Hey Evan,
> 1. I think decoupling the authentication mechanism from the endpoint is
> important; that's why I did dialback authentication.
Could you elaborate on this a little?
> 2. I think overloading the "Pingback" name is a bad idea. Not only is
> the brand pretty weak, and using the same name for a very different
> protocol confusing, but also it implies that the protocol is only useful
> for replies -- which it's not.
I did consider this especially given the existing association with
SPAM (a common wordpress recommendation is to disable pingback/
trackback) but I'm hoping that the Activity prefix hopefully makes it
distinct. I wanted a name that makes it feel familiar to the existing
base of pingback implementors, while also communicating that it's the
next natural evolution of Pingback to the social web. I'm open to any
suggestions for a better name.
> Instead of the HMAC signature, how about just using Dialback? I could
> support that.
I did consider this and was going to make two requests:
* "URI" element in addition to "host" and "webfinger".
* Additional requirements on token to discourage implementors from
sending the same token everytime.
The reason I didn't send out those requests and went with the HMAC sig
is to keep the spec as simple as possible (which is the most important
goal of the project). It might be cool to have these in Dialback
though.
--
Sandeep Shetty