Current standards for robot exclusion, robots.txt and robots META tag, are effective only for page level robot exclusion directives.  In light of Google versus Blog controversy, I think it makes sense to introduce finer-grained robot exclusion tags.  Here is a sketchy proposal:

<robots> Tag

<robots> tag advises web robots whether data and links following the tag are indexable and/or followable.  <robots> tag may be used in HTML or integrated into XML application-specific schemas.  It has only one attribute, 'content', with same case-insensitive values as the content attribute of the robots META tag, specifically ALL, NONE, INDEX, FOLLOW, NOINDEX, NOFOLLOW.  'content' attribute is required.  <robots> tag is an empty tag, meaning it has no child elements nor textual contents.

<robots> tag's namespace URI is "http://www.robotstxt.org/xmlns&quot;.  Namespace declaration is not required in HTML documents.

HTML Example:

  <robots content="noindex" />
  <table id="blogroll">....</table>
  <robots content='index' />
  
...

XML Example:

 <channel>
 <robots content='none'
 xmlns="http://www.robotstxt.org/xmlns"/>
 <title>Don Park's Blog</title>
 ...
 <item>
 <robots content='all'
 xmlns="http://www.robotstxt.org/xmlns"/>
 <description>...</description>

Processing Guidelines

• With HTML documents, robots may search <robots> tags by searching for string pattern "<robots" to find next indexable and/or followable areas of the document.

Check out this short Business 2.0 piece showing how each dollar collected per song is divided up.  Artists get 12 cents out of a dollar.  The music download service (i.e. Apple) gets 40 cents.  That leaves 48 cents up for grab as music download industry emerges, expands, and consolidates while the real world music distribution business shrinks.  I expect record companies will start to dwindle during the expansion phase as they start losing artists to the music download industry.  There will still be middlemen, but record companies will be left with peddling only oldies.

Here is another great post from java.net weblogs about another orphaned Java package: javax.comm.

"If Sun really wants to see Java applications on the desktop, it needs to finish the tools–all the tools–that people need to write those applications. And that includes javax.comm. I couldn't argue that javax.comm should be a high corporate priority, but there's a solution to that: contribute javax.comm, javax.sound, and any other APIs that have been orphaned over the years to the community. The "write once, run anywhere" story is GREAT, and it REALLY WORKS–but it doesn't count if it's "write once, run anywhere, as long as you don't need to talk to any devices out there."

Weblogs are important part of Java.net although one needs to stroll around a bit to find them.  I usually go here to find new articles.  Here are two articles worthy of mention this week:

In Whats up with the JavaSound team?, Jonathan Simon discovers that entire JavaSound team split a while back and now there is just one hardworking guy wearing many hats.

This is ridiculous on a number of levels! How does Sun expect to put out a decent product with a single guy responsible for all of JavaSound? Also, the code was poorly designed to begin with, and Florian can't even really change it! So whats left is a really buggy, poorly designed library that is on every Java enabled PC!

Michael Champion, an old compadre from XML-DEV, answers the question "When does SOAP add value over simple HTTP+XML?" and concludes with:

It's just as "wrong" to blindly reject SOAP as to blindly accept. it.

<

p dir=”ltr”>Right on, Michael.

Writing about ambient devices and reading about Gartner Group's recommendation against investing in intrusion detection systems (IDS), I thought this might be a good time to talk about ambient security: protection that weaves into your daily life without being obtrusive.

Most of today's authentication technologies works like locked doors and intrusion detection systems works like security guards laying traps, walking rounds, and examining logs.  To enter a door, you open it with a key.  Problem with this approach is that you have no idea who might have entered the door other than you.  Likewise, security guareds have to guess whether someone who entered is an intruder or not.  You and the security guards, one clueles and the other balancing between false alarms and security with guessworks, all because information is not shared between the two.

While I was working at Arcot Systems, I came up with novel ways (read patent-pending) to solve these problems in both the real world and online.  The core idea is to give users ambient information (aka full-court awareness) necessary to actively participate in intrusion detection.

One application is to ambiently display login time and duration over past seven days during entry or while inside the protected area.  The user can usually remember last seven days of activities so they can notice and flag suspicious activities.

Another application, this time in the real world, is to print recent creditcard purchase activities visually on creditcard receipts so I can ask my wife as I sign the restaurant bill, "Honeybunny, did you go somewhere far and buy something expensive yesterday?"

People talk about abundance of processing power at the edge, but very few realize that there are even greater processing powers beyond the edge: humans.  Tapping that potential is not easy, requiring skills beyond cryptography or user interface designs, but potential ROI is huge in all aspects including user confidence.

Update: In light of ideas I presented here, Gartner's recommendation against IDS in favor of better firewalls seems pretty silly.  I wonder how long Gartner will wait before advising against firewalls in favor of something else?  Firewalls are like the guard at the gate and IDS is like the sitting in a room full of monitors.  Both are working with limited information which leave a lot of room for infiltration.

For better security, everything and everyone involved must work together as a team.  If you expect to get better security simply by getting an expensive box and flipping a switch, you got a big problem no matter where you place the box.