Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder1.news.weretis.net!feeder.erje.net!newsfeed.xs4all.nl!newsfeed6.news.xs4all.nl!xs4all!newsgate.cistron.nl!newsgate.news.xs4all.nl!post.news.xs4all.nl!not-for-mail Return-Path: X-Original-To: python-list@python.org Delivered-To: python-list@mail.python.org X-Spam-Status: UNSURE 0.215 X-Spam-Level: ** X-Spam-Evidence: '*H*': 0.57; '*S*': 0.00; 'api.': 0.07; 'closest': 0.09; 'practice,': 0.09; 'api': 0.11; '"social"': 0.16; 'from:name:mark hammond': 0.16; 'incompatible': 0.16; 'received:192.168.0.9': 0.16; 'reply-to:addr:mhammond': 0.16; 'reply-to:addr:skippinet.com.au': 0.16; 'roy': 0.16; 'wrote:': 0.21; 'header:In-Reply-To:1': 0.22; 'header:User-Agent:1': 0.23; 'message-id:@gmail.com': 0.27; 'academic': 0.27; 'draft': 0.27; 'seems': 0.28; 'second': 0.28; 'extensively': 0.29; 'subject:skip:i 10': 0.29; 'twitter,': 0.29; "i'd": 0.29; 'mostly': 0.30; 'player': 0.30; 'fact': 0.31; 'received:209.85': 0.32; 'towards': 0.32; 'received:google.com': 0.32; 'point.': 0.32; 'smtp': 0.33; 'server': 0.34; 'received:209': 0.35; 'point': 0.35; 'received:192.168.0': 0.35; 'version': 0.36; 'but': 0.36; 'list': 0.37; 'actual': 0.38; 'supports': 0.38; 'next': 0.38; 'received:192': 0.39; 'to:addr:python-list': 0.39; 'either': 0.39; 'received:192.168': 0.40; 'to:addr:python.org': 0.40; 'your': 0.60; 'close': 0.61; 'single': 0.61; 'site': 0.62; 'exchange': 0.62; 'today': 0.62; 'most': 0.63; 'yes,': 0.63; 'further': 0.64; 'here': 0.66; 'header:Reply-To:1': 0.66; 'is.': 0.67; 'care': 0.67; 'due': 0.68; 'money': 0.71; 'reply-to:no real name:2**0': 0.72; 'winner': 0.76; 'article': 0.81; '1:18': 0.84; '2.0.': 0.84; 'credentials': 0.84; 'observed': 0.84; 'player.': 0.84; 'understand,': 0.91 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:reply-to:user-agent:mime-version:to:subject :references:in-reply-to:content-type:content-transfer-encoding; bh=4taWylt+RIPfhB2mq9JLUpPrWkVpXnlnn3GHehSA0i4=; b=DNJ8a9J+0RTrFvXaSWgA3qQ6P9dhwncXJ6HV/lNQFAvGJv2g0eWiyxoqQxoOmR+7Xc u2Bve1H0eGoixzlW9EpZEwjkGmIL+G/FYXDQVN3IYhpw0io5E+AKNgBo+Rr0iQxvfwzZ UUGbyZnhvx2tNrVkdON+sdD7HbdtORFITi0PhcPsovAJzca/reu9xJKWS57Kra9oWLYM nyPwZ46/9sioHN49ypZFJXnZO9m6pBDTj8Pw4CybcJd44bGwwc/m9WK9zSQrLhIT46KF YuxVkVuXH4aSYUL7eMc4cOK4wz7YuuyKIZxZ0xvHNLlFg90N3c9mLgccN34WxL44wUgF vfXA== Date: Wed, 28 Mar 2012 14:42:25 +1100 From: Mark Hammond User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:13.0) Gecko/20120325 Thunderbird/13.0a2 MIME-Version: 1.0 To: python-list@python.org Subject: Re: OAuth 2.0 implementation References: <1973354.3.1332816158529.JavaMail.geo-discussion-forums@pbae2> <87haxahh51.fsf@benfinney.id.au> <878vimhfdp.fsf@benfinney.id.au> <87zkb2fz7g.fsf@benfinney.id.au> <7909491.0.1332826232743.JavaMail.geo-discussion-forums@pbim5> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Mailman-Approved-At: Wed, 28 Mar 2012 09:39:20 +0200 X-BeenThere: python-list@python.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: mhammond@skippinet.com.au List-Id: General discussion list for the Python programming language List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Newsgroups: comp.lang.python Message-ID: Lines: 30 NNTP-Posting-Host: 2001:888:2000:d::a6 X-Trace: 1332920361 news.xs4all.nl 6958 [2001:888:2000:d::a6]:53902 X-Complaints-To: abuse@xs4all.nl Xref: csiph.com comp.lang.python:22264 On 28/03/2012 1:18 AM, Roy Smith wrote: > In article > <7909491.0.1332826232743.JavaMail.geo-discussion-forums@pbim5>, > Demian Brecht wrote: > >> OAuth 2.0 is still in draft status (draft 25 is the current one I believe) >> and yes, unfortunately every single server available at this point have >> varying degrees of separation from the actual spec. It's not a >> pseudo-standard, it's just not observed to the letter. Google is the closest >> and Facebook seems to be the farthest away (Stack Exchange is in close second >> due to building theirs to work like Facebook's). > > In practice, OAuth is all about getting your site to work with Facebook. > That is all most web sites care about today because that's where the > money is. The fact that other sites also use OAuth is of mostly > academic interest at this point. > > The next player on the list is Twitter, and they're not even up to using > their own incompatible version of OAuth 2.0. They're still using OAuth > 1.0 (although, I understand, they're marching towards 2.0). Almost all "social" or "sharing" sites implement OAuth - either 1.0 or 2.0. Facebook is clearly the big winner here but not the only player. It's also used extensively by google (eg, even their SMTP server supports using OAuth credentials to send email) I'd go even further - most sites which expose an API use OAuth for credentials with that API. Mark