Windows Live Quantum Mechanics : MIX07

MIX07 UK Podcast with Craig Murphy

dthorpe — Mon, 24 Sep 2007 20:37:18 GMT

I sat down with Craig Murphy to chat about Windows Live and life in general at MIX07 UK. Craig has just posted a podcast of that conversation.

I've known Craig for many years through the Delphi community. I think we first met in person in 2001 at "The Delphi Conference" run by the Borland User Group UK. Aha! Found a photo. Craig got his start as one of the pillars of the Delphi developer community - particularly at the Scottish end of the isles. Today he provides much the same community organizing and informing service over a much broader swath of tech topics as a Microsoft MVP.

Windows Live Web Controls Mix07 Video

dthorpe — Mon, 18 Jun 2007 21:40:23 GMT

In the better late than never department, a video interview with Koji and me from the week prior to MIX07 is now posted on Channel 9: http://channel9.msdn.com/ShowPost.aspx?PostID=317385

Yay! Thanks Catherine for pushing it on through.

MIX07 Speaker Interviews on Channel 9

dthorpe — Mon, 07 May 2007 05:35:00 GMT

Video interviews of many of the MIX07 speakers are posted up on Channel 9. I think most of these were filmed before MIX and released during the event. Koji and I were interviewed by Catherine Heller here.

MIX07: POST/GET/PUT/DELETE Your Way To Windows Live Data

dthorpe — Thu, 03 May 2007 22:38:00 GMT

Martin Heller posted an article on Infoworld, "Data Wants To Be Free," about the Windows Live Data "secret session" at MIX07. The Windows Live Data service (probably not its final name) enables a deeper level of integration and data access than the devlive web controls, but still maintains user control over access to user data.

The Windows Live Contacts Control and Windows Live Spaces Control are designed to be super simple to drop into an HTML page and wire up with a minimal amount of JavaScript code. Easy easy easy. The controls provide prepackaged UI, take care of user login, and pass back to your page just the data that the user has chosen to use with your web app. The controls are stateless in that they don't remember any sort of relationship between your web page and the end user. Each time the user selects data to send to your web app, the controls will prompt the user to confirm the data transfer. The controls require nothing from you but an http file server - no server side execution required, so they can be used on even the most minimal, shoestring budget hosted domain.

Windows Live Data enables your web application to establish a lasting relationship with the end user. The user can choose to allow your application to access their Windows Live data without constant confirmation prompts. Your web app can make server-to-server calls to read or write the user's Windows Live data. To prove that you have the user's permission to do this, your app includes a token in the request that was issued to you by the Windows Live Data service when the user approved access for your app. The user can revoke that permission at any time by going to a Windows Live page and removing your app/domain name from their approved list.

Windows Live Data imposes no UI on your application other than the initial granting of access permission. (Your site directs the user to Windows Live to approve access for your app, then Windows Live redirects back to you) Your app is trusted by the end user, and has unhindered access to the data the user has granted your app permission to use.

More Control, More Work

The price for this deeper data integration is that you need to write more code than the super easy Windows Live web controls require, and you'll need more from your web server than just http file serving. It's pay for play. If you want full control of the UI and seamless integration of the user's data into your web app, you'll need to work a little harder to get it. Because you'll need to remember the user's id and the authorization token issued to you by Windows Live Data, you'll most likely need server side storage for your web app. You definitely don't want to leave that token lying around in persistent browser cookies. You'll probably use server-to-server calls to access the user's data via Windows Live Data service, so that means you'll need code execution capability on your web host. If you're running your own server farm, that's probably a no brainer, but if you're on a shoestring budget using a hosting service you'll probably pay a little more for your web hosting to include server side script execution. Windows Live Data does not require ASP.NET on the server - it's usable from anything that can drive http requests and responses.

There are multiple ways your app can present itself to the Windows Live Data service to prove that you are indeed the app that the user authorized for access to their data - authorization tokens are one path. Mutual SSL (server to server) is another option.

Knowing Your Costs At Scale Before You Get There

How much will direct access to the user's Windows Live Data cost you? Nada. Nothing. Under the new unified terms of use announced at MIX07 this week, you can use Windows Live Data service for the Contacts API in your application for noncommercial and commercial purposes for free up to a threshold of one million unique users per month, averaged over 3 months. That's not one million API calls, not ten thousand users visiting your site a thousand times each, not even a million unique users accessing your site - it's one million different user ids seen by the Windows Live services in API calls from your site. You may have 2 million users running around on your site, but if only 1/3 of them are using a feature that touches Windows Live Data services then you're not at the 1Muu threshold yet.

What happens as your app grows in popularity to beyond that 1Muu threshold? That's the point at which you'll need to have a chat with Microsoft about a suitable "exchange of value". One way for your app to provide an exchange of value with Windows Live is to serve Microsoft AdCenter ads in your app. If you aren't interested in putting ads on your pages, or you feel you can get better return from some other ad system, you could choose to just pay for your service usage outright: 25 cents per unique user per year, calculated quarterly. Other options are possible, but those are two baseline examples.

Worried that these terms may change in the future? Lock the terms in with a service contract. Microsoft also announced this week that service level agreements including multi-year service contracts will be available for Windows Live services in 2008. So you can bet your business on a set of Windows Live services, get a commitment in writing from Windows Live, and use that contract as an asset in growing your business. Venture capitalists, for example, like to see supply chain contracts in place in a startup to minimize the risk of costs spiraling out of control as the startup scales up in volume. A multiyear service level agreement is not going to be free, but it's cost effective way to hedge against future unknowns and establish a beachhead of stability in this chaotic industry. It's also what entrepreneurs have been asking for - a way to lock in service guarantees and pay down business risk.

The specific details mentioned here are for the Windows Live Contacts API, a service of Windows Live Data services. The thresholds for other Windows Live services such as Silverlight Streaming, Virtual Earth maps, or Windows Live Search queries will vary slightly due to the different nature of the services (Search doesn't involve logged in users, for example), but the concept across the board is the same: free usage for noncommercial and commercial purposes up to a well-defined threshold of "significant" activity beyond which an exchange of value is needed. Simple baseline terms for exchange of value (such as serving ads or paying for usage) are clearly defined well in advance so that you don't have to worry about shakedowns just as your business begins to take off.

mix07

Watch the video of this session

MIX07: Extending the Browser Programming Model with Silverlight

dthorpe — Wed, 02 May 2007 20:34:00 GMT

Silverlight implements isolated local storage on the client. Currently in the Alpha, the storage is limited to 1MB per web application and is keyed to the full URL of the XAML/HTML page. That means for this alpha release, two pages that are part of the same application served from the same domain will have separate isolated storage. In later beta releases, support will be added to allow configuration of isostorage quotas by users or corporate configuration profiles.

Isolated storage is stored outside the browser cache. This suggests to me that the lifetime of the data in the isostorage is independent of the browser cache settings - isostorage won't be wiped out when the user clears the browser cache.

Silverlight running in different browsers on the same machine will use the same isostorage area on the machine. If the user fires up your Silverlight web app in Safari on a Mac and your app writes something to isostorage, then if the user later fires up your Silverlight web app in Firefox on the same Mac, your app will find the data it wrote into local storage earlier in the Safari session.

Isolated local storage is not strictly protected on the local machine. It's stored in the hidden App Data subdirectory in the user private directory. A determined user can drill down into this directory and possibly muck with your app data files. If you're wanting to write sensitive data to the isolated storage that you want to trust has not been mangled by the user, you should consider encrypting the data.

Silverlight provides scriptableobject wrappers for managed code to access JavaScript objects and DOM elements, properties, etc. When serializing JavaScript data into managed code, you can use CLR generics to instantiate the JavaScript data in strongly typed collections on the managed side. (strong types! generics! compiler-checked code! Yay!) For example, instead of implementing a GetProperty method that returns integer, and another one that returns double, and another one that returns strings, they've implemented only one GetProperty method as a generic method whose type parameter defines the return type you want back. foo.GetProperty<string>("name"), for example.

In the current 1.1 Alpha release, directly calling from managed code into JavaScript is not yet implemented. However, managed code can invoke events that will fire on the JavaScript side, so you can at least cobble together a way for the managed code to invoke code on the JavaScript side until the real method invoke marshalling is implemented. JavaScript can call directly into managed code that is tagged with the scriptable attribute.

Silverlight provides an OpenFileDialog functionality. It manages the UI of prompting the user to select file(s) on the local system and providing them to Silverlight code. The UI uses the open file dialog of the native OS, so that Mac users see Mac file open behaviors while Windows folks see Windows File Open dialogs.

The filenames returned by OpenFileDialog are stripped of all path information to minimize accidental disclosure of sensitive info that might be embedded in the file path, such as the user's login id.

Files selected by the user and returned by OpenFileDialog can only be opened by Silverlight code in read-only mode. This is also for safety reasons. Neither OpenFIleDIalog nor isolated storage ever allow web app code to write to arbitrary locations on the local machine.

MIX07

Watch the video of this session at MIX07

MIX07: Bat Signals and Five Minute Field Ops Centers

dthorpe — Tue, 01 May 2007 21:59:28 GMT

I apologize for cutting short my live/raw soundbyte blog post on the MIX07 keynote yesterday. I was literally called out of the keynote (audience) to fix an issue caused by a server update-in-progress back at the office. IM's went out to the team at MIX (the "bat signal" reference) to convene in Koji's hotel room, pronto. Save post, close laptop, exit stage right. The server issue was resolved in less time than it took to power walk from the Venetian conference center to the hotel room / makeshift ops center. Why do the conference centers have to be on the far side of the shopping mall and casinos?

Even after telecommuting to Redmond from California for most of the past year, it still strikes me as pretty cool that, short of total hardware (or power) failure, with a good Internet connection we can set up a field command center in a matter of minutes and fix just about any service problem from any location in the world.

Of course, the downside to all that is when the cabana boy shows up at your beachside sand chair with the big red phone. You have to get pretty creative to take a vacation where work can't follow. We are neither shackled to the desk nor entirely free in the field.

And people ask me why I go to so much trouble to travel to such strange and far away places...

Icebergs in Gerlache Strait, Antarctica

MIX07

MIX07: Silverlight Supports Dynamic Languages (Iron Ruby, Iron Python, JavaScript)

dthorpe — Tue, 01 May 2007 21:17:35 GMT

Josh Holmes has a great summary of the Ray Ozzie / Scott Guthrie keynote yesterday. Towards the end of his post, Josh notes with shock & awe that Silverlight not only includes a .NET CLR execution environment, but also the Dynamic Language Runtime as well. Yes, it's true! You can write apps for Silverlight using dynamic languages such as Iron Ruby, Iron Python, and managed JavaScript!

MIX07

MIX07 and Silverlight in Technorati Top 10

dthorpe — Tue, 01 May 2007 20:48:01 GMT

Chris Woodill noticed that the MIX07 event and Silverlight announcements are creating ripples in the blogsphere. MIX07 and Silverlight are in the top 10 searches on Technorati!

MIX07

MIX07: Windows Live Platform Beta

dthorpe — Tue, 01 May 2007 19:39:00 GMT

Live & raw notes from Brian Arbogast's keynote: (watch the video)

"Today we are announcing the Windows Live Platform Beta"

Simple and consistent terms of use across the Windows Live service spectrum

Predictable costs at scale - so that you can plan your business growth with high degree of predictability

Windows Live Web Services evolving from "first party applications" such as Messenger, Hotmail, XBOX Live into reusable and recombinable service offerings to support 3rd party applications such as social networking, rich media, mashups, and enterprise applications.

What can you do with the Windows Live Platform today, at MIX07?

Combine video, photos, contacts, maps, and search into web applications. Broad spectrum of engagement: you can drop web controls into your web app with just a few lines of JavaScript and be up and running in a matter of minutes, and/or you can dive a little deeper to access service APIs directly and define your own UI and process flow. A little more work for a lot more options.

User Controlled Privacy Model. Users have control over what applications can access their private data, and can revoke that access at any time.

Easy to Understand Business Model

Apps can use Windows Live services for free up to a point of "high traffic". As app usage grows beyond that threshold, seek to find "exchange of value" for service usage - app use of Microsoft ads, or pay per unique user. Example: For Spaces Photos and Live Contacts: Unlimited use of Web Control. For direct service API use, free up to 1 million unique users per month (avgd over 3 months). Past 1Muu/month, apps can either provide exchange of value with Windows Live by serving Microsoft AdCenter ads, or by paying 25 cents per unique user per year. Similar terms with threshold variations for Silverlight, Virtual Earth, Search.

The intent of the threshold is to nurture adoption and help applications grow at scale. The clear and simple cost structure beyond the free threshold makes is easy / possible to build a solid business plan that extends from zero all the way out to wildly successful Internet killer app with tens or hundreds of millions of active users. Knowing your costs up front is critical to structuring your revenue streams so that your business can be as financially successful as your app grows in popularity.

PhotoBlugBlog - Koji showed the PhotoBugBlog travel journal that we "wrote" on stage in yesterday's 30 Minute Social App session. I'll blog more on that later today.

Match.com dating service - early pioneer in the social networking. As an industry, online matchmaking is responsible for nearly 10% of all marriages in the United States. Match.com alone responsible for 400,000 marriages per year. 60,000 new match.com customers per day worldwide. 55,000 anonymous emails sent between customers each month. Looking for new ways to communicate, anonymously. "winks" - one way anonymous message. Match.com partnered with MSN Dating & Personals

Match.com technology: Microsoft shop. Windows OS / IIS web platform. .NET development environment. SQL server databases. Significant platform size and scale. Top 50 site in the English speaking world. 1.5 billion page views per month globally. "a lot of people looking for love, globally"

Improve user engagement, development new communication tools, anonymous environment, use presence. Everything through "double blind" anonymity systems.

match.com online demo. customer A can communicate with and see presence of customer B via Messenger even though customer A is not logged into Messenger and customer B is not logged into Match.com. This is done using back-end Messenger service APIs used by Match.com. (No messenger API announcements today, but clearly something is cooking in the labs)

Q&A:

Q: Is Virtual Earth licensing still based on tiling? It's very hard for us to plan our business costs around this tiling model.

A: We've simplified the Virtual Earth terms a bit already, but there is still an element of tiles served. That's sort of representing our back-end cost structure for the images we license, but you're not the first to ask this question. We'll continue working on simplifying the Virtual Earth licensing even further.

MIX07

MIX07: Social Mixing

dthorpe — Tue, 01 May 2007 09:12:00 GMT

I bumped into Anders Hejlsberg in the speaker's lounge this afternoon just before my 4:30 presentation. He was at Mix to talk about LINQ, and probably on hand to provide Silverlight air cover. He asked how things were going now that I had a full year under my belt at Microsoft. My reply was to show him the WL Contacts control and Spaces control in the 30 second elevator pitch. He was curious about the cross-domain communication trick we've developed. We both had to head off to our respective sessions, so I'll have to follow up with him on that.

Speaking of which - keep an eye out for the June issue of the The Architecture Journal 12 #6. I've written up some notes on secure client-side cross-domain communication using the iframe URL technique, it's weaknesses, and how we've addressed them in our Windows Live Contacts and Spaces controls.

After our dev live session (The 30 Minute Social Application, with Lynn Ayers and Koji Kato), I bumped into Chuck Jazdzewski in the hallway. Chuck wasn't presenting a session at MIX, but was on deck to field questions about XAML designer work that he's been working on in the Visual Studio group (applicable to Silverlight, I believe). I was trying to keep up with my team to get in on the dinner plans, and he was trying to do the same with his team, so we hardly had time for a score of words before we lost our respective dinner groups. S'ok, I have lunch with him in Redmond every month or two.

Hardly 20 seconds after seeing Chuck, I bumped into Miguel de Icaza outside the speaker lounge. Man, this place is crawling with power hitters. I met Miguel at the first non-Microsoft .NET development conference (.NET ONE) in November 2001 in Frankfurt. It was a somewhat smallish event, so we speakers ended up spending most of the time talking to each other between sessions, over dinner, etc. Miguel was there for Mono, of course, and I was there to make the first public presentation of Delphi for the .NET platform. (a very early alpha compiler, but it was enough to show IL codegen and compile a writeln app)

Miguel was of course orbited by all manner of fans and friends, so we said hello and made a mental note to try to hook up again later to catch up.

In the speaker lounge, I mentioned to my devlive coworker Galo Corvera how cool it was to see Miguel at MIX. Galo's response: "Miguel de Icaza? THE Miguel de Icaza? WOW!" So naturally, I dragged Galo out into the hallway and introduced him to Miguel. Though Miguel protests loudly, there is no escaping the fact that he is an icon within the open source community in general, and nothing short of a cult hero in the software development community of his homeland, Mexico. Galo was gobsmacked. Ah, such fun. :P

John Lam of Ruby on Rails fame was spotted at dinner just outside the Venetian conference center. Said hello to Julia Lerman on the escalator between floors. (She's already checking out ink support in Silverlight!) Donovan West caught in passing.

Last but not least, I was pleased to see Yousef El Dardiry in the audience at our session this afternoon. Yousef recently made MVP recently, finally. He's won or placed in just about every coding contest Microsoft has come up with for the past two years, but he's been excluded from MVP recognition due to age minimums required by the MVP non-disclosure agreement. Well, his birthday was a month or so ago, so he now has his long-deserved MVP badge. Congrats Yousef!

Tomorrow morning, Brian Arbogast (Windows Live Developer Platform VP) will kick off day 2 with a mini-keynote rolling out new unified terms of use and cost-at-scale across all the Windows Live service offerings. I call it a mini-keynote because it's actually a breakout session alongside other sessions, but it's in the keynote room and is expected to draw a capacity crowd. Anyone wanting to build a business on Windows Live services will want to be there.

After that, the buzz is building about the "secret session" that isn't listed on any of the printed schedules, nor on the billboard at the room entrance. We unequivocally cannot confirm or deny that it may or may not be scheduled at 11:45 in room Lando 4204, entitled "Windows Live Data services" and presented by the devlive team's king of privacy paranoia, Yaron Goland. We deny any involvement in annotating the room signage with a sharpie of unknown origin.

The session is real, but it was withheld from the printed matter to avoid showing our hand too early. It is actually listed in the online schedule. I can't tell you about it (yet), but it should be a knockout session. Maybe not quite as sexy as spinning video cube Silverlight eye candy, but I'm sure it'll get a rise out of the true data diehards who manage to actually find this session.

What am I going to do after MIX? Take a little break, build a few thousand feet of steel pipe fencing at the homestead, and then perhaps get cozy with Silverlight to see how it can be used to assist and accelerate our JavaScript web controls under the hood. I doubt we'll take the hit to rewrite the Contacts or Spaces control in Silverlight, but it seems very likely that one of our next web controls might be built first in Silverlight.

MIX07

Blogging in my own session

dthorpe — Tue, 01 May 2007 03:00:00 GMT

Live blogging during our 30 Minute Social Application. I'm not in the audience, I'm presenting the session!

Watch the video of this session

MIX07 Keynote: Silverlight With Cross-Platform .NET Runtime

dthorpe — Mon, 30 Apr 2007 22:21:00 GMT

Soundbyte streams from the MIX07 keynote, live and raw:

Ray Ozzie on platforms, emergence of rich web apps doesn't mean stand-alone client apps are going away. Some apps are best viewed as services with client component, other apps are best viewed as client apps with server components. Shrink wrap isn't going away, but is likely to grow into server side extensions to the app's capabilities.

Scott Guthrie: Silverlight was announced a few weeks ago as a rich media technology. Today at MIX07, Silverlight gains a new cross-platform .NET CLR runtime optimized for fast web download and execution in the browser - IE, Firefox, and other browsers.

Silverlight Streaming: developers can use Microsoft's extensive content delivery networks to deploy Silverlight content / applications over the web.

Netflix (Neil Hunt) & Razorfish showed an online movie viewing experience built on Silverlight. This is Netflix's holy grail of moving movies on demand over the Internet. ("instant watching")

Netflix viewer built with Expression Suite, passing XAML to devs.

Netflix viewer built in less than 3 weeks! Razorfish got the call to start working on this app only 3 weeks ago.

Netfix (Silverlight) movie player running on a Mac in Firefox.

Shared viewing: invite friend to view same movie as you, movie playback sync'd. IM messaging while movie watching

{Hmm... Great opportunity to build your own MST3K peanut gallery movie viewer}

Wayne Smith on Expression Studio

Designer support for Silverlight

Video prepared for the web: Expression Media Encoder

Drop time markers that can be referenced by code

A/B compare mode to compare video playback between source and compressed output. Playback sidebyside

Silverlight template selection in encoder

Expression Design

export designer sets to xaml, silverlight style

Expression Blend - to bring together design elements and code elements

showing Blend 2.0. masking video with borders, artwork

switch to animation mode

Configure fly-ins, fade-ins on timeline. Set video player to fade in at startup.

Awesome stuff!

Woops... bat signal. Gotta go put out a fire. BBL.

MIX07

Windows Live Spaces Control Launched

dthorpe — Mon, 30 Apr 2007 10:12:16 GMT

I'm pleased to announce the availability of a new client-side web control for accessing Windows Live services: The Windows Live Spaces control! This control enables web visitors to use photos stored in their Windows Live Spaces photo albums with third party web applications.

It's a "photo picker" - the control is not for displaying photos on a third party site, but for selecting photos and obtaining URLs that point to the photos in Spaces storage. You'd use it like a File Open common dialog to select photos to include in blog posts, web pages, documents, or to designate a photo to use with a third party vendor service such as printing photos on mugs or shirts.

Following the same pattern as the Windows Live Contacts Control, you use a pseudo HTML element tag "spacescontrol" to place the Spaces control on an HTML page and then fill in attributes to specify options and operations. The JavaScript you need to include in your app has changed slightly: you need to include http://dev.live.com/scripts/v0.2/live.js and http://dev.live.com/scripts/v0.2/controls.js on the page that has the "spacescontrol" control tag. In previous releases of the Contacts control, the second file was control.js (singular) and was located in a different directory. We've done a little housekeeping and consolidated the control discovery and bootstrap code into one file that will handle both the Contacts control and the Spaces control, and other controls in the future.

Also like the Contacts control, the Spaces control requires a privacyStatementURL as a parameter. Many countries now have laws that require that application and web site developers must provide full disclosure to end users about how the app is going to use, store, or modify the user's personal data, including photos.

Specify what kind of data you want back in the "dataDesired" field. Your field choices are fileExpiringURL and fileAccessControlledURL.

A fileExpiringURL is a time-limited URL that enables the user to make a specific photo available to a third party, even if the photo is marked as private or only visible to the end user's friends. You'd use this in scenarios where the third party needs to see the actual photo rather than just keeping track of a URL, such as when the third party is vendor who can print your photos on mugs or t-shirts.

A fileAccessControlledURL is a URL that respects the user's access control settings for a given photo. Any app can keep the URL as long as they want, but if the photo is marked as visible only to the user's friend list, then only the user's friends will be able to see the photo, after logging in with LiveID. If the user's photo is marked as visible to everyone, then of course there would be no restrictions on the URL. If the user later changes the permissions on a photo after a URL has been handed out, the URL will respect the new permissions immediately.

You'd use a fileAccessControlledURL in situations where the third party app doesn't care what is in the photo, but only passes the URL through for others to use, such as when inserting photo URLs into a public blog post.

The rest of the Spaces control fields are pretty much the same as for the Contacts control - channelEndpointURL, onSignin, onSignout, onError, and market.

HTTPS Contacts Control

Also as part of this 0.2g release, we've updated the Contacts control to support end-to-end https, so that the control can be used on https web pages without raising any of those annoying "This page contains secure and nonsecure items" warnings. With this update, the list view of the Contacts control runs "clean" in https in IE7, Firefox 1.5 and Firefox 2.0. The tile and tilelist views need more work before they'll be https ready, and IE6 still displays false positive security warning in the list view.

Anxiety of Activity

It's been a hectic two weeks. Prepping an update to the Contacts control, an all-new release of the Spaces control (dependent on a new release of Spaces storage that went live only a few days prior), and writing demos and presentations for MIX07 (which, by the way, requires the satisfactory completion of the first two items) have taken their toll. Naturally, just when we thought we were done, some gremlin runs amok through everything and we're back to doing line by line code reviews and destructive debugging to try to figure out what's failing and why. I learned a lot about how to break https this round!

Time to MIX it up!

I'm actually blogging this from Las Vegas at MIX07, trying to catch up on my blog post backlog to clear the decks for MIX07 this week. I'll try to post fast and frequent tidbits about MIX happenings and announcements as they happen this week. I wonder if I could blog while speaking Monday afternoon? Hmm....