Microid mailing list

[eran AT yedda.com]

On 12/9/06, Chris Roos <chrisjroos AT gmail.com> wrote:

> I agree, because there is no way to stop spoofing of microids.  I
> think spidering could be used to provide clues as to what you may have
> authored, but not to decide that you definitely are the author.  I
> wonder if spidering becomes more of an option if you've already
> verified a link with a given site, and, a third party (me or a
> verifier) trusts that the site doesn't allow microid injection from
> the outside (i.e. the site is responsible for generating all microids
> in its pages).  This would give me some trust in spidering the site
> and finding all content relating to you.  As a practical example, I
> might want to aggregate all of the reviews I've written on amazon.
> Assuming amazon doesn't offer this already, and that they don't allow
> arbitrary microids to be inserted, I could use an aggregator to spider
> amazon looking for all reviews with my microid.

The major point here is not spoofing or not spoofing. They can spoof all they 
want to. Only a site of the likes of claimid.com is where my identity should 
be proven (which is the OpenID/whatever part of the story that I'm not going 
to cover here).

Only what I claim is mine, therefore, let them spoof whatever they want. If I 
don't claim it, I don't stand behind it.

> I understand this point but can't think of anytime I'd want to do
> this.  Maybe you could give an explicit example?  The argument also
> only holds up when talking about each page having its own microid.
> What if one page has multiple microids (e.g. a forum) - if it contains
> a message from each of your identities then they will still both have
> the same microid.

Even in a forum each post has a permalink, this means that even multiple 
posts that I have are actually different resources (or sub resources, if you 
wish) inside the page. Since the hashing is on the complete URL (including 
its anchor, which is the usual way permalinks work for elements in the same 
page) each of my posts will have a different microid.

It is true that in the case of a forum I might want to claim the whole 
disscussion (although technically, this is a discussion and not all of it, as 
opposed to blog post minus the comments, is mine). 

We can probably think of a solution on how to implement this, for example:
a) Have a microid near my profile part (which is usually in each post - at 
least the name) which contains the URL of the discussion and the my 
email/openid/whatever. This will allow me to claim the whole page (although 
sometimes you will want to claim specific posts)

b) Have a microid near each permalink (including the anchor, of course) so I 
will be able to claim a specific post on the thread.


This point actually leads me to something that I think will be essential in 
the spec (or as an addundum).
I think that we must specify implementation samples (in the forms of text, 
not code) on where and how  one should implement microid in various scenarios 
(blog, forum, etc). Perhaps this is a good place for a wiki where we can add 
additional scenarios as we find them.

Eran