Re: Can "http://danbri.org" and "http://danbri.org/" URIs represent different things?

On 1/7/09 12:02, Williams, Stuart (HP Labs, Bristol) wrote:
> Hi Dan,
>
> Had a little play with wget, firefox and tcpmon. Interestingly, http://danbri.org doesn't seem to make it to the request line - all external appearance are that the request is for http://danbri.org/ . Kind of make http://danbri.org web inaccessible.

Thanks for investigating, and to John for digging out the spec citation,
http://tools.ietf.org/html/rfc2616#page-18

I don't see anything in RFC2616 that stops me from claiming the URI to
directly denote me, the person. Common sense makes me wary; it might
quite reasonably be taken to denote a Web site in it's entirety. But
that interpretation isn't widely established either in Web standards.

Let's leave the OpenID aspect aside for now, for clarity. Except:

One thing I learned recently when the danbri.org site was hacked, was
that it is a really horrible experience. In future I want my openid to
be kept WELL AWAY from my blog, my PHP scripts, and other possible entry
points for vandals, spammers, identity thieves etc. Because danbri.org
was compromised (for a while), my OpenID delegation could have been
mis-used, etc etc.

My lesson here is that I want to use a new and separate sub-domain for
OpenID purposes, FOAF files etc. And my main website can be a more
chaotic, risky, lower security affair. So I expect to start using
something like http://id.danbri.org/ as an OpenID. Or perhaps even
http://id.danbri.org/

Can anyone find good reason (from deployment pragmatics, or specs) why

I can't write

  me-the-person: http://id.danbri.org
  my homepage, delegating openid page, etc. ... http://id.danbri.org/

This would be really nice, since at the moment SemWeb people are running
around using either very different URIs for themselves and their
homepages, or putting #me into them. With the above model, they could
essentially put *almost* the same URL on their sig files, biz cards
etc., and let the browser correct the difference transparently.

No browser knows to add or remove "#me" yet, by contrast.

> Note wget and firefox both appear to make request for http://danbri.org/ - which is what gets rewritten into the browser address bar - no redirections, no content-location... all before fact of making the request.

So they're different URIs, and the shorter one does NOT return a 200. It
can't be de-referenced directly, only adapted by universally known rules
into a different URI. The adaptation step is under-documented, and
doesn't make explicit whether the "before" and "after" forms denote
different things. Is that a fair reading?

> So a bit like using #'d URI, the URI that makes it to the request line is different from the one used in the reference.

Yup. But it would make for a much more consistent story with other
"social Web" folk who like URIs for people too...

Domain name registrars might be happy also.

cheers,

Dan