2

I can't make sense of why the Atom spec requires every single entry to have a globally (the entire universe for all time) unique ID. I understand that it's technically possible, but aren't collisions still possible?

If not accidental, definitely malicious collisions could occur. I could choose a New York Times article, and give my spoof site article the same id in it's entry. Thus nullifying any function served, and possibly causing damage.

Why not just have a unique url of the feed, which is easy/safe because it's centrally confirmed by DNS, and then within each feed have locally unique IDs. It's in that author's best interest to maintain their own scheme of non-colliding IDs, and even if they do collide, it doesn't affect some other site's uniqueness.

Pls explain :)

Related question - if there's already a link field in every entry, why does the spec recommend (as one option) to use a link in the id field. Atom was supposed to fix these RSS inconsistencies :)

Dan Lowe
  • 51,713
  • 20
  • 123
  • 112
Ben
  • 149
  • 10

2 Answers2

1

Why not just have a unique url of the feed, which is easy/safe because it's centrally confirmed by DNS, and then within each feed have locally unique IDs.

This point was discussed during the Atom spec drafting, and using URLs as you suggest was a popular position. However, using separate IDs allows feeds and entries to move (for example, see How do you generate a good ID in ATOM documents?).

If you change your feed's base URL, you would need to either change all entry IDs or ensure that redirections from the old URLs were in place. This might be impossible if you no longer controlled the original site.

if there's already a link field in every entry, why does the spec recommend (as one option) to use a link in the id field.

Exactly because, after a move, they would no longer match.

Any publisher that sees their URLs as permanent global identifiers is free to use them as IDs; in this way, the current spec aims to allow both behaviours.

If not accidental, definitely malicious collisions could occur.

In theory, this allows a feed reader to treat items that appear in multiple feeds as identical. In practise, I'm not aware of much software that trusts IDs to be global, leaving them effectively feed-level.

Community
  • 1
  • 1
Joe
  • 29,416
  • 12
  • 68
  • 88
0

UUIDs provide a mechanism to have non-colliding, global identifiers; see RFC4122.

This allows different feeds (or authors) to talk about the same thing. It isn't a security measure, however; as you point out, people can assert something that isn't true.

Mark Nottingham
  • 5,546
  • 1
  • 25
  • 21