XAuth – a Terrible, Horrible, No Good, Very Bad Idea(hueniverse.com)

XAuth – a Terrible, Horrible, No Good, Very Bad Idea

http://hueniverse.com/2010/06/xauth-a-terrible-horrible-no-good-very-bad-idea/

4 comments

Other terrible, horrible, no good very bad ideas include toolbars that fly out on page load and pop ups that ask you to read some message that i completely ignored while I tried to hit the 12x12px 'X' button in its top right corner.

Otherwise, great article. I need to remember to click that new Safari 'Reader' button.

jrockway16 anni fa

Yeah, I added the site to adblock after I saw that popup. Not cool. If I like your blog, I'll remember to promote it on my own. Now all I remember about the blog is that the author is a douche that reads too many "you should follow me on twitter" articles.

tedunangst16 anni fa

In case you read comments before stories, no, this is not the xauth you're likely thinking of.

_pius16 anni fa

Really? Which one were you thinking of?

krakensden16 anni fa

Ahem: http://www.x.org/archive/X11R6.8.1/doc/xauth.1.html

_pius16 anni fa

Heh, I guess what "you're likely thinking of" depends on your frame. I haven't thought of that xauth in years ... never occurred to me that someone might decide all of a sudden to start bashing it today.

dotBen16 anni fa

Although I agree with Eran, in the interest of balance let me also link to John Panzer (of Google, but writing independently) who tries to address some of Eran's concerns:

http://www.abstractioneer.org/2010/06/xauth-is-lot-like-demo...

papachito16 anni fa

Even Googlers agree with Eran, xauth is just a temporary solution, the real solution should go into the browser, maybe with a API that is xauth compatible. Mozilla is already working on those ideas.

edit, from another googler: http://www.google.com/buzz/dclinton/RcW6X3EjKj1/John-Panzers...

> John Panzer's take on the XAuth project is pretty much spot-on. It's not that XAuth is what anyone wants for the ultimate answer in this space. > Rather, XAuth is a short-term way of pushing for any momentum in this direction.

> There are a number of companies leading it, btw:

> MySpace: http://xauthdemo.myspace.com/

> Microsoft: http://xauthdemo.mslivelabs.com/

> Yahoo: http://developer.yahoo.net/blog/archives/2010/04/xauth_oauth...

> Etc., etc. (Eran suggested this was Google-led, which didn't quite strike me as accurate, given that Yahoo, Microsoft, MySpace, etc., were all as involved as Google was.)

> For more background on XAuth, I did a round-up of the various announcements and responses during the XAuth launch:: http://www.google.com/buzz/dclinton/CYgLcs24yqP/

nailer16 anni fa

Oh dear. Computing sometimes has naming conflicts, but choosing 'xauth' as your authentication scheme when there's already an authentication scheme named xauth?

> Security guy 1: xhost is deprecated. use xauth.

> Security guy 2: xauth? But that's reliant on whoever controls a single domain.

> Both: ???