Introducing Pond: A New RSS+Atom Syncing Protocol • Hacker News Board

Re: Introducing Pond: A New RSS+Atom Syncing Protocol

#11

Post by ArturoVM » Tue, Nov 26, 2013, 2:42 AM UTC

marshray wrote: post #9

ArturoVM wrote: post #6

Earlier quoted context omitted.

TLS/SSL will be a requirement soon, with some form of "bearer token" auth scheme. At least for the reference implementation. The MD5 hash is there to mitigate two issues, currently: some (or most) common users won't pay for a certificate, so instead of sending the password in cleartext, it's hashed as an MD5 to avoid exposure—all of this, of course, is no guarantee against MITM. Which leads us to the second issue: mo…

Transmitting MD5(password) is really no better than just sending the password (except maybe for the top 20% or so strongest passwords).

Auth is a WIP. Anybody who has suggestions and candidates for auth schemes, is welcome to send them to the mailing list, so we can improve the protocol :) pond@librelist.com

Re: Introducing Pond: A New RSS+Atom Syncing Protocol

#12

Post by nl » Tue, Nov 26, 2013, 3:06 AM UTC

ArturoVM wrote: post #5

nl wrote: post #3

It's not really a syncing protocol - a syncing protocol is something more like FeedSync (formally SSE)[1]. This looks more like an API for a feed reader type application. From a quick read it looks mostly ok for that (although I'd question why...) Out of interest, why not implement a read-only version of rfc5023/AtomPub[2]? Anyway... I'd suggest you get rid of the "Article" Object, and use the Atom "Entry" object ins…

Thank you for your feedback (and the links). Changing "Article" to "Entry"—noted. As for doing away with the custom schema and using the Atom serialization you posted: it's worth noting the protocol is meant to sync with Atom _and_ RSS transparently; to keep things simple and consistent, a middle ground has to be found. `since_date` is something I'm working on.

Atom is a superset of RSS (to be more precise, it's a superset of all the different RSS dialects, properly specified).

Re: Introducing Pond: A New RSS+Atom Syncing Protocol

#13

Post by tptacek » Tue, Nov 26, 2013, 3:11 AM UTC

ArturoVM wrote: post #7

grinich wrote: post #2

You might consider changing the name. There's a new crypto messaging project started by some folks at Google called Pond: https://pond.imperialviolet.org/ https://github.com/agl/pond It's pretty much impossible to avoid naming collisions for projects. :-/

Yeah, I caught that :/ thanks! I have been working on the project for 6 months now, and I even tweeted the author of that project when he posted it, but he just ignored me haha :(

Pond is probably more than 6 months old, and is an important project. If I were in your shoes, I'd just change the name.

Hopefully, in a couple years, we'll know Langley's Pond by a different name: "email".

Re: Introducing Pond: A New RSS+Atom Syncing Protocol

#14

Post by ArturoVM » Tue, Nov 26, 2013, 3:19 AM UTC

nl wrote: post #12

ArturoVM wrote: post #5

Earlier quoted context omitted.

Thank you for your feedback (and the links). Changing "Article" to "Entry"—noted. As for doing away with the custom schema and using the Atom serialization you posted: it's worth noting the protocol is meant to sync with Atom _and_ RSS transparently; to keep things simple and consistent, a middle ground has to be found. `since_date` is something I'm working on.

Atom is a superset of RSS (to be more precise, it's a superset of all the different RSS dialects, properly specified).

True. But there are certain elements that vary greatly between specs (or rather, between spec and... suggested format?). For example, the `person` construct, the `text` construct, etc, which are rather inconsistent and flat in the RSS spec. If it were all fire–and–forget, I could rest at ease knowing it's a superset, but most differences are not additive.

Re: Introducing Pond: A New RSS+Atom Syncing Protocol

#15

Post by ArturoVM » Tue, Nov 26, 2013, 3:32 AM UTC

tptacek wrote: post #13

ArturoVM wrote: post #7

Earlier quoted context omitted.

Yeah, I caught that :/ thanks! I have been working on the project for 6 months now, and I even tweeted the author of that project when he posted it, but he just ignored me haha :(

Pond is probably more than 6 months old, and is an important project. If I were in your shoes, I'd just change the name. Hopefully, in a couple years, we'll know Langley's Pond by a different name: "email".

You are absolutely correct. Guess I should seriously think about it.