We need to remember that XRD only addreses discovery for URL identifiers. XRD does not address email like identifiers. XRD actually has two properties. 1) generic format for resource descriptor documents (XRD documents) 2) protocol for obtaining XRD documents from HTTP(S) URIs. For email identifiers we are using only property (1) which is by and large defined, except for the signature part.
David Recordon wrote: > > Hey David, > I've been following some of the discovery work the past few months, > but don't have a clear picture if the various components are actually > solid enough to begin working with. I know XRD is moving forward, but > what's the state of site-meta > (http://tools.ietf.org/html/draft-nottingham-site-meta-01 > ) or now WebFinger (http://code.google.com/p/webfinger/)? Is there > something in WebFinger which wouldn't solve OpenID discovery entirely? > > These questions and the lack of adoption of XRD, site-meta or > completion of WebFinger have all contributed to my belief that we're > still just not ready to redefine how OpenID's discovery process should > work. > > Thoughts? > > Thanks, > --David > > Begin forwarded message: > >> From: David Fuelling <sappe...@gmail.com> >> Date: June 9, 2009 10:07:20 AM PDT >> To: Allen Tom <a...@yahoo-inc.com> >> Cc: secur...@openid.net, gene...@openid.net >> Subject: Re: [security] OpenID Security Best Practices Doc >> Reply-To: sappe...@gmail.com >> >> On Tue, Jun 9, 2009 at 5:38 AM, Allen Tom <a...@yahoo-inc.com> wrote: >> Is the community ready to move forward with OpenID 2.1? >> >> I can't necessarily speak for the community, but I'd at least like >> to move forward with the 2.1 Discovery WG. The output of that is >> expected to be a "best practices" document relating to Discovery >> that would (it is expected) be used in the regular OpenID 2.1 WG. >> >> I'm not opposed to doing all of this in parallel. >> >> I do believe that we really need a security best practices document, >> and it shouldn't have to wait until OpenID 2.1 is finalized. >> >> >> +1 >> >> >> Anyway, when you said you had been "nominated", it made me think >> there's some shadow process going on behind the scenes when it comes >> to these Working Groups. >> At the December 2008 IIW, I was either nominated or was volunteered >> to work on Security Best Practices document after I strongly >> advocated that the community write one. >> >> Cool. Like I said, I wasn't trying to say you shouldn't be doing >> this work. I just wanted to make sure it was "open". I wasn't at >> IIW, so that explains my disconnect. >> >> Am I missing something? Are there "private" WG discussions going on >> that the rest of us can't see? >> The security best practices document was first discussed at the >> December 2008 IIW session on OpenID 2.1, completely in the open. >> >> See my comment above. >> >> >> Or are you just "taking some initiative", as it were? >> Well, I'd been procrastinating for more than 6 months, but I think >> we waited long enough. More and more sites want to deploy OpenID, >> and it's about time we had a security document that potential >> implementers can read, other than just reading the specs, and >> various blog posts. >> >> :) -- I'm glad you've started working on this. It's important to >> have. >> >> >> -- I'm really just looking to get "in the loop" on this Working >> Group business, assuming I'm out if currently). >> I believe that the process requires the WG proposers to take their >> proposal to the Specifications council who will review the proposal >> and give their recommendation to the general membership of the OIDF >> to either approve or deny the request to form the WG. The general >> membership then votes on the proposal, and if the proposal is >> approved, the WG is formed. There's also a very painful process for >> the WG members to get their employers to approve their participation >> in the WG. >> >> The WG proposals that seem to be stalled right now appear to be >> OpenID 2.1, SREG 1.1, and AX 2.0. >> >> At least with regards to SREG 1.1 and AX 2.0, I believe that the >> proposers are waiting for their employers to approve their >> participation. Where is Dick Hardt? The OpenID world misses you! >> >> I'm not sure about the status on OpenID 2.1, but at least for >> myself, I'm more focused on the immediate goals of getting OpenID >> OAuth Hybrid and the OpenID UI Extensions finalized. >> >> I for one would like to move forward on the 2.1 Discovery WG. XRD >> will be a big part of that, but at this point it seems like much of >> XRD has been solidified (at least, enough for us to begin the 2.1 >> Discovery WG). >> >> The OpenID Wiki says that the Discovery WG proposal has been sent to >> the specs council, but I have not seen the proposal yet. >> >> I think this is the proposal: >> http://wiki.openid.net/OpenID-Discovery >> >> _______________________________________________ >> security mailing list >> secur...@openid.net >> http://openid.net/mailman/listinfo/security > > > _______________________________________________ > specs mailing list > specs@openid.net > http://openid.net/mailman/listinfo/specs > > ----- Santosh Rajan http://santrajan.blogspot.com http://santrajan.blogspot.com -- View this message in context: http://www.nabble.com/Are-the-Discovery-Components-Done-Enough--%28Fwd%3A--security--OpenID-Security-Best-Practices-Doc%29-tp23948900p23949321.html Sent from the OpenID - Specs mailing list archive at Nabble.com. _______________________________________________ specs mailing list specs@openid.net http://openid.net/mailman/listinfo/specs
