Terence Eden wrote a blog about a proposal for, essentially, “You want my avatar? Fine, you have my email address, go get it yourself.” Which, I must say, I like the premise. A lot.
Since the key, in this exchange, is a person’s email address, the proposed service would most likely be something handled by an email provider. I mean, if a user signs up for SwellNewSite with their email, user@example.com, then the backend worker queue at SwellNewSite.biz is going to have to reach out to avatar.example.com (maybe that host name is a new TXT record that we expect email hosts to fill out?) so that it can request, “Hey, got any pictures I can use for your person, user@example.com?”
Like, distributed is good. I like distributed. I don’t even mind that distributed means there has to be a bit more communication and support infrastructure. But here’s a thing: I don’t host my own email any more. Haven’t done for 20 years. There’s a reason for that, and that is that, 20 years ago, it was too much work to keep up with security patches and new anti-spam requirements. It hasn’t gotten any simpler since then. So, adding this new feature — presumably with a bunch of permissions and logic and extra storage that, mind you, have nothing to do with SMTP — to the job of “be an email provider” feels a bit much.
On the other hand, there are already services that collect avatars for their users. I mean, that’s the very thing that inspired the proposal. And there’s also already a precedent for a protocol where user@example.com wants to do something at SwellNewSite and they tell the site, “You want info? Great, go ask MyFavoriteSite for it, and tell ‘em I sent you.” Yes, I’m talking about OAUTH.
An OAUTH provider is already collecting a bunch of information about the individual. Email, name, some secret, and probably more stuff (for example, the list of other sites the person uses OAUTH to authenticate with, the last time they did so…) and an OAUTH provider is already in the business of responding to web requests from other sites, asking for data about and on behalf of their users. So, rather than spin up a new service that overlays some dynamic content onto the static .well-known path, how about we just add an optional avatar payload to the OAUTH token? A requesting site can specify that, as well as wanting your email address, it wants your avatar. This is even where the requesting site can negotiate things like image size and format. Then, as part of the user creation/login flow, the avatar can get copied into the user’s profile. Next login, the avatar could be updated (or not, if it’s unchanged — maybe there’s a hash? modification date?), and if the user never logs in again, then the avatar is just a snapshot in time from that one time the user used the service.