News and discussion about tech related to FriendFeed and other lifestreaming systems e.g. RSS, Atom, XMPP, OAuth, PubSubHubbub, rssCloud, SUP, APIs and webhooks
Installment Loans is a dependable loan arranger for those who are not capable to pay back a loan all at a time. Come to us and we will help you find range of perfect loan services Unsecured Loans, Instant Cash Loans, Same Day Installment Loans and Installment Loans No Credit Check. For more details : http://www.installmentloans.ca
"Envisioned by four NYU computer science students, the Diaspora project would replace today's centralized social web (yes, they mean you, Facebook) with a decentralized one, while still offering something that's convenient and easy for anyone to use. According to the project's homepage, the students, Daniel Grippi, Maxwell Salzberg, Raphael Sofaer, and Ilya Zhitomirskiy, "bonded over many late nights building a Makerbot," (to you non-geeks, that's a type of robot) and they "started discussing what a distributed social network would look like.""
- Meryn Stol
from Bookmarklet
"If Diaspora is realized, it will be up to technology advocates to position the turn-key service in a way that will make it sound simple and appealing to precisely those sorts of mainstream users if it is to ever succeed. Taking shots at Facebook's privacy issues may be a good course (Take back control with Diaspora!)."
- Meryn Stol
"6d is an identity building application. Its purpose is to allow you to centralize your life, photos, thoughts, posts or anything else, but still share with friends, colleagues, or the world."
- Meryn Stol
from Bookmarklet
"The latest version of Feeds has realtime web feed subscriptions based on PubSubHubbub (PSHB). Here I explain when this could benefit you and how you can set up your site to aggregate news efficiently in realtime."
- Mike Chelen
from Bookmarklet
Because PSHB is supported through the Feeds module which handles node import, Drupal can then process the data.
- Mike Chelen
"by default -- the people you follow and the people that follow you are made public to anyone who looks at your profile"
- chaz2b
from Bookmarklet
yeah, noticed this today... i was pretty surprised when i realized i can actually peep some people i really don't know... but everything seems like g-reader in g-mail...
- deborah hustic
omg, i hope ppl dont see my greader, it would swamp their feed, :o tell me if you can, and i'll do what i can to fix it
- chaz2b
"Here at Thing Labs, we’re always looking for ways to improve the performance of Brizzly. One important technique for real-time communication in web apps is “long polling,” where a web server keeps a connection open with a client until it has results to send back. Unfortunately, this technique came around after most web frameworks were designed so they’re not built to handle gobs of simultaneous connections efficiently. Because of this, we were excited by the release of the Tornado web framework"
- Ken Sheppardson
from Bookmarklet
"The Salmon Protocol (http://salmon-protocol.org) is a real time, decentralized commenting and annotation system. The basic idea is that commentary swims upstream to the thing being commented on, which can then redistribute comments back out to interested subscribers. It's based on Atom and is intended to be compatible with Activity Streams -- using thr:in-reply-to and crosspost:source for example -- and is also intended to allow for reverse syndication of activities such as likes, ratings, etc. that are about an object that has registered a Salmon endpoint. That is, if you like an item you discover in a Salmon-enabled feed, your agent of choice can push the "like" activity up to an endpoint specified by the original item, providing more visibility and potential re-publishing of activities around the web. There's a demo available at http://salmon-playground.appspot.com/ros which posts comments back to a Blogger blog (by proxying to an existing API, just for demo purposes). Feedback and comments welcomed."
- Jason Wehmhoener
from Bookmarklet
Interesting: why does PubSubHubbub use a verify token rather than encoding it in the URL? It allows notifications from multiple feeds to be batched to the same endpoint. http://groups.google.com/group...
"There have been two changes proposed to the walkthrough document for rssCloud. 1. Adding a domain parameter to the REST request for notification. (9/13/09) 2. Adding a challenge parameter to the verfication of a notification request."
- Ken Sheppardson
from Bookmarklet
Adobe manages the process of getting their UI to run on OS X, Linux and Windows and you have to code against it using their rules. With Swing you have to make sure the Java environment your deploying to can handle your app and manage all of the non-App details like installing and updating. (those are the two items off of the top of my head) - note that i am neither a Java or Air coder - I just deploy and manage apps using both technologies.
- bear (aka Mike Taylor)
"To Sam Diaz who says RSS was "a good idea at the time but there are better ways now," I have many things to say. 1. People confuse RSS with Google Reader. Let's be clear that there's a difference. Google Reader is an application that reads RSS-formatted data. There are many other applications that read and write RSS. 2..."
- Ken Sheppardson
from Bookmarklet
I live on RSS feeds but I wish that a new revision could be drafted that makes the syndication stream address the problem of fragmented comments throughout the internet.
- manielse (Mark Nielsen)
I fully agree with that assertion, although I can imagine a kind of "push" distribution to take over. And that's what meant with "is dead" in general. It's not that it has no use right now, it is that one *idea* has been superseded by another. I think the main reason we had RSS (and thus polling) in the first place is that we lacked proper "distribution servers", akin to what SMTP...
more...
- Meryn Stol
I like ATOM better now. I used to be an RSS fan, but after reading the spec, ATOM is cleaner and makes far more sense. Plus it support publishing as well, with APP.
- Otto
"One of the most profound sins that can be committed by a protocol designer is to introduce sources of burstiness in a distributed system. i.e. Increase the sources of variance in traffic patterns. In general, a push-based system, like PSHB, can be clearly shown to generate less traffic variance than a ping/polling system like what has recently been proposed by the rssCloud advocate. This issue is related to the "thundering herd" problem..."
- Ken Sheppardson
from Bookmarklet
August 19 -- "[O]ver the past few weeks we've enabled the PubSubHubbub protocol for many Google services, including FeedBurner, Reader shared items, and Blogger. This protocol provides web-hook notifications when Atom and RSS feeds are updated, delivering web applications near-real-time information about what's new or changed. Today we're happy to announce that we have gone a step further and added PubSubHubbub support to Google Alerts. This gives developers the means to write web applications that process newly relevant search results as they become available. Think of it as an AJAX search API that tells *you* when it finds new results. Acting upon these notifications your app could update your website, email friends, send an SMS-- the possibilities are endless."
- Ken Sheppardson
from Bookmarklet
Posterous Theming: It's here, it's live, and it's time to make your site yours! - The Official Posterous Posterous - http://blog.posterous.com/postero...
"Posterous is proud to announce the ability to change the look and feel of your Posterous blog! It's been a long time coming, and are we ever excited about releasing this feature to you guys today."
- Ken Sheppardson
from Bookmarklet
NICE --> "Yes, we support Tumblr themes You can drop them right in, and they'll work. We don't support 100% of their blocks and elements, but all the basic ones will work out of the box."
- Ken Sheppardson
you can get total code control too by turning on the advanced theming - i do hate their overall admin UI tho (the theming UI is good but getting to it is like 5 clicks) - good thing i rarely have to use it - hopefully it'll get better
- Chris Heath
This is basically just an extension to OPML. Not sure why it's necessary when OPML more or less seems sufficient?
- Chris Messina
Chris, can you make OPML say that a url points to a Twitter user? I thought OPML was just for pointing to feeds. Pointing to a feed (together with a free-text title) is quite a bit different than saying: Hey, here's a Twitter user you can subscribe to, or go talk to, or analyze with Twitter Grader or a plethora of other tools. I think that for OPML to be a replacement for this, I think...
more...
- Meryn Stol
I dislike the TweepML spec because it uses "screen_name" as the primary identifier (in the simplest case). Screen names are not fixed, anybody can change theirs to any unused one at any time, and the "follow" remains. While you can put the ID in there, it's optional, which is bad. Using the RSS feed gives you the internal Twitter ID number, which never changes, and with that feed, you...
more...
- Otto
Otto, I don't think an OPML document - at this moment - can carry the semantics of pointing to Twitter users in particular (as opposed to pointing to any kind of feed or web page). So for automated processing - for example, support by web browsers! - OPML currently does not suffice. Or we would need to rely on "URL sniffing". Then browsers would need to hardcode something like the...
more...
- Meryn Stol
One other possible - and promising - direction would be to introduce a HTML microformat to indicate a link to a Twitter user. Something like <a href="http://twitter.com/meryn" rel="twitteruser">meryn</a>. This could be picked up by browser plugins. No need for a separate TweepML page then.
- Meryn Stol
:confused: I don't understand the issue here. If the feed starts with twitter.com then it's a twitter feed. You don't need special semantics to identify a twitter user specifically. That's completely unnecessary and kinda silly. Same goes for the microformat, why require people to add all this extra crap just to prevent, literally, one line of parsing code?
- Otto
My point is that it's utterly pointless to invent a new format when an old one fits just fine. Especially if your purpose in the new format is to make your coding.. well.. not any easier. How is it harder to recognize twitter.com than having to look for extra tags or examine the content of the rel attribute? Short answer: It's not. A "browser plugin" could just as easily read the bare...
more...
- Otto
Now I thought about it a little more, the obvious use case for a tweepml file is simply to open it with a Twitter client which supports the file format. So it's not so much a matter of browser support, it's a matter of Twitter client support. This special file format makes a lot of sense. OPML is too generic.
- Meryn Stol
Would be cool as well if Twitter itself would start to support TweepML format for its "following" and "followed by" pages.
- Meryn Stol
The Twitter ID number should be the primary identifier, with the Username provided as an optional additional field. Then both could be read directly by a client program, without additional Twitter web scraping or API calls, which would be more convenient than OPML, currently the best compromise.
- Mike Chelen
I'm not sure what the issue is that OPML doesn't address directly. We had twitter user lists and browsable / drill-down-able packages of users a few years ago (using just OPML). I'll see if I can dig up an example.
- mikepk
Bah drives me crazy again. One of the services we shut down when I left. The Grazr Twitter Reader API would let you chose a user, and get a package of their followed list that would let you drill down through it. OPML does a lot more than people realize (inclusion is a really neat concept people never quite 'got')
- mikepk
plus OPML can easily be extended with a namespace to add the user ID if that was really needed (without requiring breaking OPML or adding a new spec)
- mikepk
I think the main point that we always tried to do with OPML was to build on a base spec. That way, even with namespace extensions, the core list would still work in things like feed readers (for pulling in the feeds) and other OPML aware applications. Applications that understood the additional namespace could add additional functionality. The need to always create new specs is damaging in a lot of ways when the old ones can get the job done.
- mikepk
mikepk: could someone do that then? the situation that occurs is having a list of Twitter usernames, it is useful to find and save their ID numbers, in case of username change. right now that is done often with basic CSV, or hacking the username into the OPML feed title
- Mike Chelen
Twitter already supports XFN by linking to someone's friends using rel-contact. They also markup the contact list in microformats. I suppose getting a full list of someone's friends is currently challenging, but I guess in general I question the creation of new formats where others exist (though, starting with OPML seems fine).
- Chris Messina
I think OPML + a clean namespace would solve this problem 100% and still maintain compaitibility with OPML aware apps (like feed readers). Unfortunately, after I left Grazr, we shut down all the advanced feed applications we had (sniff), so the Twitter Reader no longer works. That would have been a good example.
- mikepk
So assuming we have a namespace of "supertwit" you could create outline nodes that look like this: <outline supertwit:userid="IDNUM" text="mikepk" type="rss" xmlUrl="http://twitter.com/statuse..." htmlUrl="http://twitter.com/mikepk" />
- mikepk
I still think a new format (with a new mime-type) is by far the easiest way to get a list of Twitter users loaded into a Twiter client like Tweetdeck. Otherwise, all OPML clients (what are OPML desktop clients anyway? I don't know any?) should support either Twitter natively, or support forwarding the mentioned Twitter users to a user-configured Twitter client. That just doesn't make sense.
- Meryn Stol
I kinda think that you don't quite understand the whole purpose of OPML in specific, and XML in general. OPML is designed to be able to exchange lists of feeds between feed readers. If you want to extend it with twitter specific extensions, then you could do that with a namespace. No existing OPML capable clients would have to be modified to support your extensions, that's the whole...
more...
- Otto
Otto, I do understand both OPML and the concept of namespaces. Can you please explain to me how I'd ever get Firefox to push Twitter-specific data inside an OPML file to Tweetdeck? Or how would you have in mind that I'd get Twitter usernames communicated to a Twitter client otherwise? Also, Tweepml is not my spec. Why would you think so? I just saw it, thought it was a great initiative, and shared it here. I'm just defending a great idea.
- Meryn Stol
Can you explain how you'd ever get Firefox to push OPML to anything, period? If you can do that, then I'll explain how you can add support for additional namespaces. Fact is that you're going to have to write the code to generate the ML file anyway. The choice of format is not a software support issue, it's a compatibility issue. By using straight OPML with add-ons, you instantly have...
more...
- Otto
Otto, you're *really* missing my point of the usefulness of specific mime-types... Do you know why mime-types were invented? They are a crucial element of HTTP. It's part of what makes the protocol so powerful.
- Meryn Stol
I understand MIME types, but you don't need a whole new incompatible file format to switch to a different MIME type.
- Otto
Ok so you propose serving OPML with a more specific mime-type? E.g. not text/x-opml but something more specific? What about text/x-opml-tweeps? Something like that?
- Meryn Stol
All desktop feed readers will consume OPML, as will outliners (but that's a niche-y kind of thing). There are also lots of feed meta-tools that use OPML, as grazr once did. By using OPML with a namespace, you get the benefit of your format being immediately useful to a very large set of applications, otherwise you have to hope people implement your unique spec. Having a unique mime type doesn't seem to bring enough benefit to overshadow those points IMHO. You clearly disagree :)
- mikepk
I'm generally of the opinion that MIME type doesn't make quite the difference you think it does. Format is much more important. People can make their browser send to their app of choice manually, all having a MIME type standard does is to let apps tell the browser, in advance, that they can deal with that type. On the whole, MIME type is a platonic ideal, it doesn't have much real-world application that matters.
- Otto
additionally, nothing says you can't define a new mime type to serve the opml as, if you *really* wanted to.
- mikepk
I really don't understand the resistance to this nice little spec... I think it's about on the level of KML. Just *useful*. Not world changing, but nice for exchange of twitter usernames just like KML is nice for interchanging geographical data.
- Meryn Stol
Personal opinion I guess. There's a sliding scale between using existing formats that makes the data available and useful to all the applications that already understand that format, and needing something truly unique to represent your data but by definition making it a highly niche format that will only be useful in a handful of applications (if they implement it). The more general you...
more...
- mikepk
Agree that an opml extension would be best, but the TweepML folks have built something pretty neat and it looks like it could be a fun and useful tool
- Brian Hendrickson
Meryn: There's nothing wrong with the *idea* of it, I'd just prefer it if they used a format that would already work with all my existing software. OPML is well known and understood and supported. Libraries already exist for it. Adding it to twitter client programs would be trivial. This format, OTOH, is not supported by anything I use, and therefore is useless to me.
- Otto
Example: I can't take a TweepML file and import it into my Google Reader. If they used an OPML extension, I could import it there and instantly get all my followers as feeds.
- Otto
Best solution would be to serve the information in both OPML (text/x-opml) and in Tweepml (whatever the proposed mime-type is). Then the user can both use generic tools, and have it automatically forwared to their Twitter client of choice. But I personally doubt many people want to add Twitter users to their feed reader, or any other generic RSS tool. Twitter is a world in itself. A...
more...
- Meryn Stol
Just the same, some people like to consume geo-data through a GeoRSS element embedded into feeds. Others like to consume it through KML files. But a KML file can be configured to always open in Google Earth. It wouldn't make sense to let a browser forward all rss feeds to Google Earth.
- Meryn Stol
On the contrary, I used that specific example for a reason: a *lot* of people have been doing exactly that lately, exporting their Twitter feeds into Google Reader. Dave Winer wrote a tool to do exactly that: http://rsscloud.org/twitter... and several people commented on it and have been using it. Also see http://www.google.com/search...
- Otto
otto, I must say that I don't have stats handy, but I think that people using Google Reader for Twitter feeds really represent a niche. In any case, I expect dedicated Twitter clients (or at least, clients that go beyond the feed, taking "users" or "people" as their starting point) to win handsomely in the future shoot-out. "Feeds" do have their place, and will always have, but the people-oriented web is rising fast.
- Meryn Stol
It's not a niche, it's being actively done by some rather big names in the biz. Might want to read the comments here as well: http://www.scripting.com/stories...
- Otto
Just to be clear, I think Dave Winer lives in quite a bubble. He's not representative of most users. not even the typical early adopter. I'd be wary if I found myself to be referring to one particular old guy from the valley too much.
- Meryn Stol
That doesn't mean I don't want to take OPML (or anything else) away from you, or anyone else. It's just that for other users, other solutions - like dedicated formats to talk about Twitter users, or tweets, or retweets) might be very appropriate. There are enough Twitter clients out their to warrant development of standard exchange formats.
- Meryn Stol
I don't disagree with you on the need for a format to do this sort of thing... I disagree on the need for a custom format that doesn't work with anything else, especially when it verges on trivial to simply add what you need into OPML. Furthermore, the existing OPML created by that tool already gives you all the necessary information to transmit lists of Twitter users. No other data is really *required*. If I was a Twitter client developer, I'd program support for the OPML idea first, not for this format.
- Otto
At least we need a new mime-type to make it carry the *semantics* of point to a Twitter user. How else could a browser know to what app to forward a downloaded file to? I don't see a browser actually "sniffing" inside an OPML file to see if it contains "twitter.com/" as a viable solution.
- Meryn Stol
Why do you need the browser to know where to send the file? Are you incapable of picking your Twitter client from a list? Furthermore, nobody really uses only one Twitter client, which one gets the data in your MIME type scenario?
- Otto
Well ask some regular internet users if they're happy that their KML files open in Google Earth. I expect they'll answer affirmative.
- Meryn Stol
Many internet users like to open the KML files in Google Maps, actually, since it supports them too. Also, KML is a special use case, since location data like that actually does not fit into OPML or any other existing format. But take it as an example: If you were going to develop something that fit into KML, would you make a new, incompatible, format for it?
- Otto
Well you can probably bind the mime-type to Google Maps too... The point is that it's useful to be explicit about what data ends up where, even if you use - say - three "Geo" clients (GMaps, GEarth, MSN Earth) and three Twitter clients, at least you only have to choose from a group of three.
- Meryn Stol
Do you have a program on your machine that supports the OPML mime type now, other than perhaps a single feed reader? Is it really so hard to pick a twitter client from a list of a twitter client and a feed reader?
- Otto
Not going to argue anymore... This is typical - unproductive- arguing. Let's look back at this thread a few months later from now.
- Meryn Stol
My point is that OPML is specifically designed for this. There's nothing special about a Twitter user's feed. It's just another form of blog, with very small posts. The RSS feed contains those posts. And an OPML contains a list of those feeds. QED.
- Otto
Meryn, don't think of this as an attack on you. I left it as we can 'agree to disagree' but I understand the negative reaction to another spec. It may seem harmless to create a unique spec for every slight variation of data format, but it makes developers lives worse, throws out any 'baked in' experience with existing specs, and fractures data making it less useful overall. Then again, you never know what specs actually get implemented vs. not implemented so only time will tell if this gets used or not.
- mikepk
Mike, I think that I've been mostly arguing for introducing another mime-type. I don't care much what particular serialization format is used in the end. But browsers do need to know if they're receiving information about Twitter users or just regular feeds. There's a big difference in semantics there. You can do many things with Twitter users which you can't do with feeds. E.g. You...
more...
- Meryn Stol
I already said that another solution would be to introduce an "OPML switchboard" which would intelligently handle different kind of links inside an OPML file (much the same as a browser really, based on mime-types or pseudo mime-types appearing inside each OPML entry). But I think that with simply using microformats inside HTML we would be much closer to a solution then. Such a "switchboard" could be implemented pretty fast with a Firefox plugin I suppose.
- Meryn Stol
If you have a Twitter users feed address, then you can find out all you ever want or need to know about the Twitter user. Here's my Twitter feed: http://twitter.com/statuse... The "link" tag inside the "channel" contains my current twitter url (and by extension, my username). With that info, you can do anything you like. Furthermore, my username can change. That feed URL will never change, no matter what I change my username to.
- Otto
Furthermore, if you examine the Twitter API, it will take either ID numbers or usernames for all identification fields. The ID number is right there in the feed link itself, so you can get any info you want from the API without even retrieving the feed. If you know my ID is 7016582 (from the feed url) then you can retrieve http://twitter.com/users... to see everything about me.
- Otto
Meryn, there's a happy medium here too. All of these formats are just XML, it's up to the server to serve it as a particular mime type. You could easily define a new xml mime-type for the twitter user bundle and just have the server use it. I'd have to do some research but off the top of my head I don't know of any cases where a namespace extension to a format is served as a new mime-type, but I can't think of any reason why not. Does GeoRSS have a mimetype. I'd have to look.
- mikepk
No, GeoRSS is not a MIME type, it's an extension that you can put in RSS2 (application/rss+xml), ATOM (application/atom+xml) or RSS1 (application/rdf+xml). Most generators I've seen use one of those or sometimes just application/xml. The whole thing about MIME types is overblown anyway. They're just not that darned useful in real world applications. Sure, they're fine to hook a format...
more...
- Otto
But again, if it's not a big deal, and there's some utility for twitter clients, why not serve it as a new mime type? MIME is extensible too (just have to look up the mechanism). That gets the best of both worlds, standard spec + functionality for desktop stuff if it's warranted.
- mikepk
The correct mime type for OPML is either text/xml or text/x-opml. Technically, that last one should be text/x-opml+xml to identify it as an XML document, but Radio Userland used text/x-opml back in the day and it stuck. Anyway, you could easily just say text/x-whatever+xml if you really wanted to target twitter clients, but that has the same compatibility issues as a new format. Your...
more...
- Otto
My main concern is simply that I don't see how this TweepML spec actually adds anything that you can't do with OPML, with no extensions. A twitter feed *is* the user. There's no more information that I really need. I can grab the ID number from the feed URL and directly follow that user. One Twitter API call. Nothing more is necessary. I don't need the username at all to follow a user or even to see his tweets. ID's and usernames are 100% interchangable, everywhere.
- Otto
Note: TweepML doesn't define a MIME type, they're returning their data as text/xml.
- Otto
Otto, then the standard is more or less worthless in its current incarnation. No mime-type means no semantics.
- Meryn Stol
The next time you hear somebody dis XMPP because it's too hard too use, not widely adopted, or hard to maintain... then turn around and herald the coming of Google Wave, could you point them at http://www.waveprotocol.org/draft-p... ?
"1.1 Overview - The Google Wave Federation Protocol Over XMPP is an open extension to the XMPP core (Saint-Andre, P., Ed., “Extensible Messaging and Presence Protocol (XMPP): Core,” October 2004.) [RFC3920] protocol allowing near real-time communication of wave updates between two wave servers."
- Ken Sheppardson
Or at least tell them to go away when they say, "So I'm going to reinvent it from scratch!" Some things end up complicated because the problem is harder than you think.
- Dustin Sallings
I tell people the same thing when they ask why OAuth is complicated - because security is *hard*
- bear (aka Mike Taylor)
Hey, I get as frustrated by XMPP as the next guy, particularly the deployability and maintainability of the available servers... but that just means there's room for improvement.
- Ken Sheppardson
Well Google Wave is not widely adopted as well. I mean just try to compare number of HTTP implementations (a thousand? thousands?) to Google Wave implementations (one? the one from Google?). I won't dis XMPP though. It has already earned its place for other applications. Google Wave could grow as well, but I don't have high expectations of it.
- Meryn Stol
I'm actually not sure with what we should compare Google Wave... Google's version is a kind of framework talking a certain protocol (wave protocol). Should we compare it to all web frameworks out there then? But Google's version is only hosted at one place. Should we compare it to *one* instance of a web app framework? How many Rails sites are there alone?
- Meryn Stol
Or you could point them to AppEngine where they can use XMPP with minimal setup and somebody else worries about keeping the servers running.
- Adewale Oshineye
XMPP on GAE is very limited -- it wouldn't work for most of my interesting apps.
- Dustin Sallings
What are the limits and what interesting apps do they prevent you from building?
- Adewale Oshineye
XMPP seems relatively easy and well supported, compared with other realtime messaging technologies that came before. maybe Google Wave can be even more convenient
- Mike Chelen
"Are you confused about the difference between PubSubHubbub and rssCloud? You're not alone. Here's how the confusion came about: Dave Winer invented rssCloud way back in the day. It only distributed lite pings, the callback endpoint was the IP address that you subscribed from, and nobody really ever implemented it, so you probably never heard of it. We sure hadn't. Fast forward 5 or 6 years..."
- Ken Sheppardson
from Bookmarklet
Without reading the article, my current opinion on this: RSS Cloud shows Dave Winer got the importance of adding realtime notifications to RSS many years ago. However, even more so than has become apparent with RSS, he's not that good of an engineer. He didn't think things through, and is satisfied with "quick and dirty" solutions, almost as if he prefers them to completely thought-out standards.
- Meryn Stol
Yet, I consider the difference between RSS Cloud and Hubbub to be far greater than the difference between RSS and ATOM, so in the benefit of the web, I hope RSS Cloud dies a quick death. RSS hasn't been able to hurt the web that much because it's simply not *that* bad compared to Atom. That said, I consider Dave Winer a huge visionary. He's the archetype hacker. Since he still got a lot of credibility, I hope he puts his weight behind Hubbub soon. We can consider it the realization of *his* vision.
- Meryn Stol
Winer writes imprecise specifications and leaves implementation concerns like scalability to others. There's value in what he does, but RSS, OPML and now the new RSSCloud are hobbled by his belief that writing a "human-readable" spec and opening it up to feedback for a couple weeks is sufficient. You have to hammer at these things, and bring people into the process with voting power, to make them good.
- Rogers Cadenhead
Introducing a "domain" parameter into the rssCloud spec before a "challenge" parameter seems a little irresponsible. Now, instead of just DDoSing shared hosting providers, you can DDoS anyone. re: http://rsscloud.org/walkthr...
All you need to do is point it at high-CPU search page on your target, ie: curl -d "domain=example.com&path=/search.php%3Fq%3Dslow&url=...". The search will return 200 OK and happily accept turn all the future POSTs into search results. Multiply this by a few thousand blog pings and you've got a DDoS.
- Matt M (inactive)
does PubSubHubbub have an analogous mechanism that can be exploited similarly?
- Chris Heath
Chris - PSHB requires the endpoint to echo back a challenge parameter: http://pubsubhubbub.googlecode.com/svn... As the PSHB spec puts it, this "Verifies Intent of the Subscriber". rssCloud doesn't verify the intent - only the existence of the endpoint and its willingness to accept POST requests (although you can use an HTTP redirect to convert that POST into a GET to exploit URLs that don't accept POST).
- Matt M (inactive)
Any known exploit? I mean, is there a documented or known mis-use of rssCloud like this? Just askin'
- Pandu ● IT Optimizer
Pandu, you can exploit it today by issuing the appropriate curl commands against an rssCloud hub (ie: rpc.rsscloud.org).
- Matt M (inactive)
Oooo Matt... you just can't begin to imagine the temptation I had... :-P
- Pandu ● IT Optimizer
Before the "domain" parameter, you needed to be running on a shared host. You could basically DDoS the boxes that the hosts use for outgoing HTTP. I wrote it up on my blog along with some recommendations on how to fix the protocol (ie: adding the challenge parameter).
- Matt M (inactive)
Peer review is important. Thanks for providing it, Matt.
- Brett Slatkin
Brett, absolutely. It's also important to have an open forum where this stuff can be discussed without egos getting involved. I've tried to find issues with PSHB as well, but the challenge parameter and rate limiting basically prevents any sort of DDoS from taking place.
- Matt M (inactive)
I'm glad to see Dave is at least moving to fix the IP address issue
- Nick Lothian