14:58:38 RRSAgent has joined #did 14:58:42 logging to https://www.w3.org/2025/09/25-did-irc 14:58:53 rrsagent, make logs public 14:58:57 Meeting: Decentralized Identifier Working Group 14:59:05 Chair: ottomorac 14:59:14 Agenda: https://lists.w3.org/Archives/Public/public-did-wg/2025Sep/0012.html 15:00:45 JoeAndrieu has joined #did 15:01:20 swcurran has joined #did 15:01:31 present+ 15:01:33 Wip has joined #did 15:01:39 present+ 15:01:39 present+ 15:01:43 markus_sabadello has joined #did 15:02:51 present+ 15:04:26 present+ 15:04:27 dmitriz has joined #did 15:04:37 scribe+ 15:04:50 Wip has joined #did 15:05:03 present+ 15:05:30 present+ 15:05:37 q+ 15:05:46 ack pchampin 15:05:54 pchampin: I was contacted by some people that have a pending PR on DID Extensions 15:06:01 q+ 15:06:24 ... and I realize that there's a few pending PRs there; I completely appreciate that this is an additional burden and that this group has been concentrating on specs etc 15:06:37 q+ 15:06:42 ack Wip 15:06:43 ... I just told them I'd bring it up on a call, just so it's on the radar 15:06:59 Wip: same (also had it brought to attention). It raises the challenge that this group does not have enough resources to manage that list / registry 15:07:15 ... I replied that we had volunteers (who have gone quiet). I can't even do it, since I'm not on the list 15:07:31 ... so the question is - what happens when the working group does not have the resources. and what happens when the WG is disbanded / expires 15:07:47 ack manu 15:07:52 ... also has to do with the perception that people have that being on that registry makes it a 'valid did method' 15:08:00 q+ 15:08:03 manu: yeah, it's always been a problem. it's usually me processing it, and I just dont' have time 15:08:13 ... we have like 12 volunteers theoretically 15:08:21 ... I mean, Will, if you want to be added to the list, we can certainly do that 15:08:22 q+ 15:08:29 ... the only way we can make this work is if we have volunteers 15:08:51 ... because it's a constant drumbeat of new did methods. and the challenge is the folks that don't do it right, so there's a lot of education and back-and-forth 15:09:12 ... what we can do is -- whoever complains, we can focus on their one, etc 15:09:12 ... that's usually how it works 15:09:29 ... the other option is, maybe, something that an AI bot can help process? (judge on whether a PR meets the rules criteria) 15:09:48 ... and another option is -- we just merge everything. which we did not like as a concept, before 15:09:58 ... soo, I think we're just stuck with the registry. we don't want to drop it on the floor 15:10:05 ... so this dragging out / slow processing is better than nothing 15:10:07 q+ 15:10:18 ack pchampin 15:10:23 ottomorac: I'd also like to be added 15:10:29 JennieM has joined #did 15:10:34 present+ 15:10:37 pchampin: will's question about the registry after the WG lifetime -- this is a Notes document 15:10:49 ... if it was an official W3C Registry, that'd be a different process 15:10:59 ... so Notes wise, the W3C Team maintains it (which doesn't help) 15:11:02 q+ 15:11:12 ... we have a precedent of a CG volunteering to maintain WG Notes after the WG expires 15:11:20 ... so if we think that it might help, maybe we can have something similar here 15:11:32 ... find a CG to volunteer to curate the DID Extensions / DID Registry 15:11:38 ack swcurran 15:12:02 swcurran: just as a matter of interest -- is there a definition of the minimum amount of info necessary for a PR? 15:12:09 ... I assume the main problem is that one PR that has like 20 methods 15:12:12 ... has that one been dealt with? 15:12:43 ack JoeAndrieu 15:12:49 ... the others look like single DID methods that follow the intent / spirit of the registry 15:12:53 JoeAndrieu: I want to be a voice for getting rid of the registry entirely 15:13:00 ... we had this problem from the beginning, and will continue to. 15:13:14 ... we have consensus as a group that we should enforce conformance. but it's a pretty major burden 15:13:25 ... identical DID methods (in a single PR) is within the rules 15:13:37 ... we also agreed, and had some consensus, that we should make it an official W3C Registry 15:13:43 ... so that's another option. (though we've failed at that) 15:13:54 ... I want to put forward the question -- what do we think the registry is doing? 15:14:09 ... the registry is not going to resolve security & privacy concerns. so then, what's it for 15:14:14 ack manu 15:14:19 ottomorac: yeah, and maybe something self-service? 15:14:36 manu: for pchampin's comment -- who maintains the registry is just shuffling around the chairs on the deck of a sinking ship 15:14:54 ... doesn't matter if it's CCG or W3C staff, still the same core issue of - work is not being done, reviewers are not reviewing 15:15:17 ... and the issue is not necessarily with someone jamming 20 DID Methods in a single PR. the issue is more -- people are not reading/listening / doing the basic thing in PRs 15:15:29 ... basically, people not paying attention. and having to review and re-review is really burdensome 15:15:54 q? 15:16:01 ... I don't want to get rid of the registry yet, but I'm open to what Joe is suggesting 15:16:12 ... if there was some way to just list the methods without having a bad actor come in and DDOS the registry 15:16:14 q+ we don't know the number of DID methods 15:16:18 ... if we can figure that out, we could get to self-service 15:16:20 q+ to say we don't know the number of DID methods 15:16:29 ... I also don't want to spend time on this in the WG, we have way more important stuff to work on 15:16:48 ack JoeAndrieu 15:16:48 JoeAndrieu, you wanted to say we don't know the number of DID methods 15:16:49 ... also, I don't want to just come up with another plan that falls on the same people's lap 15:17:14 JoeAndrieu: manu, we will never know how many DID methods are there 15:17:23 manu: it's not a count, just that some people want there to be a list 15:17:35 JoeAndrieu: that's centralization though; why do _we_ want there to be a list? 15:17:40 ... sometimes it's a monetization thing 15:17:44 ... what's the value prop for us? 15:17:52 present+ 15:17:54 manu: I have lots of thoughts on this. but I don't this is a good use of WG time 15:18:26 q+ 15:18:40 ack Wip 15:18:49 JoeAndrieu: hey, if we get rid of the registry, then people won't have to send Pierre emails. it's like fly-paper ... 15:18:56 Wip: yeah, we could debate this, but probably not a good use of our time today 15:19:01 ... maybe after horizontal review 15:19:18 ottomorac: I'll open an issue about this to keep it on our radar 15:19:30 Topic: Horizontal Review 15:19:45 q+ 15:19:56 https://github.com/w3c/did-resolution/issues/177 15:19:56 smccown has joined #did 15:20:01 Wip: I just want to have this on the calendar as a touchpoint - where are we with the review 15:20:04 https://github.com/w3c/did-resolution/issues?q=is%3Aissue%20state%3Aopen%20label%3ATAG 15:20:07 ... I think we're in a good state, if you have a look at the PRs 15:20:14 present+ 15:20:49 ... lets spend some time on that, and also talk about the SING (?) review 15:20:49 ottomorac: let's start with Manu's PR? 15:20:53 https://github.com/w3c/did-resolution/pull/199 15:21:09 Wip: we just need some more reviews on these PRs 15:21:22 manu: yeah, not much to say about #199 15:21:37 ... if TAG needs us to say more than that, they can tell us 15:21:46 https://github.com/w3c/did-resolution/issues/187 15:21:50 ... the PR would close 3 of our horiz rev issues 15:22:03 ottomorac: the other one is #187 15:22:13 ... I used some AI summary to help answer that question 15:22:19 ... mentioned the testing suite 15:22:23 ... do people have any comments on this? 15:22:24 q+ 15:22:32 ack Wip 15:22:49 Wip: why don't we open this is a PR? 15:22:52 ottomorac: that section, the Relationship to Other Specs -- hasn't been merged into the main branch 15:23:03 ... so I wasn't sure if I should branch off of Manu's PR 15:23:20 Wip: ah, so you think this is going to be a subsection to the Relationship to Other Specs section? 15:23:28 ottomorac: I was confused about Manu's PR 15:23:36 - Add a "Design Goals and Rationale" 1.1 section before Conformance (this section will incorporate the changes required for issues 185, 187-189)- Add a "Relationship to Other Specifications" (New Appendix "C") (this section will incorporate changes required for issue 186) 15:23:42 ... I asked about doing these 2 sections. which was, Design Goals and Rationale 15:24:04 ... and the Relationship one which would be an appendix under pr 186? 15:24:18 Wip: my recommendation is -- just put it in a PR wherever you think it goes. and we can reconcile it later 15:24:46 q? 15:24:54 ottomorac: I'll open an PR, no prob 15:24:57 ... anything else? 15:24:58 subtopic: https://github.com/w3c/did-resolution/issues/191 15:25:10 Wip: 191 - maybe I can ask Markus or Steve 15:25:19 ... it's about filling out & addressing the Security & Privacy self-review 15:25:29 ... this is the last review that we need to get in, then we can request horizontal reviews 15:25:35 ... so, either Steve or Markus -- 15:25:46 smccown: when is it due by? 15:25:48 WIp: soon as possible 15:26:18 smccown: ok, I'll work on it this afternoon 15:26:23 Wip: thanks 15:27:04 Topic: DID Resolution Test Suite 15:27:08 https://github.com/w3c-ccg/did-resolution-mocha-test-suite 15:27:09 q+ 15:27:15 ack Wip 15:27:27 Wip: I am making some progress. is there anyone willing to volunteer to help? 15:27:42 ... I don't think we need a full on special topic call. I just need someone to sit with me, look at the code, talk through it 15:27:59 ... one of the issues I have at the moment is - in the Resolution spec -- a lot of the properties are optional 15:28:15 ... and "If it is defined, it MUST be like this...". I don't know the best way to test that 15:28:22 ... so, would be great to have another pair of eyes on this 15:28:54 https://w3c.github.io/did-resolution/#resolving-algorithm 15:29:00 ... also the DID Resolution Algorithm. a lot of it is -- you need visibility inside the resolver 15:29:17 ... there's a lot of statements that are hard/impossible to test 15:29:26 ... so, we don't need to discuss it on the call right now, but I need help 15:29:37 q? 15:29:39 q+ 15:29:45 ottomorac: anyone have thoughts / volunteers? 15:29:48 ack markus_sabadello 15:30:04 markus_sabadello: wrt optional features -- isn't that something we also had to solve in other suites? VC-API etc? 15:30:18 ... maybe put it into the config of the implementation, etc? 15:30:32 ... the test suite should be able to test those things, conditionally, if supported in the impl config 15:30:38 q? 15:30:49 WIp: maybe yeah 15:31:07 ottomorac: ok, let's just keep in mind, that we need somebody to help out here 15:31:21 Topic: DID Resolution Internationalization Issues 15:31:27 https://github.com/w3c/did-resolution/issues?q=is%3Aissue%20state%3Aopen%20label%3Ai18n-needs-resolution 15:31:46 Subtopic: Define timestamp format carefully #203 15:31:52 https://github.com/w3c/did-resolution/issues/203 15:32:18 ottomorac: this is about the timestamp format, etc... 15:32:24 ... something about normalizing to UTC 15:32:38 q? 15:32:48 q+ 15:32:52 ack Wip 15:32:58 q+ 15:33:07 WIp: I don't have many opinions on many of these i18n issues 15:33:16 ... but we just need to address them for horiz review 15:33:28 ... like, how do we even define the operation of normalizing to UTC? 15:33:32 ack manu 15:33:43 https://w3c.github.io/vc-data-model/#representing-time 15:34:10 q+ 15:34:12 manu: we do have responses, like the one from VC DM, we should just point to that 15:34:21 ... definitely not copy paste (it's too much text), but rerference 15:34:23 ack Wip 15:34:49 Wip: so we can just say 'as defined by VC DM'? 15:34:50 manu: danger here is pulling in a normative dependency on VC DM, which we don't want to do 15:35:04 ... but there aren't normative statements in that section. so it wouldn't be a straight up dependency 15:35:24 ... yeah, we should just point to this section 15:36:33 q? 15:36:35 ottomorac: any volunteers? 15:36:44 q+ 15:36:48 ack Wip 15:37:12 WIp: I don't know if I want to do a PR, but I could write a comment -- do we have a section that you can reference, see what they say 15:37:23 ... this seems like it has been solved by other specs 15:37:32 Subtopic: Use character reference notation and Unicode names for references to specific characters #202 15:37:37 https://github.com/w3c/did-resolution/issues/202 15:38:05 ottomorac: seems a bit more editorial? 15:38:26 looks editorial to me 15:38:39 yep, editorial 15:39:14 ... if it's ok with you, I'll just assign it 15:39:27 ... to Markus 15:40:02 Subtopic: relativeRef should prefer UTF-8 for percent encoding #201 15:40:08 ottomorac: next one is our dear friend Relative Ref 15:40:14 https://github.com/w3c/did-resolution/issues/201 15:40:29 ... I don't know whether this is a discussion for next week (Weds) 15:40:44 q+ 15:40:49 ... what do you think Will? 15:40:50 ack manu 15:40:51 Wip: reading... 15:41:21 manu: Addison us usually right about this stuff. I think it's separate, unless we get rid of relativeRef, which I don't think we're likely to 15:41:29 ... so, he's right that we should prefer UTF8 for percent encoding 15:41:39 q+ 15:41:44 ack Wip 15:42:02 Wip: the change we need to make is - somebody needs to make a PR stating that we prefer UTF8, yeah? 15:42:07 q+ 15:42:09 ottomorac: I can take that on, if it's just the clarification 15:42:13 ack manu 15:42:15 q+ 15:42:25 manu: just to be clear, this is a MUST. if we want to help interop 15:42:46 ack JoeAndrieu 15:42:49 ... you MUST encode disallowed URL chars using UTF8 15:42:49 ottomorac: ok, so just make it a must statement 15:43:00 JoeAndrieu: we should make it clear that this is for ALL URL params, not just relativeRef 15:43:04 ottomorac: ok 15:43:07 +1 to what Joe said 15:43:08 s|encoding #201|encoding [#201](https://github.com/w3c/did-resolution/issues/201) 15:43:17 Subtopic: DID parameters require ASCII-only #200 15:43:26 https://github.com/w3c/did-resolution/issues/200 15:43:37 ottomorac: so, this is another one, discussing various parameters here 15:43:45 ... requirement that the value be an ASCII string... 15:43:54 q+ 15:43:54 ... some other references to an RFC 15:44:04 ack JoeAndrieu 15:44:12 JoeAndrieu: this seems directly entangled in the other one. shouldn't it be UTF8 and not ASCII? 15:44:14 q+ 15:44:15 ottomorac: yeah... 15:44:30 q+ 15:44:41 ack manu 15:45:01 manu: yeah, I agree with Joe -- the nuance here is -- we DID say ASCII on purpose originally 15:45:19 ... but Addison is right unfortunately, we can't ignore that part of the world, non-US/Latin characters that billions people use, etc 15:45:33 ... so yeah, it's entangled w UTF8, so we'll just have to clarify 15:46:03 ... like, IF you have non-ASCII character, you MUST use UTF8 encoding. and percent-encode it to ASCII 15:46:20 ack Wip 15:46:58 Wip: (confirming he heard Manu correctly) 15:47:06 q? 15:47:07 Wip: ok, so, somebody just needs to define that process somewhere 15:47:18 q+ 15:47:22 ack manu 15:47:42 manu: yeah, we should just say - this is a statement around encoding/decoding parameters. All parameters need to go through this process 15:47:57 ... you start w an input string, ensure it's encoded as UTF8, then you percent-encode THAT value to get to an encoded param 15:48:17 ... to decode a parameter, you percent-decode it and arrive at a UTF8 string. 15:48:17 q+ 15:48:35 ack bigbluehat 15:48:37 bigbluehat: yeah, there's a couple of RFCs related to this 15:48:49 ... that have a fallback to ASCII / related functions 15:48:51 a couple RFC's have some stuff about this https://datatracker.ietf.org/doc/html/rfc3454 "stringprep" 15:48:55 ... and discussion of footguns 15:49:14 ... encoding UTF8 URLs has been around for decades etc 15:49:24 ottomorac: ok, yeah, so that's connected to that other issue 15:49:29 ... I'll try my hand at it 15:49:44 q+ 15:49:50 ack manu 15:50:23 manu: I agree w bigbluehat that we need to reference an existing RFC, but specifically, we don't want to use Punycoding (that's for domain names only, not URL fragments) 15:50:44 Ask Addison what should we ref for this 15:50:56 Topic: DID Resolution PR Processing 15:51:06 https://github.com/w3c/did-resolution/pulls 15:51:23 Subtopic: Security Consideration -- DID Resolver Clients should detect resolution cycles #204 15:51:31 https://github.com/w3c/did-resolution/pull/204 15:51:38 PR from Stephen Curran regarding the issue with the infinite loop DID resolution cycles. 15:52:22 swcurran: this isn't an issue for a DID Resolver, because it doesn't expand references, it just returns the DID Doc 15:52:27 ... so this is for CLIENTS of a DID Resolver 15:52:32 ... _that's_ where cycles can occur 15:52:47 q? 15:52:49 ... I did decide to put it in security consideration sections 15:53:08 ... so, it's a short one - if you're a client of a resolver, and if you do repeated resolutions 15:53:12 ... you may wind up in a cycle 15:53:19 ... and should take steps to mitigate 15:53:32 I have no objections for it going into a security considerations section -- doesn't a DID Resolver do this, though? 15:53:33 q+ 15:53:37 ack manu 15:54:02 manu: I thought we had some algorithm in the spec where the DID Resolver does it too? 15:54:07 swcurran: I didn't see one 15:54:10 manu: ok that's fine then 15:54:27 q+ 15:54:44 ack JoeAndrieu 15:55:07 JoeAndrieu: I think there may be.. didn't we parametrize in the resolution request to de-reference it on the resolver level? that might run into this problem 15:55:09 My recollection is the same as Joe's 15:55:30 ... otherwise, I agree with your analysis 15:55:38 ... unless resolver has to do it, it's the client's problem 15:55:44 swcurran: I'll take another look 15:55:50 Subtopic: Define HTTP POST binding #196 15:55:57 https://github.com/w3c/did-resolution/pull/196 15:56:26 ottomorac: Will has provided approval, but it would be great if other folks also reviewed 15:56:28 q+ 15:56:36 ack Wip 15:56:40 https://github.com/w3c/did-resolution/pull/183 15:56:49 Wip: this isn't about this PR, but just briefly - 15:57:13 ... maybe this 'no cache allowed' is a 'feature not supported'? 15:57:51 manu: wait, I'm confused 15:57:56 https://github.com/w3c/did-resolution/pull/183 15:58:05 Wip: sorry, this is about PR 183 15:58:40 q+ 15:58:45 ack manu 15:58:49 ottomorac: I think Will was saying that instead of having a 'No-cache disallowed' error, we make it more generic, use the 'feature not supported' error instead 15:58:51 manu: yeah, I think that would be fine 15:59:04 ... as long as we have a description of what the missing feature is 16:01:54 ottomorac has joined #did 16:02:24 ottomorac has left #did 16:16:12 TallTed has joined #did 18:02:05 Zakim has left #did 19:04:46 ottomorac1 has joined #did 19:05:18 rrsagent, make minutes 19:05:19 I have made the request to generate https://www.w3.org/2025/09/25-did-minutes.html ottomorac1 19:06:03 m2gbot, link issues with transcript 19:06:04 comment created: https://github.com/w3c/did-resolution/issues/177#issuecomment-3335573415 19:06:05 comment created: https://github.com/w3c/did-resolution/issues/191#issuecomment-3335573461 19:06:06 comment created: https://github.com/w3c/did-resolution/issues/203#issuecomment-3335573509 19:06:07 comment already there: https://github.com/w3c/did-resolution/issues/203#issuecomment-3335573509 19:06:08 comment created: https://github.com/w3c/did-resolution/issues/202#issuecomment-3335573603 19:06:09 comment already there: https://github.com/w3c/did-resolution/issues/202#issuecomment-3335573603 19:06:10 comment created: https://github.com/w3c/did-resolution/issues/201#issuecomment-3335573689 19:06:11 comment created: https://github.com/w3c/did-resolution/issues/200#issuecomment-3335573737 19:06:12 comment already there: https://github.com/w3c/did-resolution/issues/200#issuecomment-3335573737 19:06:13 comment created: https://github.com/w3c/did-resolution/pull/204#issuecomment-3335573816 19:06:14 comment already there: https://github.com/w3c/did-resolution/pull/204#issuecomment-3335573816 19:06:15 comment created: https://github.com/w3c/did-resolution/pull/196#issuecomment-3335573893 19:06:16 comment already there: https://github.com/w3c/did-resolution/pull/196#issuecomment-3335573893 19:06:31 zakim, end the meeting 19:06:59 RRSAgent, please excuse us 19:06:59 I see no action items