Blog posting delegation and third-party auth

2007-03-05T22:13:45+00:00

Here's something I've been meaning to post about, brought back to mind from Kim Cameron's post on "Wrong-headed impersonation":

I wish that blog posting interfaces (ie. MetaWeblog API and Atom Publishing Protocol) offered a way to delegate blog posting to a 3rd party app (desktop or web) in such a way as to avoid providing one's login details (i.e. user name and password). For instance, consider both Flickr's and Upcoming's 3rd party token-based authentication / authorization schemes.

In particular, I'm looking at things like del.icio.us' own Daily Blog Post and others. These can be used to auto-post content to one's blog generated elsewhere - but at the price of sharing login details. Granted, you can mostly trust these 3rd parties not to do anything nasty with your credentials, but it would be nice not to have to.

I figure that something RESTful like extending HTTP authentication (ala Atom Authentication) with a token scheme could be interesting, and possibly fit nicely into APP itself. It could probably be retrofit into the MetaWeblog API by specifying a per-app user name and password. I can imagine a WordPress admin plugin that issues approved authentication tokens to restrict the categories and other activities allowed by 3rd party apps.

Just something I'm thinking about, as more services may or may not grow into delegated blog posting.

Archived Comments

fluffy
2007-03-05T22:40:26

Wouldn't openID be a better candidate for this?
l.m.orchard
2007-03-05T22:48:24

Not really, unless I don't entirely understand OpenID.

OpenID offers way to authenticate yourself. However, what I want is an easy way to delegate your access to 3rd party apps, without those apps being able to authenticate as you or performs actions outside of the permissions you approve. I don't really want Flickr Uploader, Ecto, MarsEdit to be able to use OpenID to login as me with carte blanche.

With a token-based system like Flickr has, I can approve delegation to various apps and revoke their access at any time - without ever releasing my login details.
George Hotelling
2007-03-06T17:51:55

At first I had this great idea to build a blog posting proxy service that could grant access to your blog to different services by giving them different usernames and passwords and you could revoke them at any time and it would be great and everyone would be posting to everyone's blog all the time.

Then I realized I had put on complicator gloves and that it would be way easier to just add new users to my blog without a proxy service.
l.m.orchard
2007-03-06T18:04:57

Yeah, I figured making multiple accounts is a way to go when you've got your own install of something like WordPress. It kind of gets stymied, though, if you want the same thing for a hosted service like WordPress.com, Vox, TypePad, or LiveJournal where one account = one blog.
Ian McKellar
2007-03-12T17:43:49

It seems to me that the ideal solution to this is to have your blog pull new posts from an RSS/Atom feed that's hosted by the service that is generating your content. Feedburner already has a half-assed implementation of this where they'll pull your delicious bookmarks and flickr photos into your burned feed.
l.m.orchard
2007-03-12T17:58:35

@ian: Hmm, yeah, that probably does end up being the least onerous solution - just offer an aggregated feed of one's output. I do like the idea of auto-posting to a blog, though, for the sake of something sorta like daily backups to a system I control.
Ian McKellar
2007-03-12T18:44:46

@l.m.orchard: you don't need to just aggregate you can also import posts into your own store. We could come up with a cleverly confusing buzzword acronym like Atom Pull Publishing. You just periodically poll a feed and import the items. Actually, this is kind of what Google Reader is doing. They've even got a namespace in their atom for expressing the original id and the source feed. Perhaps I should write a drupal module.
l.m.orchard
2007-03-12T19:01:45

@ian: Hmm, yeah, that does sound like the least complicated way to get outside content pulled into a blog without releasing the blog's login details. I know I've seen / used some WordPress plugins that do basically that, though I've not been happy with any of them yet. I should re-look into why that's been the case
Ian McKellar
2007-03-12T19:26:16

@l.m.orchard: in my experience the problems are with the formatting of the content (do blank lines turn into paragraphs, etc) and fragile post IDs (the upgraded wordpress and spammed all my friends on livejournal or planet problem). I'm not sure how to fix either of these problems but I think they're both problems Atom is attempting to solve...

Time-release Syndication

2005-10-21T03:45:54+00:00

Want to read Cory Doctorow’s new book, Someone comes to Town, Someone leaves Town, via RSS?

This chicklet will let you do just that…doesn’t matter when you first subscribe, this feed will deliver the book to your feed reader in the right order, a couple of chapters a day, over the next month. You could even subscribe via WINKsite and get it all on your mobile phone…

Source: Surfarama » RSS for serialized content

I've been toying around with a few ideas for something like this for a few years, but have never bothered to finish any of them. Russell Beattie had an interesting implementation of this too.

But, just in case I never actually do anything with this notion, here's a free idea—I wonder how many aggregators actually obey a 301 Moved Permanently HTTP status code?

Simon Willison wrote about this notion: A reader subscribes using a clean and simple feed URL, but the aggregator receives a 301 redirect upon the first GET. This redirect shifts the subscription over to a new feed URL with a unique ID for the reader, thereby uniquely tagging every new subscription to the feed. The aggregator should then continue to use this tagged URL for all future requests.

However, tagging a subscriber with an RSS radio collar implies that you'll have a database on the server maintaining notes tied to those IDs. That might be cool if I'm trying to gather some metrics, but for simple time-release syndication I don't really care about tracking a person. I want to track a start time.

What if this post-redirect feed URL had the time of initial redirect in it, and the time release was just a function of the duration since that initial redirect? Anonymous and no need for a database. My notion is that I'll just need a PHP script and a fully-formed "master feed" on which the time-release feed will be a time-bounded "viewport" informed by a little date math.

Or, maybe I'll have a pile of pre-prepared content in a folder and munge that into a feed. Imagine a podcast like Scott Sigler's Ancestor, all queued up and ready on the server, but doled out automatically on a weekly basis from the beginning from the point you subscribed. I'll leave as exercises for the reader issues of "obfuscating" URLs so that people can't easily skip ahead through the story.

Archived Comments

kellan
2005-10-21T04:16:34

My favorite example of this is Matt Webb's service which offers RSS feed of your personal light cone
Martin Atkins
2005-10-21T07:06:00

This scheme falls down in two ways. Firstly, people have a tendency to share URLs, and when they do they tend to just take whatever's in their user-agent (your timestamped URL) rather than your pretty entry point URL that lives only on some HTML page somewhere.

Secondly, lots of people use "shared aggregators", which reduces load on your server but requires that everyone is seeing the same content.

It's a nice idea, though. Its a shame that syndication tech ended up making it so tricky.
l.m.orchard
2005-10-21T10:54:22

@Kellan: Heh, I thought that one was kinda silly, but neat... It's in my subscription list.

@Martin: D'oh, that's right. Even podcasts are being heard via shared aggregators now like Odeo.
Pete Prodoehl
2005-10-21T17:14:17

Delta Park Project is a podcast that provides you with your own RSS feed url. I'm not exactly sure what they do with it, but for now I trust them not to do any evil.

0xDECAFBAD - Tag: rest

Blog posting delegation and third-party auth

Archived Comments

Time-release Syndication

Archived Comments