<?xml version="1.0" encoding="ISO-8859-1"?>
<!-- OPML generated by OPML Editor v11.0.6 on Sat, 17 Dec 2011 16:43:22 GMT -->
<opml version="2.0">
	<head>
		<title>Conclusions about oEmbed</title>
		<dateCreated>Sat, 17 Dec 2011 14:57:44 GMT</dateCreated>
		<dateModified>Sat, 17 Dec 2011 16:43:22 GMT</dateModified>
		<ownerName>Dave Winer</ownerName>
		<ownerEmail>dave.winer@gmail.com</ownerEmail>
		<expansionState>1, 4</expansionState>
		<vertScrollState>1</vertScrollState>
		<windowTop>144</windowTop>
		<windowLeft>986</windowLeft>
		<windowBottom>1276</windowBottom>
		<windowRight>2125</windowRight>
		</head>
	<body>
		<outline created="Sat, 17 Dec 2011 14:57:44 GMT" ctSaves="31" flPreview="false" id="2011.12.17.1527" server="xmlrpc://cms.scripting2.com:5337/RPC2" storySerialNum="1527" text="Conclusions about oEmbed" type="scripting2Post" url="http://scripting.com/stories/2011/12/17/conclusionsAboutOembed.html" username="davewiner" versionClient="0.44" versionServer="0.44" whenLastSave="Sat, 17 Dec 2011 16:43:22 GMT">
			<outline created="Sat, 17 Dec 2011 14:49:30 GMT" pgfnum="11618" text="0. Disclaimer. Rather than hold my conclusions to myself, it's better to put them out there and let them be debugged publicly. None of this is personal, so I hope people don't take it personally. "></outline>
			<outline created="Sat, 17 Dec 2011 14:50:08 GMT" pgfnum="11619" text="1. The &lt;a href=&quot;http://oembed.com/&quot;&gt;oEmbed spec&lt;/a&gt; documents two ways to get from the HTML source of a page to the content it contains. One method is simple, let's call it the link method. I could implement it in an afternoon for the &lt;a href=&quot;http://scripting2.com/&quot;&gt;Scripting2&lt;/a&gt; blogging software. I have something very much like it, already working. Each story on this site, including this one, has a link to an &lt;a href=&quot;http://scripting.com/stories/2011/12/17/conclusionsAboutOembed.opml&quot;&gt;OPML document&lt;/a&gt;. From there, any kind of rendering is possible. The key thing is I'm getting to all the content of the page, with none of the overhead/template stuff. One link element &lt;a href=&quot;http://scripting.com/images/2011/12/15/whereToFindTheLink.gif&quot;&gt;in the HTML&lt;/a&gt; is all it takes to make this work."></outline>
			<outline created="Sat, 17 Dec 2011 14:51:26 GMT" pgfnum="11620" text="2. No one implements the simple way. They all do the complicated way. ">
				<outline created="Sat, 17 Dec 2011 16:11:26 GMT" pgfnum="11635" text="See section 0, above."></outline>
				</outline>
			<outline created="Sat, 17 Dec 2011 14:51:49 GMT" pgfnum="11621" text="3. There's a short list of service providers included in the doc. Pragmatically, if you want to be part of the oEmbed club, you have to get them to list your service in the &lt;a href=&quot;http://oembed.com/#section7&quot;&gt;implementations&lt;/a&gt; section of the spec. Otherwise how would people find out about your service?"></outline>
			<outline created="Sat, 17 Dec 2011 14:52:32 GMT" pgfnum="11622" text="&lt;img src=&quot;http://scripting.com/images/2011/12/17/joeMontana.gif&quot; width=&quot;145&quot; height=&quot;262&quot; border=&quot;0&quot; align=&quot;right&quot; hspace=&quot;15&quot; vspace=&quot;5&quot; alt=&quot;A picture named joeMontana.gif&quot; class=&quot;storyImage&quot;&gt;4. The simple way of doing it has ample prior art and works well. &lt;a href=&quot;http://scripting.com/stories/2011/12/17/rssAutodiscovery.html&quot;&gt;We use it in RSS&lt;/a&gt; for connecting feeds to HTML pages. And for &lt;a href=&quot;http://tales.phrasewise.com/rfc/rsd&quot;&gt;RSD&lt;/a&gt;, which tells editing software who to call to edit the source of the page (which seems fairly related to oEmbed)."></outline>
			<outline created="Sat, 17 Dec 2011 14:53:27 GMT" pgfnum="11623" text="5. I think the security argument is bogus. The oEmbed spec has a &lt;a href=&quot;http://oembed.com/#section3&quot;&gt;section&lt;/a&gt; that explains how to keep a bad actor from doing a XSS exploit or accessing cookies they have no right to access."></outline>
			<outline created="Sat, 17 Dec 2011 14:54:15 GMT" pgfnum="11624" text="6. The security argument is no different from the argument against embeds in general. We embed tweets from Twitter or videos from YouTube without questioning what they might inject into our reader's browsers. Why does &lt;a href=&quot;http://scripting.com/stories/2011/12/16/wordpressAnd&quot;&gt;WordPress trust&lt;/a&gt; them more than they trust me? I think this problem has to be addressed in some other way. "></outline>
			<outline created="Sat, 17 Dec 2011 14:55:29 GMT" pgfnum="11625" text="7. I would deal with the security issue differently. Strip all markup. And use a structural format like OPML so the way the page is arranged can be transmitted without taking any risks that something nefarious is coming along for the ride. "></outline>
			<outline created="Sat, 17 Dec 2011 14:56:29 GMT" pgfnum="11626" text="8. If I implement it I will only use the simple method. I don't see any upside in using the complex method. I will listen to what the oEmbed spec says to do from a security standpoint. "></outline>
			<outline created="Sat, 17 Dec 2011 16:12:20 GMT" pgfnum="11636" text="9. I also include a link to the OPML in my RSS feed. &lt;a href=&quot;http://scripting.com/images/2011/12/17/linkToSource.gif&quot;&gt;Screen shot&lt;/a&gt;. I &lt;i&gt;want&lt;/i&gt; you to find it, so I leave little hints around everywhere I can think of. :-)"></outline>
			<outline created="Sat, 17 Dec 2011 14:57:33 GMT" pgfnum="11627" text="Anyway, that's my thinking on this for now."></outline>
			</outline>
		</body>
	</opml>
