Microid mailing list

[Terrell Russell <terrellrussell AT gmail.com>]

As for catching up on previous threads here...

My current position on things:

1) URL Normalization

We should not make assumptions about capitalization or www or *. or
co.uk - calculate the URL as it is.  The verifiers will work it out -
the publishers should calculate and publish with the simplest of steps
with the least number of assumptions built in to those calculations.

2) Hashing algorithms

We should stick to SHA1 for now - the point about this not being an HMAC
or cryptographically secure... it doesn't matter all that much as the
keys themselves aren't secret.  The claim itself is being made by two
parties who have independently verified the communication identifier.
That said, the point against SHA1 because of the potential for collision
(shown in feb 2005), I think might hold more water and should be
discussed more.

3) MicroID is not a microformat

Microformats are being 'created' to map to current practice (roughly
calculated as 80% of use cases in the wild).  MicroIDs are used on less
than 10 sites as far as I know and does not constitute anything close to
the bar set for talking to the microformats community.  We move ahead
with the formalization of the spec here itself - and other conversations
will follow as needed.

4) Default publication of MicroID

I do think that sites that implement MicroID should offer a choice of
whether to publish a microID to a user.  And I think the admin should
select a good default based on the particulars of that software
installation.  The software itself should probably ship with the default
for the admin setting set to [off] - although that will slow adoption
perhaps.  I agree with the sentiment expressed earlier on this list.



Again, apologies for missing out on a month or more of pointed discussion.

Terrell
http://claimID.com
http://terrellrussell.com