What makes a protocol survive

We are designing a protocol for high scores, which is a good reason to look at what happens to protocols.

The survival rate is bad, and the survivors have almost nothing in common technically. What they share is structural, and it is learnable.

The ledger

1. Adoption first, specification later

robots.txt was proposed by Martijn Koster in 1994 on a mailing list. It became a de facto standard within months because the major crawlers of the day simply obeyed it.

It was published as an official internet standard, RFC 9309, in 2022. That is twenty-eight years of universal use with no standard at all. The RFC did not create the convention. It documented one that had already won.

Compare the other direction: SOAP, WSDL and UDDI were specified thoroughly, by committee, before anyone needed them. All three are gone, replaced by people posting JSON at URLs and calling it REST.

A specification written before adoption is a prediction. A specification written after adoption is documentation. Only one of those is reliable.

2. An open write endpoint gets spammed to death

This is the one that should terrify anyone building a score protocol, and it is the closest historical parallel we have.

Trackback let one blog tell another that it had linked to it. Beautiful idea, genuinely useful, immediately abused. The first wave of trackback spam hit in 2004 and never stopped. Today the estimate is that 99 percent of all trackbacks and pingbacks are spam, and the feature survives in blog software only for backward compatibility.

Now the important detail, because it is the one everybody skips.

Pingback was the fixed version. It had verification. When it received a notification it went and fetched the linking page to confirm the link actually existed. That is exactly the kind of check a sensible engineer adds.

Spammers set up throwaway pages that genuinely contained the link, sent the pingback, and passed verification.

The verification worked perfectly and the protocol died anyway. The attacker did not break the check. He satisfied it.

Any protocol that accepts writes from anonymous senders will meet this. A high score endpoint is a write endpoint. Anyone can post any number, and the moment there is any reason to want a name on a leaderboard, someone will automate it.

3. One large adopter makes a protocol

RSS existed for years as a minor syndication format. Podcasting made it infrastructure, because a large distributor built on it and every publisher had to follow.

robots.txt spread because the crawlers that mattered obeyed it. Not because it was elegant.

Protocols do not spread on merit. They spread when somebody with a large audience makes following them the cheaper option. The design question is therefore not "is this good", it is "who is the first adopter big enough that others must follow, and what would make it trivially cheap for them?"

4. Embrace, extend, extinguish is a real ending

XMPP was the open standard for instant messaging. Google Talk adopted it and federated with the wider network, which looked like a triumph for open standards.

The size difference was the whole story: Gmail had well over a hundred million active users, XMPP around five million. In 2013 Google shut down server-to-server federation and moved to Hangouts, which does not interoperate. The Electronic Frontier Foundation's write-up was titled "Google Abandons Open Standards for Instant Messaging". Facebook ended its XMPP support in 2015.

XMPP still exists. It is technically fine. It lost anyway, and it lost hardest at the moment it was most successful, because success meant a giant joined and then left with the users.

Being adopted by someone far larger than you is not obviously a win.

5. Simple beats complete, every time

SOAP could describe anything. REST could describe less and required no tooling. REST won so completely that most developers now using it have never read a spec for it.

RDF and the full Semantic Web could model all knowledge. schema.org, a far cruder subset with a vocabulary and no philosophy, is what actually ended up in billions of pages.

Atom was the technically better feed format. RSS won because it was already there.

The pattern is not that quality loses. It is that the cost of a first correct implementation decides adoption, and completeness always raises that cost. A protocol you can implement wrong and still have work is a protocol that spreads.

6. The name is not neutral

Two observations from the ledger.

UDDI stood for Universal Description, Discovery and Integration. It is entirely dead. UPnP, Universal Plug and Play, survived and is mostly known today as a security liability. Meanwhile HTTP, SMTP and FTP say only what they do, in the dullest possible terms, and run the world.

"Universal" is a claim about the future written into a name that has to survive the present. It ages badly in both directions: unearned if the thing stays small, redundant if it wins.

The names that lasted are descriptive and boring, or they are short words that became nouns: Atom, Gopher, Matrix, Webmention. What almost never works is a name one letter away from an existing famous protocol. It reads as a typo, it collides in search, and it inherits expectations it cannot meet.

What we take into our own design

Written down before we build it, so it can be held against us later.

No spec before adoption. Ship the smallest thing that works, document what it actually does, and only formalise if it spreads.

Assume the write endpoint will be abused, and design for tiers rather than truth. Trackback proves verification alone does not save you. Twin Galaxies, forty years earlier, arrived at the same answer from the other direction: separate lists with separate rules, because "verified" and "unverified" are both useful and only dangerous when mixed.

Make a first correct implementation nearly free. If it takes more than one line to submit a score, we have lost to the effort budget of a jam game.

Do not build in a dependency on us. The record should be a document anyone can accept, not a call to our server. That way we can be replaced rather than mourned.

Be careful about who adopts it. A large platform adopting our protocol looks like the goal and is also the XMPP ending.

---

Sources

• robots.txt: proposed by Martijn Koster in 1994, de facto standard within months, published as RFC 9309 in September 2022 after Google proposed formalisation on 1 July 2019
• Trackback and pingback: first spam wave 2004; current estimates that 99 percent of trackbacks and pingbacks are spam; pingback link verification defeated by throwaway pages carrying genuine links
• XMPP: Google Talk federation ended 2013, Hangouts non-interoperable, Electronic Frontier Foundation, "Google Abandons Open Standards for Instant Messaging", May 2013; Facebook ended XMPP support 2015; relative scale of Gmail versus XMPP userbases as reported at the time
• SOAP, WSDL, UDDI and the WS-* stack; RSS and Atom; RDF and schema.org, from the general record of web standards adoption

Retrieved 4 August 2026.

Related: The graveyard of global leaderboards and Twenty years of trying to give players one identity.