15:49:33 RRSAgent has joined #did 15:49:38 logging to https://www.w3.org/2026/01/15-did-irc 15:49:45 rrsagent, make logs public 15:49:49 Meeting: Decentralized Identifier Working Group 15:49:53 Chair: ottomorac 15:49:57 Agenda: https://lists.w3.org/Archives/Public/public-did-wg/2026Jan/0005.html 15:49:58 clear agenda 15:49:58 agenda+ Agenda Review, Introductions (5 min) 15:49:58 agenda+ Security Review - Initial Threat Modelling (10 min) 15:49:58 agenda+ DID Core PR Processing \[2\] (10 min) 15:49:58 agenda+ DID Resolution PR Processing \[3\] (10 min) 15:50:01 agenda+ DID Path Discussion \[4\] (20 min) 15:50:13 previous meeting: https://www.w3.org/2026/01/08-did-minutes.html 15:50:21 next meeting: https://www.w3.org/2026/01/22-did-minutes.html 15:50:35 dmitriz has joined #did 15:58:57 JoeAndrieu has joined #did 16:00:56 Wip has joined #did 16:01:01 swcurran has joined #did 16:01:02 present+ 16:01:03 present+ 16:02:37 present+ 16:03:09 KevinDean has joined #did 16:03:22 present+ 16:03:52 present+ 16:04:11 present+ 16:04:25 present+ 16:04:45 TallTed has joined #did 16:05:19 present+ 16:05:23 scribe+ 16:05:32 zakim, next item 16:05:32 agendum 1 -- Agenda Review, Introductions (5 min) -- taken up [from agendabot] 16:05:45 JennieM has joined #did 16:05:48 present+ 16:05:59 ottomorac: welcome. thanks for everyone's support as we drive to CR 16:06:14 .. Today we have the security review and threat modeling conversation. 16:06:21 ... We are going to go over items in DID core 16:06:27 ... DID Resolution 16:06:40 ... The core of the call with be about the DID path conversation and try to get to more alignment 16:06:50 ... Any additions or items for the agenda? 16:06:59 q+ 16:07:05 ack manu 16:07:14 manu: updates re going into CR 16:07:25 present+ 16:07:26 ottomorac: let's take that on first 16:07:26 Topic: updates re going into CR 16:07:44 manu: we resolved to take did core into CR around november. 16:07:49 present+ 16:07:55 ... and our last text was "after the horizontal reviews are complete" 16:08:03 ... and that is preventing us from going to CR 16:08:18 ... We've pinged them, but there are two outstanding: accessibility and security 16:08:32 ... Accessibility has been non-responsive 16:08:53 ... 2. Simone has pinged Tomasso about moving into CR and addressing issues then 16:09:03 ... We're waiting for a response 16:09:16 KevinDean has joined #did 16:09:16 swcurran has joined #did 16:09:16 Wip has joined #did 16:09:16 JoeAndrieu has joined #did 16:09:16 rhiaro has joined #did 16:09:16 ... The hope is that we publish CR as soon as we can. 16:09:24 q? 16:09:42 JennieM has joined #did 16:09:42 ottomorac: good update. Any reactions? 16:09:53 manu: I need guidance from the group. 16:10:06 ... Are we cleared to proceed as soon as Tomasso replies 16:10:06 q+ 16:10:15 ottomorac: Is no response an implicit green light? 16:10:15 ack pchampin 16:10:39 pchampin: I'll check with the team about calling a timeout with Accessibillity 16:10:43 q+ 16:10:46 +1 makes sense to me 16:10:49 ... if we also have a green light from the security group, we're good to go 16:10:54 ack KevinDean 16:11:03 KevinDean: is there any escalation process to get groups to respond? 16:11:04 q+ 16:11:23 pchampin: nothing formally defined 16:11:41 ... Security is a bit more of a problem with DIDs, but they've been more responsive 16:11:51 ack JoeAndrieu 16:11:58 scribe+ 16:12:29 JoeAndrieu: Note reviews are done be volunteers generally. So sometimes hard to get a response 16:12:33 Here's the latest from security: https://github.com/w3c/security-request/issues/91#issuecomment-3735255869 16:12:33 q? 16:12:38 q+ 16:12:39 KevinDean: Understood, true of many standards orgs 16:12:40 ack manu 16:12:43 scribe- 16:13:07 manu: Simone knows we are waiting on it. He asked Tomasso last week. If this goes beyond this weekend, I'll reach out. 16:13:26 q? 16:13:31 zakim, next item 16:13:31 agendum 2 -- Security Review - Initial Threat Modelling (10 min) -- taken up [from agendabot] 16:13:33 ottomorac: so that gets us into our next item 16:13:38 q+ 16:13:47 ack Wip 16:13:57 https://github.com/w3c/security-request/issues/106 16:13:59 wip: the did resolution 16:14:07 ... There is a security request. 16:14:20 ... what Simone suggested we join the security interest group call 16:14:32 ... we through out some dates 16:14:48 ... Are people able to attend the call at 7am pacific, maybe targeting the 3rd 16:14:57 q+ 16:15:05 I can make that 16:15:17 ack manu 16:15:28 q+ to say we should also queue up our own special topic calls 16:15:46 q+ to talk against using LLMs for threat modeling 16:16:18 manu: it has a bunch of stuff. it's not complete (local resolver stuff) 16:16:28 ... it has 25 threats, like private key compromise 16:16:29 Straw documents are good things to get from LLMs. Easier to poke holes in, and to fill in, than a blank page. 16:16:50 ... I did read through the vast majority of all of it, so it seems not crazy 16:17:00 q? 16:17:07 scribe+ 16:17:08 ack JoeAndrieu 16:17:08 JoeAndrieu, you wanted to say we should also queue up our own special topic calls and to talk against using LLMs for threat modeling 16:17:15 q+ 16:17:31 JoeAndrieu: couple of things, first manu I think you conflated the DID resolution issue with the DID core spec 16:17:56 ... I also wanted to speak against in general using LLMs for this work. The important step is doing the thinking, not just producing a document 16:18:13 ... I feel like this work from manu is undermining some of the work I thought I was taking on 16:18:19 q+ 16:18:28 q- later 16:18:30 ... I do not think LLMs are capable of doing a first principles, security first analysis of the threats in the ecosystem 16:18:39 scribe- 16:18:41 ack manu KevinDean 16:18:45 KevinDean: +1 to Joe 16:18:54 q? 16:19:01 ack KevinDean 16:19:02 ... we need to remember that LLMs are conversational agents that can only create based on what's gone before 16:19:18 ... Our work is touch on things that LLMs just don't have in scope 16:19:35 q+ 16:19:36 ... We're going to get something that looks like a threat model, but it won't quite be 16:19:38 ack manu 16:19:50 manu: did resolution v core. 16:19:56 q+ 16:20:02 ... my expectation is that we'll create a threat model that is all inclusive 16:20:12 q+ to talk about the constellation approach to threat modeling 16:20:34 ... It would probably be good to do a holistic threat model 16:20:44 ... On the use of LLMs, Kevin, have you read the document 16:21:21 joe: yes 16:21:32 manu: I'm not saying we shouldn't have humans look at this 16:21:32 q? 16:21:45 ... I'm saying that we should have humans produce this using the tools that are most effecient 16:22:04 ... When used by humans it's been shown to be useful 16:22:12 JoeAndrieu: not necessarily 16:22:25 manu: the time is not that great. so we just don't have the time to do it. 16:22:33 ... I don't know what others experiences are. 16:22:45 ... They have gotten to the point where they are doing a pretty good job. 16:22:48 bigbluehat has joined #did 16:23:04 ... I think it is a mistake to dismiss them 16:23:26 q+ 16:23:31 ack Wip 16:23:32 ... If the people doing the work, don't want to, that's their choice 16:23:51 zakim, close the queue 16:23:51 ok, ottomorac, the speaker queue is closed 16:23:59 wip: A few things here. I hear what manu is saying. We have limited time. 16:24:06 ... The security group is asking us to do this work. 16:24:16 ... I also feel the LLMs are creating leverage 16:24:26 ... But joe's point about having the conversation is important. 16:24:44 q? 16:24:45 ... Maybe after we identify the threats (in our conversation), we can use LLMs to expand it 16:24:54 ... Do the thinking first, then use LLM 16:24:58 q+ to state that the input to the LLM was our security and privacy considerations sections :) 16:25:06 ... Joe, you mentioned some special topics 16:25:26 ack swcurran 16:25:44 swcurran: I support the use of LLMs in certain circumstances 16:25:53 ... Manu's statement, that I haven't read the whole thing 16:26:01 ... that's a problem 16:26:19 ... LLMs aren't an eliminator, but what came across was I put this forward, I'm not going to stand behind it. 16:26:24 manu: I do stand behind it 16:26:33 swcurran: as long as you do, I'm ok with it 16:26:34 ack KevinDean 16:26:51 KevinDean: + 1/2 to manu, +1/2 to joe 16:27:05 ... LLM can provide a good starting point 16:27:06 ack JoeAndrieu 16:27:06 JoeAndrieu, you wanted to talk about the constellation approach to threat modeling 16:27:08 scribe+ 16:27:28 JoeAndrieu: One thing more logistic, about the structure of the docs... 16:28:25 ... we should echo that every spec for the web depends on many other specs. But the threat analysis is dependent and depends on a "constelation of other specs" 16:29:00 ... The DID spec should clearly point of the potential issues it has in relation with those other specs... 16:29:29 ... there should be a diagram that points out those potential areas of security concern 16:29:53 ... acknowledge that this is tricky, I think perhaps the group should have some special topic calls for these 16:31:14 ... the diagram lays out the concern areas and helps us think through the potential issues 16:31:34 ... some areas missing in the diagram are the did-architectures here 16:32:36 q+ 16:33:37 zakim, next item 16:33:37 agendum 3 -- DID Core PR Processing \[2\] (10 min) -- taken up [from agendabot] 16:33:45 manu: Ok. there's enough push back to withdraw the proposal 16:33:50 zakim, open the queue 16:33:50 ok, Wip, the speaker queue is open 16:33:53 ottomorac: moving to some PRs 16:34:00 subtopic: https://github.com/w3c/did/pull/915 16:34:10 Clarify DID document term definition throughout spec #915 16:34:18 ottomorac: we'd appreciate reviews 16:34:37 wip: This has two reviews, but if you care about how we describe a DID document, please chime in 16:34:52 +1 on that change 16:35:09 subtopic: https://github.com/w3c/did/pull/916 16:35:19 q+ 16:35:28 ack manu 16:35:30 ottomorac: Manu can you give us a summary 16:35:44 manu: This one is a request from PING to detail considerations for change notification text 16:35:54 q+ to ask why we have change notification 16:36:11 scribe+ 16:36:19 manu: this is about VDRs, with a DID in it, how do you let people know about that 16:36:38 manu: PING thinks this matters. Talk about what you need to do to harden that surface 16:36:43 ack JoeAndrieu 16:36:43 JoeAndrieu, you wanted to ask why we have change notification 16:37:08 q+ 16:37:08 JoeAndrieu: I think we should get this section out of the spec... 16:37:38 +1 to Joe 16:37:39 ... I think we should not be speaking to this in spec 16:37:43 ack manu 16:37:58 manu: I'm fine with doing that as well. This text came from the early days. 16:38:11 ... This talked as if this is a regular thing, but it isn't really. 16:38:16 q? 16:38:26 q? 16:38:27 ... It confused the reviewers. Since we haven't done the analysis, we should probably stay quiet 16:38:38 zakim, next item 16:38:38 agendum 4 -- DID Resolution PR Processing \[3\] (10 min) -- taken up [from agendabot] 16:38:40 ottomorac: moving us to another PR 16:39:03 manu: anyone object to removing the section on did notification 16:39:07 ... not seeing any objections 16:39:22 ottomorac: thanks 16:39:28 subtopic: https://github.com/w3c/did-resolution/pull/271 16:39:41 Rename Read to Resolve and clarify introduction #271 by WillSome feedback has been provided by Markus. 16:39:47 wip: this is an issue 230. 16:39:49 https://github.com/w3c/did-resolution/issues/230 16:39:58 ... I took a stab at fixing that. 16:40:22 s/is an issue/is on issue/ 16:40:24 ... basically now I've renamed "read" to "resolve" throughout. 16:40:46 ... And i added a section that clarifies the Resolution spec is defining an API on top of the resolution methods defined by the methods themselves 16:40:51 ... Those two things. 16:41:17 q? 16:41:18 ... I was initially more in Marcus's camp: distinguishing between the call to the resolver and the process the method defines 16:41:29 ... but now I think it's find to use the same term 16:41:35 +1 to the PR 16:41:41 +1 to me reviewing it 16:41:45 q+ 16:41:49 ack manu 16:41:56 (it's probably good, but hard to scan while scribing) 16:42:17 manu: No objections to using resolution instead of read 16:42:27 https://w3c.github.io/did/#method-operations 16:42:30 ... are there any changes to DID core we need? 16:42:52 wip: we don't really define the names of the operations, so the text is probably fine. because we don't talk about "read" at all 16:43:03 manu: so DID core is good 16:43:08 q? 16:43:10 ... Maybe our registration process should change 16:43:17 wip: agreed. that says "read" 16:43:39 ... I'm hearing no objections. If you can take a pass and review, that'd be appreciated. 16:43:46 zakim, next item 16:43:49 agendum 5 -- DID Path Discussion \[4\] (20 min) -- taken up [from agendabot] 16:43:50 https://github.com/w3c/did-resolution/pull/260 16:43:53 ottomorac: thanks. 260 is next 16:44:13 scribe- 16:44:20 swcurran: based on the conversation that's going on, I've applied the changes discussed last week 16:44:25 ... and that markus revised 16:44:54 ... instead of introducing a new parameter, use relativeRef as is, for any query components to be appended to the service endpoint path handler 16:45:13 ... and to remove the reference about returning the resource 16:45:29 Update comment : https://github.com/w3c/did-resolution/pull/260#issuecomment-3752168527 16:45:50 ... The relative reference, from RFC3986, it looks like path component MUST be required. 16:46:02 q+ to mention 3986 allows PathEmpty 16:46:12 scribe+ 16:46:25 swcurran: something about path 16:46:44 ... if the service endpoint defines itself as a query parameter, we can't simply append, as that creates a non-standard URL 16:47:02 ... The result is just a URL, that's what the resolver returns. 16:47:13 ... That's another thing that's returned from resolution 16:47:21 ... lists a bunch of things that can be returned 16:47:50 ... we need clear boundaries on what the resolver returns and what the client is expected to do 16:48:08 ... Please take a look at the commit 16:48:21 ... I did revise the definition of relative ref 16:48:25 q+ 16:48:26 scribe+ 16:48:37 ack JoeAndrieu 16:48:37 JoeAndrieu, you wanted to mention 3986 allows PathEmpty 16:48:54 https://www.rfc-editor.org/rfc/rfc3986#section-4.2 16:49:05 JoeAndrieu: on 3986, the path can be a path empty... 16:49:27 swcurran: Ah ok, yes it was kind of confusing 16:50:08 q+ 16:50:15 JoeAndrieu: Another question, the VCWG has moved to the WHATWG definition of URL for good reasons 16:50:28 ack manu 16:50:48 manu: Agree with what Joe and Markus have said. PathEmpty is allowed. 16:51:04 ... the confusing thing in the ABNF is that slashes mean "or" 16:51:04 wow! 16:51:25 ... WhatWG? Yes, I suggested that. I hate that spec, but everyone has moved over 16:51:37 ... It is what browsers implement 16:51:52 ... it closes out some corner cases and holes that 3986 has 16:52:14 ... problem is it doesn't define ABNF, so we'd have to figure out how to update 16:52:20 I can add an issue on that and try a PR to fix -- separate PR. 16:52:25 ... but all the specs are moving, we should consider it 16:52:27 ack Wip 16:52:40 Joe -- can you provide the reference to the new spec? 16:52:53 wip: For a DID URL dereferencing, currently the spec returns a content stream 16:53:10 q+ 16:53:47 swcurran: I though Markus said the only thing the resolver should return is the resulting URL and the client can do what they want 16:54:04 ... I tend to agree, because that makes the resolver too complex. 16:54:15 ... The client can figure out the next thing 16:54:26 ... That gets into exactly the question of what exactly a DID resolver returns 16:54:38 q? 16:54:43 scribe+ 16:54:49 ack JoeAndrieu 16:55:20 JoeAndrieu: one the challenges is conflating De-referencing with Resolving 16:55:32 q+ 16:55:58 JoeAndrieu: I am a bit frustrated that we are returning things different from just did-resolution data 16:56:09 JoeAndrieu: I am concerned that might make it complex 16:56:28 ack swcurran 16:56:46 swcurran: I'm concerned as well. This almost artificial difference between dereferencing and resolution. 16:57:04 ... Resolving a DID as its defined is just the degenerate case of dereferencing a DID URL 16:57:14 q? 16:57:22 ... that said, there is value in having a consistent way to interpret paths 16:57:34 ... so defining what happens with paths should be in the spec 16:57:49 ... but if we're returning anything other than DID document, that complicates thing 16:58:04 q? 16:58:06 ... For example, we return an "altered" did doc and an array of endpoints 16:58:17 ... let's lock that down 16:58:22 q+ 16:58:25 ack manu 16:58:37 manu: Stephen, do you have enough to raise a PR 16:58:51 swcurran: I've raised a PR, but not enough feedback yet 16:59:06 ... so what am I returning? Just a string that is more than a URL? 16:59:11 manu: yes, let's do that 16:59:27 swcurran: ok. that's what I have today. But what form? A JSON string? 16:59:38 manu: JSON, since there might be metadata to return 16:59:47 ottomorac: To be continued 16:59:59 swcurran: I'll update the PR after I check with a few folks 17:00:09 ottomorac: Ok. I'll ping you about time on the call next week. 17:02:38 zakim, end the meeting 17:02:40 As of this point the attendees have been Wip, swcurran, pchampin, KevinDean, manu, dmitriz, ottomorac, JoeAndrieu, JennieM, ivan, TallTed 17:02:40 RRSAgent, please draft minutes 17:02:42 I have made the request to generate https://www.w3.org/2026/01/15-did-minutes.html Zakim 17:02:50 I am happy to have been of service, ottomorac; please remember to excuse RRSAgent. Goodbye 17:02:50 Zakim has left #did 17:09:09 rrsagent, make minutes 17:09:11 I have made the request to generate https://www.w3.org/2026/01/15-did-minutes.html ottomorac 17:09:48 m2gbot, link issues with transcript 17:09:50 comment created: https://github.com/w3c/did/pull/915#issuecomment-3755965567 17:09:51 comment already there: https://github.com/w3c/did/pull/915#issuecomment-3755965567 17:09:52 comment created: https://github.com/w3c/did/pull/916#issuecomment-3755965685 17:09:54 comment created: https://github.com/w3c/did-resolution/pull/271#issuecomment-3755965763 17:09:54 comment already there: https://github.com/w3c/did-resolution/pull/271#issuecomment-3755965763 17:09:55 comment created: https://github.com/w3c/did-resolution/pull/260#issuecomment-3755965837 17:11:13 RRSAgent, please excuse us 17:11:13 I see no action items