6 ms·

The Real Deal About rel="me"

133 points by tempodox 8y ago

forkerenok 8y ago
Reading the article I couldn't get rid of the feeling "gee, what a first world problem" (where by the world I mean the World Wide Web). On the actual topic: Rel="me" sounds bizzarely narrow, at the same time wildcard-ish and borderline narcissistic. Something like Rel="about:author" or Rel="author:blog" seems better to me. Disclosure: not big on web semantics.
- privong 8y ago
  > Rel="me" sounds bizzarely narrow, at the same time wildcard-ish and borderline narcissistic. Something like Rel="about:author" or Rel="author:blog" seems better to me. That article states that this is not the intent of rel="me" but rather: "The me link relationship can be seen as saying: the URL I am pointing to is about the same person as the page I am on." So it's not describing the author so much as noting that the two pages are about the same person.
- detaro 8y ago
  As the article says, it's not for authorship (rel="author" and a bunch of other options), but for connecting profiles. What's borderline narcissistic about that? Is keybase.io also "borderline narcissistic" since you can verify accounts on it, or Github because you can link to your homepage from your profile? (which they actually mark up with rel="me", but that's all rel=me does: make the existing links machine readable, and the bidirectional linking allows some level of verification)
  - forkerenok 8y ago
    Thanks for clarifying and pardon my half-assed reading, I get the idea now! I see the benefit of authenticating personal profiles and protecting people against account hijacking and fake accounts. With "borderline narcissistic" I was referring to the fact that personal profiles are a giant part of the web nowadays (which is sad on some level) and creating even a special rel value for it felt like submitting to the current state of affairs.
    - icebraining 8y ago
      Personal profiles were always a big part of the web; in the 90s, it was all those sites with URLs with a tilde (e.g. https://www-cs-faculty.stanford.edu/~knuth/ https://www-cs-faculty.stanford.edu/~knuth/), and lots of pages on Geocities et all were also personal profiles.
geofft 8y ago
rel="me" for authentication sounds like it could help with the inevitable problem of Mastodon account verification. Instead of putting a verified checkmark on your name, whatever that is supposed to mean, put one on your home page if there's a rel="me" pointing back to the same profile. Parties that don't fully trust you (other federated servers, most likely, but individual clients if necessary) can verify the relationship before displaying the check mark.
- CM30 8y ago
  This is similar to my own idea for how to authenticate a Twitter verification esque setup; having the user upload auto generated files to their server and the site check for those, like how Google verifies accounts in Webmaster Tools. The issue however is that I suspect verification should also have the purpose of verifying that the individual/group doesn't just own a third party domain/resource, but that they're the owners of the version people associate with that name. All these systems make it very easy to just register say 'Microsofte' and end up with a verified account called 'Microsoft' or what not. That's going to allow for a lot of easy impersonation.
- floatboth 8y ago
  IIRC, App.net did exactly that — rel=me based verified checkmarks for the "personal site" field
  - dfee 8y ago
    I tried finding a post-mortem on App.net but couldn’t. What exactly happened with them?
    - mikepurvis 8y ago
      Couldn't generate enough revenue on paid subscriptions to be sustainable. https://en.wikipedia.org/wiki/App.net#History https://en.wikipedia.org/wiki/App.net#History
- epeus 8y ago
  Mastodon now publishes rel=me on profile links, so you can do bidirectional verification between mastodon and other rel=me publishers like github and wordpress, as well as your own site. https://xoxo.zone/@KevinMarks/100616472097157585 https://xoxo.zone/@KevinMarks/100616472097157585
kkaranth 8y ago
I've found that almost all the results I get from Google these days point to some "big site": pinterest, quora, wired, verge, etc. Often, these sites are behind a paywall/login wall, and the content isn't very good either. Is the whole concept of authors publishing their opinions and thoughts on their personal websites dying, or is Google ranking such posts lower?
- jacoblambda 8y ago
  As far as I've seen, it's been both a centralisation of content and heavy abuse of SEO by large sites to force themselves to the top of basically any search. I know I have no interest fighting with SEO and I doubt many of the people who host their own small sites do either.
  - CM30 8y ago
    Maybe also add Google's reluctance to truly punish popular/large websites for dubious SEO tactics. If a lot of them got banned just as easily as smaller sites do for similar things (link buying and networks, thin/duplicate content, etc) the results might be quite different.
- amelius 8y ago
  By the way, why can't I still tell Google to ignore e.g. pinterest or w3schools? Google wants to know everything about me so they can serve me better (they claim), but a simple preference to exclude a website from my search results is not possible?
  - Nadya 8y ago
    >By the way, why can't I still tell Google to ignore e.g. pinterest or w3schools? You can. Use "-site:pinterest.com -site:w3schools.com". To facilitate using it in every search, setup a keyword search so you can type "gsearch blah" and have the querystring automatically add those two filters. I agree there should be a way to add sites to a global blacklist in your user settings if you have a Google account. I'm sure Google has monetary reasons for not doing so though.
Normal_gaussian 8y ago
The largest problem the semantic web is tackling is answering the question that is at the end of the article > If someone has the URI of that thing, what relationships to what other objects is it useful to know about? In many ways, its really a question about the observer than the page; which means the pages seeking to answer it - even for their own special cases - will get the answer consistently, and often subtly, wrong. The upshot is that pages will comply or optimise for particular observers- for financial or political reasons. This makes it very hard for observers not fitting the expected mould to make definitive use of the semantic web. For example, a world in which distributed validation is not immediately politically or financially important (ours) is one in which such schemes as described in the article are faced with a huge problem of being consistently and often subtly broken. User validation isn't something I'd like to be widely broken.
zeveb 8y ago
I really like the Indie Web stuff, and I think that their idea of using one's own website as a login is a great one. The problem is that one actually ends up using some third-party website (e.g. github.com) to run authentication for one — and generally via a fourth (indieauth.com). Adding two extraneous parties to an authentication seems pretty extraneous to me: rather, it'd be a good idea just to specify a way to run web sign-in entirely from one's own site.
- detaro 8y ago
  One can do that, but it's built entirely on a protocol to do exactly this: > just to specify a way to run web sign-in entirely from one's own site and many in the community do not involve third parties. The rel=me thing through IndieAuth.com is merely a trick to get started quickly, by relying on existing identity providers. http://indieauth.net/ http://indieauth.net/

133 points by tempodox 8y ago

Reading the article I couldn't get rid of the feeling "gee, what a first world problem" (where by the world I mean the World Wide Web). On the actual topic: Rel="me" sounds bizzarely narrow, at the same time wildcard-ish and borderline narcissistic. Something like Rel="about:author" or Rel="author:blog" seems better to me. Disclosure: not big on web semantics.

privong 8y ago
> Rel="me" sounds bizzarely narrow, at the same time wildcard-ish and borderline narcissistic. Something like Rel="about:author" or Rel="author:blog" seems better to me. That article states that this is not the intent of rel="me" but rather: "The me link relationship can be seen as saying: the URL I am pointing to is about the same person as the page I am on." So it's not describing the author so much as noting that the two pages are about the same person.
detaro 8y ago
As the article says, it's not for authorship (rel="author" and a bunch of other options), but for connecting profiles. What's borderline narcissistic about that? Is keybase.io also "borderline narcissistic" since you can verify accounts on it, or Github because you can link to your homepage from your profile? (which they actually mark up with rel="me", but that's all rel=me does: make the existing links machine readable, and the bidirectional linking allows some level of verification)
- forkerenok 8y ago
  Thanks for clarifying and pardon my half-assed reading, I get the idea now! I see the benefit of authenticating personal profiles and protecting people against account hijacking and fake accounts. With "borderline narcissistic" I was referring to the fact that personal profiles are a giant part of the web nowadays (which is sad on some level) and creating even a special rel value for it felt like submitting to the current state of affairs.
  - icebraining 8y ago
    Personal profiles were always a big part of the web; in the 90s, it was all those sites with URLs with a tilde (e.g. https://www-cs-faculty.stanford.edu/~knuth/ https://www-cs-faculty.stanford.edu/~knuth/), and lots of pages on Geocities et all were also personal profiles.

geofft 8y ago

rel="me" for authentication sounds like it could help with the inevitable problem of Mastodon account verification. Instead of putting a verified checkmark on your name, whatever that is supposed to mean, put one on your home page if there's a rel="me" pointing back to the same profile. Parties that don't fully trust you (other federated servers, most likely, but individual clients if necessary) can verify the relationship before displaying the check mark.

CM30 8y ago
This is similar to my own idea for how to authenticate a Twitter verification esque setup; having the user upload auto generated files to their server and the site check for those, like how Google verifies accounts in Webmaster Tools. The issue however is that I suspect verification should also have the purpose of verifying that the individual/group doesn't just own a third party domain/resource, but that they're the owners of the version people associate with that name. All these systems make it very easy to just register say 'Microsofte' and end up with a verified account called 'Microsoft' or what not. That's going to allow for a lot of easy impersonation.
floatboth 8y ago
IIRC, App.net did exactly that — rel=me based verified checkmarks for the "personal site" field
- dfee 8y ago
  I tried finding a post-mortem on App.net but couldn’t. What exactly happened with them?
  - mikepurvis 8y ago
    Couldn't generate enough revenue on paid subscriptions to be sustainable. https://en.wikipedia.org/wiki/App.net#History https://en.wikipedia.org/wiki/App.net#History
epeus 8y ago
Mastodon now publishes rel=me on profile links, so you can do bidirectional verification between mastodon and other rel=me publishers like github and wordpress, as well as your own site. https://xoxo.zone/@KevinMarks/100616472097157585 https://xoxo.zone/@KevinMarks/100616472097157585

kkaranth 8y ago

I've found that almost all the results I get from Google these days point to some "big site": pinterest, quora, wired, verge, etc. Often, these sites are behind a paywall/login wall, and the content isn't very good either. Is the whole concept of authors publishing their opinions and thoughts on their personal websites dying, or is Google ranking such posts lower?

jacoblambda 8y ago
As far as I've seen, it's been both a centralisation of content and heavy abuse of SEO by large sites to force themselves to the top of basically any search. I know I have no interest fighting with SEO and I doubt many of the people who host their own small sites do either.
- CM30 8y ago
  Maybe also add Google's reluctance to truly punish popular/large websites for dubious SEO tactics. If a lot of them got banned just as easily as smaller sites do for similar things (link buying and networks, thin/duplicate content, etc) the results might be quite different.
amelius 8y ago
By the way, why can't I still tell Google to ignore e.g. pinterest or w3schools? Google wants to know everything about me so they can serve me better (they claim), but a simple preference to exclude a website from my search results is not possible?
- Nadya 8y ago
  >By the way, why can't I still tell Google to ignore e.g. pinterest or w3schools? You can. Use "-site:pinterest.com -site:w3schools.com". To facilitate using it in every search, setup a keyword search so you can type "gsearch blah" and have the querystring automatically add those two filters. I agree there should be a way to add sites to a global blacklist in your user settings if you have a Google account. I'm sure Google has monetary reasons for not doing so though.

Normal_gaussian 8y ago

The largest problem the semantic web is tackling is answering the question that is at the end of the article > If someone has the URI of that thing, what relationships to what other objects is it useful to know about? In many ways, its really a question about the observer than the page; which means the pages seeking to answer it - even for their own special cases - will get the answer consistently, and often subtly, wrong. The upshot is that pages will comply or optimise for particular observers- for financial or political reasons. This makes it very hard for observers not fitting the expected mould to make definitive use of the semantic web. For example, a world in which distributed validation is not immediately politically or financially important (ours) is one in which such schemes as described in the article are faced with a huge problem of being consistently and often subtly broken. User validation isn't something I'd like to be widely broken.

zeveb 8y ago

I really like the Indie Web stuff, and I think that their idea of using one's own website as a login is a great one. The problem is that one actually ends up using some third-party website (e.g. github.com) to run authentication for one — and generally via a fourth (indieauth.com). Adding two extraneous parties to an authentication seems pretty extraneous to me: rather, it'd be a good idea just to specify a way to run web sign-in entirely from one's own site.

detaro 8y ago
One can do that, but it's built entirely on a protocol to do exactly this: > just to specify a way to run web sign-in entirely from one's own site and many in the community do not involve third parties. The rel=me thing through IndieAuth.com is merely a trick to get started quickly, by relying on existing identity providers. http://indieauth.net/ http://indieauth.net/