OpenSocial
China - October 2008
Arne Roomann-Kurrik
Developer Relations
Jacky Wang
Software Engineer
1

OpenSocial’s goal:
Make the web more social
2

What does “social” mean?
“Eliette, what do you do with your friends?”
3

What does “social” mean?
This work by Eliette Chanezon is licensed under a Creative Commons Attribution-Share Alike 3.0 License
4

What does “social” mean?
This work by Eliette Chanezon is licensed under a Creative Commons Attribution-Share Alike 3.0 License
5

What does “social” mean?
This work by Eliette Chanezon is licensed under a Creative Commons Attribution-Share Alike 3.0 License
6

What does “social” mean?
This work by Eliette Chanezon is licensed under a Creative Commons Attribution-Share Alike 3.0 License
7

What does “social” mean?
This work by Eliette Chanezon is licensed under a Creative Commons Attribution-Share Alike 3.0 License
8

What does “social” mean?
This work by Eliette Chanezon is licensed under a Creative Commons Attribution-Share Alike 3.0 License
9

What does “social” mean?
“Internet, what do you do with your friends?”
10

“We look at each other”
11

“Talking”
12

“Laughing”
13

“We help each other”
14

“We read together”
15

“We do projects together”
16

The social internet
A social website..
• Provides a feature that becomes more engaging as the number of users
grows.
• Uses relationships between people to present users interesting
information.
17

The social internet
Some social websites...
18

The social internet
A social website..
• Has overhead to manage users and relationships.
• Grows slowly because users must sign up to use the site.
What if we remove
the overhead?
• Developers can focus
on providing
features, not
managing users.
19

The social internet
A social network..
• Manages large numbers of users and relationships.
• Is slow to add new features.
20

The social internet
Many social networks...
21

The social internet
How do we add new features to social networks?
• Make the social network a platform.
• Give creative developers the tools to add the features themselves.
22

The social internet
A social application...
• Lets the social network manage users and relationships.
• Adds new features to the social network.
• Lets users “install” the application without signing up for new accounts.
• Grows quickly because users are already communicating with each
other.
23

The social internet
Lots of social apps...
24

Need for a social API
How do we put apps in social networks?
25

A day in the life of a social app developer
26

A day in the life of a social app developer
27

A day in the life of a social app developer
28

A day in the life of a social app developer
29

A day in the life of a social app developer
30

A day in the life of a social app developer
31

Introduction to OpenSocial
Numbers:
• 19+ implemented Containers
• 40+ committed Containers
• 3000+ applications
• 400,000,000+ of users
In China:
32

The OpenSocial APIs
Versions:
• 0.6 - Client-side APIs introduced
• 0.7 - Server-side APIs introduced
• 0.81 (current) - Server-side APIs finalized
Client-side:
• Gadgets XML
• Gadgets JavaScript
• OpenSocial JavaScript
Server-side:
• RESTful protocol
• RPC protocol
33

Gadgets
Not widgets, not sprockets, not gidgets, not wadgets
34

Gadgets
A gadget spec:
• Is an XML file.
• Defines metadata about an OpenSocial app.
• Is highly cacheable and does not need a high performance server.
Gadgets use existing web standards
• XML to define metadata.
• HTML for markup.
• JavaScript for interactivity.
• CSS for presentation.
35

Gadgets
A gadget server:
• Takes the gadget spec as input.
• Performs optimizations on the gadget spec.
• Outputs HTML, JavaScript, and CSS as one document.
36

Gadgets
A container:
• Displays the social network’s user interface.
• Opens an IFrame to the rendered gadget.
Containers and gadget
servers are both run by
the social network, but
do not need to be on
the same machine, or
even domain.
37

Gadgets
Example gadget XML spec:
• Uses HTML to print “Hello World”.
• Colors the text red with CSS.
• Dynamically adjusts the height of the gadget with JavaScript.
<?xml version=\"1.0\" encoding=\"UTF-8\" ?>
<Module>
<ModulePrefs title=\"Hello World!\">
<Require feature=\"dynamic-height\" />
</ModulePrefs>
<Content type=\"html\">
<![CDATA[
<h1>Hello World</h1>
<style type=\"text/css\">
h1 { color: #dd0000; }
</style>
<script type=\"text/javascript\">
gadgets.window.adjustHeight();
</script>
]]>
</Content>
</Module>
38

Gadgets
Requesting the gadget XML spec:
1. The client requests an app to be rendered.
39

Gadgets
Requesting the gadget XML spec:
1. The client requests an app to be rendered.
2. The container fetches the gadget XML spec from its host.
40

Gadgets
Requesting the gadget XML spec:
1. The client requests an app to be rendered.
2. The container fetches the gadget XML spec from its host.
3. The container renders the gadget into HTML, which is displayed
to the client.
41

Gadgets
Requesting the gadget XML spec:
• Because the gadget spec is simple, it can be cached easily.
• Caching reduces the load on your server, great when you have millions
of users.
42

Gadgets
Requesting a cached gadget XML spec:
1.The client requests an app to be rendered. The container already
has a copy of the spec stored in its cache.
43

Gadgets
Requesting a cached gadget XML spec:
1.The client requests an app to be rendered. The container already
has a copy of the spec stored in its cache.
2.The container renders the gadget into HTML, which is displayed
to the client.
44

Gadgets
What kind of rewriting is done by the gadget server?
• Rewrite links to use content proxies.
• Rewrite relative links to full paths (some containers).
• Return only content for the current view.
45

Gadgets
What are views?
• Gadgets can render in different locations on a container.
• Rendering area changes from small to large.
• Certain pages might be public, some are private.
• Containers may have different policies depending on the page,
especially when the gadget displays ads.
• Views provide a way for gadgets to provide different functionality
depending on where it is rendered.
46

Gadgets
iGoogle \"home\" view:
• On iGoogle, the \"home\" view is a small,
private page that does not allow ads.
47

Gadgets
iGoogle \"canvas\" view:
• Large private view, allows ads.
48

Gadgets
Working with views in the gadget XML:
• <Content> sections are repeated for each view.
• Add a view=\"view name\" attribute to each section.
• Content sections may support multiple views, for example
view=\"home,canvas\"
<?xml version=\"1.0\" encoding=\"UTF-8\" ?>
<Module>
<ModulePrefs title=\"Hello World!\">
<Require feature=\"dynamic-height\" />
</ModulePrefs>
<Content type=\"html\" view=\"home\">
<![CDATA[
...
]]>
</Content>
<Content type=\"html\" view=\"canvas\">
<![CDATA[
...
]]>
</Content>
</Module>
49

Gadgets
JavaScript utility functions for gadgets:
• gadgets.io.makeRequest()
Make cross-domain AJAX calls to remote servers.
• gadgets.json.parse() and gadgets.json.stringify()
Native JSON support.
• gadgets.util.escapeString()
Make text safe for display via innerHTML.
• gadgets.util.registerOnLoadHandler()
Execute code when the page is finished loading.
50

Gadgets
gadgets.io.makeRequest():
• Make cross-domain AJAX calls to remote servers.
Remote content:
• Most interesting gadgets will need to
work with content stored on different
servers.
• AJAX cannot cross domains, so you
cannot request content from your own
server.
• JSONP is only really good for one-way
data transfer.
• Gadgets with millions of users can
overwhelm a remote site.
51

Gadgets
Requesting remote content:
1.The rendered app calls gadgets.io.makeRequest() to fetch
remote content. This call is sent to the container.
52

Gadgets
Requesting remote content:
1.The rendered app calls gadgets.io.makeRequest() to fetch
remote content. This call is sent to the container.
2.The container requests content from the specified URL.
53

Gadgets
Requesting remote content:
1.The rendered app calls gadgets.io.makeRequest() to fetch
remote content. This call is sent to the container.
2.The container requests content from the specified URL.
3.The container returns the response to the application, which renders
the data.
54

Gadgets
Add extra features to your gadget:
• dynamic-height - Change the size of your gadget in the container.
• views - Navigate between different surfaces of the container.
• skins - Make your gadget change its styles to match the container.
• Containers may offer custom features...
<?xml version=\"1.0\" encoding=\"UTF-8\" ?>
<Module>
<ModulePrefs title=\"Hello World!\">
<Require feature=\"dynamic-height\" />
</ModulePrefs>
<Content type=\"html\">
<![CDATA[
...
]]>
</Content>
</Module>
55

Gadgets
<?xml version=\"1.0\" encoding=\"UTF-8\" ?>
<Module>
<ModulePrefs title=\"Hello Social!\">
<Require feature=\"opensocial-0.8\" />
</ModulePrefs>
<Content type=\"html\">
<![CDATA[
...
]]>
</Content>
</Module>
The OpenSocial JavaScript API is a gadget feature, too!
56

The OpenSocial JavaScript API
“It's people!”
57

The OpenSocial JavaScript API
Representing users:
• Client-side, users must work with the VIEWER and the OWNER.
58

The OpenSocial JavaScript API
Multiple personalities:
• When you visit your own profile, you are both the VIEWER and the
OWNER.
59

The OpenSocial JavaScript API
OpenSocial requests:
• An OpenSocial DataRequest is created.
• Requests are added to the DataRequest.
• The DataRequest is sent to the server asynchronously.
• When the request finishes, the supplied callback will be called.
function request() {
var req = opensocial.newDataRequest();
req.add(req.newFetchPersonRequest(\"OWNER\"), \"get_owner\");
req.add(req.newFetchPersonRequest(\"VIEWER\"), \"get_viewer\");
req.add(req.newFetchActivitiesRequest(\"VIEWER\"), \"vactivities\");
req.add(req.newFetchPersonAppDataRequest(\"OWNER\", \"*\"), \"odata\");
...
req.send(response);
};
function response(data) { ... };
gadgets.util.registerOnLoadHandler(request);
60

The OpenSocial JavaScript API
OpenSocial responses:
• Responses are bundled according to the keys specified in the request.
• Check for an error at the global response level.
• Check for an error at the specific response level.
• Use getData() to retrieve the actual information in a request.
function response(data) {
if (data.hadError()) {
if (data.get(\"get_owner\").hadError()) {
...
}
if (data.get(\"get_viewer\").hadError()) {
...
}
...
}
var owner = data.get(\"get_owner\").getData();
var viewer = data.get(\"get_viewer\").getData();
};
61

The OpenSocial JavaScript API
Working with people:
• opensocial.Person - JavaScript representation of a user.
62

The OpenSocial JavaScript API
Request one person:
req.add(req.newFetchPersonRequest(idspec, opt_params), \"key\");
• idspec can be either “VIEWER”, “OWNER” or an ID number.
• opt_params contains extra request parameters, such as which profile
fields to fetch.
newFetchPersonRequest responses:
var owner = data.get(\"key\").getData();
alert(owner.getDisplayName());
• Data contains a single opensocial.Person
object.
• Person objects can contain lots of information,
such as addresses, companies, phone numbers,
favorite movies, and thumbnail urls.
63

The OpenSocial JavaScript API
Methods available on an OpenSocial Person:
• getDisplayName()
Gets a text display name for this person; guaranteed to return a useful
string.
• getField(key, opt_params)
Gets data for this person that is associated with the specified key.
• getId()
Gets an ID that can be permanently associated with this person.
• isOwner()
Returns true if this person object represents the owner
of the current page.
• isViewer()
Returns true if this person object represents the
currently logged in user.
64

The OpenSocial JavaScript API
An OpenSocial Person's fields:
• ABOUT_ME • JOB_INTERESTS • SEXUAL_ORIENTATION
• ACTIVITIES • JOBS • SMOKER
• ADDRESSES • LANGUAGES_SPOKEN • SPORTS
• AGE • LIVING_ARRANGEMENT • STATUS
• BODY_TYPE • LOOKING_FOR • TAGS
• BOOKS • MOVIES • THUMBNAIL_URL
• CARS • MUSIC • TIME_ZONE
• CHILDREN • NAME • TURN_OFFS
• CURRENT_LOCATION • NETWORK_PRESENCE • TURN_ONS
• DATE_OF_BIRTH • NICKNAME • TV_SHOWS
• DRINKER • PETS • URLS
• EMAILS • PHONE_NUMBERS
• ETHNICITY • POLITICAL_VIEWS
• FASHION • PROFILE_SONG
• FOOD • PROFILE_URL
• GENDER • PROFILE_VIDEO
• HAPPIEST_WHEN • QUOTES
• HAS_APP • RELATIONSHIP_STATUS
• HEROES • RELIGION
• HUMOR • ROMANCE
• ID • SCARED_OF
• INTERESTS • SCHOOLS
65

The OpenSocial JavaScript API
Working with people:
• A Collection represents many opensocial.Person objects.
66

The OpenSocial JavaScript API
Request many people:
var idspec = opensocial.newIdSpec({
“userId” : “OWNER”,
“groupId” : “FRIENDS”
});
req.add(req.newFetchPeopleRequest(idspec, opt_params), \"key\");
• idspec is an object that can represent groups of people. “userId” can be
“VIEWER” or “OWNER” or an ID, and “groupId” can be “SELF”,
“FRIENDS”, or the name of a group.
• opt_params contains extra request parameters, such as which profile
fields to fetch, and how to order or filter the returned people.
newFetchPersonRequest responses:
var owner_friends = data.get(\"key\").getData();
owner_friends.each(function (person) {
alert(person.getDisplayName());
});
• Data contains a Collection of opensocial.Person
objects. Iterate over these by using the each() method.
67

The OpenSocial JavaScript API
Working with data:
• Persistent data gives apps key, value storage directly on the container.
• String only, but conversion to JSON allows for storage of complex
objects.
• Storage per app per user - scales well with growth.
• Ideal for settings, customizations.
68

The OpenSocial JavaScript API
Set persistent data:
req.add(req.newUpdatePersonAppDataRequest(idspec, key, value));
• idspec can only be “VIEWER”.
• key is the name under which this data will be stored.
• value is a string representing the data to store.
69

The OpenSocial JavaScript API
Fetch persistent data:
var idspec = opensocial.newIdSpec({
\"userId\" : \"OWNER\",
\"groupId\" : \"SELF\"
});
req.add(req.newFetchPersonAppDataRequest(idspec, keys),
\"key\");
req.add(req.newFetchPersonRequest(\"OWNER\"), \"ownerkey\");
• idspec is an object that can represent groups of people, the same as
newFetchPeopleRequest.
• keys is a list of persistent data keys to retrieve the data for.
• The owner is requested because the data returned is indexed by user ID
and we want the owner’s data.
newFetchPersonAppDataRequest responses:
var app_data = data.get(\"key\").getData();
var value = app_data[owner.getId()][key];
70

The OpenSocial JavaScript API
Fetch persistent data:
• Data is returned as an object indexed by ID number, then as an object
indexed by key name, even if there is only data returned for one user!
{ \"1234567890\" : { \"key1\" : \"value1\" } }
• One person, multiple keys:
{
\"1234567890\" : {
\"key1\" : \"value1\",
\"key2\" : \"value2\"
}
}
• Multiple people:
{
\"1234567890\" : { \"key1\" : \"value1\" },
\"2345678901\" : { \"key1\" : \"value2\" }
}
71

The OpenSocial JavaScript API
Working with activities:
• API to post information about what users are doing with your app.
• Many containers have support for images and some HTML.
• Channel to grow your application.
orkut MySpace hi5
72

The OpenSocial JavaScript API
Post an activity:
function postActivity(text) {
var params = {};
params[opensocial.Activity.Field.TITLE] = text;
var activity = opensocial.newActivity(params);
opensocial.requestCreateActivity(activity,
opensocial.CreateActivityPriority.HIGH, callback);
};
• Assign the activity text to the TITLE field.
• Call opensocial.newActivity() to create a new Activity instance.
• Call opensocial.requestCreateActivity() to post the activity to the
container.
73

RESTful and RPC protocols
Servers talking to servers
74

RESTful and RPC protocols
Opens new development models
• Background processing.
• Easier Flash integration.
• Mobile applications.
75

RESTful and RPC protocols
Communication methods:
• RESTful (Representational State Transfer)
• RPC (Remote Procedure Call)
Formats:
• XML
• JSON
• AtomPub
76

RESTful and RPC protocols
REST:
• Resources are URLs.
Example - People:
• All people connected to the given user:
/people/{guid}/@all
• All friends of the given user:
/people/{guid}/@friends
• Profile of the given user:
/people/{guid}/@self
• Profile of the authenticated user:
/people/@me/@self
• Supported Person fields:
/people/@supportedFields
77

RESTful and RPC protocols
Querystring parameters customize requests:
• Response format (JSON, XML, AtomPub)
format={format}
• Request extra fields
fields={-join|,|field}.
• Filtering:
filterBy={fieldname}
filterOp={operation}
filterValue={value}
updatedSince={xsdDateTime}
networkDistance={networkDistance}
• Paging:
count={count}
sortBy={fieldname}
sortOrder={order}
startIndex={startIndex}
78

RESTful and RPC protocols
REST responses (Person):
• JSON:
{
\"id\" : \"example.org:34KJDCSKJN2HHF0DW20394\",
\"displayName\" : \"Janey\",
\"name\" : {\"unstructured\" : \"Jane Doe\"},
\"gender\" : \"female\"
}
• XML:
<person xmlns=\"http://ns.opensocial.org/2008/opensocial\">
<id></id>
<displayName></displayName>
<name>
<unstructured>Jane Doe</unstructured>
</name>
<gender>female</gender>
</person>
79

RESTful and RPC protocols
REST responses (Person):
• AtomPub:
<entry xmlns=\"http://www.w3.org/2005/Atom\">
<content type=\"application/xml\">
<person xmlns=\"http://ns.opensocial.org/2008/opensocial\">
<name>
<unstructured>Jane Doe</unstructured>
</name>
<gender>female</gender>
</person>
</content>
<title/>
<updated>2003-12-13T18:30:02Z</updated>
<author/>
<id>urn:guid:example.org:34KJDCSKJN2HHF0DW20394</id>
</entry>
80

RESTful and RPC protocols
REST:
• Perform operations using different HTTP methods on each URL.
CRUD: HTTP:
• Create • POST
• Retrieve • GET
• Update • PUT
• Delete • DELETE
81

RESTful and RPC protocols
REST has some disadvantages:
• Batch support requires multiple HTTP requests, or a contrived URL
scheme.
• Specifying multiple users via querystring is difficult. Is
?uid=1234,5678 the same resource as ?uid=5678,1234 ?
82

RESTful and RPC protocols
RPC:
• One endpoint - parameters specify methods to call.
• Batch support.
• Specify collections of users through passed arguments, not URLs.
Example - Fetch current user:
• Request • Response
POST /rpc HTTP/1.1 HTTP/1.x 207 Multi-Status
Host: api.example.org Content-Type: application/json
Authorization: <Auth token> {
Content-Type: application/json \"id\" : \"myself\"
{ \"result\" : {
\"method\" : \"people.get\", \"id\" : \"example.org:34KJDCSKJN2HHF0DW20394\",
\"id\" : \"myself\" \"name\" : { \"unstructured\" : \"Jane Doe\"},
\"gender\" : \"female\"
\"params\" : {
}
\"userid\" : \"@me\",
}
\"groupid\" : \"@self\"
}
}
83

RESTful and RPC protocols
Authentication:
• Both protocols use OAuth to identify users and apps.
• Depending on what the application needs to do, it can use two-legged
or three-legged OAuth.
Two-legged OAuth:
• The application authenticates directly with the container.
• Perform non-user specific operations:
• Update persistent data for app users.
• Can request information for users who have shared their profile
information with the app.
Three-legged OAuth:
• The user tells the container to give profile access to the application.
• Perform user specific operations:
• Post activities.
• Fetch friends of the current user.
84

RESTful and RPC protocols
Client libraries are being created for PHP, Java, and Python.
• Help you connect to OpenSocial containers, and work with social
data on your server.
Sample: log into a container:
85

RESTful and RPC protocols
RESTful and RPC use OAuth for authentication
• OAuth is an open standard.
• Client libraries will help make this process easier for developers.
Sample: use OAuth to get an access token for a user:
86

RESTful and RPC protocols
• Once OAuth is used, you can store a user token for later access.
Sample: use an existing token:
87

RESTful and RPC protocols
• Once authentication has happened, requests are easy:
Sample: Fetch the current user:
88

RESTful and RPC protocols
Sample: Fetch the current user’s friends:
89

OpenSocial Tools
What sets us apart from the animals
90

Shindig
Writing a gadget server is difficult:
• Fast changing API - hard to keep up.
• Standardization is hard to get right.
• Costs ¥ / !
91

Shindig
Apache Shindig to the rescue!
• Open Source project.
• Available in Java and PHP.
• Run by itself and connect to an
existing social site to add
OpenSocial support.
• Goal: Launch a
new (simple)
container in under
an hour’s worth
of work
http://incubator.apache.org/shindig/
92

OpenSocial Dev App
Development tool to test out JS code in different containers
http://osda.appspot.com
93

Upcoming Features
Caja and Templates
94

Caja
When JavaScript goes bad
• Gadgets can be a new vector for phishing, spam, malware.
• Social spread of gadgets can spread bad gadgets too.
• Caja reduces threats with a JavaScript
sanitizer as an additional \"sandbox\"
on top of iFrame protection.
95

Caja
Caja is:
• A capability-based Javascript sanitizer.
• An Open Source project from Google.
• Optional but recommended for
OpenSocial containers.
• Will eventually be secure enough
to run gadgets
inline instead of in iframes.
http://code.google.com/p/google-caja/
96

Templates
Need for a templating language:
• Developers need a simple way to convert OpenSocial data to HTML.
• DOM manipulation is slow and ugly.
• innerHTML is unsafe.
97

Templates
<script type=\"text/javascript\"
src=\"http://ostemplates-demo.appspot.com/ostemplates.js\"></script>
<script type=\"text/os-template\">
<b>${owner.displayName}'s friends</b>
<ul>
<li repeat=\"friends\">${displayName}</li>
</ul>
</script>
<script type=\"text/javascript\">
function loadData() {
var req = opensocial.newDataRequest();
req.add(req.newFetchPersonRequest('OWNER'), 'owner');
var idSpecFriends = opensocial.newIdSpec(
{'userId':'OWNER', 'groupId':'FRIENDS'});
req.add(req.newFetchPeopleRequest(idSpecFriends), 'friends');
req.send(function(data) {
os.Container.processDocument(data);
});
}
gadgets.util.registerOnLoadHandler(loadData);
</script>
http://ostemplates-demo.appspot.com/
98

Templates
Templates developer application available:
http://ostemplates-devapp.appspot.com/
99

The OpenSocial specification process
“We can fix it, we have the technology”
100

The OpenSocial specification process
101

The OpenSocial specification process
102

The OpenSocial specification process
103

The OpenSocial specification process
104

The OpenSocial specification process
105

Challenges
Nobody said this was going to be easy
106

Challenges
Cross container development is still tricky:
• Containers may not follow the standard.
• Containers may follow the standard but have different policies.
• Follow best practices:
http://tinyurl.com/4nuzll
107

Challenges
No central directory
• Hard for apps to spread to many containers.
• Apps need to work with different install processes.
• Directory approval requirements vary from container to container.
108

Challenges
Scaling is hard:
• Easy to start and get some users.
109

Challenges
Scaling is hard:
• Being popular on one social network
can push your server to the limit...
110

Challenges
Scaling is hard:
• ...being popular on many networks
will push you right over.
111

Resources
112

Resources
• OpenSocial Tutorial: http://rurl.org/ss3
• OpenSocial Spec, Foundation, Reference: http://opensocial.org
• Caja: http://code.google.com/p/google-caja/
• Shindig: http://incubator.apache.org/shindig/
• OpenSocial Across Containers video: http://tinyurl.com/4nuzll
• OpenSocial Templates: http://ostemplates-demo.appspot.com/
• OpenSocial Dev App: http://osda.appspot.com
• Partuza: http://partuza.nl
• OpenSocial Specification Proposals:
http://groups.google.com/group/opensocial-and-gadgets-spec/topics
113