Subject: RE: why is atom:id globally unique?

From: "Joe Madia" <[email-masked]>
Date: Fri, 20 Aug 2004 10:42:10 -0700

> (If an aggregator did
> have complete trust in atom:id, I'd be able to publish "updates" to
> anyone's blog entry.)

The issue of intentionally forged IDs is an interesting one that I don't
think I've seen mentioned before.  (Of course, I may have missed any
previous discussions.)  A technical solution to this potential problem
would require some sort of strong authentication, which seems well out
scope for the time being.  Fortunately, the non-technical solution is
pretty simple: identify any such feeds engaging in ID spam and
unsubscribe.

I'd be curious to hear the opinions of any aggregator authors about how
much trouble an attack like this could cause to their applications out
in the wild today.  Would an intentionally forged ID "bleed" from one
feed to another in your existing code base?

Joe