A couple of good questions I have seen, and my best attempt to answer them:

1. Don't you mean rel? No, I mean rev. It indicates a reverse link.

2. Why not make your URLs short in the first place? I happen to like my URLs and have made them as short as I want them. They're only too long in some very specific use cases, like Twitter. I could just complain about Twitter, or I could support an idea that makes URL shortening suck less. I chose the latter.

Thanks for reading, and please do feel free to criticize whatever you think is wrong with this idea. I'd like a way to indicate a preferred short URL for my own stuff, and this seems like a pretty good way to do it that makes sense semantically and is easy to implement. For an ongoing discussion about adding an HTTP header to do the same thing (so that only a HEAD request is required), read here:

http://shiflett.org/blog/2009/apr/a-rev-canonical-http-header

The safeguard you're describing protects against CSRF and has nothing to do with XSS.

With Plone, you can see what is possible...with Zope. With Zope, you can see what is possible with Python.

The problem here is that Plone is not a language; it is a CMS. And Zope is not a langauge; it is a framework that happens to be written in the language Python. Python otherwise shares the same problem as PHP: when you start a new project, you either have to find some existing code or reinvent the wheel. Zope minimizes this by providing a framework in which you can work and find a lot of the code you already need -- the wheel is already there.

There are many, many PHP frameworks out there that try to fill this need. The trouble is that there isn't a single PHP framework that has achieved the same level of notoriety as Zope. However, more and more people are using PEAR [pear.php.net] as a framework, and the beauty of PEAR is that you don't have to use the entire framework in one installation; you can pick and choose.

So, people in the PHP community are working to solve the wheel reinventing problem; it's just that many people either don't know about it or don't want to learn to use the existing frameworks.