7 ms·
Transitioning Persona to Community Ownership
- Tomte 13y agoI never understood why Mozilla always talked about how great the future was going to be, when Persona would be part of web browsers. But then never implemented it in Firefox, even as a default-off optional feature. It looked very half-hearted, and that was a really bad signal to the world.
- fabrice_d 13y agoWe implemented it in b2g aka FirefoxOS and the user experience is quite nice there. I agree that it should have been done on firefox desktop too.
- yeukhon 13y agoWhen you say implement in Firefox, did you mean instead of a popup, Firefox simply display an integrated login button in the browser?
- Tomte 13y agoYes, without any Javascript, real native chrome.
- jedp 13y agoMozilla Identity dev here. The reason for that was due to a large degree to time and priorities. We were close to shipping Persona preffed off in Firefox over 18 months ago. Then FirefoxOS came along and our focus was changed to implementing Persona as the sign-in system on the device (which we did; it's natively supported there). FirefoxOS has been a massive effort on behalf of the whole company, and it has diverted crucial resources from the Persona effort on desktop. Then we shifted our focus again to Firefox Accounts and revising Sync. A native implementation of Firefox Accounts should be landing in FirefoxOS 1.4. As a result, we have native BrowserID support (both Persona and Firefox Accounts use this protocol) in FirefoxOS and as a backbone in desktop Firefox. There is a lot of persona in Firefox right now, but sadly you can't see it. Despite these massive efforts, we still have not been able to land the last patches to surface this in the UI on desktop. And you're right, it appears to send the message that Mozilla did not see enough importance in federated, user-controlled identity on the web to make sure it landed in the desktop browser. But Mozilla, like all organizations, has to balance its priorities. There's a lot going on, and the decision was made that other projects would take priority. I hope the decision is revised in the future. If it looked half-hearted, I can assure you it was not from lack of effort or dedication from the team. We believe in Persona and poured our hearts into it.
- beefman 13y agoThanks for the info. I don't think anyone's accusing the Persona team of being half-hearted. Execution was great! But I will accuse Mozilla leadership of being tragically poor. It's nice to think about "sustainability" in a post-web world, but sustainability for Mozilla must start with Firefox. Mozilla is Firefox. And Mozilla has the billions to make it rock. So when resources are diverted away while there's still work to do, you should see red flags and look for better focus right away. When Apple was the iPod, we made damn sure it was the best possible iPod before anything else.
- cbtacy 13y ago"And Mozilla has the billions to make it rock." Really? What do you base that statement on?
- beefman 13y agoThey have a contract with Google that guarantees them $1B over 3 years. http://www.zdnet.com/blog/btl/google-paying-mozilla-300-million-per-year-for-search-deal/65921 http://www.zdnet.com/blog/btl/google-paying-mozilla-300-mill...
- yeukhon 13y ago1B is very little. I would focus on your other point: So when resources are diverted away while there's still work to do, you should see red flags and look for better focus right away.
- dllthomas 13y agoI'm not sure 1B is very little - it's thousands of programmer-years. It is weird to characterize 1B over 3 years as "billions" unless there are substantial funds coming from other sources.
- 13y ago
- Zikes 13y agoWithout it being an established W3C standard I think it would be disingenuous to integrate it into the browser. Despite its obvious benefits, it would feel like they're using their browser as a platform to push other products. Until it saw widespread adoption I think implementing it as a browser extension/add-on would be more appropriate.
- pekk 13y agoThe implementation of Firefox contains countless things which are not W3C standards.
- judk 13y agoWhere do you think new standards come from?
- 21echoes 13y agow3c standards are for what gets rendered by Gecko. The browser itself has many things that do not involve w3c at all (search box, bookmarks, sync, etc.)
- tommorris 13y agoIdentity standards are a long and depressing history of failure and mental masturbation. Waiting for the W3C to fix this means you'll be waiting a long while.
- 6a68 13y agoOne thing I want to add right off the bat: we're going to build new features, where "we" is some of the people who used to get paid to work on Persona + some people in the community. We'd love help! There are some get involved links at the bottom of our MDN page: https://developer.mozilla.org/en-US/Persona https://developer.mozilla.org/en-US/Persona
- camus2 13y agoThat's why i cant use Mozilla techs,lot of projects started,few finished.(XULrunner ? Tamarin ? ...). Nobody is going to use Persona now.
- callahad 13y agoI sincerely hope that's not the case. Mozilla Corporation is still using Persona internally, and still deploying new sites and services that rely on it. We think it's absolutely great for when you need simple, email-based authentication, and we're still fully supporting it. (PS: Because it's email based, there's absolutely no lock in. Want to migrate away from Persona? Just add a password column to your database. But we hope it won't come to that.)
- jdlshore 13y agoThere's no lock in, but migrating away from Persona isn't quite that simple. You still have to educate users about the switch ("make a new password, and by the way, don't use your Persona password!"), then implement everything Persona provides: login form, password change form, email authentication, ...
- rmcguigan 13y agoIf Mozilla did migrate away from persona, would the staff become less familiar with the details over time thus making the best effort support being offered by the community in sumo and being talked about here: https://support.mozilla.org/en-US/forums/contributors/710099 https://support.mozilla.org/en-US/forums/contributors/710099 My question for you all is what do you think could be supported once it has been depreciated?
- BrendanEich 13y agoYou have to be willing to lose in life. It's unrealistic to expect all hits all the time. If some organization or open source project seems too perfect, look for a "memory hole" where their negative results get flushed. So XULRunner and Tamarin did not pan out. But we have lots of hits, some still ramping up: Firefox, Firefox OS, Gecko, Servo, Rust, Fennec, various SpiderMonkey iterations including OdinMonkey for Emscripten/asm.js, PDF.js, Shumway. Negative results are important in science, as roc blogged once (he cited a "Journal of Negative Results", in one of the physical sciences I think). Let's learn from them and make better results, not deny that they happen or keep on banging heads against stout oak trees....
- natrius 13y agoPersona is one of the Mozilla projects that best exemplifies why we need Mozilla. They're the only ones purely dedicated to the future of the open web. The only foreseeable future for the web today is one where two or three gatekeepers control user information with no way out. Persona seemed like the best way to prevent that future. The services that they're switching their focus to are also crucial for the open web. Firefox needs them to be competitive, and the open web needs a competitive Firefox. But it feels like putting Persona on the backburner—especially when it comes to UI integration in the browser—is letting a pivotal moment pass us by, and I don't think identity on the open web will recover. If you held a donation drive for Persona browser integration, the donations from Hacker News alone would fund it.
- danielsiders 13y agoMozilla does a great job promoting open web standards and Firefox is the one of the best footholds the community and industry have against hegemony and stagnation online. However other organizations can and do work towards the same goals. I'm one of the creators of Tent[1] which shares a lot in common with Persona (including some community members) but is more ambitious in many ways. In the Persona AAR Mozilla identified several reasons for Persona's failure to gain adoption[2] including that Persona " can't offer the same [as Facebook Connect] incentives (access to user data)". Tent's primary purpose is as a user data store and also supports features like address changes automatically (which Persona never did). We were fans of and friendly with the Persona team, but I believe the best solutions to these problems will come from teams that aren't afraid to think bigger than Mozilla's strategy at the time allowed. The work of federated identity solutions will continue on Tent and other projects, many of which are probably better suited for a wide variety of users and products than Persona would have been. Of course none of us have (or are likely to gain) the level of institutional (or financial) support that Persona had. [1] https://tent.io https://tent.io [2] https://wiki.mozilla.org/Identity/Persona_AAR https://wiki.mozilla.org/Identity/Persona_AAR
- username223 13y agoOkay, spammer... > Persona " can't offer the same [as Facebook Connect] incentives (access to user data)" That sounds like a feature. Gathering ever-creepier amounts of personal information to serve marginally-more-effective ads is a losing game.
- jorgev 13y agoThis sounds like a bit of cop-out, but, maybe it has a brighter future than it seems. I hope the Google and Yahoo bridges are reconsidered. On paper they're a good idea but in a practice, they add further complication and confusion to a concept that's already alien to most users.
- jdlshore 13y agoAgreed. I recently had someone who refused to sign in (after paying for a subscription!) because they thought I was asking for their Gmail password. He ended up changing his account to a different email address specifically so he wouldn't go through the Google bridge. Persona is a great idea on paper, but my outsider's perspective is that it has been very very challenging to implement in practice. The BrowserID protocol works great. User experience and login state management has been a bumpy ride. My site (letscodejavascript.com) relies solely on Persona, so I hope it thrives, but I can't help being worried at this announcement.
- dublinben 13y agoI'm a little confused at how the process could be any clearer. Just trying to register on your site, I'm asked to enter my email address. Upon providing a gmail address, I'm redirected to a Google OpenID page. It specifically says that your site will be granted access to my email address, no more. By clicking yes (without being asked to enter my password anywhere) I'm authenticated. I've never used a more simple SSO system before.
- callahad 13y agoThanks for the kind words! For most people, it works exactly like you described. Unfortunately, there are some rough corner cases for folks with multiple Gmail addresses, and the experience is less-than-stellar if you're not logged into Google at all when you start. (We do have patches ready for those issues. They'll go live as soon as we work out some deployment kinks and finish upgrading our production servers to Node 0.10.)
- primitivesuave 13y agoPersonally I think it's great that something like Persona exists. When Youtube switched over to require Google login, my comments started posting under my GMail username without any warning. When I sign into something with my Facebook account, the app will most likely ask me to invite all my friends to try out the app or post about it to my wall. An SSO that provides no information other than a confirmed email would be ideal for user privacy, but app developers implementing SSO stand to benefit from the existing social network data of their users, and subsequently exclude Persona from their SSO options.
- schmichael 13y agoDoes it really exist if no one uses it?
- eruditely 13y agoYes, aka UNREALIZED demand.
- Pacabel 13y agoPersona was launched in July 2011. It has gotten a fair amount of publicity in that time. Yet the adoption rates among websites and users are still very, very low. I just don't think that there's any significant demand for this product, realized or unrealized. People know about it, and people could choose to use it, but doing so would likely not make them sufficiently better off. Maybe that's not ideal, from an ideological standpoint or when it comes to "openness". But I think it is the, perhaps unfortunate, reality. It really doesn't make sense to endlessly waste resources on a product that has been proven to be unwanted, or at least not valuable enough to use.
- mook 13y agoPersona was launched in July 2011. It's been two and a half years, and they still haven't declared it safe to actually verify anything locally; you're still supposed to load a random Javascript file from their domain that will spawn a window with their contents. I'd have thought the whole point was to target people who didn't want a centralized system.
- sergiotapia 13y agoAs an early supporter I find this really sad. Persona is as good as dead without a big name behind it like Mozilla.
- zoowar 13y agoI find the blog disingenuous. We haven't forgotten this https://news.ycombinator.com/item?id=7243021 https://news.ycombinator.com/item?id=7243021 Why not take another stab based on what you learned.
- jdlshore 13y agoThat exact link (the Persona AAR) is in the blog entry. It's in the FAQ under "Why has Mozilla stopped funding new feature development on Persona?"
- pekk 13y agoI had an idea they were going to kill Persona. Without Mozilla to really champion it, it's dead edit: so, anyone have a near alternative, that is open source, to invest time into that either will get browser uptake, or won't need it?
- callahad 13y agoI'm curious as to why you think Persona, which is Free & Open Source Software, can't be that alternative?
- mixedbit 13y agoI disagree. Persona piggy backs on email system so it doesn't need a critical mass of users to be useful. Persona as a brand may not become widely recognizable with limited involvement from Mozilla, but some people argued from a beginning that it was a mistake that Mozilla tried to create a recognizable brand. The team succeeded at creating smooth email verification system. As long as Mozilla keeps servers running, quickly solves security issues and accepts patches with improvements from community, Persona will be used. I strongly believe it will organically grow and eventually will become a crucial part of the open web.
- beefman 13y agoWe don't deserve a technology as good as Persona.
- ryanseys 13y agoAs a former Mozilla intern whom worked directly with Identity team on a daily basis last summer, I can say that this indeed hits close to home, though not unexpectedly so. I could see this coming. The Identity team has so many weird and wonderful things on the way for the broader Firefox audience that transitioning it to the community only makes sense. I for one can't wait to see what the open source and HN community does with Persona and also can't wait to see what comes out of the Identity team as a result of this transition of focus.
- ENGNR 13y agoI think the landing page needs more work. Show me how to integrate it with a simple code snippet on the front page (and if it's not simple.. it needs to be). Honestly my eyes glazed over a little bit looking at the implementation details. Clearly it's not that hard, but the second thing is motivation which leads to.. Show me a video on the front page of how simple it is for users to login, and how any server can act is the authentication provider. It's too hard to understand the need. I guess these are just personal suggestions but I think UX is the only thing holding Persona back.
- MarkMc 13y agoTldr; Persona is dead
- davidgerard 13y agoThe phrase "transitioning to community ownership" - which always means "we are dumping this" - is too odiously weasely for an otherwise respectable organisation such as Mozilla, and I do wish they'd stop using it.