13:53:46 RRSAgent has joined #did 13:53:50 logging to https://www.w3.org/2026/08/19-did-irc 13:53:52 rrsagent, make logs public 13:53:59 Meeting: Decentralized Identifier Working Group 13:54:04 Chair: ottomorac 13:54:24 swcurran has joined #did 13:54:26 Agenda: https://lists.w3.org/Archives/Public/public-did-wg/2026Aug/0007.html 13:54:28 clear agenda 13:54:28 agenda+ Will Abramson 13:54:28 agenda+ Pierre-Antoine Champin 13:54:28 agenda+ Otto Mora 13:54:28 agenda+ [Decentralized Identifier Working Group](https://www.w3.org/groups/wg/did/) ([View Calendar](https://www.w3.org/groups/wg/did/calendar/)) 13:54:37 previous meeting: https://www.w3.org/2026/08/13-did-minutes.html 13:54:43 next meeting: https://www.w3.org/2026/08/20-did-minutes.html 13:59:09 transcriber-bot has joined #did 13:59:20 transcriber-bot, connect 13:59:21 scribe+ 13:59:30 transcriber-bot, pause 13:59:30 scribe- 14:00:01 markus_sabadello has joined #did 14:00:42 present+ 14:00:48 present+ 14:01:02 TallTed has joined #did 14:02:03 Wip has joined #did 14:02:06 present+ 14:02:40 present+ 14:02:47 denkeni has joined #did 14:03:05 JoeAndrieu has joined #did 14:03:35 transcriber-bot, resume 14:03:35 scribe+ 14:03:38 Topic: Agenda 14:03:40 Joe Andrieu: Howdy. How's it going?... 14:03:47 Otto Mora: Good morning, Joe... 14:03:55 ... If 14:03:57 danpape has joined #did 14:03:59 https://docs.google.com/presentation/d/11fdtIGQ8iB1w13VqGVsaFE0IaBqYhWozjP9NUxdUiOA/edit?slide=id.p#slide=id.p 14:04:06 present+ 14:04:16 present+ 14:04:19 ... Alright, so I think then we would be good. Let me just, uh 14:04:20 present+ 14:04:23 Topic: PR 344 14:04:24 ... And then transcriber part 14:04:47 ... So, uh, yeah. So the topic for today is, uh 14:04:48 Stephen Curran: Okay... 14:04:51 Otto Mora: a walkthrough of a presentation, uh, prepared by Steven, uh, to help us kind of review some of the comments and suggestions on PR344... 14:05:06 Stephen Curran: Oops. Yeah. Okay. Hopefully, people can see that... 14:05:09 q? 14:05:14 Otto Mora: Um, and then we'll be walking through that. The link to it is here. Paste it here and in the zoom app... 14:05:31 Stephen Curran: Um… let me see... 14:05:42 Otto Mora: And... 14:05:56 ... I guess, uh, that would be the main topic, any… suggestion from anybody before we dive into the presentation. Let's even do the driving 14:06:13 ... Okay, any suggestions? 14:06:16 Stephen Curran: I can remove this. I'm in section 611... 14:06:19 Otto Mora: Uh… perfect. Go ahead, Steven. Yeah... 14:06:24 Stephen Curran: Hopefully that'll help. So trying to get to merge, that's our goal here. What I did was scan the PR, collected the open points of discussion, put into slides with links. Um, and then... 14:07:10 q+ 14:07:13 ... User of the implementation get to that selecting of the resolver 14:07:34 Manu Sporny: Yeah, I... 14:07:34 ack manu 14:07:38 Stephen Curran: So let's see how this works. So the 1st issue is. Section 611. So if I click on this link, takes me to Joe's PR... 14:07:42 Manu Sporny: Okay, thank you... 14:07:46 ... Uh, yeah, um… It's fine to be vague about this, um 14:07:51 Otto Mora: Go ahead... 14:07:54 Joe Andrieu: Sure. The implementer is whoever is writing the client software. The client software is executing this algorithm. The algorithm must choose a resolver to talk to... 14:08:03 Manu Sporny: But we do need to be clear about, you know, what's actually doing the selection. I think the text is pretty clear. as if… the text could be clearer. At the very end, it says, implementers must enable users to choose the resolvers they trust... 14:08:06 Stephen Curran: Um... 14:08:12 Joe Andrieu: And the user has to be able to, um, decide which resolver is used... 14:08:15 Stephen Curran: Number two here is to select a resolver that is capable of handling the DID methods. And the question that comes out, let me make sure I can jump back. Yep. The question that comes out is... 14:08:22 q? 14:08:29 ... Um… Who is selecting the resolver and what is the mechanism they are using to do that? And 14:08:32 Manu Sporny: for a specific DID method... 14:08:33 Joe Andrieu: In some manner, in the same way that you get to pick which website your browsers go to... 14:08:36 Manu Sporny: Um, okay... 14:08:48 Stephen Curran: And related to that is, how did that… how does an implementer, as it say, have a must involved? And that's where I wasn't sure. I think I'm the main one asking about this one. I wasn't sure how... 14:08:53 Manu Sporny: I don't know how we actually enforce that in a testable way in the test suite... 14:08:55 q+ 14:09:00 ... uh… I would suggest we remove that must statement, and just make it a statement of fact. Um, you know, implementers enable users to choose the resolvers they trust. Um… and then the… I think that the thing that's tripping me up is, like, who selects a resolver? Um, it could be 14:09:01 q+ 14:09:05 ... You know, it's the software selects a resolver based on user preference would be one way to state it to make it a little more clear, because everything that we're writing here is for the software implementation, I think 14:09:08 ... anything testable here that we're writing is for the software implementation, right? Um, that's the only thing I'd suggest here. Like, I think it's fine to be vague about, like, how the selection happens, but we do need to say, like 14:09:11 Stephen Curran: Um... 14:09:14 q+ about the use the term "client" is the implementer 14:09:20 q? 14:09:26 ack JoeAndrieu 14:09:29 ... Who the… who the implementer is in this case, and then how does the 14:09:37 Manu Sporny: Ultimately, the software chooses a resolver based on user preferences... 14:09:40 ... And then this could be a remote resolver or local resolver 14:09:41 Otto Mora: Alright... 14:09:42 Stephen Curran: So, over to Joe, I think, to start... 14:09:45 Otto Mora: Okay, so we see Joe in the queue, and then after that, Marcus... 14:09:49 Joe Andrieu: Yeah, uh, Manu, I wasn't clear about what you thought was just clear, so, um, might be useful if you have some proposed language. Um, I really just didn't follow. Um... 14:09:58 Stephen Curran: Okay, Manny? And we're using the queue. So go ahead. Sorry... 14:10:17 Joe Andrieu: To me, this seems easy to test. In your test suite, you have included the profile of what test is happening, the resolver that the test writer wants to be tested for that. And if the software can't handle that the resolver is being set in some way, um… then, uh, we would know that they're not able to be, uh, reflexive to using 14:10:17 different resolvers than what the software is already configured for. Um... 14:10:28 ... uh 14:10:33 ... The 14:10:40 q? 14:11:05 ack markus_sabadello 14:11:07 ... The point here is that it's the… if the user doesn't… isn't choosing the resolver, either through some preference interface, or by specifically selecting it in real time. Then we're just building a walled garden where the the client to resolution decides for the user And that is, I think, not only antithetical to our decentralized mission, 14:11:07 it violates our security model 14:11:11 ... Where the user fundamentally has to be able to trust the resolver that they're using because they are not the ones who are going to be able to validate what the resolver is doing. You have to have a trusted relationship there. So the client software should not be mediating that question. The user should be in charge of 14:11:14 ... Pointing to whichever resolver we go to 14:11:17 Otto Mora: Okay, Marcus... 14:11:21 Joe Andrieu: Um... 14:11:26 Markus Sabadello: Yeah, I think it's good that we say something about this. And obviously, I also believe it's important to be able to choose what resolvers to use... 14:11:29 Joe Andrieu: And I I think it's it's core to our security disposition... 14:11:45 Markus Sabadello: Um, I'm… I'm not sure if this is part of the algorithm itself. I… I feel like it's… it's a little bit out of scope of maybe this section, at least. It's... 14:11:51 ... It's a bit like, if you imagine the HTTP specification, that doesn't say that the user must be able to choose between browsers. I feel like it's not part of the algorithm itself, but it's something that we can 14:12:14 ... Uh, covering 14:12:28 ... in, uh, architecture section or security considerations. I'm… and I'm not sure if I agree with the must statement here. It would be a bit like saying that if you want to be 14:12:32 q? 14:12:32 Maybe we could change the text before the list needs to add something like: "An implementation does the following:"? 14:12:38 q+ 14:12:43 ack manu 14:12:43 Otto Mora: Yeah, go ahead, man... 14:12:47 Markus Sabadello: conformant with DNS and use DNS, then you're only conformant if you allow people to choose the DNS resolver, but I think in some cases. there are also applications, uh, where you just have a built-in resolver, right? And let's say for these, you have some... 14:13:01 ... constrained IoT device that wants to use this, and now you maybe can't build an elaborate system to configure what kind of resolver to use, because you just have a built-in one that's working fine. So I think it's a good idea to say a lot of things about this 14:13:10 Manu Sporny: Yeah, I suggested some language in IRC, Joe, uh, that doesn't have a must in it. I think maybe in prepare for resolution, we just have something before that that says an implementation does the following... 14:13:16 Markus Sabadello: Just not sure if it's... 14:13:17 pdl-asu has joined #did 14:13:18 Manu Sporny: Um... 14:13:19 q+ to say that's the entire section 14:13:21 Markus Sabadello: A strict must statement... 14:13:32 +present 14:13:39 ack JoeAndrieu 14:13:39 JoeAndrieu, you wanted to say that's the entire section 14:13:40 Manu Sporny: Because I think that is what we're saying is like, the spec is written for, you know, an implementation, an implementer that's implementing an implementation and the implementation must do the following four things, or the implementation does the following four things. I'm taking must out of there. The… I… it sounded… what you 14:13:40 said sounded workable, Joe, but I was working on the text and I missed it. How… how... 14:13:44 Joe Andrieu: Um... 14:13:47 Manu Sporny: How does the test suite work?... 14:13:52 ... Test that statement at the end of two 14:13:57 Joe Andrieu: The... 14:14:00 ... To answer your last question, the… the… my understanding is how we're testing any of this is that 14:14:00 q+ 14:14:01 ... The, uh 14:14:02 Otto Mora: Go ahead... 14:14:05 Joe Andrieu: The software being tested... 14:14:10 ... Provides a profile of the test that it has implemented so that we can test it just for those things. And they include in that the metadata needed to do that test. Um 14:14:24 ... Because we've not standardized how you set it 14:14:45 ... There would have to be some way to communicate that to the test algorithm. And so the part of part of what maybe is confusing here with our previous test regimes that we had 14:15:04 q+ to ask where we say that? I'm looking... 14:15:12 ... Is that this is the implementation algorithm. So it actually got on the queue because you use a phrase saying that we need to add the language. Um that an implementer that's implementing must do or does these things 14:15:25 ... That's what this whole section is 14:15:31 ... Like, that's what the DDDRLD referencing algorithm is, is that client software and implementation of the spec does these things. So we could repeat it on any number one of these bullet points, but that is the point of this section to explain what a client does 14:15:37 ... Um 14:15:52 ... I'm I'm confused why the I mean, if if the if your opposition to the must is just that it's hard to test. Then we probably need to rethink how we are testing this implementation 14:15:59 ... And this algorithm. Because we're not testing an endpoint like we will be for resolve. Right. The resolution endpoint has clear inputs and outputs. And we can run against that. But this whole implementation algorithm 14:16:02 ... Is what a client needs to implement. And we haven't really talked about how do we know that that implementation is happening. Because there isn't a clear input and output. That's part of the design algorithm here is because reducing it to the inputs and outputs led to more arguments than 14:16:04 ack swcurran 14:16:10 Otto Mora: Uh, Steven?... 14:16:11 Stephen Curran: Um, I'm... 14:16:14 Joe Andrieu: clarification, and I think created… concerns about security and function and privacy and all sorts of things. Um… so maybe there is a bigger question about how we test this algorithm in general?... 14:16:27 ... Um 14:16:36 Stephen Curran: I'm not so much questioning the why, but the how, as I think Marcus and Manu have mentioned, is the difficulty there. Your use of the term client threw me off, but then you used the term user. So, are you envisioning that. Did URL dereferencing is an algorithm?... 14:16:39 ... As is the resolution, and that something in 14:16:47 q+ 14:16:49 q+ 14:16:53 ... invokes it, and that's what you call the user. So the use… so there's this standard software, a client, and a user invokes it. And… and then it… that client, as you called it, takes over 14:16:56 Joe Andrieu: But I'm not sure best how to resolve that... 14:17:02 Stephen Curran: and runs through all of these steps. And and so the and and so I'd like to clarify that. And then... 14:17:16 q+ 14:17:16 ... somehow the user has to signal to the client, hey, I want you to use this resolver, and it's that that I don't understand. So I… that… my model was that, that 14:17:28 ack manu 14:17:28 manu, you wanted to ask where we say that? I'm looking... 14:17:28 ... Something is calling a implementation. And, it's got to somehow. convey to that implementation, hey, I want you to use Fifth Resolver, and that's what… where I'm a little lost 14:17:34 Otto Mora: Okay. Thanks, um, bye now... 14:17:39 Stephen Curran: That's it... 14:18:05 Manu Sporny: Yeah, so just to be clear, Joe, I'm not opposing anything. I'm trying to help with the language here. I'm fine with the way a lot of this is written, but I'm thinking about our company has to implement this and I don't want us to get tripped up implementing it in some of the things I'm seeing here... 14:18:17 ... you know, I can see our engineers coming back to us and going, like, how do I do this, right? And I agree that it's the test suite that needs to figure out a way to test this, but again, like, you know, we need to, we need to figure that out. So I don't want this to be, like, an adversarial, like, I'm opposing this, it's, I'm trying to figure 14:18:17 out what kind of 14:18:26 ... language would not have our engineers coming back to us repeatedly asking us what, you know, particular statements mean. Um 14:18:45 ... The… I also agree that, you know, this entire thing is supposed to be for… You know, implementers… It's meant to be instructions for, uh 14:18:49 ... uh, implementation… implementers implementing implementations. Uh 14:19:05 ... Sometimes in our conformance section, we have four different classes of things this could be talking about. And in the conformance section, we do specifically call out did URL dereferencing and a conforming did URL dereferencer does. You know, these, these things, um 14:19:17 to your Q in chat, that particular section that explains the algorithm's purpose should be at the top of 6. Agreed. That is missing. 14:19:18 q? 14:19:36 ... But then, when you go down to the section, there is no text in there. I'm saying the text is missing where we're like, Hey, you know, this is what a conforming blah blah blah implementation does. You could argue that that's repetitive, and we don't need to repeat ourselves there. But currently there is no text specifying like this section is 14:19:36 entirely 14:19:46 ... you know, for people doing implementations to do. So an implementation in 6.1.1 is expected to do all of these things, or an implementation in section 6.1 is expected to do every subsection 14:19:51 ... in here. That's the clarity I'm trying to get to 14:19:55 ... I think it's easy. We just stated clearly, right? I'm just looking at Section 6 14:20:12 ... No text section 61 no text you know and then we go right into validate that the input did URL conforms to OK who's supposed to be doing that validation. Is it the implementation? Is it the I mean clearly it's not the user but we don't 14:20:21 ack markus_sabadello 14:20:23 ... you know, it could be any class of, uh, uh, the conformance criteria. That's what I'm trying to get to, is, like, we need very clear statements saying who's supposed to be doing these, these four steps. Um… That's it 14:20:29 q+ to note the current text is in conformance A conforming DID URL dereferencer is any algorithm realized as software and/or hardware that complies with the relevant normative statements in 7.2 DID URL Dereferencing. 14:20:34 Otto Mora: Um, Manu? Oh, sorry, Marcus. Go ahead... 14:20:37 Markus Sabadello: Yeah, about the testing, I didn't really understand why... 14:20:45 ... I'm not sure you thought that the referencing was hard to test. I mean, you also said there are no clear inputs and outputs, but 14:20:54 ... That's not really my understanding, I think, for dereferencing, just, like, for resolution 14:21:03 ... We have inputs and outputs. We also have the HTTP binding. There are multiple implementations of that. I think we even have a test suite already for. Some of the dereferencing, uh 14:21:14 ... functions, so while I… while I agree that the referencing, just like resolution, should happen on the client side as much as possible, I don't think it's, uh, hard to test 14:21:19 ack JoeAndrieu 14:21:19 JoeAndrieu, you wanted to note the current text is in conformance A conforming DID URL dereferencer is any algorithm realized as software and/or hardware that complies with the 14:21:20 Otto Mora: Okay. Joe?... 14:21:22 ... relevant normative statements in 7.2 DID URL Dereferencing. 14:21:25 Joe Andrieu: Right So to to go maybe in reverse order... 14:21:30 ... Marcus, what's hard to test is that we do not have a function with clear inputs and outputs 14:21:47 ... That is what this algorithm is dealing with, which is the fact that reducing to specific functions and specific outputs made common usage of how you use resolution results non-conformant with the specification 14:22:02 ... The fact that we had this strict input and output idea that implementers must implement broke common implementations that nevertheless were doing things like verifying a proof on a VC without ever having this kind of function that was required in the specification 14:22:18 ... So the design here is to talk about the algorithm that is executed, which could have many side effects, such as rendering something on a screen, which is not a returned value from a function. So that's you and I have always had a 14:22:49 q? 14:22:50 ... a different way to think about this algorithm. And this is an implementation, so that we get around the complexities that we'd otherwise have to fight about in terms of what options are passed and what return values go to whom and what is required in that whole process. We are not talking about a standalone library. This is maybe jumping to 14:22:50 Steven's comment. We're not talking about some sort of library that someone calls. We're talking about a process that runs 14:22:53 ... That a user interacts with, like a browser 14:23:07 ... Most people do not use browsers in the way that we might use Curl or Wget or something like that. We run the application. And in the application, we do things, we have gestures, we click on things, and as a result of that, we go to the websites that we choose 14:23:20 ... And there are issues with sometimes you can get phished and you go to a website that was fraud, but that's because every system has failure modes. But the browser is based on the fact that I don't have to just go to the places that are vetted by the browser maker. Right? Um, Safari, I'm not restricted to only the places Apple likes. Um, if I 14:23:20 use Chrome, I'm not restricted to only the places Google likes 14:23:30 ... Um and so the the client is run by the user 14:23:50 ... And the client needs some way to be able to, indicate which resolvers they wanna use for which did methods. And it's perfectly fine if there are defaults but the user has to be able to override those defaults or we're just allowing every client implementation 14:24:04 ... to override the resolver choices, which I think would be really unfortunate. To get to Manu, who's in the middle, actually, we could and should have some language. I think the legacy reason we don't have the language is in conformance 14:24:18 ... The pattern that we have had is, um, actually in there right now, it's pointing to the wrong section, but that's because our document is not coherent right now. So the language about conformance says that a conforming, um, a URL dereferencer 14:24:22 ... implements the the algorithm in did URL dereferencing 14:24:23 q+ to speak to details. 14:24:28 q? 14:24:28 ... Um, so I'm… I'd be happy to copy that over, I agree. I… I actually thought it was in 6 14:24:39 ... Um, and I thought you were asking it to be in that particular line, and so that… that was the redundancy I thought was there, but it's not. I agree with you, we should add some clarifying language 14:24:39 ack Wip 14:24:44 Otto Mora: Thank you, James. Uh, well... 14:25:02 Will Abramson: Uh, yeah, I just want to maybe add some… a different analogy to show you the browser, but just speaking to Steven, like, I like to think of this like MetaMask, or something like that, right? You install this thing in your browser... 14:25:03 Existing tests for DID URL dereferencing: https://github.com/w3c/did-test-suite/tree/main/packages/did-core-test-server/suites/did-url-dereferencing 14:25:18 ... And then Metamask is acting as the client, right? And it's, you know, dealing with the blockchain and, like, the addresses. But in Metamask, in your client's application, you can go in there and, as Joe says, override the default rate. And in this case, you're talking about 14:25:24 ... Which, like, blockchain nodes are you talking to? Ah, for which blockchain? 14:25:46 ... So, you know, they have some defaults which talk to, like, sort of hosted nodes endpoints, but you might want to run a local node, and you might want your Metamask client to talk to that local node. And absolutely, it would be terrible if Metamask didn't allow that, right? People wouldn't accept that, they wouldn't use it, they would use 14:25:46 something else 14:25:51 ... I… but I think, like, that example to me also does make me think 14:26:21 ... like, the place where we have this text in the spec today doesn't… like, it does feel a bit out of place. Like, I think we definitely want to be talking about this, but I don't know if it makes sense to, like, talk, like, in… the… in a step of the algorithm? Because that kind of, like, makes me think, like, every time this algorithm is 14:26:22 executed 14:26:28 ... we should be asking the client, like, which resolver you're gonna… which resolver do you want to use? It's more like these… this client should have a list of resolvers that they use, the specific bid methods, and they are selecting from there, and that list should be 14:26:37 ... Uh… Editable. Configurable. By the… User of that client 14:26:39 +q 14:26:52 ... So I don't know where that goes. I mean, I don't know what Joe thinks about, like, moving it somewhere else. Like, maybe just moving it to the top of this section as part of the introduction to this entire dereferencing algorithm. um… I don't know if that helps, that's just how I think about 14:26:58 Otto Mora: Is that akin to almost, like, uh, your DNS servers on your computer? Kind of like list of resolvers... 14:27:01 Will Abramson: Mmhm... 14:27:07 Otto Mora: No. Maybe. Okay. I just wondered... 14:27:09 Will Abramson: Yeah, maybe... 14:27:10 ack manu 14:27:10 manu, you wanted to speak to details. 14:27:12 Joe Andrieu: Yeah, I would say, yeah, I think it is why we have the flexibility and problems we have with DNS... 14:27:15 Otto Mora: Got it. Thank you. OK, Manu... 14:27:21 Manu Sporny: Yeah, I mean, plus one to that. I think we agree on... 14:27:37 I wouldn't mind moving that MUST up to the top of the dereferencing section and out of the flow of the algorithm 14:27:41 ... what we're trying to achieve here. I think we're just talking about the language. Um, I guess going back to, you know, the implementers must enable users to choose resolvers they trust for specific DID methods, I think we're all on… we're all on the same page there. We want that to be 14:28:04 ... true. Joe, one of the and we don't have to address this right now. Right? But I'm just noting my my, you know. What about if an implementer knows that a particular did resolver is attached to a botnet or a criminal network, or whatever. And even though the user wants to use it, the implementation is like, no 14:28:09 q+ for "known bad actors" 14:28:15 ... You should not use that. I know it's a known bad actor. Just like, you know, when you go to a known compromised, you know, site, the browser renderers jump in, and they're like, hey, sorry, like, this is a known phishing site 14:28:25 bigbluehat has joined #did 14:28:34 ... Uh, you know, or, or HSTS, you know, it's like, hey, you turned on HSTS, and now things have changed, and I don't think you should go to this website. It's, it's stuff like that, where a line like, implementers must enable users to choose, and it's solved by something 14:28:36 +1 to Wil's comment -- very helpful analogy -- and the config idea is good as the mechanism I'm looking for. 14:28:45 ... Saying, like, you know 14:28:49 ... reasonably choose or or choose safe, or which which opens up its own, you know, can of worms. So I don't know what level of nitpicking we want to do on this right now. I think you know we we've mentioned the concern here. It's on the 14:28:56 ... You know, minutes, maybe we can move on. I'm sure there are many other slides for us to get through and we're halfway through the call 14:29:04 ... Going back to Steven, do you feel like we've addressed the concerns that you've raised, or do we 14:29:06 ack markus_sabadello 14:29:07 ... Is there something that has remains, you know, unresolved? 14:29:27 Stephen Curran: Um, yeah, I finished my comments on it. Um, I loved Will's… Will's analogy, and that was very helpful, and, like, the idea of repositioning it, but yeah, I'm done, and I see there's people on the queue, so... 14:29:31 Otto Mora: Go ahead, Marcus, and then we'll let just Joe close the section, and we'll jump back on the presentation... 14:29:41 Markus Sabadello: No, just I agree with what Will said. It would feel better if this was part of the introduction, not in the algorithm itself... 14:29:44 Otto Mora: Nope... 14:29:45 ack JoeAndrieu 14:29:45 JoeAndrieu, you wanted to discuss "known bad actors" 14:29:51 Markus Sabadello: That's it... 14:30:03 Joe Andrieu: Um yeah so plus one to moving it to the front um I think the language explaining you know that this is the conformance class uh algorithm that implementers implement at the top of six I think that's a fine change to get it out of the flow I agree with Will's point like it reads as if... 14:30:19 ... There's a pop up every time, and that would be horrible. But I did want to gently push back against the idea that someone else should be telling me what known bad actors are. I have benefited from Google doing exactly that interruption when I click on a link at Google search 14:30:26 ... Um, and it was useful, and so warnings are fine, but if Chrome doesn't let me go 14:30:55 ... Um, that's… that's a real problem to me. Um, and they are currently implementing things like that, and I think it's atrocious. I think it's a control framework. I don't… I think the moral authority about who is good or not is up to the user, um, and not to some nanny state architecture, whether it's a corporate oligarch or it's the nation 14:30:55 state. So 14:31:01 ... But let's move on. I think these are hopefully what I'm hearing is if we could move that must into the description, we have a better description about how the implementation of a conformant dereferencer would use this algorithm 14:31:04 ... If that addresses folks concerns, then I think we can move forward 14:31:09 Stephen Curran: Cool... 14:31:13 ... Alright, uh, next one 14:31:25 ... Um, part three, we're up to part three of that same section, so we'll jump back to that section. Um, remove any fragment. Um, I think 14:31:57 ... The intention, and I think Marcus has raised this in his comment, I mean, ultimately what we're doing is removing everything except the DID, and I think an alternative wording that might be better would be because the query parameters in the path also need to be removed, simply extract the DID from the DID URL. So let's jump to that, um 14:31:58 Joe Andrieu: Uh, yeah, plus one. That's an easy fix. That's just legacy... 14:32:02 q? 14:32:04 Stephen Curran: Item 3. So remove any fragment. I think we actually need to remove more than the fragment. And that was the where that comment is. And we'll go to Joe. Cool. Excellent. Any other comments from anyone?... 14:32:11 ... Jump on the queue 14:32:15 ... Excellent 14:32:19 ... 2 in 30 minutes, look at that, averaging 15 per 14:32:47 ... Okay. Prepare did resolution options 14:32:52 ... Um, a couple of things on that, um 14:32:57 ... There aren't any details about preparing the data resolution in the link section, so if we look at the text 14:33:04 ... It says see the resolving algorithm for details, but there's really no details about preparing good resolution options. There is 14:33:10 ... Um, specific data resolution called out, and there is… um, the… the resolving algorithm looks for often, but this is preparing those oftens. That's one. And then my comment adds to that, which is, any 14:33:16 ... Options that the client sees as being… or, sorry, any parameters that the client sees as being 14:33:20 q+ 14:33:22 ... part of bid resolution should be converted into auctions, and to me, that's what preparing the bid resolution auctions is about. And so, I wanted to raise that 14:33:30 ack JoeAndrieu 14:33:44 Joe Andrieu: Yeah, I think there are two things going on here. One is this PR was just to be about dereferencing... 14:33:51 ... So my presumption is that the definition of resolution and the section on resolution options explains what options you would choose and when 14:34:06 q+ 14:34:08 q+ 14:34:08 q+ 14:34:23 ... What I do push back on is that the disposition should be that the user translates all of the query parameters into options. I think that is the security problem that we're bumping up again when we blindly pass options we don't understand 14:34:40 ... And so the client's job at this point is to understand the options and to pick those that are appropriate 14:34:50 ... Um, and those may or may not come from the query parameters. The query parameters themselves may not be relevant to what I'm doing. I may have a query parameter that has a version time, but I'm looking at a log file from a month ago, and so that version time is not appropriate to the analysis that I'm doing right now. And so I should not 14:34:50 propagate the version time forward. I should think critically about what options, and I should use the section about resolution, resolution options to figure out which options are appropriate. That's why I just hand this 14:34:56 q? 14:35:00 Will Abramson: Hey, Ryan. Uh... 14:35:00 ack Wip 14:35:01 Joe Andrieu: section over to the resolution algorithm... 14:35:04 Will Abramson: Yeah, uh... 14:35:08 ... I just had one comment around, like 14:35:15 ... I just had a look at this text and where the link goes. I mean, currently this link's going to the algorithm, right? Section 4.4. I think 14:35:35 ... Probably it would be fine if it went to Section 4 on Section 4.1. You know, Section 4 is all about the data resolution options, and maybe we need a little bit extra text in there, but at least it defines what those options are so that you can have some help when thinking about. The structure of the options you are trying to prepare 14:35:42 ... um 14:35:43 ack markus_sabadello 14:35:47 ... That's all I have 14:35:50 Stephen Curran: Um, Marcus?... 14:35:53 q+ to say the resolution options does link to 4.1 14:35:57 Markus Sabadello: Yeah, I think we've talked about this topic... 14:36:21 ... several times. I remember not long ago, we had this proposal that the entire DTRL should be passed to the resolver. One of the arguments was that supposedly only the resolver knew what to do with the parameters and with the options due to. The confused deputy risk. Now I'm 14:36:26 ... I'm happy that we're back to a design where we don't pass the entire URL 14:36:31 ... to the resolver, and now I'm hearing that 14:36:34 ... Client should somehow decide 14:36:43 ... which parameters to pass as options to the resolver and which ones not to pass 14:36:51 ... I'm not sure, I also had a presentation about this a few weeks ago in the 14:37:00 ... In the current algorithm, the currently referencing algorithm, the way it's written is that the… Client passes all the parameters as options to the resolver, plus the… The reference in options that the 14:37:06 ... Client wants to 14:37:22 q? 14:37:22 ... I want to use separately, and those would override the. the parameters, that's how it's written right now, which I think… is a start, but I also recognize some… Potential security aspects here 14:37:27 ack swcurran 14:37:36 Stephen Curran: Okay, um, I'm on the queue, um... 14:37:47 q+ to note "such as" language with a reference might be helpful. 14:37:50 ... Yeah, it's… to me, the con… This doesn't say anything about what 14:38:03 ... the client or the user are supposed to do, and that's what's throwing me off. Um 14:38:15 Language in current DID URL Dreferencing algorithm: 14:38:15 "All dereferencing options and all DID parameters of the input DID URL MUST be passed as resolution options to the DID Resolution algorithm." 14:38:37 ... I've got an example that I gave that I actually did put in here, which is about a proof. I've got a proof and it's got a DID and a key ID in it. When I reference the DID URL, I want to stick version time in. As the time that it was signed. I think I'm a user in that case, and I want to pass that, and I expect the client to pass that on to the 14:38:37 resolver. That's my expectation. Now, that 14:38:56 ... Same URL with the time and the ID could be what's in the proof 14:38:57 ack JoeAndrieu 14:38:57 JoeAndrieu, you wanted to say the resolution options does link to 4.1 14:39:06 ... But that's up to the user to decide, not the client, and that's why I'm confused as to where 14:39:10 ... Um 14:39:16 Joe Andrieu: Sure. So to your point, Steven, I think we're on just opposite sides of the aisle on whether or not we trust the URL writer... 14:39:25 ... Um, I do not. I see them as a potential point of attack, and that manipulations of the URL can be used to bypass expectations of the client if they blindly pass through the parameters 14:39:30 Stephen Curran: what is supposed to happen in that section? And as far as I can see, there's no, A, guidance or warning that, hey, this could be problematic. Or, um, how the transition of a... 14:39:36 Who Is the "URL Writer"? 14:39:36 ... Query parameter that is intended to affect, um… resolution is treated when included in the URL. So those are the… that's my confusion 14:39:36 q+ to note "client should be intentional" is close to "browser should block" 14:39:44 Joe Andrieu: And so the client should be intentional about what parameters get passed through. And I think I agree with you. Maybe in resolution it doesn't explain the consequences of of choosing options correctly... 14:39:58 Stephen Curran: Um... 14:40:01 Joe Andrieu: But I think that should be covered in the resolution section, not here. But we could add extra things like be careful about what options you select. The client should understand them thoroughly and know that that's appropriate for the particular use case. We could add some language like that... 14:40:02 q+ 14:40:03 Stephen Curran: Let's go... 14:40:06 Joe Andrieu: Um, to… to Will's comment, uh, actually, there are two links there. The first one does go to 4.1... 14:40:14 ... Um, and the other one is a follow-up if you want to understand the resolving algorithm. Um, so 14:40:31 ... I think those sections maybe are underspecified if they don't clarify the question Steven has about what do I do to resolve a DID, and we're not explaining how you should choose the version time that's appropriate for your use case, i.e. the version time that you believe that VC was issued at as opposed to the version time right now 14:40:46 ... Like, those sorts of complications are, I believe, about how you properly prepare resolution, which I think should be with the algorithm. But I wouldn't be opposed to a sentence here if we wanted to add something like that 14:41:00 ... The other thing, Marcus, you said something that threw me off because you said that the current algorithm that you still feel is what we should be doing sends dereferencing options to the resolver 14:41:20 ... And absolutely, that shouldn't happen. Um, the whole point here is to cleanly separate, you know, what goes to the resolver, and I think we've… we've come to an agreement that that's just the DID 14:41:21 ack manu 14:41:21 manu, you wanted to note "such as" language with a reference might be helpful. and to note "client should be intentional" is close to "browser should block" 14:41:26 ... Um, and so whatever dereferencing option should not go to the resolver. The resolver's not going to dereference for me. The client is doing the dereferencing, and they may understand, um, uh, certain parameters in a particular way, but that's up to the client, not something that gets passed through 14:41:33 Stephen Curran: Uh, Manny, sorry. Go ahead... 14:41:49 ... Awesome 14:41:52 Manu Sporny: Uh, no problem. Um, so plus one to the, you know, prepared DID resolution options is not very descriptive. You know, if someone's just reading through this, I don't really know what that means, and then when they click on the link, they go somewhere and it doesn't explain what that is, and I think, Joe, that speaks to your, like... 14:42:09 ... if it's under specified there, we should, um, we should be a bit more, uh, you know, clear about that. Um, uh, sometimes it helps to provide such as language, um, like, you know, prepared resolutions options, such as, you know 14:42:25 ... whatever. We can put some… it's so terse right now, it does… it requires the person to go somewhere else to figure out what the sentence actually means, and I think that's the… that's an issue. Uh, it's just an editorial one. So that's item one. Item two is, um, Joe, on your… you know, the client should be intentional 14:42:32 q+ 14:42:38 ... um, you know, statement, and I'm not saying this is… I agree with it, um, but it's also very close to the browser should block or the browser should warn in 14:42:57 q+ to say this is analogous to setting HTTP headers 14:43:07 ... Here, we're kind of talking about… processes that don't necessarily get user feedback before they execute, and we need to be careful about not creating systems that could fail open from a security standpoint, right? Um, so I agree with the point, like, the client should be intentional, it should not allow things to 14:43:17 ... uh, you know, go through that it, um, that could be harmful to the user, like, you know, um, uh, and detect, and, you know, and if it's an automated process, block by default, uh, always allowing the user to rerun the commands 14:43:20 ... you know, saying, no, I know what I'm doing, do the thing, right? Um, so 14:43:37 ... I know that's at odds with maybe what some other folks in the group, you know, think, but I think we need to get crisp about what 14:43:46 ... is allowable behavior, allowable protective behavior for a client and what is not, right? And if we had something that spoke to that generally, then we could kind of point to that section and say, this is what we mean. We mean individuals should have choice 14:43:52 q- 14:43:52 ... and they should have the option to override their software if… if they so choose. I think, Joe, that is your position. I agree with it. Um 14:44:03 ack swcurran 14:44:07 q+ 14:44:08 Otto Mora: Steven?... 14:44:24 Manu Sporny: But, you know, we don't, I don't think we have that in the spec right now. And I think that's what's causing some of this, like, when is it appropriate to step in and protect the user versus not discussion?... 14:44:36 Stephen Curran: Okay, yeah, similar to Manu, I don't see how, for example, in the example I gave in the slides, how... 14:44:46 ... the generic piece of software, a client can know whether the user is being intentional or not. Maybe that's a flag or something like that that's put in. But in the example I give, like, you know, I 14:44:52 ... the, um… in particular, and it did YVH in the way we're using it and have suggested using it, if we just pass in this, this part of it, without the version time, this will 14:44:58 ... result in a failure, because there's no key ID at… in the current dead dock that has that. It has to be at the version time that I want, and… and there's no 14:45:15 ... the user has to be able to convey that somehow. Perhaps that is that they can affect the options. But I don't see where in this there's a way to affect the options. So I'm not sure how we get around this idea that you can't 14:45:24 q? 14:45:29 ack JoeAndrieu 14:45:29 JoeAndrieu, you wanted to say this is analogous to setting HTTP headers 14:45:29 ... as a user specify those things. You have to be able to do it somehow. And I don't see in this current spec text how that's done. And that's what's throwing me off. That's it. I'm Joe 14:45:36 ... Whoops 14:45:46 Joe Andrieu: So, you know, it might help to think of this as HTTP headers. Um, HTTP headers should not be added willy-nilly, um, when the browser or a, um... 14:45:54 ... You know a command line tool or you know some server side tool that's that's creating an HTTP request 14:46:13 ... They intentionally construct what headers they wanna send. But they don't filter which URL they're going to. Those are two different things I I think they got conflated here. The which URL you which resolver you rely on for particular DID methods is a security modality that the user needs to be involved with They need to have some override 14:46:38 q+ to note definitions of "client" might be different here 14:46:44 ... What I'm saying is that the URL should not be treated blindly to trust all of the option parameters 14:46:47 ... Because it's the clients who knows what the task is that's the business purpose of this dereferencing right now. If I am, um, verifying a proof on a VC, then I know something about version time, and I should not use the version time in the URL 14:46:56 ... If I am authenticating a historical record from a log file, also, I'm going to know the version time that I believe that log was created at, and I need to apply that version time. If I just use the version time that is in the URL, I'm subjecting myself to potentially 14:47:07 ... I'm using the wrong version time for the particular business case that I'm in. And so this is, you know, if you think about how browsers work, the user is usually not involved with the HTTP headers. What happens is people writing web apps 14:47:27 ... um, construct HTHP headers that then are executed by the browser on behalf of the user. So in that case, it's the software that's the web app that says, oh, hey, I know that if I set my headers, um, uh, uh, accept type to a certain way, then I'll get back a different result from the server, so I'm gonna set that header 14:47:42 ... So that I get back the right data type. Right? That's that's what I'm talking about is that the client software is the one who's in the business use case and understands what's appropriate. Whereas the the URL author or writer should be considered potentially an attacker 14:47:46 q? 14:47:54 Otto Mora: Okay. Marcus?... 14:47:55 ack markus_sabadello 14:48:01 Joe Andrieu: Um, because that URL may have been manipulated in context before it got into the client... 14:48:09 Markus Sabadello: Yeah, Joe, what you just said resonates a lot with me. I've also always thought of the options here as being analogous to HTTP headers, and... 14:48:23 ... I also think it's something that's basically set by the application and by the client. Kind of feels a bit 14:48:34 ... unnatural to just blindly copy parameters from a URL into this option data structure 14:48:48