Microid mailing list

[Peter Saint-Andre <stpeter AT jabber.org>]

Fred Stutzman wrote:
> On Tue, 28 Nov 2006, Peter Saint-Andre wrote:
> 
>>
>> As I understood things from Jer way back when, the point of a microid
>> is to form an association between me and you (where the URIs are
>> stand-ins for those entities). If I am http://saint-andre.com/ (which
>> I own) and I accept comments (which I don't), then a microid that
>> mashes up that HTTP URI and your mailto URI (or XMPP URI or whatever)
>> can be used on any page where you comment at my website.
>>
>> Things become hazy if you are (say) http://chimprawk.blogspot.com/
>> (which you seem to be), because you don't own that URI -- it's owned by
>> blogspot, with the result that your blog is (IMHO) not a full citizen of
>> the Internet:
>>
>> http://www.saint-andre.com/blog/2006-01.html#2006-01-13T10:07
>>
>> Fred, you've spent a lot more time thinking about claims than I have,
>> but to my mind a microid forms an association between me and you. As Jer
>> once put it, it's like smearing your fingerprint on something of mine.
>> In the microid context that fingerprint doesn't change because it's a
>> relation between you and me. I think a page-specific claim is something
>> that we build on top of microid. Maybe we need something that is a
>> combination of microid plus a specific resource. So any page at
>> http://del.icio.us/ could have a microid that associates you with
>> delicious (forum, testimonial page, whatever) and that microid would
>> always be the same. I'm still not clear on why, but you might also want
>> to smear your fingerprint over http://del.icio.us/fstutzman or
>> http://del.icio.us/fstutzman/facebook in a particular way, to signify
>> that "this is my facebooky fingerprint".
>>
>> That said, I also see that there maybe value in integrating microid with
>> something like OpenID. You might have an OpenID provider (i.e., you
>> don't host your OpenID at a domain that you own because you're not a
>> full citizen of the Internet -- most people aren't!). So a microid that
>> mashes up http://saint-andre.com/ with the URL of your OpenID script
>> extends OpenID in an interesting way. But that's different from a
>> per-page microid.
> 
> The idea of a decentralized claims system is that it is arbitrary and
> scalable.  Imagine the following scenario:
> 
> http://foo.com/profile.php?p=1
> http://foo.com/profile.php?p=2
> 
> In this case, we have two pages that host the profiles of two unique
> users. If the MicroID is computed at the per-domain basis, how would
> these two users resolve their claims?  I don't see how the architecture
> of domain-level claims would resolve this situation.
> 
> Now imagine I have two claimID-like services.  In one I wish to claim my
> general web reputation (so I would claim http://del.icio.us/fstutzman)
> and in the other I wanted to claim my facebook-specific reputation (so I
> would claim http://del.icio.us/fstutzman/facebook).  These are both
> valuable points of my reputation.
> 
> However, in the system you're describing, there would be no way to issue
> such claims unless every microid system had a complex ruleset governing
> all namespaces for all websites.  The MicroID verifier would have to
> know that http://del.icio.us/fstutzman begins the namespace, so it would
> have to know that http://del.icio.us/fstutzman ==
> http://del.icio.us/fstutzman/facebook. As you can see this is complex
> and non-scalable.  People are going to have profiles or content nested
> in every different type of place in a page's namespace.  The only way to
> support this is to have per-page claims.
> 
> I also am a little unclear on the you and me aspect of things.  The
> MicroID is a claim between an individual and an entity.  I wish to claim
> pages I have created.  I don't wish to claim pages you've created, or
> establish your relationship to me.
> 
> I hope this makes sense.  This is a very critical point - the
> architecture of MicroID (remaining simple and scalable) falls apart in
> any other case.

Again, I'm not the identity guy here, I'm the documentation guy.

But the way I understood it is that the microid says "this is fred at
delicious". So http://del.icio.us/fstutzman has a microid in the head or
whatever that says "yep, delicious verifies that this page is claimed by
fred" and http://del.icio.us/fstutzman/facebook has the very same
microid because delicious verifies that fred has claimed that page, too.
I don't see that http://del.icio.us/fstutzman is different from the
claim perspective than http://del.icio.us/fstutzman/facebook is. It's
all you and delicious.

It seems to me that what we care about here is the fact that delicious
verifies that it's indeed you who have claimed both
http://del.icio.us/fstutzman and http://del.icio.us/fstutzman/facebook
-- the fact that you have claimed two different URLs is captured by the
fact that there are indeed two URLs here. Why does the microid need to
reflect the different URLs? It's still all you and delicious.

But I freely admit that I may be muddle-headed.

Peter

-- 
Peter Saint-Andre
Jabber Software Foundation
http://www.jabber.org/people/stpeter.shtml

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature