Microid mailing list

["Yaniv Golan" <yaniv AT yedda.com>]

> -----Original Message-----
> From: microid-bounces AT lists.ibiblio.org [mailto:microid-
> bounces AT lists.ibiblio.org] On Behalf Of Terrell Russell
> Sent: Sunday, December 10, 2006 5:48 AM
> Subject: [Microid] Summary and Hello
> 
> As for catching up on previous threads here...
> 
> My current position on things:
> 
> 1) URL Normalization
> 
> We should not make assumptions about capitalization or www or *. or
> co.uk - calculate the URL as it is.  The verifiers will work it out
> -
> the publishers should calculate and publish with the simplest of
> steps
> with the least number of assumptions built in to those calculations.

www, *., co.uk: +1

capitalization - I actually think this would be an issue, there is no
way (that I can think of) that a verifier could try all the different
options for capitalization. 

It will be possible to work around this for dynamic sites, but
requiring the code to generate the hash for the URL request, but it's
not practical for static sites. 

I suggest that we reconsider the capitalization issue. 

> 
> 2) Hashing algorithms
> 
> We should stick to SHA1 for now - the point about this not being an
> HMAC
> or cryptographically secure... it doesn't matter all that much as
> the
> keys themselves aren't secret.  The claim itself is being made by
> two
> parties who have independently verified the communication
> identifier.
> That said, the point against SHA1 because of the potential for
> collision
> (shown in feb 2005), I think might hold more water and should be
> discussed more.
> 
> 3) MicroID is not a microformat
> 
> Microformats are being 'created' to map to current practice (roughly
> calculated as 80% of use cases in the wild).  MicroIDs are used on
> less
> than 10 sites as far as I know and does not constitute anything
> close to
> the bar set for talking to the microformats community.  We move
> ahead
> with the formalization of the spec here itself - and other
> conversations
> will follow as needed.

+1

However, allowing variants of the MicroID syntax that follow the
Microformats spirit (e.g. human readable, usage of class attribute
etc) is useful IMO. 

> 
> 4) Default publication of MicroID
> 
> I do think that sites that implement MicroID should offer a choice
> of
> whether to publish a microID to a user.  And I think the admin
> should
> select a good default based on the particulars of that software
> installation.  The software itself should probably ship with the
> default
> for the admin setting set to [off] - although that will slow
> adoption
> perhaps.  I agree with the sentiment expressed earlier on this list.

+1

Yaniv

--
Yaniv Golan
My profile on Yedda: http://yedda.com/people/9512186217351/