14:19:01 RRSAgent has joined #did 14:19:05 logging to https://www.w3.org/2026/05/28-did-irc 14:19:20 rrsagent, make logs public 14:19:31 Meeting: Decentralized Identifier Working Group 14:19:35 Chair: ottomorac 14:19:38 Agenda: https://lists.w3.org/Archives/Public/public-did-wg/2026May/0050.html 14:19:38 clear agenda 14:19:38 agenda+ Agenda Review, Introductions (5 min) 14:19:38 agenda+ VCWG f2f Next Week: No Calls 14:19:38 agenda+ Special topic call summary (5 min) 14:19:38 agenda+ DID Resolution Algorithm Inputs \[1\] (20 min) 14:19:41 agenda+ DID Resolution PR review (15 min) 14:19:43 agenda+ Next Time: Threat Modelling Discussion (5 min) 14:19:58 previous meeting: https://www.w3.org/2026/05/27-did-minutes.html 14:20:18 next meeting: https://www.w3.org/2026/06/04-did-minutes.html 15:00:51 present+ 15:01:05 markus_sabadello has joined #did 15:01:52 present+ 15:01:56 present+ TallTed 15:02:04 JoeAndrieu has joined #did 15:02:04 Wip has joined #did 15:02:11 swcurran has joined #did 15:02:16 present+ 15:02:40 present+ 15:03:40 present+ 15:04:02 present+ 15:05:01 zakim, next item 15:05:01 agendum 1 -- Agenda Review, Introductions (5 min) -- taken up [from agendabot] 15:05:42 transcriber-bot, resume 15:05:42 scribe+ 15:06:01 zakim, next item 15:06:01 agendum 2 -- VCWG f2f Next Week: No Calls -- taken up [from agendabot] 15:06:02 Otto Mora: Okay. Uh... 15:06:14 ... Okay, so I guess, yes, next week there is a verifiable credentials working group. Okay. Any, just anything anybody would like to, add to that, agenda or any other thing to point out to? 15:06:26 ... I know that the CCG meetings, at least, have already been canceled, but I wanted to kind of ask the group, do we also cancel our meetings for that week, given 15:06:31 yes, let's cancel the meetings, please -- at least 3 of us will be gone. 15:06:33 ... Given the face-to-face meetings, or do we have quorum to go ahead and meet? 15:06:36 q+ 15:06:36 ... Any thoughts from 15:06:40 ack manu 15:06:41 Stephen Curran: I'm available to meet and think we should if we can... 15:06:46 Otto Mora: Okay. And Mano, I think you're... 15:06:52 Manu Sporny: Um, I think I'll be gone, Will will be gone, uh, Joe will be gone... 15:06:54 Stephen Curran: Thank you. Never mind... 15:06:56 Joe Andrieu: Thank you... 15:06:59 Stephen Curran: Go ahead... 15:07:02 Manu Sporny: I just… adding that, like, you know, I think that might be difficult to have a meeting, but, you know... 15:07:06 ... Happy for folks to meet and make progress where we can 15:07:06 q+ 15:07:07 Otto Mora: Mmhm... 15:07:10 Manu Sporny: That's it... 15:07:11 ack JoeAndrieu 15:07:15 Otto Mora: Yeah, no, I think it… uh, Joe, yeah, go ahead... 15:07:24 Joe Andrieu: Yeah, I just wanted to ask Steven, what topic would you want to discuss without us? Maybe there is something you could do productively. It's kind of off my radar... 15:07:37 Stephen Curran: I didn't know… I didn't… Yeah, I just didn't know who was gonna be gone, so… Nobody was saying anything, so I just said that. But if… if… Half the group, three quarters of the group, it's... 15:07:40 ... Here today are gonna be gone, then yeah, it seems pointless 15:07:46 Manu Sporny: Dad's going to be gone too in just a sec... 15:07:49 ... And I think I forgot to mention that Ted's going to be attending as well 15:07:52 Stephen Curran: Yeah... 15:07:59 s/Dad's/Ted is/ 15:08:00 Otto Mora: Okay, fair. Uh, makes sense. Yep, I think then, yeah, group decision, we won't have calls next week... 15:08:02 zakim, next item 15:08:02 agendum 3 -- Special topic call summary (5 min) -- taken up [from agendabot] 15:08:03 ... Um… let me… Move on. So, uh 15:08:27 ... Yeah. So for the call yesterday, we discussed a bit about the Prs that we would be creating. And I know Steven had mentioned that he'd be working on some of them. And then we also had a conversation around 15:08:34 Will Abramson: Uh... 15:08:38 Otto Mora: uh, the input to the DAD resolution algorithm. Um, I don't know, Will, should we… do you want to briefly, maybe, add anything in terms of summary?... 15:08:41 Will Abramson: Well, I think we didn't make any final decisions, but we did lay out the arguments, uh, for and against... 15:08:57 ... Move forward, Sarah 15:09:04 ... And I think, you know, that's what we're going to continue today. And I just want to remind folks again of, you know, we are on this short timeline, we're already over time, and we do have to make some difficult decisions 15:09:07 ... that's really all I have to say about that. I mean, I think Steven had a good idea to, like, start the call, like, ground it with the two options, but 15:09:11 q+ 15:09:18 ... By the end of this call, I would really like for us to pass the resolution and put this issue to bed and move forward 15:09:18 ack swcurran 15:09:20 Otto Mora: Uh, yes, Stephen... 15:09:29 Stephen Curran: So I went through and laid out on a slide, to me, what are the two… So we've got the first two steps of… Um... 15:09:36 ... the Pr. That was merged from Will. I've laid out 15:09:49 ... Given the two options, here are the steps they would be, and I'd like to share them if that's okay with people. Are we okay that I share my screen for a second and show what I think are the two? 15:09:52 Will Abramson: Does not make sense to me... 15:09:53 Stephen Curran: No... 15:09:55 Otto Mora: Yeah, right, I think that's fine. um... 15:09:58 Stephen Curran: No objections? Okay... 15:10:04 ... So 15:10:13 ... This would be steps one and two of DID URL dereferencing based on what we'll already put into that 331 PR that we merged 15:10:22 ... Um, if we stick with the idea that the did… did URL… or, sorry, did resolution 15:10:31 ... Here's what I think the steps would be. deals only with the DID. So DID resolution does not accept a DID URL 15:10:35 ... The dereferencing steps would be receive a data URL 15:10:40 ... A May 15:10:44 ... Um, I put this one as 15:10:54 ... And I put brackets around it because I'm not certain of this one. But anyway, some implementations. I could put an S on that, may accept an options data structure 15:11:12 ... Verify the received URL for validity. I'm going to call out here that I mentioned the other day that did WebVH because of its use in the Linux kernel group is using for it. They did a pass through 15:11:32 ... Basically, all of those, the code for DidWebDH and a bunch of the results came from not 15:11:38 ... doing validity on the URL and those items that we passed in that merge a few weeks ago of security warnings about the URL parameters. But anyway, that's what the verify would be, but no details on that one at this date 15:11:44 ... Okay. Remove the path and parameters to create a bare DID 15:11:52 ... Create, if needed, an options data structure, and add to it each parameter from the DID URL. So you're going to take the DID URL, and no matter what the parameters are, you stick them in the options 15:11:59 ... Invoke the DID resolver passing the bare DID and the options and process the DID URL thereafter 15:12:07 ... That would be the steps where we don't touch did resolution and. And 15:12:10 q? 15:12:14 ... they would be. Does any… does that match what people agree with? 15:12:16 q+ 15:12:20 ... What they would envision it to be 15:12:23 Otto Mora: Uh, Marcus? Let's see... 15:12:26 ack markus_sabadello 15:12:31 Markus Sabadello: Uh, yeah, yeah, Steven, that definitely matches how I've always understood it, and how the... 15:12:35 q+ 15:12:38 ack manu 15:12:38 ... Algorithm has been has been written. I think that's a good summary 15:12:41 Stephen Curran: Okay, second one… Okay... 15:12:42 Otto Mora: So, hang on, manuals, or one or two? Okay... 15:12:46 Stephen Curran: Oh, sorry. Mac… whoops... 15:12:54 Manu Sporny: Yeah, no, I mean, our, you know, I mean, internal discussions, our implementations would only... 15:12:57 ... Uh, put stuff into the options that were recognized 15:13:08 TallTed has joined #did 15:13:18 ... So that's fine. I mean, you know, we don't care either way. I mean, like, this is an algorithm, we can implement it, but we did not implement it, or this is not the expectation. Like, the only thing that we would end up pulling out would be URL options 15:13:21 ... Uh, that we understood for the did method, uh, in play 15:13:27 Stephen Curran: Okay, let's leave that as a detail... 15:13:31 ... Yeah. Um, and that one, again 15:13:34 Manu Sporny: But we don't need to change anything. Yeah, yeah, that's fine, yeah... 15:13:40 q+ 15:13:45 Stephen Curran: Yeah, for me, you know, because there's things like extensions and so on, a client is less likely than a DID resolver to know what matters. Um, but anyway, yeah, we can leave that... 15:13:46 ack manu 15:13:48 Otto Mora: Nothing... 15:13:51 ... But 15:13:54 Stephen Curran: Then this is the second one, so I'll jump to the second one. Yeah, oh... 15:14:06 Manu Sporny: Hold on, sorry, Steven, to go back, the reason we strip stuff out is because we're concerned that, you know, just blindly doing that, you could have attacks against the resolver that end up passing options that you never intended to pass, like options... 15:14:14 ... can be a bunch of things that, um, that you, you as, uh, you don't want the attacker to choose 15:14:26 ... Dangerous options. Uh, uh, a certain subset of options, and if we did this algorithm, it would allow the attacker to choose 15:14:30 Stephen Curran: Okay. Yeah... 15:14:32 ... Yes 15:14:34 Manu Sporny: Which is why we did not implement it like this, right? So anyway, we can go on, but I'm just saying, like, this is the problem that we have with this approach... 15:14:37 Stephen Curran: Yep. Well, we're gonna see that in the next one, then... 15:14:40 Manu Sporny: That's... 15:15:02 Stephen Curran: Create, if needed, an empty options data structure, and that's because... 15:15:04 q+ 15:15:07 ... Where did Resolution accept a DID URL? So the same step for number one, receive a DID URL. Some implementations may accept an option data structure. Verify the received DID URL for validity. Did resolution has already been defined to have options? 15:15:14 ... Invoke a DID resolver passing the DID URL and options 15:15:20 q+ to say I think options data structures are a MUST 15:15:26 ... And carries on. And then processed the URL with the resulting DID document that did metadata. So assume that they did resolver, accept the URL 15:15:27 ack Wip 15:15:33 Otto Mora: So, I see Will first on the queue... 15:15:38 q+ 15:15:43 Will Abramson: Yeah, I was just gonna say, like, I don't think this… this options data structure is empty, or not necessarily. Uh, right, like, it's... 15:15:44 q+ 15:15:53 ... up to the client to decide which options they want to additionally provide. I think Joe had some good examples, like, for example, you know, if you have a 15:15:58 ... Verifiable credential with a specific issuance time, or, like, an expiry date. you 15:16:09 ... might want to resolve the verification method on that bid, but also for the specific time that you're kind of additionally adding in 15:16:15 ... So it's basically you create the options with options that make sense to you. I don't think it would always be empty 15:16:23 Stephen Curran: Options… Um, okay, so… so hang on, so... 15:16:23 ... Uh, I believe options are just parameters 15:16:26 Will Abramson: What?... 15:16:26 Stephen Curran: That are passed in a different way. And... 15:16:29 Will Abramson: Whoop-a-thank Earl... 15:16:38 q? 15:16:47 ... I think they are, well, currently they are parameters, but also you can just, they don't need to be parameters, right? Like you can resolve a did with some options. And those options don't have to have come from the did URL. They can just come from there. Um, resolving part 15:16:55 Stephen Curran: Okay, so that would require a dereferencer would need this step... 15:16:58 ack JoeAndrieu 15:16:58 JoeAndrieu, you wanted to say I think options data structures are a MUST 15:16:59 Joe Andrieu: I'm on the queue to talk to this, Ste... 15:17:02 Stephen Curran: Um, I did… okay, go ahead... 15:17:12 Joe Andrieu: I think it is a may, but on the client side, not on the server side... 15:17:28 ... So the… the dereferencing clients may have options that they care about. Uh, verifiable credentials, a good example. Like, the… the DID URL that is… is pointed to in the… in the proof property. Um, may not have a version time on it, but we may want to add a version time option 15:17:46 ... And I believe this is this is the pattern of HTTP headers. You can you can absolutely do an HTTP get without adding any headers. But you might for good reasons. And so I think the client might add options for good reasons. And that means that the server needs to be able to handle options coming in 15:17:46 q+ 15:17:50 ... But it will also need to parse the did URL to get the query parameters from the URL 15:17:52 ack manu 15:17:54 Otto Mora: Okay... 15:17:59 ... Let's see, Mano next 15:18:18 Manu Sporny: Yes, uh, plus one to what Joe said, um, the data… the options don't always have to come from, you know, the query parameter, uh, URL. Uh, it also opens a question on, like, our expectation is the options would override, um, what's in the DID URL. That's… that's given. I don't know if we've… we've... 15:18:37 ... we had a discussion about that. And then the options can also have, uh, things that are totally unrelated to the DID URL, things that you know the resolver can do, um, that are specific to the resolver you're using, um, and so on and so forth. So it is very important to have both of these things 15:18:43 ... you know 15:18:48 ... Um, because if you only have one of them, you have to do 15:19:02 ... potentially, you know, weird things and you can't override and you have to make decisions when you don't necessarily have all the information that you need to make the decision. So a plus one to this 15:19:14 q? 15:19:18 ... but the expectation is that, you know, the options are not empty. Uh, if they, you know, conflict with what's in the DID URL, they override, and then they can also have things that are completely independent of the DID URL, um, and any kind of query parameter. That's it 15:19:19 ack markus_sabadello 15:19:21 Otto Mora: Okay... 15:19:29 ... Marcus? 15:19:42 Markus Sabadello: Okay. A few things. First. just have to… to mention again that I… I objected to merging the pull request to 331. Um, I… I know we probably don't want to spend time on the call about that, but I… I don't think that, uh... 15:19:58 ... process for reaching consensus against objections was followed. I'm not an expert on this, but I read something about call for consensus and votes and things like that, and I don't think that was 15:20:03 ... that was done, so I think while we're still discussing these things, uh, that pull request should not have been… There's, um 15:20:12 ... Having said that, I fully agree with what Joe said about 15:20:28 ... I also agree with what Manu said, that options would override what's in the… Client might want to add options for good reasons in addition to two parameters in the URL. This is a little bit like HTTP headers. I fully agree with that 15:20:33 ... Parameters, um, and… Yeah, with regard to 15:20:45 ... to these two options that I think Stephen summarized them really well. I think it's well known that I'm very much against the second option, and 15:20:49 ... Uh, prefer the first one, the way how it's been, um 15:20:53 q? 15:20:58 ... I don't understand the argument why, what would be dangerous about that 15:21:00 ack swcurran 15:21:02 Otto Mora: Uh, yes, Steven... 15:21:14 Stephen Curran: Um, I… I'm confused by what, Joe, you're calling a client. Is… I thought the client would be the thing that's invoking... 15:21:17 q+ 15:21:25 ... the DID URL dereferencer, so it would be supplying these two inputs, these one and possibly two inputs. So, um… I'm not sure 15:21:37 ... where you're using it. I guess maybe you're using the term of the client of the resolver, but that just gets confusing to me. And then the other 15:21:38 q+ to suggest we do a CfC today on 331, also. 15:21:42 ... Manu, if you're saying that the input must have 15:21:45 q+ to clarify misreading the slide. 15:21:46 ... Um, an options data structure, and must 15:21:54 ... even override the URL with those. I think that 15:21:59 ... would adjust this first step. Is that what you're suggesting, is this first step is wrong, and then, in fact, in client… And… did URL 15:22:08 ... dereferencing the. Data structure? There has to be an accept 15:22:10 Otto Mora: Okay... 15:22:10 ack manu 15:22:10 manu, you wanted to suggest we do a CfC today on 331, also. and to clarify misreading the slide. 15:22:11 Stephen Curran: That's it... 15:22:14 Otto Mora: Uh, Manu?... 15:22:16 Manu Sporny: I think Joe was on the queue... 15:22:19 Otto Mora: Oh!... 15:22:20 ack JoeAndrieu 15:22:24 Joe Andrieu: Yeah, that's alright, I know. Um... 15:22:27 Otto Mora: Apologies. Yes, sure. Right... 15:22:33 q+ 15:22:38 Joe Andrieu: Uh, I'm confused by your confusion, Steven. Um, there's one client, and it's a client of the resolver. There's a resolve call that we're talking about, and the question is whether that resolve call takes a DID or a DID URL... 15:22:59 ... I had thought we had resolved that the client here is what we sometimes call the dereferencer as opposed to having a separate service endpoint that then creates the potential for two different kinds of clients that we have to distinguish who's calling the dereferencer service and who's calling the resolve service. So, I don't know if you just 15:22:59 misspoke, or… or I missed hearing you 15:23:09 Stephen Curran: No, that's that's just never been clear to me, and I don't. I don't really understand. But that's okay. That's I don't want to distract us from that. Um... 15:23:24 ... this… Okay, so you're saying it's just the invoke the DID resolver, and the only question you have in this whole thing is you don't care about these other steps, you just care about whether. is in here 15:23:25 Joe Andrieu: Well... 15:23:28 Stephen Curran: This word is in here... 15:23:35 Joe Andrieu: I… I don't know who's receiving a DID URL... 15:23:38 ... Um 15:23:47 Stephen Curran: Like, okay, so let me give a concrete example that's been used before. A VC has been signed with a DID URL, which I think is a... 15:23:53 ... a thing that I'm promoting as a use case, where I would like to see 15:24:04 pdl-ASU has joined #did 15:24:09 q+ 15:24:10 present+ 15:24:12 ... Um… you know, in signatures in VC, not only the fragment that it identifies the key, but also a version time parameter. So I might see a… did URL sign a VC that contains version time and… And the, um… PID 15:24:27 ... So we stripped off that. That's what I am expecting as the input to here would be the thing that was used in signing the VC. Not only that, but I would expect that 15:24:27 qq+ 15:24:37 ... The caller to this might even add the version time, because they want to know what 15:24:48 ... on their own. The state of the DID was at the time it was signed. So they've got this VC that was signed two years ago. They want to process it at that time. So the input DID URL to the dereferencer they pass, they add on version time 15:24:50 q+ to you wanted to suggest we do a CfC today on 331, also. and to clarify misreading the slide. 15:24:54 ... That is what I'm expecting as this input to step one. And then the rest of steps. The rest of the steps are simply 15:24:55 q? 15:24:59 ... deterministic steps to invoke a DID resolver 15:25:02 ... So that's how I see it. That's it 15:25:08 Otto Mora: Okay, uh… Yes, now, Manuel, go ahead, yes... 15:25:09 ack manu 15:25:09 manu, you wanted to react to JoeAndrieu and to you wanted to suggest we do a CfC today on 331, also. and to clarify misreading the slide. 15:25:27 Manu Sporny: Yeah, I think I misread it in the same way that Joe did, Steven. It was confusing to me that you're basically writing the steps from the point of view of, like, the server. And now that I understand that, I understand the steps a bit better... 15:25:30 q+ 15:25:39 ... the… the concern I had is that, you know, step 3, you create an empty options data structure, um, and the if-needed thing threw me off, because you don't need it if somebody passes it in, and then it gets passed through. So it's just some of the wording was 15:25:42 Stephen Curran: Exactly. Yes... 15:25:50 Manu Sporny: was confusing. I think I'm fine with it now that I understand, like, it's written from the point of view of the server, and... 15:25:56 q+ 15:25:58 Stephen Curran: Yeah... 15:26:01 Manu Sporny: you know, if you don't get in options, you'll create an empty one, because they didn't give you anything, and then you pass it on. If you were given options, you'll just pass them through, uh, which is… which is fine... 15:26:09 ... Yep, and I think you're right, the thing that matters is step 4, where it says, did URL instead of did, and 15:26:10 q? 15:26:14 Stephen Curran: Yeah... 15:26:28 Manu Sporny: And that's the key difference, I think, between the one before and this one, or the one that matters that we're discussing today. The other thing I put myself on the queue for is, you know, I heard Marcus loud and clear. I think he thinks there's been a process issue... 15:26:44 ... Uh, so we should do a call for consensus on poll 331 today. Um, what we could do is we could back it out, and then wait a week, and it's gonna be two weeks, and then do a call for consensus, and then, you know, decide, and then put it back in, or we could just 15:26:50 ... Figure out if that was, um, uh, you know, what the, what the… If that… if that… if we, you know 15:27:04 q? 15:27:09 ... Don't have consensus, which I don't think we have, um, because, you know, Marcus' statement earlier, and then the repercussions of that. Um, so I, I'd suggest chairs, you've got to take, you know, process issues seriously, and you're gonna have to 15:27:13 ... run, um, you know, a call for consensus on that item. Um… That's it 15:27:15 Otto Mora: Mm-hmm... 15:27:16 ack markus_sabadello 15:27:19 ... Okay, Marcus? 15:27:34 Markus Sabadello: Yes, just to add to that 331, just to be clear, I actually really like that in some ways. I like the... 15:27:50 ... organization of of handling strategies and and things like that. I just don't, or I just object to the fact that 3, 3, 1 already clearly leans into one one of these 2 options that we're 15:27:58 q? 15:28:05 ... And… still discussing here. Right? So it it talks about resolving Ddrls. And that that's what I I'm opposed to. But I'm I'm not opposed to the the general structure in 3, 3, 1 15:28:14 ... With regard to these two options, I would really like to understand a bit more 15:28:20 ... why the second option is better than the first. I know I've missed some of the calls, so I apologize if this is 15:28:23 q+ 15:28:29 ... already been, uh, covered, and this is clear to everyone, but it's… it's not clear to me. I don't understand 15:28:34 ... what's dangerous about the first option? Um, I feel like 15:28:40 ... If we are worried about an attacker injecting dangerous options 15:28:44 q? 15:28:53 ... in the in the 1st option in in the 1st approach, then the the same attacker could just as well and check dangerous options or dangerous parameters in the in the second approach. So I don't 15:29:02 q- 15:29:06 ... that it doesn't really need it. It passes the potentially a path 15:29:16 ... I don't understand that. I feel like the second approach is more dangerous because it has these things to the resolver. To the resolver, which it doesn't need, so there's additional… opportunity for attackers to inject something. So, I don't understand 15:29:20 ... That argument, um 15:29:26 ... Yeah, in addition to my concern to make these kinds of changes in… In the first place 15:29:29 ack JoeAndrieu 15:29:34 Otto Mora: Mm-hmm. Uh, Joe?... 15:29:34 q+ to state why first option is dangerous (the client has less knowledge than the resolver to make decisions around parameters). 15:29:40 Joe Andrieu: Sure. So, Manu, unfortunately, your comments confused me even more... 15:29:48 ... If… if… if we want to talk about what the client is doing. It's… I think 15:30:13 ... That would be one set of steps. And I can and I want to speak to that. If we're talking about what the resolver is doing when it is called, that's another set of steps. And we could talk to that. But when I was reading it, I thought Stephen was trying to map this to what the client of resolver does when they have a DID URL from a VC. And what 15:30:13 do they do with it? 15:30:20 ... And in that case, for me, I wouldn't even bother verifying the DID URL, and I would not create an empty data structure, because I don't need one. I'm just going to call the DID resolver. Um, and give it a date URL 15:30:29 Stephen Curran: So… It requires an options. That's why it's there. It has to have that. That's the interface... 15:30:29 q? 15:30:33 Joe Andrieu: Right. My position is that that should be optional rather than forcing people to construct an empty one... 15:30:37 ... Um, but let me also speak 15:30:40 Stephen Curran: So that opens another, that opens another can of worms. So, okay... 15:30:59 Joe Andrieu: Sure, but let me speak to Marx's concerns. I think anywhere we can reduce unnecessary processing, we will improve the security of the system. We will remove the bugs that might occur because the client. Isn't processing options, according to the spec, 100%... 15:31:16 ... Manu described earlier that their their clients don't do that Their clients do not process all the options. So if the query parameters that need to go to the resolver change, then Manu's code is gonna be in in a problematic situation 15:31:25 ... Um, all we're doing in that processing step on the client is we're taking what is already embedded in the URL, assuming there are no changes 15:31:28 q+ 15:31:41 ... Um… The… And forcing the client to process it, and put it in a JSON object, and then send it to the server. It's the exact same information with an additional, I would argue, unnecessary transformational step. That transformational step is what I'm trying to get rid of 15:31:59 ... On the resolver side, I think it's easy to ignore what you don't need. I think it's harder to, on the client side, to add what you don't know you need to add. That's the difference between these two approaches, is I'm trying to make it easy for the client to say, hey, I've got a DID URL 15:32:13 ... Give me the DID document for it. I don't have any special requirements around version ID or version time. I don't know of any other options that I'm going to put in, just like I get a URL and I do a GET without adding any HTTP headers. If I do want to customize 15:32:18 ... the resolution output, then I can add options, but I don't need to. And that's the simplicity I'm trying to get to 15:32:19 ack Wip 15:32:21 Otto Mora: Okay... 15:32:28 ... Thank you, Joe, and Will 15:32:53 Will Abramson: it… there's no normative language there. I tried to be intentionally vague. I agree, it does reference… it does talk about dig URLs, maybe it... 15:32:56 ... slightly lean towards DigiURLs, but it does not 15:33:01 ... It doesn't define the inputs and outputs of any of the steps intentionally. And… Uh, yeah, I mean, I think that was a great description, but I just wanted to talk to 331 briefly. I mean, I'm happy to do a call for consensus, that's a great idea. I guess, you know, the reason that it got merged was so we could move forward to getting the PRs 15:33:01 into the other thing. Like, my sense of 331 is 15:33:23 ... You know, the conversation today was intentionally decided, you know, set up to finalize this discussion, did URL versus did. I don't think 331 is implying in any way that we've made that decision. I think that's very clear 15:33:36 ... To me. So, you know, in some ways, it's not a normative change, but… oh, I saw it anyway. That's why I thought we could just merge it and then get to concrete spec text around the steps and start moving the spec forward. Maybe I have… yeah 15:33:39 Agree with Will, but if we have a process objection, let's make it clear what the group. 15:33:39 Otto Mora: Yep... 15:33:46 Will Abramson: So that's all I'll say. I mean, I don't know what does a call for consensus look like. We want. Uh, proposal... 15:33:49 s/group./group wants./ 15:33:52 Otto Mora: Yes, um, I wanted to plus one what Will was saying, like, Marcus, like, the goal here was to have... 15:33:57 ... Kind of the bigger, high-level 15:34:02 ... structure of the algorithm, uh, figured out, and then go to the details where I think where… that is where 15:34:10 ... the the differences of opinion have have emerged. But yeah, like we we weren't trying to 15:34:16 q? 15:34:18 ack manu 15:34:18 manu, you wanted to state why first option is dangerous (the client has less knowledge than the resolver to make decisions around parameters). 15:34:19 q+ to note it doesn't matter what the Chairs think if we have someone noting that process was not followed. :) 15:34:23 q- 15:34:23 ... Oh. let's say, overrule you or whatnot. We were just trying to have the high level structure, and then in in further prs get down to the more specific items. Let me see… Amanda was next 15:34:33 Manu Sporny: Uh, yeah, I'm sorry, I was trying to remember what to say. Um… Uh, it... 15:34:50 ... Just to kind of underscore what Joe's saying, Marcus, you were asking for like, you know, what are the reasons the group, you know, is favoring one approach over the other. Plus one to what Joe said, when it comes to our implementations 15:35:06 q+ 15:35:08 ... We don't want the client to do any kind of processing on the dead URL by default. Right. The the when it comes to like who what what part of the system just looking at kind of software architecture, what part of the system 15:35:24 ... Has the best knowledge and is best positioned to make a decision about what parameters to use and which ones to include and which ones to not and all that kind of stuff. That is the resolver. That's the did resolver, you know, a server side component 15:35:46 ... It is not the client library that's living in application space. Now there may be extra things that that client library does that it does have kind of specialization around, but we, Digital Bazaar, would much rather that logic go into the thing that's doing resolution 15:36:15 ... Um, uh, because it has all kinds of other signals and information that it can use. Like, hey, I know what this DID is, and I know the version ID that's being used is a potential attack vector for this specific DID method, and so I am not going 15:36:22 ... to utilize that when I resolve, or I'm going to throw an error, or I'm going to do all this other stuff. The client has no ability to gather that kind of data, right? And for those reasons, we do not want the client making these types of decisions on the client side, because it does not have the information that 15:36:27 ... a resolver would have to make, you know, specialized decisions like this. So 15:36:30 q? 15:36:47 ... that is a play… that's different from Joe's reason, slightly, um, but it's another reason why we prefer the second option, right? Um, it is what most folks that use, like, HTTP 15:36:58 ... you know, URLs, what they expect from their libraries. They just pass the opaque string in, and they get something back, and all the backend stuff, you know, does what it needs to do. Meaning, you know, the server uses whatever, you know, business-specific logic that it needs to use to 15:37:02 ... to respond 15:37:13 ... the, the, you know, I appreciate, Will, your and Otto's explanation of, like, what we're trying to do, I totally agree with it, but it doesn't matter, right? Like 15:37:31 ... Marcus is asserting that there is a process violation that happened. We need to make it very clear whether or not it is. We do a proposal and a resolution proposal, you know, merge, you know, 331 or leave 331 merged. People weigh in on it on whether or not they believe that that was, you know, the right thing to do 15:37:44 Otto Mora: Okay... 15:37:47 Manu Sporny: And then you've got to make, you know, a consensus call and do a resolution. That's the only way to address, you know, Marcus's assertion that there's been a process violation. That's it... 15:37:53 Otto Mora: Uh, let me just here converse with, uh, Will on whether we can move forward to that, but, uh, yes, before, uh... 15:37:54 ack markus_sabadello 15:38:03 ... I know that Marcus was on the queue, so go ahead, Marcus 15:38:06 Markus Sabadello: Hey, thanks for explaining, Manuel, how... 15:38:23 ... how your implementation works and the reasons for that. I fully agree with that. I fully agree that the client should not have to have any knowledge about what parameters or options matter. I fully agree 15:38:32 ... the resolver is… is the place where… where that should happen. Um, but I think there's nothing in… in this first approach which 15:38:45 ... Which says that in the algorithm that we've had so far, it says take the, take the parameters and, pass them to the resolver 15:38:45 ... as options. Steven said early on this call that 15:38:50 q+ to note you can't separate out options from the URL from client desires. 15:38:56 ... if I cite him correctly, something like options are just a different way of passing parameters 15:39:08 ... Which… which I agree with, and so I think there's nothing in the algorithm the way we've always had it that suggests that the client should somehow 15:39:17 ... process or filter or decide anything about which parameters matter and which don't. So I cannot understand that explanation. I cannot understand 15:39:31 ... chose, uh, chose comment either about transforming the option… options to a… to a JSON object. That's… that's not really in the… in the approach one or in the in the previous algorithm either 15:39:32 ... That's it. Thank you 15:39:35 Otto Mora: Okay... 15:39:40 ack swcurran 15:39:44 ... Okay, um… I see Steven 15:39:49 ... Then Manu, and then we're gonna go into the proposal conversation. But yeah, go ahead 15:39:55 Stephen Curran: Okay, I think we're close to getting somewhere here, so hope we can... 15:39:55 q+ to say how do query parameters get to the resolver if the full DID URL isn't passed? 15:40:01 ... Finalize. Um, I'll add from the experience we had this week, we did WebVH, and the, um 15:40:18 ... problems with the resolver, the DID WebVH resolvers that were uncovered through the security check. It actually was all about verifying the DID 15:40:28 ... And most of them, many of them were there. So if we could move this step out of as we're calling this client space and into 15:40:38 zakim, close the queue 15:40:38 ok, ottomorac, the speaker queue is closed 15:40:39 ... the resolver, it is more likely to happen. Like, what we found was we have 5 implementations, and none of them were 15:40:52 ... really checking the DID itself for validity in a reliable way and leaving itself open 15:40:55 ... getting all clients to do that versus having this thing called a resolver, um, library that would do it. I think that's 15:41:13 ... a better way to do it. It reduces that… the likely… it increases the likelihood it will happen inconsistently. So if you don't pass the DID URL to the resolver, you don't get the possibility of that. So I'm actually… I've… I've really been on the… you know, I'm 15:41:17 q? 15:41:26 ack manu 15:41:26 manu, you wanted to note you can't separate out options from the URL from client desires. 15:41:26 ... not really concerned either way about this, but I think that is an argument that pushes it towards this one versus this 1st option. That's it 15:41:26 Otto Mora: Mm-hmm... 15:41:27 ... Bye now 15:41:48 Manu Sporny: Yeah. Um, Marcus, I wanted to respond to your, you know, the, the, you know, the ability to pass, uh, you know, take the parameters in, in, in approach number one, we take the parameters out of the URL and then we put it into a JSON object and we send it up... 15:42:05 ... The other issue that that creates is that, at that point, we cannot tell the difference. We, meaning the server-side component of this thing, cannot tell the difference between parameters that existed in a DID URL that was potentially passed to the client 15:42:20 ... and other things that the client… other options that the client wanted to provide that would override the URL, right? We… we co-mingle the information in a way that the resolver cannot tell the difference between, like, this came probably from the URL that the 15:42:31 q+ 15:42:40 ... that the client had, and this other set of things came definitely from the client and were not in the URL. I think that is also, you know, an important kind of signal that the server-side component can use to figure out the best thing to do. Again, I think 15:43:04 ... these resolvers can have massively complex decision logic based on certain types of did methods and known, you know, breaks in the space and and all that kind of stuff. And and when it's running that when it's running that those algorithms, it's it's important to be able to tell the difference. I'm like, these are client preferences. These came 15:43:04 from the 15:43:15 ... original URL, and if we commingle those things, then it loses the ability to get those types of signals in and make the best decision, the best resolving decision. Again, that's an argument for 15:43:26 ... The second option, which does let us determine the difference between, like, these definitely came from the client and are potentially overrides, and these, you know, are something the client got from some other system downstream 15:43:26 q? 15:43:26 Otto Mora: Mm-hmm... 15:43:29 Manu Sporny: That's... 15:43:34 ack JoeAndrieu 15:43:34 JoeAndrieu, you wanted to say how do query parameters get to the resolver if the full DID URL isn't passed? 15:43:40 Otto Mora: Yeah. Sorry, Marcus. Yeah, we're closing the queue for this one. But go ahead, Joe. Last last one, and then we go to the 3, 2, 1... 15:43:51 Joe Andrieu: Thanks. Plus one for the ability to tell the difference between overrides and what was in the base did URL. But Marcus, you ask where in the spec does it say that you must... 15:44:04 ... uh, parse the query parameters and put them in the options. And I… I think it is… it is… it is clear when you look at the signature of Resolve that if I cannot send the folded URL 15:44:12 ... then… if there are any options, any query parameters in the DID URL, I must put them in the options. If that DID URL has a version time 15:44:20 ... Then I must parse it and put it in the options, or I am not going to have that applied to my system 15:44:30 ... Um, and put them into options. So I think the spec makes it very clear that you must process those parameters 15:44:30 ... That's it 15:44:30 +1 to Joe 15:44:30 Topic: https://github.com/w3c/did-resolution/pull/331 15:44:30 Otto Mora: Uh-huh... 15:44:39 ... Okay, thank you. All right, so for the next, let me just change the topic to PR331. And… let me emote 15:44:42 ... a proposal 15:44:48 ... So that's my proposal text, um 15:44:56 ... I just wanted to make it simple, but is there any comments on the proposal first? 15:45:02 ... Before we… Um 15:45:05