Microid mailing list

[Fred Stutzman <fred AT metalab.unc.edu>]

On Tue, 28 Nov 2006, Peter Saint-Andre wrote:

> As I understood things from Jer way back when, the point of a microid is 
> to form an association between me and you (where the URIs are stand-ins 
> for those entities). If I am http://saint-andre.com/ (which I own) and I 
> accept comments (which I don't), then a microid that mashes up that HTTP 
> URI and your mailto URI (or XMPP URI or whatever) can be used on any page 
> where you comment at my website.
>
> Things become hazy if you are (say) http://chimprawk.blogspot.com/
> (which you seem to be), because you don't own that URI -- it's owned by
> blogspot, with the result that your blog is (IMHO) not a full citizen of
> the Internet:
>
> http://www.saint-andre.com/blog/2006-01.html#2006-01-13T10:07
>
> Fred, you've spent a lot more time thinking about claims than I have,
> but to my mind a microid forms an association between me and you. As Jer
> once put it, it's like smearing your fingerprint on something of mine.
> In the microid context that fingerprint doesn't change because it's a
> relation between you and me. I think a page-specific claim is something
> that we build on top of microid. Maybe we need something that is a
> combination of microid plus a specific resource. So any page at
> http://del.icio.us/ could have a microid that associates you with
> delicious (forum, testimonial page, whatever) and that microid would
> always be the same. I'm still not clear on why, but you might also want
> to smear your fingerprint over http://del.icio.us/fstutzman or
> http://del.icio.us/fstutzman/facebook in a particular way, to signify
> that "this is my facebooky fingerprint".
>
> That said, I also see that there maybe value in integrating microid with
> something like OpenID. You might have an OpenID provider (i.e., you
> don't host your OpenID at a domain that you own because you're not a
> full citizen of the Internet -- most people aren't!). So a microid that
> mashes up http://saint-andre.com/ with the URL of your OpenID script
> extends OpenID in an interesting way. But that's different from a
> per-page microid.

The idea of a decentralized claims system is that it is arbitrary and 
scalable.  Imagine the following scenario:

http://foo.com/profile.php?p=1
http://foo.com/profile.php?p=2

In this case, we have two pages that host the profiles of two unique users. 
If the MicroID is computed at the per-domain basis, how would these two 
users resolve their claims?  I don't see how the architecture of 
domain-level claims would resolve this situation.

Now imagine I have two claimID-like services.  In one I wish to claim my 
general web reputation (so I would claim http://del.icio.us/fstutzman) and 
in the other I wanted to claim my facebook-specific reputation (so I would 
claim http://del.icio.us/fstutzman/facebook).  These are both valuable 
points of my reputation.

However, in the system you're describing, there would be no way to issue 
such claims unless every microid system had a complex ruleset governing all 
namespaces for all websites.  The MicroID verifier would have to know that 
http://del.icio.us/fstutzman begins the namespace, so it would have to know 
that http://del.icio.us/fstutzman == http://del.icio.us/fstutzman/facebook. 
As you can see this is complex and non-scalable.  People are going to have 
profiles or content nested in every different type of place in a page's 
namespace.  The only way to support this is to have per-page claims.

I also am a little unclear on the you and me aspect of things.  The MicroID 
is a claim between an individual and an entity.  I wish to claim pages I 
have created.  I don't wish to claim pages you've created, or establish 
your relationship to me.

I hope this makes sense.  This is a very critical point - the architecture 
of MicroID (remaining simple and scalable) falls apart in any other case.

-F




--
Fred Stutzman
claimID.com
919-260-8508
AIM: chimprawk