, links, imported blog posts … etc) and a structure with “civilian” moderators for the forums, etc. as well as ironed out some of the bugs. It seems to me that they sprang the site out barely formed in order to forestall any other efforts to create a central PowerShell site.

With that as background, I will add that the attitude of entitlement doesn’t help. There seems to be some expectation that since Microsoft and it’s other commercial partners have declared this to be the community site, not only will other sites shut down and join the community for the greater good (farewell PowerShellLive, so long Scripting Answers) but apparently we the users ought to be contributing as well, and ought not to put our opinions on our blogs without first submitting it to their forums. All I’m saying is: eventually this expectation of participation may be realistic, but you’re not there yet.

My point is: just because you pay a prominent MVP to run the site, and convince all of your partners to join a business league doesn’t automatically mean the site deserves effort from the rest of the community — particularly when it’s easier to continue doing what we have been doing. Honestly, I figure that posting my opinions on my blog is at least as helpful as posting in the community forums, since my review post will actually boost their PageRank™ My original post was a gut reaction on the first day the place opened, and honestly, I thought that they’d appreciate the link, even with negative feedback. I guess I was wrong.

More ideas

I’ve posted a comment on Don’s blog, but it’s the last time I’ll do that until they remove the captcha that asks me to prove I’m human every time I post a comment — even though I’m also required to log in as a member of the community first. That’s just adding annoyance on top of roadblocks, and makes me assume they don’t really want to get feedback on their blogs anyway.

Now that the script vault on the community site is improved, I’ll probably be submitting some of my scripts on their site too, just to help people out — although I take a bit of a dim view of the fact that scripts I post there have to wait for a moderator before they show up. So many roadblocks …

I’m unlikely to submit links to their links section just because quite honestly, I’m lazy, and I feel that putting links in my delicious and diigo sites (not to mention Furl, Blinklist, Simpy, etc) or linking them from my blog is more than enough effort to help people find things (after all, how many people browse community link lists instead of using Google when they’re really looking for something). I would be willing (if asked) to help develop a tool to automatically include links from delicious (which has a ton of links, but isn’t moderated) or from the Diigo PowerShell group which I already moderate (and would be more than willing to let Don or others also moderate) ... That seems like the best way to manage link collections to me — since Diigo has tools for moderation and for link submission that are built into the browser as extensions.

There’s no community quite as easy to build as a commercial junta, I guess. Several major commercial players are on board — even the upstart ShellTools has lent their logo in support. One must assume this will succeed to some degree … especially since Microsoft has been MVP-deputizing all the big PowerShell bloggers who’s support will determine whether this will remain an empty site where these commercial backers can get some extra advertising, or will actually become a true “community” site with active involvement from people without financial incentives .

On the down side, PowerGadgets (among others?) is conspicuously missing, and it remains to be seen if these guys can all play nice with each other. They are, after all, competing in a couple of PowerShell-enhancement spaces, and I haven’t yet seen any sign that any of them are going to shut down their (Microsoft | ShellTools | Sapien) PowerShell forums and route traffic to the “community” site. I also can’t find an RSS feed except on the individual blogs (and so far, only Marco Shaw seems likely to actually blog there).

One last thing, which I was at first not going to say, but after surfing the “blog” section and forums and finding them decorated the same way, I can’t hold back: That is quite honestly the ugliest web site I’ve seen in a while. It’s roughly the color of the swirling brown stuff in the bottom of the toilet after you throw up, and there’s more bits of scrolling, pulsing, and throbbing flash and javascript than I’ve ever seen outside of MySpace.

Update

It turns out that Sapien (Don Jones’ company) is, in fact, going to close their PowerShell Forum and move their PowerShell-related blogging to throw their whole weight behind this new site. So that means all three of the Bloggers listed on PowerShellCommunity.org will be actually blogging there. Nevermind that this makes it look, for now, even more like a Sapien spin piece than an community-driven site, it’s certainly a guarantee of some success, since one presumes that some of the traffic on the sapien forum will actually move to the new location, and all of these guys have been fairly consistent bloggers.

Update

Well, just for the record … I’ve been flipping around on the “community” site and I have a few more gripes. There is a script repository, but it’s not searchable, it’s practically empty, has no download links, and displays scripts double-spaced and without highlighting. Plus, posting scripts requires registration — on a site which as yet has no privacy policy and appears to be partially owned by Microsoft (there was a rumor about a 501c non-profit, but there’s no trace of that on the site, even on the “About us” page which merely says it’s run by Don Jones —an MVP, author, speaker, blogger and corporate ).

Just for kicks, compare their scripts page to the PowerShell Central Scripts site (note that I help out with PowerShell Central, and it’s independently run by Brandon Shell (another MVP) and also has no privacy policy, but then, it doesn’t require you to sign up). Oh, and for now you can access the scripts interface directly … but don’t tell Brandon I told you about it

Feedback Works

They’ve fixed a lot of these problems …

Acting on the advice of the License Approval Chair, the OSI Board today approved the Microsoft Public License (Ms-PL) and the Microsoft Reciprocal License (Ms-RL). The decision to approve was informed by the overwhelming (though not unanimous) consensus from the open source community that these licenses satisfied the 10 criteria of the Open Source definition, and should therefore be approved.

Not much to say about that, except: about time! (oh, and thank goodness Richard Stallinman isn’t in charge of the OSI).