1. Mike on August 22, 2004 01:56 PM writes...

From your earlier reply to my post:

"The 'tapping' into other networks by Multiply is not wrong, per se,"

Again, no. Like I said before, the spam situation, while annoying and interesting in a different way now that it's in a Social Networking context, is not really the worse part of this Multiply business. Hopefully I can be clear in this post about why I think that.

I'm not totally sure that you (or other people posting about this Multiply business) is totally understanding what the real evil is here.

Multiply is not just 'tapping' into other SN networks (Orkut, Friendster)...they are *mining* them.

For example, when a new Multiply user "imports" their Orkut profile, they give up their username and passwd, and Multiply's servers log into Orkut as them. Let's skip right over the fact that that action is absolutely in violation of Orkut's Terms of Service, even *before* any messages are being sent.

The user is then presented whith their Orkut contacts, and given the option to invite them (i.e. send messages, via Orkut's messaging system, which a second violation of Orkut's ToS) or not. Let's say that I am one of those invitees. Multiply now knows the relationship that exist on ANOTHER and DIFFERENT social networking service, of me, and my soon-to-be ex-friend.

Why is this evil ? Because it doesn't matter whether or not those invitees actually sign up with Multiply. It doesn't even matter whether or not he chooses to invite ANY of his Orkut contacts...Multiply now knows that a relationship exists, between him and his Orkut contacts, without having a challenge-response mechanism that Orkut had to go through to make those relationships explicit. Not only *that*, but does anyone think that Multiply will just discard those Orkut contacts and (user IDs) that have been sucked out of Orkut ? I seriously doubt it. They now have the user IDs of Orkut users who have explicitly made their relationship/contact known to Orkut.

Re-read that last sentence again. The absolute number one information that Social Networking Services have is *not* the profile information, but the data on HOW THOSE PROFILES ARE CONNECTED.
Yes -- it is what they call the "family jewels" of social networking.

About the work that Multiply is not doing to earn their users: On Orkut, in normal Orkut fashion, someone on Orkut asks to be my friend. I have the choice to acknowledge that relationship or not. Multiply doesn't even GIVE me that option when Orkut contacts are imported.

Relationship/contact information is *private*, and is not private, if my friends give away my private information, and that information includes who I am friends with.

I'll end with an analogy that I think can help:
The Hollywood rolodex of a movie producer is valuable for 2 different reasons. One reason is the actual data that each rolodec entry contains; that is the beef that you are making here...it would make a hell of a great spam list, and I agree.

My point is the second reason, which is much more subtle, but I think much more important: one Hollywood rolodex won't just give you numbers of famous people....but

A) how MANY famous people, per rolodex
B) given enough (not that many) rolodexes, you could guess the contents of many more rolodexes without ever having to obtain them.
C) given enough rolodexes, the contact info becomes less important than the relationship between each rolodex, which is much much more exploitable.

In the network security world, Kevin Mitnick would recognize what Multiply is doing as getting pretty close to a hacking/cracking technique known as "social engineering". And he should know why that's bad.

2. Stowe Boyd on August 23, 2004 09:39 AM writes...

Response to various points you are making:

You wrote "For example, when a new Multiply user "imports" their Orkut profile, they give up their username and passwd, and Multiply's servers log into Orkut as them. Let's skip right over the fact that that action is absolutely in violation of Orkut's Terms of Service, even *before* any messages are being sent."

This is the analogy to using a Trillian or Gush 'multi-headed' IM client, which taps into the public IM services in violation of those networks terms of service. And I maintain, that, per se, acting as a proxy on my behalf, Trillian is not doing anything evil. Nor is Multiply... at least not yet.

You go on to argue (I think) that pulling that information from Orkut and placing it into Multiply automatically subverts an explicit agreement between the various contacts and... who, exactly? If I use Multiply to pull the information and then paste those contacts' information (email address, etc) into Multiply, who is breaking what agreement? Perhaps me, if I choose to do so?

Now, if Multiply uses that information for its own purposes -- like spamming people to join the service, or selling it to advertisers -- that is wrong, and I am opposed to it.

Perhaps the central issue in here is 'who owns information about a relationship?' Do both parties have to agree that a relationship exists, by explicitly agreeing that they are 'friends' or whatever? Certainly, I have stated that all SNAs should provide an opt-out at every step of every process, so that someone can assert 'while Stowe might have my email address, he is no friend of mine!' I also believe that SNAs should provide finegrained whitelisting and blacklisting for users, and complete opt-out for those who wish to be non-users, which should satisfy everyone;s concerns.

I understand your concern, which is this, I believe: Multiply crosses a line when it provides an easy mechanism for one party to copy contact information (degree of relationship, email address, etc.) from another SNA which was collected through the agreement of the other parties, and which was presumed to be used only in the context of that other SNA's safeguards and security provisions. Is that it?

This is -- by the way -- one of the arguments that the public IM providers level against the 'rogue' clients like Trillian, by the way. Being someone's 'buddy' means a specific set of safeguards in Yahoo, for example, which could be subverted through the use of a different client.

But the benefits of multi-headed clients are so great, and the reluctance of the public IM networks to move toward interoperability has been so egregious, that I have come to believe that the loss of safeguards is a small price to pay.

Ultimately, we will be confronted with similar issues in SNAland. Each SNA will have no incentive to allow interoperability (or export of profile, contact info, etc.) because it lowers the cost of moving to other services for the individual. But individuals will want to duplicate information entered in one service to another, even if it includes (or specifically in order to include) relationship information that what agreed to by other parties in the context of a specific service.

And just like the recent court decision that ruled that various peer-to-peer services were not guilty of copyright enfringement because their services enabled individuals to circumvent copyright of digital media, the same thinking should hold here. The individuals are to blame if they misuse the information, not the service. Note again, I agree with your objection to the service using the contact information for its own purposes -- that's spamming, plain and simple.

But people will want to be able to manage their networks as if it were one network not a dozen partitioned and closed networks.

3. Mike on August 23, 2004 01:08 PM writes...

Excellent insights, and I agree with all your points, even the issue of "blindness" with regards to the P2P analogy. Knives don't kill people, people kill people. :)

Also, I do agree and see that people would like a central management point of their social networking, as Marc Canter will remind every visitor to his blog, every day, till the end of time. (referring to FOAF) But until each of the Social Networking sites figure out a way to place quality or characteristics on a connection (work ? romantic ? family ?) then I don't see that consolidation happening anytime soon at all.

All that said, I'm not 100% sure that I've worded my concerns in the best way either, because I still feel as though a point I'm trying to make isn't really coming across very well. At this point I'm also feeling like I'm hogging this comment space, so I'll make this my last feeble attempt to word my concerns. :)

Ok, I think here's where I think that possibly the IM/Trillian analogy doesn't work. Anyone can IM someone else, and how those people are connected are not at all made explicit. It's like a telephone. Now of course one can look at the amount of communication between certain parties and infer some relationship, but it's not the same as Friendster or Orkut, where that is the whole premise of the six degrees deal.

Eurekster (and along with it, Friendster) uses that explicit connection information in an attempt to improve web search. It's not the contact or profile information at all, but the connection made between people, that is the most important property with Eurekster. On Friendster, a web search (done thru Eurekster) are not going to affect/improve the search of someone outside my network, only those *within* it.

Eurekster is just one of the first attempted applications that make the actual connection, and not the node, important and valuable. Having such a non-reductionist or holistic view of the social network is what I believe will become valuable in as SNs getter better at exploiting it. Another example is the application of whitelisting email based on your network of friends. Yet another example being looked at is a referral system based on explicit contacts for sales. Companies like Spoke are researching these sorts of applications that exploit not just the individual profiles of people, but the connections graph *between* them.

Indeed, in those situations, (Eurekster, spam-blocking, Spoke, etc.) the contents of user profiles aren't important whatsoever.

In graph/math terminology, it's not the nodes, it's the *edges*, that are important. This is what I oppose in Multiply...that Multiply is gaining not just the NODE, but also all of that node's EDGES, by importing from Orkut, and there is nothing I can see that prevents them from using that information to their advantage. Like you said, spamming would be an abuse of that, of course, and that would be bad/evil, etc. But think of the possibilities that could happen if they exploit the edges of that network, which can be completely INVISIBLE to the users, and without their permission ?

You are 100% correct that Multiply's servers only get Friendster info about a user's friends on a human-initiated request from a Multiply user.

I think that I'm just stressing the question that you posed, 'who owns information about a relationship?' but I want to point out that it can and should be thought of in the light of the connections themselves, not just the user's (email/contact info) data.

Ok, I'll stop now with the blathering. Thanks for giving up the bandwidth to serve up my comments. :)

4. Scott Allen on August 26, 2004 02:15 PM writes...

How about simply "SNAs shouldn't make it easy to do things that are a really bad idea -- socially inept, if not downright illegal."

For example, it's a really, really bad idea to send the exact same canned invitation to your entire contact list. SNAs think they're making it easier on their members to invite more people, but there's an unintended consequence of creating social ill-will both for their members who do that and for the sites themselves.

I contend it's a really, really bad idea to send almost ANY message -- commercial or otherwise -- to all your friends of friends.

I know some prefer the Darwinian approach -- those with poor practices will simply not succeed. The only problem is, there's no disincentive. There's little or no negative feedback for them, at least in most SNAs. They simply don't get results, and you have to hope that they eventually tire of a lack of results and leave. In the meantime, the rest of us have to wade through all that noise.

I tend to take a fairly libertarian approach -- let people do what they want -- minimal restrictions. You still don't hand them a loaded shotgun, e.g., the ability to send a generic mail to everyone they've ever met electronically. Bad idea.

On another note, Mike's point about quality/characteristics of relationships being a requirement for interoperability is right on. It will also have to have an indicator of relationship strength. For example, on Ecademy, you're "connected" with someone once you've had a bilateral exchange of private messages. That's very different than, say, the confirmed strong relationships many (not all) people use LinkedIn for.

I believe it's also a requirement to have granularity of exposure of that data, e.g., you may not choose to expose your personal relationships in a business context, and you may not want to show your real name or your employer in a social/romantic context. This is what danah boyd has written so much about regarding segmented identity.

Until that is addressed, interoperability isn't going to go mainstream. And FOAF (at least in its current incarnation) can't meet those needs.

- Scott -