Comment Authentication Prototype
24th July 2003
I’ve built a prototype of the comment signature system discussed earlier. The prototype consists of an authentication server which anyone can register with and support on this blog for verifying signatures. So far it seems to work.
To gain the ability to sign comments:
- Add the following HTML to the head section of your homepage/weblog:
<link rel="sigserver" href="http://simon.incutio.com/auth/confirm" />
- Create a comment authorisation account.
- Log in to your authorisation account and add the bookmarklet it provides you with to your browser.
- You can now sign a comment on this site (and any others that support the prototype) using the bookmarklet. You must activate it while looking at the entry page containing the ’Add Comment’ form. The site will do the rest. Note that the bookmarklet will fill in the name, email and url fields on the form, saving you the hassle.
To add support for comment authentication to your own blog (assuming it uses PHP):
- Grab this file: sig-confirm.inc.php. It contains a function which can be used to confirm a signature. It requires IXR, which you can download from here.
- Make some minor modifications to your ’add comment’ form, to make it compatible with the bookmarklet. You need to assign ID attributes to the input fields for name, email and URL of ’commentFormName’, ’commentFormEmail’ and ’commentFormURL’ respectively. You also need to add a hidden field like this one:
<input type="hidden" name="signature" id="commentSignature" value="" />
- Modify the code that processes the add comment form. If ’signature’ is not an empty string, the comment has been signed so confirm the signature by calling the confirmSig() function (documentation of the arguments is included in the sig-confirm.inc.php file). If the function returns true, flag the comment as signed. I suggest doing this by saving the signature variable along with the rest of the comment.
- When displaying comments, be sure to visually indicate comments that are “signed”.
The system is decentralised, so if you want to host your own authentication server rather than relying on mine feel free to grab the PHP code (warning: it’s a bit of a mess) and use it as a starting point.
This is more of a proof of concept than anything else, so feedback and suggestions would be very welcome.
More recent articles
- Datasette Enrichments: a new plugin framework for augmenting your data - 1st December 2023
- llamafile is the new best way to run a LLM on your own computer - 29th November 2023
- Prompt injection explained, November 2023 edition - 27th November 2023
- I'm on the Newsroom Robots podcast, with thoughts on the OpenAI board - 25th November 2023
- Weeknotes: DevDay, GitHub Universe, OpenAI chaos - 22nd November 2023
- Deciphering clues in a news article to understand how it was reported - 22nd November 2023
- Exploring GPTs: ChatGPT in a trench coat? - 15th November 2023
- Financial sustainability for open source projects at GitHub Universe - 10th November 2023
- ospeak: a CLI tool for speaking text in the terminal via OpenAI - 7th November 2023
- DALL-E 3, GPT4All, PMTiles, sqlite-migrate, datasette-edit-schema - 30th October 2023