14:05:36 RRSAgent has joined #vcwg 14:05:41 logging to https://www.w3.org/2023/10/04-vcwg-irc 14:05:41 RRSAgent, make logs Public 14:05:42 please title this meeting ("meeting: ..."), ivan 14:06:08 Meeting: Verifiable Credentials Working Group Telco 14:06:09 Date: 2023-10-04 14:06:09 Agenda: https://www.w3.org/events/meetings/ae05a21b-c065-4e69-8d5e-352a0d391513/20231004T110000/ 14:06:09 chair: kristina 14:06:09 ivan has changed the topic to: Meeting Agenda 2023-10-04: https://www.w3.org/events/meetings/ae05a21b-c065-4e69-8d5e-352a0d391513/20231004T110000/ 14:56:32 pauld_gs1 has joined #vcwg 14:58:11 hsano has joined #vcwg 14:58:50 present+ 14:59:36 decentralgabe has joined #vcwg 14:59:48 present+ 15:00:03 present+ pauld 15:00:06 DavidC has joined #vcwg 15:00:12 present+ 15:00:22 Orie has joined #vcwg 15:00:30 present+ orie, kristina 15:01:03 present+ brent 15:01:09 kristina has joined #vcwg 15:01:12 present+ 15:01:42 brent has joined #vcwg 15:01:50 present+ 15:02:25 present+ manu, dlongley 15:02:45 present+ seabass 15:02:52 present+ 15:02:58 TallTed has joined #vcwg 15:02:58 present+ 15:03:20 Will has joined #vcwg 15:03:22 present+ 15:03:32 present+ TallTed 15:04:06 present+ selfissued 15:04:25 present+ benjamin 15:04:48 GregB has joined #vcwg 15:04:57 present+ 15:06:49 scribe+ 15:06:59 cabernet has joined #vcwg 15:07:00 present+ 15:07:04 andres has joined #vcwg 15:07:08 kristina: I expect us to spend a good bit of time on PRs today 15:07:08 present+ 15:07:14 ... many things are blocked 15:07:18 present+ 15:07:26 present+ cabernet 15:07:35 ... they should be labeled, but some may not be, so we may consult others if time 15:07:37 present+ joeandrieu 15:07:53 ... manu raised Data Integrity PR reviews as needing to be addressed 15:08:02 present+ gregb 15:08:18 q? 15:08:38 q+ 15:08:39 ... anyone want to start with a PR or status update? 15:08:42 q+ 15:08:51 JoeAndrieu has joined #vcwg 15:08:52 Topic: PR status updates 15:08:56 ack manu 15:09:03 ... DavidC are you queued to talk about ToS topics? 15:09:13 manu: do you want these in oldest to newest order? 15:09:24 kristina: probably skip 1271 15:09:32 subtopic: https://github.com/w3c/vc-data-model/pull/1270 15:09:46 manu: so, 1270 has multiple requests for changes 15:10:00 ... selfissued is blocking. Orie is blocking 15:10:01 q+ 15:10:06 ... what changes need to be made? 15:10:07 selfissued has joined #vcwg 15:10:12 present+ 15:10:16 scribe+ 15:10:18 1270 15:10:23 https://github.com/w3c/vc-data-model/pull/1270 15:10:40 q+ 15:11:29 ack Orie 15:12:08 Orie: we have this section about JSON processing...which I don't really like 15:12:31 ... I'd believed we would/should add a JSON-LD section to explain applying `@context` more completely 15:12:46 ... and these two things differ substantially when you just process JSON 15:12:58 ... I think the text in the JSON processing section is dangerous and misleading 15:13:14 ... that text is mostly information that doesn't help implementers 15:13:17 -1 to what Orie is saying :) ... the information is the same, JSON-LD is a syntax that expresses graph information. 15:13:24 ... and doesn't help people use RDF or JSON-LD 15:13:37 ... so the changes I want to see are to remove these differences 15:13:58 ... bigbluehat's comments are excellent 15:14:07 PL-ASU has joined #vcwg 15:14:07 present+ 15:14:12 ... he says there dangers of doing just JSON processing 15:14:32 ... it's a huge mistake for us to be vague 15:14:45 ... and this will harm interop if these things differ too much 15:14:59 ... the JSON-LD processing section needs to talk more about RDF data model 15:15:07 ... `@id`, `@list`, etc. 15:15:21 ... basically the stuff that's in the `@context` that only an advanced processor would use 15:15:31 ... I strongly disagree with the position that dlongley stated 15:15:48 ... that we should avoid the JSON-LD feature to keep it compatible with JSON processing 15:16:10 ... bigbluehat's PR has some of this, but not enough which is why I'm requesting changes 15:16:13 ack selfissued 15:16:26 selfissued: this PR kind of runs at the mouth 15:16:30 +1 to json processing is not compatible with JSON-LD processing (without additional checks on top co json processing) 15:16:37 ...it says a lot of things that aren't useful to implementers 15:16:49 ... we don't need to be an evangelist mouth piece for JSON-LD 15:16:55 q? 15:17:01 q+ 15:17:02 ... I will not approve this until it's down to a sentence or a paragraph 15:17:08 q+ 15:17:12 ack dlongley 15:17:24 dlongley: trying to figure out where to start 15:17:28 I would encourage better direct references to the JSON-LD spec, for example: https://www.w3.org/TR/json-ld11/#relationship-to-rdf 15:17:33 ...there are many competing requests 15:17:47 ... many from Orie requesting explanation of the advantages of JSON-LD 15:18:01 chairs hat on, i don't think the request was "json-ld advantage" it was about "json-ld processing guide" 15:18:13 I disagree that the PR captures the advantages on JSON-LD, but I agree that is an objective... and I think citing the JSON-LD spec, would better accomplish the mission. 15:18:19 ... new comers are often confused by the ability to process JSON-LD further with libraries 15:18:29 ... but they miss that JSON-LD is a syntax 15:18:42 ... if you understand the `@context`, then you can move ahead 15:18:58 ... if you don't understand what's in `@context, then you do need to process that and understand it 15:19:11 ... so this section is really talking about that difference 15:19:19 ... JSON is really just a syntax 15:19:30 ... and if you want to do anything with JSON, you need a spec to read and implement 15:19:48 ... whereas JSON-LD is an object-oriented graph model that defines how to be processed 15:19:56 ... JSON-LD imposes additional constraints 15:20:17 ... so you don't have this problem of missing out on this extensibility and data model 15:20:38 I agree with what dave is saying, that JSON-LD and JSON claims can't be merged, without understanding RDF... that is the security issue that the group is being unclear regarding. 15:20:46 q+ 15:20:58 ... the JSON processing model section basically says that if you know it's using these `@context` definitions that the spec specifies, then you can just process this in JSON--because you trust it implemented the spec 15:21:19 ... on top of that Orie has been asking on elaborating on the additional value of JSON-LD 15:21:34 We don't have the section, we have draft text, which I don't feel is acceptable yet... the mission is still ongoing. 15:21:42 ... but now we have the counter request to remove all of this--both JSON-LD values that were requested and the JSON processing section 15:21:54 ... many of the new comers have missed the history here 15:22:09 ... that this context ability was chosen on purpose 15:22:26 ... that it provides the clarity of what the data is about referenced from that data 15:22:40 Agree with what dave is saying about JSON-LD providing value to W3C Verifiable Credentials, hence the need to communicate the value of JSON-LD and RDF processing as opposed to "JSON Processing", which does not require reading the JSON-LD spec, to do safely. 15:22:43 q+ 15:22:55 +1 to landing the PR, after revising it. 15:23:09 ... it's valuable to explain this value and how it helps and has helped this community since the beginning 15:23:15 kristina: I don't think we don't want to have this section 15:23:26 ... it feels like there's more discussion needed for this PR 15:23:34 ... it's not like this needs huge conversation 15:23:40 ... so lets entertain the queue 15:23:43 q+ to move on to next issue. 15:23:55 ... but keep it sort and sweet to exactly what you want to see here 15:24:02 ack TallTed 15:24:05 ... not debate the values of JSON-LD etc. 15:24:23 TallTed: I started off being extremely frustrated by two voices in this conversation 15:24:36 ... both are asking for vague changes with no specific changes 15:24:43 If the working group agrees, I am happy to author an alternative PR 15:24:50 ... I kinda want to lock Orie and selfissued in a room and let you hash it out 15:24:58 ... but I don't think that's going to be useful 15:25:07 ... and others should support you if they agree 15:25:15 ... Orie's been asking for this for months 15:25:26 ... but without any actual contribution to the conversation 15:25:26 IMO its better to refer to a spec, than it is to mischaracterize the benefits of a spec, without references. 15:25:36 ... he hasn't put the concrete suggestion forth 15:26:02 ... and selfissued if you want this down to a sentence, then write that sentence 15:26:06 ... otherwise you're just blocking to block 15:26:19 kristina: this is an inclusive environment 15:26:29 TallTed: you're spending more time on this than anyone 15:26:34 ... let's move onto the queue 15:26:41 kristina: please leave the call TallTed 15:27:22 brent: ivan please remove TallTed from the call 15:27:30 q? 15:27:44 ack seabass 15:27:57 My offer to author an alternative is sincere, we may find that merging 2 different PRs is an effective path forward. 15:28:06 yes, please write something Orie ^ 15:28:12 will do 15:28:18 seabass: my comment was related to dlongley's comment earlier 15:28:26 ack selfissued 15:28:26 kristina: ok. skipping 15:28:39 selfissued: strangely related to what TallTed was saying 15:28:49 ... I do have a specific action 15:28:55 ... put this in a note, and reference the note 15:28:56 q+ to suggest line in imp guide 15:29:07 q+ to suggest text in imp guide 15:29:17 ivan: clarification. you mean a separate note, correct? 15:29:20 selfissued: yes. 15:29:54 kristina: there is a separate JSON-LD spec...so I'm not sure a separate note gets us much 15:30:05 IMO, its worth highlighting the parts of the JSON-LD spec that can provide the most value to Verifiable Credentials. 15:30:09 ... please offer concrete PRs with concrete suggestions Orie 15:30:13 ... and we can move from there 15:30:20 yes, i will do a PR. 15:30:21 ... Orie is that OK? 15:30:24 q? 15:30:31 ack DavidC 15:30:45 q- 15:30:45 +1 to see something from Orie ... but also note, Orie, I think there may be more benefits to VCs that you're thinking of (including all of the ones in the PR of that subtopic) 15:31:00 https://github.com/w3c/vc-data-model/pull/1295 15:31:02 s/VCs that/VCs than/ 15:31:12 q+ to process PR 196 15:31:13 subtopic: https://github.com/w3c/vc-data-model/pull/1295 15:31:33 DavidC: no one had implemented this on the v1 data model, but there have been some now 15:31:45 ... to the best of our knowledge there are several now 15:32:06 ... the problem now is that the original term was generic 15:32:20 ... and my original PR was to improve it to make it more encompassing 15:32:41 ... the v1 had generic text, but talked about mandatory things to do...which was not equally generic 15:32:56 ... so this PR makes the actions also be generic 15:33:10 ... then the comments came to provide examples 15:33:18 ... so I did that with real URIs, etc. 15:33:42 ... but then the feedback came about the URI's and that they may not be around as long as the spec 15:33:55 ... so now I think the data model should have the generic text 15:34:02 present+ dmitri 15:34:05 ... and we should point to an extension space for these 15:34:35 ... so my proposal is that if we want the EBSI example to be the example, then we'd have to explain it all 15:34:44 q+ 15:34:55 ... or we could make it a generic example...but then it wouldn't be a good example 15:35:13 q+ to speak to examples in spec. 15:35:15 kristina: so the question I have is proving that there are two implementations in the example--is that what we want to see? 15:35:19 q- 15:35:20 q+ to speak to examples in spec. 15:35:30 ... how the use of the ToS seems underspecified 15:35:37 q+ 15:35:38 ack Orie 15:35:43 ... so how can that be improved --that's the question I want addressed 15:35:50 Orie: I want to thank DavidC 15:36:01 ... he's been good about addressing feedback 15:36:23 ... there's some v1 stuff that still needs removed, but overall this seems ready for tests to be written for 15:36:35 ... once there's two tests we can merge this 15:36:39 w? 15:36:39 q? 15:36:42 ack manu 15:36:42 manu, you wanted to speak to examples in spec. 15:37:05 manu: the examples in the spec are non-normative, so the URL's in them shouldn't matter 15:37:21 ... DavidC has proved that there are multiple extensions 15:37:30 s/extensions/implementations 15:37:36 ... there is v1 cleanup 15:37:48 ... but I am confused about testing the extensions 15:37:51 q+ 15:38:10 ... feel like goal posts are being moved unless we're being very clear about what needs testing 15:38:18 ... multiple people are using it 15:38:24 ... there is a separate test suite 15:38:33 ... and I think that tests that it's being used 15:38:40 present+ nsteele 15:38:40 ack DavidC 15:38:44 ... so not sure we need to take on the interop tests 15:38:59 DavidC: I accept that it's v1 because it's based on their existing work 15:39:03 ... I can upgrade it to v2 15:39:21 ... I realized it takes more than swapping out the contexts 15:39:34 ... and that an additional EBSI context needs to be defined now 15:39:39 ... to work with the v2 data model 15:39:54 ... however, I don't think I should be describing how EBSI works 15:40:08 ack Orie 15:40:11 ... maybe I can just say, this is implemented according to the EBSI spec and link there 15:40:17 Orie: this is about testing 15:40:29 ... my request is about removing that "at risk" flag 15:40:41 ... to do that we need 2 supporting implementations that past tests 15:41:04 ... if the only normative requirement that it use an RDF type, then having an example should pass that test 15:41:12 ... I don't think there are additional tests to write 15:41:19 q+ to ask about ExampleToU as test 15:41:25 ... just share examples that can survive issuance and validation 15:41:30 ack manu 15:41:30 manu, you wanted to ask about ExampleToU as test 15:41:37 manu: so Orie if I'm understanding you 15:41:53 ... then a test that says, "uses issuer defined type" 15:42:12 ... and as long as that issues and verifies, would that meet your expectation of the testing requirement? 15:42:25 manu: can we use an example in the type in the terms of use? 15:42:52 Orie: as far as I'm concerned we just need to prove that two implementations can handle these examples 15:43:09 manu: so if 2 implementations do not choke on these examples then we're fine? 15:43:28 ... and you do not believe they need to understand the Terms of Use terms? 15:43:35 Orie: I hope not. 15:43:54 q? 15:43:56 q+ 15:43:56 manu: k. then as long as issuance and verification don't choke across two implementations, then I agree that we're good 15:44:04 q+ to cover 196 15:44:07 ack ivan 15:44:11 DavidC: this is great, thank you. 15:44:35 ivan: to clarify, if DavidC goes through what was just discussed, then we remove the at-risk flag? correct? 15:44:37 kristina: yes 15:44:44 DavidC: do I remove them now? 15:44:46 I left a comment similar to what ivan said on the PR 15:44:50 kristina: no, we need them tested first 15:44:59 q? 15:45:02 ... and an issue to track 15:45:02 ack manu 15:45:02 manu, you wanted to cover 196 15:45:14 subtopic: https://github.com/w3c/vc-data-integrity/pull/196 15:45:30 manu: this is a base PR for many other things 15:45:36 ... selfissued has made many requests 15:45:42 ... and I want to get through them on the call 15:45:46 https://github.com/w3c/vc-data-integrity/pull/196#pullrequestreview-1657894864 15:45:47 ... 'cause this is dragging out 15:46:09 ... selfissued, you are asking for more normative definitions where there are just examples 15:46:20 ... so the normative references you want are in other specs 15:46:23 https://pr-preview.s3.amazonaws.com/w3c/vc-data-integrity/pull/196.html#multibase-0 15:46:43 ... this preview shows these definitions have been in there for awhile 15:46:45 q+ 15:46:55 ... it's normatively defined in the specification 15:47:09 ... the other thing is asking about the header format and how they're used 15:47:22 ... they're headers, they're doing what they've been defined to do 15:47:32 ... these are examples, so they are not normative 15:47:39 https://pr-preview.s3.amazonaws.com/w3c/vc-data-integrity/pull/196.html#resource-integrity 15:47:41 ... same thing is true for the others also 15:47:47 ... this stuff is defined in there 15:48:09 ... I can go and respond to each one, but they are all already normatively defined 15:48:09 ack selfissued 15:48:11 selfissued: I am reading the specification 15:48:38 ... the text that you're talking about does not normatively define how to translate the alphabet to string or binary 15:49:03 ... in all cases where we're using data structures, we need to define in sufficient detail, so implementers can build implementations 15:49:22 ... I'm still doing a review, but there's similar incomplete definitions in EDSA as well 15:50:22 q+ 15:50:22 ack manu 15:50:22 ... counting on tribal knowledge isn't acceptable when we're normatively referencing something 15:50:22 manu: base encoding something is something no ones had a problem with since forever 15:50:24 ... no other spec has to define this 15:50:31 selfissued: no. you must define it in the spec 15:50:36 @manu, you an paste in this example: https://github.com/cryptocoinjs/base-x/blob/master/src/index.js. lol 15:50:45 manu: then if I define base encoding, will you let us merge this? 15:50:49 selfissued: yes 15:51:01 manu: so you want all these things redefined directly in this spec? 15:51:05 selfissued: yes. 15:51:25 manu: there's a term, multibase prefix...and that's not defined 15:51:41 s/manu: there's a term, multibase prefix...and that's not defined/selfissued: there's a term, multibase prefix...and that's not defined 15:51:44 Here is the normative definition: https://pr-preview.s3.amazonaws.com/w3c/vc-di-eddsa/pull/63.html#multikey 15:51:54 selfissued: when I review stuff, I like to pretend I'm an implementer 15:52:05 ... and imagine whether I can build code with that of others 15:52:09 Here is the other normative definition: https://pr-preview.s3.amazonaws.com/w3c/vc-di-ecdsa/pull/42.html#multikey 15:52:10 q+ 15:52:12 ... and if I can't, then I raise issues 15:52:15 ack manu 15:52:25 manu: I have pointed directly to the normatively to the definitions 15:52:37 ... and they tell you how to build the format front to back 15:52:43 ... I can make these changes, selfissued 15:52:51 ... but every time I make a change, you request new ones 15:52:58 selfissued: I'm sorry that's the way it feels 15:53:02 would referencing RFC 4648 and say that the bases used are `58`, `64`, and the alphabets are `base58-btc` and `base64-no-pad`? 15:53:09 would that help? 15:53:14 https://datatracker.ietf.org/doc/html/rfc4648 15:53:24 ... but the intent is to have each of these specs completely define everything implementers need to do to implement everything 15:53:37 q+ 15:53:39 manu: can you read what dlongley just shared 15:53:48 selfissued: maybe. I'd have to looke 15:53:58 ref'ing that RFC seems like a good move. 15:54:08 s/looke/look/ 15:54:17 manu: I can address all the comments 15:54:30 q+ 15:54:45 kristina: sorry we can't pick a date 15:54:54 ... we'll continue to believe there's good intent here 15:54:57 q- 15:55:01 ... but please address these concerns seabass 15:55:02 ack seabass 15:55:06 s/seabass/selfissued 15:55:23 seabass: it seems selfissued's main concern is anything multibase/multikey 15:55:40 ... it seems our charter includes defining these things 15:56:41 +1 to potentially publishing multiabse as a w3c document 15:56:41 ... so, if selfissued, you take issue with these not being defined at the IETF, then a probably solution is to take these multibase/multikey stuff through the W3C process within this group 15:56:41 s/multiabse/multibase/ 15:56:46 kristina: we can talk about multibase 15:57:01 ... but I do not think it is realistic within the lifetime of the WG 15:57:22 ... in the meantime if selfissued and manu can work through the PR that would help 15:57:30 q+ 15:57:34 ... next week is IIW, but we will cancel the special topic call 15:57:39 ... but keep the main call 15:57:51 ... I think the special topic call will be about accessibililty 15:58:04 ... so seabass if you could send stuff out about it, that'd be great 15:58:19 ack ivan 15:58:20 seabass: I will be absent for part of the coming weeks 15:58:33 ivan: next week, WG is at a EU unfriendly time 15:58:42 ... and I want to be part of the timing discussions 15:58:58 ... so you're welcome to meet and provide a time...but I may have to disapprove it after I see it 15:59:06 kristina: yeah, lets discuss offline 15:59:09 ... thx all 15:59:19 rrsagent, draft minutes 15:59:20 I have made the request to generate https://www.w3.org/2023/10/04-vcwg-minutes.html ivan 15:59:27 ... thx for scribing bigbluehat 15:59:27 gkellogg has joined #vcwg 16:00:25 zakim, bye 16:00:25 leaving. As of this point the attendees have been ivan, hsano, pauld, DavidC, orie, kristina, brent, manu, dlongley, seabass, shigeya, Will, TallTed, selfissued, benjamin, GregB, 16:00:25 Zakim has left #vcwg 16:00:30 ... cabernet, andres, decentralgabe, joeandrieu, PL-ASU, dmitri, nsteele 16:00:31 rrsagent, bye 16:00:31 I see no action items