[Microid] MicroID hashing algorithm(s) and normalization
Fred Stutzman
fred at metalab.unc.edu
Tue Nov 28 15:40:40 EST 2006
On Tue, 28 Nov 2006, Peter Saint-Andre wrote:
>
> As I understood things from Jer way back when, the point of a microid is
> to form an association between me and you (where the URIs are stand-ins
> for those entities). If I am http://saint-andre.com/ (which I own) and I
> accept comments (which I don't), then a microid that mashes up that HTTP
> URI and your mailto URI (or XMPP URI or whatever) can be used on any page
> where you comment at my website.
>
> Things become hazy if you are (say) http://chimprawk.blogspot.com/
> (which you seem to be), because you don't own that URI -- it's owned by
> blogspot, with the result that your blog is (IMHO) not a full citizen of
> the Internet:
>
> http://www.saint-andre.com/blog/2006-01.html#2006-01-13T10:07
>
> Fred, you've spent a lot more time thinking about claims than I have,
> but to my mind a microid forms an association between me and you. As Jer
> once put it, it's like smearing your fingerprint on something of mine.
> In the microid context that fingerprint doesn't change because it's a
> relation between you and me. I think a page-specific claim is something
> that we build on top of microid. Maybe we need something that is a
> combination of microid plus a specific resource. So any page at
> http://del.icio.us/ could have a microid that associates you with
> delicious (forum, testimonial page, whatever) and that microid would
> always be the same. I'm still not clear on why, but you might also want
> to smear your fingerprint over http://del.icio.us/fstutzman or
> http://del.icio.us/fstutzman/facebook in a particular way, to signify
> that "this is my facebooky fingerprint".
>
> That said, I also see that there maybe value in integrating microid with
> something like OpenID. You might have an OpenID provider (i.e., you
> don't host your OpenID at a domain that you own because you're not a
> full citizen of the Internet -- most people aren't!). So a microid that
> mashes up http://saint-andre.com/ with the URL of your OpenID script
> extends OpenID in an interesting way. But that's different from a
> per-page microid.
The idea of a decentralized claims system is that it is arbitrary and
scalable. Imagine the following scenario:
http://foo.com/profile.php?p=1
http://foo.com/profile.php?p=2
In this case, we have two pages that host the profiles of two unique users.
If the MicroID is computed at the per-domain basis, how would these two
users resolve their claims? I don't see how the architecture of
domain-level claims would resolve this situation.
Now imagine I have two claimID-like services. In one I wish to claim my
general web reputation (so I would claim http://del.icio.us/fstutzman) and
in the other I wanted to claim my facebook-specific reputation (so I would
claim http://del.icio.us/fstutzman/facebook). These are both valuable
points of my reputation.
However, in the system you're describing, there would be no way to issue
such claims unless every microid system had a complex ruleset governing all
namespaces for all websites. The MicroID verifier would have to know that
http://del.icio.us/fstutzman begins the namespace, so it would have to know
that http://del.icio.us/fstutzman == http://del.icio.us/fstutzman/facebook.
As you can see this is complex and non-scalable. People are going to have
profiles or content nested in every different type of place in a page's
namespace. The only way to support this is to have per-page claims.
I also am a little unclear on the you and me aspect of things. The MicroID
is a claim between an individual and an entity. I wish to claim pages I
have created. I don't wish to claim pages you've created, or establish
your relationship to me.
I hope this makes sense. This is a very critical point - the architecture
of MicroID (remaining simple and scalable) falls apart in any other case.
-F
--
Fred Stutzman
claimID.com
919-260-8508
AIM: chimprawk
More information about the Microid
mailing list