Simon Willison's Weblog: trackback

Blogmaker, a free blogging app for Django

2007-12-07T01:04:36+00:00

Blogmaker, a free blogging app for Django

“Blogmaker is a full-featured, production-quality blogging application for Django. It supports trackbacks, ping and comments with moderation and honeypot spam prevention.”

Via Michael Trier

Tags: blogging, django, michael-trier, trackback

TrackBack and Pingback supported by CNET News.com

2004-11-24T01:04:47+00:00

TrackBack and Pingback supported by CNET News.com

Blog technolog goes mainstream.

Via Photo Matt

Tags: cnet, pingback, trackback

Signing comments on blogs

2003-07-22T21:10:50+00:00

Adrian Holovaty has implemented reserved comment names in his blog, a feature that prevents anyone apart from him from using the names "Adrian", "Adrian H." or "Adrian Holovaty" when posting a comment. François Nonnenmacher suggests extending the idea to allow people to "confirm" their authorship of comments on any blog using a TrackBack sent to their site that in turn causes them to be sent an alert email, which they can then use to confirm their comment. I like his idea of authentication based on URLs (email addresses are no good; they should not be publically displayed for fear of spam harvesters) but I think I've come up with an alternative authentication scheme that removes the need for the user to manually confirm authorship. This is pretty complicated, so bare with me.

The comment author enter's their comment in to a form on the site. They see a standard icon indicating that the blog in question supports comment signing. Rather than manually entering their name and URL, they activate a bookmarklet that they have previously added to their browser.
The bookmarklet fills in the name and URL fields for them. It also takes the comment, appends a secret key (stored in the bookmarklet) and finds the MD5 hash of the new string, using the Javascript MD5 library. It inserts this hash in to a hidden field in the comment form.
The user can now submit the new comment. That's all they have to do.
The weblog server now kicks in to action. If the comment has not been signed (there is no hash in the hidden field) it adds the comment normally, noting that it should be displayed as an "unsigned" comment on the comments page. End of story.
If it has been signed, the server has some work to do. First it must start loading the URL indicated by the user on the comment form. It is looking for a <link rel="signature"> element, which will provide the URL of a signature authenticating web service. If the </head> tag is reached, the system can assume the link element does not exist and can mark the comment as "unsigned",
If the web service is found, the server can now send it the comment and the User's site URL. The web service (which knows the user's secret key) will respond with a hash created in the same way as the one constructed by the bookmarklet.
If the hash returned by the web service matches the hash provided by the bookmarklet, the comment is considered "signed". The server can store it as such, and later display it with an icon or style that indicates it is a signed comment. If they do not match, the server can either store the comment as "unsigned" or even flag it as "untrusted", since it was incorrectly signed.

As you can see, it's a relatively complicated system. The comment authors must have a custom bookmarklet and add a tag to their home page indicating their authenticating web service URL. Note that they do not need to host the authentication web service themselves - they can instead point to one run by someone else who they trust (trust here is essential as the web service must know the user's private key). Meanwhile, the blogging system needs to be able to perform HTTP requests.

The key advantage of my system is that, being based on MD5, it is relatively easy to implement (as opposed to a system based on something like PGP). Provided no one points out any immediate flaws, I would happily construct a prototype in PHP. I'm sure a Perl implementation for Moveable Type users would not prove much of a challenge to any talented plugin author.

Security wise, it strikes me that the weakest link is the client side bookmarklet which comment authors would need to use. However, comment signing is not the most critical security application in the world and comment authors could easily change their password by updating their bookmarklet and alerting their signature web-service provider (which could even be themselves) of the change.

And if the signature idea doesn't win any favour, the idea of having a bookmarklet to fill in your name and URL in blog comment forms is one I've been meaning to share for some time.

Tags: adrian-holovaty, blogging, hashing, security, trackback, site-upgrades

More Vellum

2003-01-21T11:14:58+00:00

Vellum 1.0a4 is out, and features comment support via a new Comments plugin and an Audience generic object type that abstracts the concept of "responses to your post" and is also used for Pingback support. Different response types within the same interface is a very neat idea, as Sam Ruby has demonstrated with his integrated comments, referral tracking, Pingbacks and TrackBacks. Stuart also suggests auto-discovery of You-Know-Me information from the URL of your weblog, presumably by another link element. This is a great idea, but I have reservations about the performance trade off as unauthenticated comment systems will have to retrieve the poster's home page in the background every time they make a post.

Tags: pingback, stuart-langridge, trackback, vellum

A global conversation

2003-01-19T22:26:40+00:00

Dave Winer on TrackBacks and push backs (and presumably PingBack as well):

I'm old school. I think the cool thing about weblogs is that they are not discussion groups or mail lists. If I want to know what all the people are saying there are ways to do that, but very often I'm content to read email and a few weblogs that I trust. Personally I don't think there's gold in them thar hills, but of course I've been wrong before.

I think Dave has missed the boat on this one by a long way. Just the other day I realised that weblogs (or at least the one's I read) are essentially a huge global conversation. Anyone can join in, but the price of entry is having your own blog and something interesting to say. With those two pre-requisites the social network of the blogosphere does the rest - people will see what you have to say via random browsing, links on other blogs, TrackBack return links and so forth and before you know it your (useful) opinion will be being read by people who normally you wouldn't communicate with in your entire lifetime.

Mark Pilgrim knows this, and his Recommended Reading and Automatic Linkback tools provide him with an excellent way of participating in the global conversation. Dave Winer, as a contrast, appears to treat his blog as read-only - no comments, no trackbacks. There's nothing wrong with this (how someone runs their blog is a very personal thing) but I can't help but think that by doing so Dave is missing out on a truly remarkable example of the two way web in action.

So that's my rant. Unfortunately, seeing as I'm unlikely to feature on Dave's "few weblogs" that he trusts the chances are he'll never read it. Çe la vie.

Tags: dave-winer, pingback, trackback

Stuart's pingback roundup

2003-01-11T17:54:37+00:00

Stuart has a good summary of the recent advances being made in the Pingback/Trackback implementation sphere.

Tags: pingback, stuart-langridge, trackback

Merging comments and pingbacks

2003-01-05T11:17:27+00:00

Tantek:

[...] we now have Trackback and Pingback to help automate generating comment hyperlinks to blog-on-blog commentary. While I certainly applaud these efforts at automating the plumbing, I must ask - why is there any distinction in the presentation? I ask because many blogs present separate and different interfaces for their comments, trackbacks, and/or pingbacks.

A comment is a comment is a comment. Why should it matter whether it was posted using a web form, sent via email, entered into a blog, or posted to Netnews? From a blog reader's perspective, I'd just like to see a list of the comments, and not care (nor know) about how the comment got there. Presentation/interface should be designed to present the data (information), not the underlying plumbing.

Good point (besides, I'm kind of fed up of having a seperate counter for comments and pingbacks under every post). I'm sure I've seen a blog that combines comments, pingbacks and trackbacks in to the same interface - I think it was Sam Ruby's and I'm sure I've seen it elsewhere as well. Something else to add to the list for the forever forthcoming redesign.

Tags: pingback, tantek-celik, trackback

Taking a leaf from Pingback's book

2002-10-10T13:01:26+00:00

Moveable Type 2.5 is out. From the changelog:

Added TrackBack auto-discovery, which can automatically find TrackBack ping URLs based on permalinks in entry bodies. These entries can then be pinged without any extra effort. Inspired in part by the pingback specification.

Tags: moveabletype, pingback, trackback

Pingback and Trackback

2002-09-30T13:16:54+00:00

Hixie has written a whitepaper comparing Pingback to Trackback, and answering pretty much every question that has been asked about Pingback in the past week.

Tags: hixie, pingback, trackback

Pingback implemented

2002-09-02T15:18:27+00:00

I've implemented PingBack on my blog. PingBack is a system for tracking who is linking to your blog in a controlled way, based on a post by Stuart a few months ago. The idea is that when you link to a PingBack enabled blog you (or your blogging tool) should send an XML-RPC "ping" to that blog's PingBack server telling it where you have linked to and where you linked from. The PingBack server can then grab your page, check that the link is there and extract a title and short description from the blog. The system is an alternative to (and was inspired by) MoveableType's TrackBack feature. Stuart and I are actively developing the idea and will be releasing code and documentation to help other people experiment with the system in the near future.

Tags: pingback, projects, stuart-langridge, trackback, xml-rpc, site-upgrades

A better trackback

2002-09-01T11:33:19+00:00

A discussion on Aquarionics nails why TrackBack isn't quite there yet (emphasis mine):

Plus, to support Trackback, I must put what amounts to part of an RSS feed in each post so that Movable Type's Bookmarklet thing can magically know what to do. I don't object to the idea as much as... well, there has to be a better way of doing this.

In the comments attached to the entry Stuart links to his thoughts on a better way of implementing the same functionality, using an XMLRPC server that can be auto-discovered via a <link> element.

Tags: trackback

Trackback roundup

2002-08-30T22:59:38+00:00

Plenty of action on the TrackBack front. Michel V is adding TrackBack support to b2, Moveable Type have released a standalone Perl implementation of TrackBack under the Artistic license, MetaFilter have added TrackBack support and Matt Kingston has published a full blown Homebrew TrackBack Tutorial for people who want to roll TrackBack support in to their own home grown blogs. Yet another thing to add to the todo list...

Tags: trackback

More on TrackBack

2002-07-02T20:23:55+00:00

Phil Ringnalda (now added to my blogroll) has posted his latest thoughts on TrackBack, and he seems to have come on an ideal solution to the problems mentioned earlier. He is now considering keeping the TrackBack RDF data in a seperate file referenced via a <link> tag. This gets around the validation problems and the weirdness of embedding RDF in XHTML in one stroke, but it seems Blogger may have a problem supporting it as it does not have the ability to generate external files.

Tags: trackback

TrackBack

2002-07-01T23:53:06+00:00

MovableType have released version 2.21, which finally introduces support for mySQL and also comes with an intriguing new feature called TrackBack. I'm stil trying to figure out exactly what TrackBack is.. so far I've figured out that it invovles embedding RDF information directly in to your blog which can then be combined with a "ping" to other blogs to inform them that you have linked to them, and give them additional information about your blog for display on a special TrackBack section for each of their blog entries. Scott Andrew has already implemented it and many other MovableType blogs are setting it up as well. TrackBack has its own blog, which has an interesting entry hinting that TrackBack could soon become part of a system for distributed taxonomies (a problem that XFML is also looking to solve).

I'm not completely convinced by TrackBack. The implementation includes RDF embedded in blog entries which breaks XHTML validation (a problem the trackBack developers are already working on - could comments around the RDF data help here?) and I can't really see any advantages over standard referral tracking as implemented on diveintomark. I plan to implement my own referral tracking system soon and I will almost certainly model it on Mark Pilgrim's, although I hope to provide additional information about the referral source gained by parsing their HTML. That said, I'm still trying to understand exactly how TrackBack works so I will reserve judgement until then.

Tags: moveabletype, trackback