14:49:11 RRSAgent has joined #did 14:49:16 logging to https://www.w3.org/2026/08/20-did-irc 14:49:16 rrsagent, make logs public 14:49:20 Meeting: Decentralized Identifier Working Group 14:49:24 Chair: ottomorac 14:49:28 Agenda: https://lists.w3.org/Archives/Public/public-did-wg/2026Aug/0008.html 14:49:28 clear agenda 14:49:28 agenda+ Agenda Review, Introductions (5 min) 14:49:28 agenda+ DID Resolution PR: Minor non-normative text change to address Issue 322 (5 min) 14:49:28 agenda+ DID Resolution Issue: Restricted access/Authentication/Authorization \[1\] (5 min) 14:49:29 agenda+ DID URL De-referencing Discussion \[3\] (30 min) 14:49:31 agenda+ Next Time (5 min) 14:49:40 previous meeting: https://www.w3.org/2026/08/19-did-minutes.html 14:49:53 next meeting: https://www.w3.org/2026/08/26-did-minutes.html 14:58:35 TallTed has joined #did 14:59:03 swcurran has joined #did 14:59:14 present+ 15:00:26 JoeAndrieu has joined #did 15:01:07 markus_sabadello has joined #did 15:01:09 pdl-asu has joined #did 15:01:19 present+ 15:02:19 present+ 15:02:30 Wip has joined #did 15:02:30 present+ 15:02:32 transcriber-bot has joined #did 15:02:34 present+ 15:02:52 present+ 15:03:01 present+ 15:03:34 transcriber-bot, connect 15:03:35 scribe+ 15:03:41 Topic: Agenda 15:03:46 Otto Mora: Sounds good. Um… Let me... 15:03:50 present+ 15:03:52 ... So, today we, um… we have, uh… a 15:03:57 ... request for a manual regarding the VC-recognized entities and some references that they want to make 15:04:17 ... Uh, then we have a dip resolution PR with, uh… some small changes that, um, Steven had. Uh, then we have another resolution issue that we just want to check on 15:04:31 ... And then, uh, we'll be resuming the Digital Realty Referencing, uh, discussion, which centers around PR344 from, uh, yesterday, uh, from the Special Topic Call, so we'll be continuing that. Anything else that folks want to add? 15:04:32 Topic: VC Recognized Entities: reference to WhoisService and PathService 15:04:34 ... Okay 15:04:36 https://github.com/w3c/vc-recognized-entities/issues/117#issuecomment-5333798349 15:04:42 ... No worries, so we'll move on to the first topic, which is VC-recognized entities, and this… ah 15:04:43 danpape has joined #did 15:04:46 q+ 15:04:49 ... Uh, link here. I'll, uh, I'll share my screen to present that, but I'll let Manu kind of 15:04:52 ... maybe speak more to what the request is 15:04:53 present+ 15:04:57 Manu Sporny: Alright, great. Uh, thanks, Otto. Um... 15:04:59 ack manu 15:05:04 ... Uh, so, uh, the W3C Verifiable Credential Working Group, um 15:05:21 ... Is has a task force called the Recognized Entities Task Force. And the purpose of that group is to basically let anyone, any entity, uh, it could be a big giant authority like a business register or 15:05:30 ... uh, you know, uh, GS1 or some government, um, uh, recognize who should be issuing things like 15:05:37 ... birth certificates, or driver's licenses, or things that have, you know, a regulatory, legal, you know, purpose 15:05:47 ... Or it could just be for you to say, like, hey, I've got a club, I've got a, you know, a 15:05:55 ... a book-reading club, and these are the members in the book-reading club that I recognize, right? So these are… it's not, you know 15:06:11 ... uh, X509 certificates, uh, necessarily. It's just a way for you as an individual or as an organization to say, we've got an ecosystem, these are the people that I recognize to do certain things in that ecosystem, like issue a credential. Um 15:06:23 ... In that specification, we have, um, discovery services, so if you get a verifiable credential that's issued by someone, and you don't know who the issuer is, how do you figure out 15:06:31 ... you know, how to get to an issuer you do know, or someone that you do know that recognizes that entity. So, um, uh 15:06:37 We really need to stop using language about recognition lists as being about who "should" issue credentials. 15:06:44 ... so… so that's what the recognized entity spec is about. It… it's… it's… you will get something in a verifiable credential, and it's… it'll be like, hey, if you don't know who I am as an issuer, go check with, you know 15:07:02 ... for lack of a better term, the authority on issuing these types of credentials. They know who I am, and so you trust them, and I issued this thing, so my credentials should be good for you, right? Okay, so one of the discovery mechanisms that we have are DIDs, right? And specifically 15:07:13 ... um, things in the WHOIS service, um, or things that could exist in the PATH service. And we, uh, talk about an algorithm in that specification about, like, hey, if you see a DID 15:07:31 ... there's some discovery stuff that you can do. You can go to that DID document, and if they have a WHOIS service, you can go and look at the WHOIS service, and they might have a recognized entity credential in there that tells… speaks to, kind of, what communities or what ecosystems 15:07:37 ... they're a part of. Like, you know, what credentials does that DID… is that DID officially recognized to issue, for example? 15:07:59 ... Um, okay, so in the spec, we talk about WHOIS, and we talk about PATH service, and one of the very good pieces of feedback we got was, hey, why don't you just normatively refer to WHOIS and PATH service over in the DID resolution spec? And we were like, uh 15:08:05 ... We're still kind of working on that. I don't know if we've got a stable reference that we can point to, and so this conversation is about 15:08:08 ... Does this group feel like we have a stable reference? 15:08:13 ... that the Verifiable Credential Working Group can use 15:08:25 ... Such that we will not block them from going to candidate recommendation and recommendation on the timeline that they're on 15:08:30 ... Which is… might be faster than the timeline we're on for did resolution 15:08:37 ... Um, there are a couple of ways that we could go forward. We could, one, create 15:08:41 ... A well-thought-out. Who is Service Pat, Service, you know 15:08:48 q+ 15:09:02 ... discovery mechanism portion in some specification, and tell them to link to that, and promise them that we're going to get to REC before they do. Or, we could look at their spec, and the algorithm they have there, and give them a nod, and say, yeah, that looks low-lined, and once we have. A good 15:09:09 ... normative reference for you, you can update to that. But until that happens, like 15:09:17 ... Stay separated from us, keep going on your timeline, and then once we catch up, you can link to us in the future 15:09:17 q+ 15:09:19 ack pchampin 15:09:23 ... Let me stop there, see if there are any questions, concerns, additions, changes 15:09:27 Otto Mora: Yeah?... 15:09:49 q+ to say I don't think we have time to get WhoIs into did resolution. Maybe we'll get PathService in. 15:09:50 Pierre-Antoine Champin: I do believe there's a third way. The fact that deed resolution is now in candidate recommendation makes it, I believe, an acceptable reference for a rec... 15:09:58 q+ to ask about spec text that talks about Whois and PathService for /whois. 15:10:00 ... Because there's the… one… one level… one maturity level of difference which is tolerated. So… I believe that if… if we publish it as a candidate recommendation snapshot. they could normatively reference to it, even if they go to RAG before us 15:10:02 ack markus 15:10:05 Otto Mora: Okay. Yeah, Marcus?... 15:10:18 q+ 15:10:22 Markus Sabadello: Uh, yeah, just to talk about a comment that I posted on that issue, there is another service type called Linked Verifiable Presentation, and... 15:10:29 ... To me, it feels like that would be the right mechanism for 15:10:40 q- 15:10:42 ... for solving the the use case. And it's also the service type which which the who is feature indeed. Webvh is is using. It's also using the linked verifiable presentation service type 15:10:53 ... And I think that's designed for exactly this use case. You have a date and you want to find out something about who is behind that 15:10:55 ... But it's a TIFF specification. I'm not sure if that can be referenced 15:10:58 Otto Mora: Uh-huh... 15:11:00 ack Joe 15:11:00 JoeAndrieu, you wanted to say I don't think we have time to get WhoIs into did resolution. Maybe we'll get PathService in. 15:11:05 ... Yeah, I'm familiar with JC's work on that point. Uh, Joe? 15:11:13 Joe Andrieu: Um, yeah. So... 15:11:23 q+ 15:11:23 ... I don't think right now we have any good language in our spec about who is. And I don't think we have time to get it into our current work. Um 15:11:32 ... For path service, I think we have a shot. This is wrapped up in PR 344 and how we're gonna resolve the referencing 15:11:43 ... Um, and frankly, we need to get to that before we get to who is, because who is is designed to use the past part. So, those two things need to work in synchrony. Um 15:11:47 ... And I think if we try and take that on, we're… we're not gonna finish this spec 15:11:48 ack manu 15:11:48 manu, you wanted to ask about spec text that talks about Whois and PathService for /whois. 15:11:51 Otto Mora: Okay... 15:11:54 ... Manu? 15:12:15 Manu Sporny: Yes, I agree with Joe. I don't think we want to add one more thing we're working on. But we have to ask this group and understand what the position is. So I agree with Joe. I don't think we have time for who is... 15:12:30 ... Um, uh, and I also agree with Joe, path service might be the way to do this. Uh, Marcus, to your point, the link verifi- we did look at link verifiable presentation, uh, its spec status is marked as pre-draft. Um, and it is not a W3C 15:12:50 ... I don't… we can ask. I don't know if that's the right solution, uh, because we're… because it's in a bucket of solutions that could be the WHOIS service, PAT service, and now we've got link verifiable presentation. And so, we need to tell them 15:12:59 ... to link to something. I can bring it up with the group if they want to, like, not use the WHOIS service or PAT service and use link verifiable presentation instead. Uh 15:13:07 I think LinkedVP is part of it, but whois goes further on who you use LinkedVP in this context. 15:13:10 ... I'll bring that up with the group as one thing that this group, you know, asked them to think about. Um, but what they really need is, like, a good normative 15:13:24 ... you know, easily defensible thing to link to. And a pre-draft diff spec probably does not meet that requirement. I don't, and depending on the IPR mode 15:13:34 ... Hopefully it was W3C mode, and if it's not W3C mode, then we've got to have a discussion with the lawyers, and it becomes, you know 15:13:39 ... maybe a little more difficult. Um, so I don't know how this spec was created, or where the IP on it is, and 15:13:42 https://identity.foundation/linked-vp/spec/v1.0.0/ 15:13:44 ... Uh, but we need to figure that out, uh, as well. Um 15:13:51 Otto Mora: Oh, but it's… sorry, sorry, it is ratified, sorry. There's this version, the 1.0. Yeah, bye... 15:13:57 Manu Sporny: Oh, okay, okay, alright. So then, PA, the question's to you. If we wanted to link to a link-verifiable presentation... 15:14:03 q? 15:14:09 ... could we do that? Um, since it's a diff spec and it's ratified, I don't… and again, I don't know what the IPR regime is on… under this spec. Um 15:14:09 ack markus 15:14:10 IPR is likely W3V Mode 15:14:15 Otto Mora: Marcus?... 15:14:15 the response should be here https://www.w3.org/guide/process/tilt/normative-references.html 15:14:22 s/W3V/W3C/ 15:14:28 Markus Sabadello: Yeah, I can't… I can't talk to the legal issues and how to… and whether that can be referenced. On the technical side, I think it would be the... 15:14:40 q+ 15:14:43 ... the right solution. As I said, who is in GitWebVH also uses this service type, and I don't really understand what this has to do with the PATH service, by the way. I mean, I'm 15:14:48 ... not a big fan of the… of the PATH service, but even if I was a fan of PATH service, I don't really understand 15:15:04 q+ to explain the path bit 15:15:06 ... why this is being considered here. Because I think there's nothing really happening with a deed path. Right? The the use case is. you have an issue date, and then you want to discover something about that date. So in in my mind, that's just classic 15:15:17 ... uh, resolution and finding the right service endpoint, given a service type, I don't really think you need to do anything with a… with a TID path, uh 15:15:17 Otto Mora: Okay... 15:15:18 ack pchampin 15:15:20 Markus Sabadello: Yeah, right, yeah... 15:15:30 Otto Mora: Uh, Pierre?... 15:15:33 Pierre-Antoine Champin: Yeah, just to point out, I pasted a link to the guidelines about normative references. Everything is there... 15:15:54 ... Basically, the rules are, if it's available, if it's stable, should be okay. There's a section about licensing, which I should double check as well. But I 15:15:58 ... I would be rather optimistic about that, but of course we need to double check 15:16:01 Otto Mora: Mm-hmm... 15:16:03 ack Joe 15:16:03 JoeAndrieu, you wanted to explain the path bit 15:16:06 Joe Andrieu: Actually... 15:16:09 Otto Mora: Okay, and then Joe's gonna talk about the pet service... 15:16:15 Joe Andrieu: About the path, to speak specifically to Mark at this point. The... 15:16:29 ... The best definition for who is today is in WebVH. And WebVH proposes that the path part of a DID URL has slash who is. And that is the trigger. And so 15:16:34 q+ 15:16:37 ... Either that is a method specific dereferencing, sort of fallback 15:16:52 ... Or… We have to figure out how the past part works. So that's the entanglement, is that the current definitions for who is, you do use the past part. You could have a service equals, uh 15:16:58 ... Who is? That would be a different way to do it, but it's not how they proposed it in WebVH 15:16:58 ack manu 15:17:04 Otto Mora: Thanks, y'all. Okay, Manu?... 15:17:10 q+ 15:17:13 Manu Sporny: Yeah, and from a simplicity, you know, to implement standpoint, it's basically user dereference to get the document at who is... 15:17:26 ... you know, it must be a verifiable presentation, and then you look for the recognized entity in there. We're trying to figure out a simple, simple way 15:17:42 ... uh, you know, to implement this, rather than pulling in, like, you know, the LinkVP spec is, you know, talks about, like, oh, here are the all the different types of formats you could get back, and it's kind of like, oh, that makes it more complicated, and the group was trying to stick to, like 15:17:53 ... the simplest solution to achieve the use case, uh, and not necessarily expand, you know, what the Recognized Entity spec needed to support. Um 15:18:00 ... So there's, you know, there's that. So, you know, the, the, the question, you know, is. What does this group suggest? 15:18:06 ... They do. And 15:18:14 ... Hopefully, what this group suggests is something that group is okay with doing 15:18:32 smccown has joined #did 15:18:36 ... because the other option on the table is just remove DIP-based discovery, right? Um, if we can't… if we can't get to something simple, or if this takes too long, or… or whatever, um, which I don't suggest we do, like, I… there's a… there's a… there… there is… just to give a little bit more background, there 15:18:44 ... you know, there are, um… are good arguments that did-based discovery is, like, too complex. Just put it in the VC and get it done, because, like, it's… it's so much easier to do it that way. Um 15:18:58 ... there are some arguments that, well, there's some ecosystems that are so dynamic that you can't do that. Like, the recognized entities change from day to day, and, you know, um 15:19:04 denkeni has joined #did 15:19:06 ... You can't necessarily rely on that. We haven't worked our way through all those details yet, but 15:19:07 ack markus 15:19:12 Otto Mora: Okay. Marcus?... 15:19:15 Manu Sporny: there is a point here where we make it too difficult on the other group, and they're just like, we're just gonna figure out a different way, um, to do it. Uh, that's it... 15:19:26 Markus Sabadello: Yeah, the easiest thing would be to just resolve the data and look for the service endpoint by service type without doing anything with the... 15:19:30 present+ 15:19:38 ... with the path, I, I think that's the, that's the complex part. I, I understand the design in D2FBH is that, uh, there can be a slash who is path, and then using. Pass service and things like that, you can 15:19:40 present+ 15:19:47 q+ 15:19:56 ... you can then dereference the DTRL and get something back at that path, but this would also require an extra step for the 15:20:00 ... processing of the VC, because you would have to take the issuer, which does not have a WHOIS in it, and you would have to add slash WHOIS 15:20:09 ... path, then you would have to go through all the path handling, path service processing, which is still controversial. And then you get 15:20:25 ... something at the end, and compared to that, you can just resolve the bit and look for the linked EP service type. This is… this is what people have been doing for many years, just looking up services from the… from the bit document, so that would be 15:20:27 ... My recommendation without getting into the past of 15:20:30 Otto Mora: Mm-hmm... 15:20:33 ... Uh, Manu? 15:20:38 Manu Sporny: Yeah, I mean, a plus one heard, Marcus, that that's your recommendation. Um... 15:20:42 ... I think we have three options 15:20:45 ... At least 15:20:56 ... There's the LinkVP stuff, there's the WHOIS service, and there's the PATH approach. And 15:21:01 ... That group is probably going to have to talk through all three of them 15:21:19 ... So, for example, Marcus, and this is just me speaking personally, um, I, you know, as an implementer of recognized entities, I don't care how complex the process is that the spec does, or how many different, you know, algorithm steps there are, I just, I'm gonna put in a 15:21:27 q+ to speak to "dereferencer" 15:21:39 ... URL to the dereferencer, and I'm gonna get back, you know, um… I'm gonna get back a presentation, and I'm gonna process that. Like, that's… and I want that presentation to have a recognized entity thing in there. Like, I don't care what, you know, DNS does behind the scenes to keep itself updated, I just send it 15:21:47 ... you know, a question and gives me an answer. So, I think things like that, um, will come into play, um 15:21:54 ... And I think what that group needs to contemplate is that we are dealing with 3 ways to solve the same problem 15:22:05 ... And if this group doesn't have a single suggestion, then that group is going to have to reason through 15:22:07 q? 15:22:07 ... the different approaches 15:22:09 ack manu 15:22:23 ack Joe 15:22:24 JoeAndrieu, you wanted to speak to "dereferencer" 15:22:27 ... Which is fine, I'm just saying, like, you know, I think that group was hoping for a simple answer. Yes, ref this section of this spec, and you're done. And I think probably the reality is it's more complicated than that 15:22:28 Joe Andrieu: Um... 15:22:31 Otto Mora: Joe?... 15:22:38 Joe Andrieu: I guess the first thing I want to say is, I think Marcus is right, the simplest... 15:22:46 ... Way that has spec text to support the majority of the operation is having a service 15:22:52 ... Um, and we did find a type that's who is. Um… Uh 15:22:58 ... That's not that much different than linked VP except for the entanglement or not of the diff spec 15:23:03 ... Um, but we… we have a service mechanism in our… Uh, toolbox 15:23:12 ... And I think that's the way If you want to be most compatible with the rest of the ecosystem, that would be the way to do it 15:23:28 ... Using the path or using linked VP will pull in other things that we don't have yet and have more, I feel, have more complications. But I also need to push back against the idea that you're just going to call a dereferencer. We also don't have a standardized dereferencer 15:23:35 ... I'm opposed to that. What we have is a resolver 15:23:47 ... And we have someone who's calling that. And so I really want us to clear up our language around the client to resolver, that's the dereferencer. We don't have a client to a dereferencer. Like that error is part of what is a quagmire we're caught in 15:23:50 ... And what is needed 15:24:05 ... for DIDs is resolution. And we have a API that supports that. And what we're trying to figure out is how do you properly call that API? How do you prepare for it? How do you actually execute the call? And how do you respond to the response? 15:24:19 ... Um, we do not have any consensus about defining a standalone dereferencer, um, and what its inputs and its outputs might be. Um, and we just define that the output might be a VP. Um… That's… that's weird and strange to me. So, you know, the 15:24:31 q+ 15:24:34 ... I just want to try to get to the simplicity that our specification is asking us for is that we have resolution, we have a resolver, and we need to talk about how you call that. um 15:24:39 q+ to ask about "ok, then which service?" 15:24:42 ... Talking about other potential pieces of software that might be written distracts us from what we're trying to standardize 15:24:45 ack manu 15:24:45 manu, you wanted to ask about "ok, then which service?" 15:24:47 ... That's it 15:24:50 Otto Mora: Yeah. Uh, Manu?... 15:24:58 q+ 15:25:00 Manu Sporny: Okay, so, uh, if we go down that path, then which service? Should that group use?... 15:25:04 q? 15:25:05 ... Who is service or the Link VP? One 15:25:17 ... and I haven't heard from Steven yet, but I don't know, Steven, if your slash who is thing, I… you know, if nobody's fighting for slash who is, that's fine, uh, you know, we can kill it, but 15:25:19 q+ 15:25:23 ack markus 15:25:29 Otto Mora: Okay, Marcus, and then Steven... 15:25:32 Manu Sporny: what, uh, what service are we suggesting that group uses? And, and, if we suggest something, where's their normative definition for that thing?... 15:25:35 Otto Mora: Michael's... 15:25:41 Markus Sabadello: Yeah, I would also be interested in Stephen's opinion here... 15:25:57 ... As far as I know, the WHOIS feature in WebVH uses exactly the linked verifiable presentation approach. I think there is no such thing as a WHOIS service type, but, uh, Stephen… Knows that better 15:26:00 Otto Mora: Okay, uh... 15:26:00 +1 to the lack of a normative definition of the type. and maybe figuring out how to adopt the DIF spec is the fastest route. maybe 15:26:04 ack swcurran 15:26:09 Stephen Curran: Um, yeah, I mean, our attempt was to use Slack, who is, and try to move that forward. Um, I am... 15:26:23 ... lost at the idea that there's no such thing as a URL referencer, and I'm trying to wrap my head around that, so I'm back to waiting on that conversation. I agree that 15:26:33 q+ to try to suggest a path forward. 15:26:41 ... The DID link VP is the closest thing we have right now. I would be glad to work on so Manu part of the sovereign tech maybe to help you in moving that forward, moving something forward and I'm glad to do that. Um, I would like to see every 15:26:48 ... Uh, did Method be able to support slash who is as a path, but… you know 15:26:53 ... you know, Marcus is right, you can just 15:27:00 ... Have this convention that there's this one service that you can call, and its purpose is to 15:27:10 ... Um, we might want to take it one level up, which is to say, not just to return a DP, but a return a DP with a recognized entity about the DID 15:27:16 q? 15:27:24 ... Um, that you're… you're querying on. And that… that is the vision of what SlashU is, that you can just… Oh, who's this issuer? I have no idea who it is. I can… I can re 15:27:36 ... Um, the reference, the URL, did slash who is, and I get back a link to BP. I may get back a link to BP that contains 15:27:46 ... um, VCs about that DID, and that identifier, and the entity behind it. It's all… this is all in aid of 15:27:50 ... identifying who an entity is. Really not 15:27:57 ... The use case isn't typically a person, but more an entity, and so it is used in 15:27:58 ack manu 15:27:58 manu, you wanted to try to suggest a path forward. 15:28:00 ... recognizing entities. That's it 15:28:06 Otto Mora: Thanks, Daniel... 15:28:19 Manu Sporny: Right, so let me try and suggest a path forward. We don't have a normative reference for them right now. I think that's a… uh... 15:28:31 ... Hopefully that's correct, right? We do not have a normative reference for you, Verified Credential Working Group. We are working on it. We cannot give you a timeline 15:28:45 ... I think that's where we are. I think we've got some good ideas for what it could be. Um, I don't… so that's the current thing, is, like, we just tell them, we don't have a normative reference for you, here's some ideas. Talk about, you know, talk amongst yourselves 15:29:02 ... we can try to move this forward, Steven, as you mentioned. I agree with Steven's approach. I think that that is what I would personally prefer to see. Uh, but at the same time, I don't think there's anything wrong with what Marcus suggested as an interim 15:29:08 ... Um, because both of them get… get them to the document they need, uh, I think. Um 15:29:28 +1 15:29:30 ... But we'll have to hash it out in this group, and I don't think this is a priority for this group right now, meaning, like, we have more important things to do, which is finish the spec. This is a side quest, you know, for us. An important one, but, like, I think we need to stay razor-sharp. focused on getting did resolution. finished off and 15:29:31 out to out to wreck 15:29:47 ... So if folks are okay, I can take that message back to the group and then they will think about the different approaches and then maybe they'll provide some feedback to this working group about what they plan to do going forward 15:29:55 Otto Mora: Okay, and do we need to open an issue for for ourselves, or let's go... 15:29:58 ... Okay 15:30:01 Manu Sporny: Yeah, might as well track it, right? It's a need that another working group has from this working group... 15:30:08 Otto Mora: Okay, I'll do that. Okay, cool. Excellent... 15:30:15 Topic: https://github.com/w3c/did-resolution/pull/354 15:30:18 ... Okay, thank you so much. Alright, um, so I wanted to quickly try to get to Steven's PR, and then, uh, I'll just skip over to the 344. So 15:30:28 ... Let me just do topic 4, 3, 5, 4. So on this one, I believe it's just a minimal text change from 15:30:34 ... From you Steven Right Uh and we just wanted to get folks to review it 15:30:47 Stephen Curran: Yes, um, thanks for bringing that up. Yeah, there… 322 is an issue about how, um, the test suite is suggested to be used... 15:30:57 ... And so, I just put in a minor PR that backs off of. Um, saying that implementers 15:31:03 ... should be using the TAF suite, saying they could use it, and it might be helpful to them 15:31:06 present+ 15:31:10 q? 15:31:14 ... So something along those lines. So a very simple change that addresses the particular concern that Joe raised in issue 3, the 3, 2, 2 15:31:17 Otto Mora: Okay, perfect... 15:31:30 Stephen Curran: And that would allow closing 322, I think, as well. So the big thing, Joe, would be to you to look at it and say... 15:31:33 Otto Mora: Okay, cool. So yeah, so… our reviews on this, please, and uh… if everything goes well, we would merge tomorrow... 15:31:36 q? 15:31:37 Stephen Curran: Do you think it… does it address your concern on 322? The reason for you raising 322?... 15:31:38 Otto Mora: dials... 15:31:39 Joe Andrieu: Uh, that's more complicated... 15:31:42 Otto Mora: Yep... 15:31:43 Stephen Curran: Sure... 15:31:43 Joe Andrieu: Sorry, let me jump on the queue since no one's on it... 15:31:46 Otto Mora: Go ahead... 15:31:54 Joe Andrieu: I'm happy with this PR. I did look at it. I was just about to hit my approve button... 15:31:57 ... When I realized I needed to click over to the other tab. The 15:32:06 ... I don't know that addresses issue 322 and just as socializing an issue rather than opposing this 15:32:12 ... I actually I'm not sure that we should be recommending that people do this 15:32:19 q+ 15:32:21 ... Because the test suite shouldn't be about that. The test suite is about testing the specification for, implementability 15:32:24 ... And there's a slippery slope here that I've heard 15:32:35 ... Off and on folks imagine that our test suite is somehow proving that software, is correct 15:32:45 ... Um, and even listing software so that it can be known to be correct. Um, but that's… that's really not what it's doing, and it's dangerous if people think that it is. Um 15:32:48 ... Because we don't have, like, a cybersecurity monitoring kind of capability, so 15:32:57 ... All we can do is do self-reported stuff, and it'll only be reported every once in a while. Um, so it's really not a good 15:33:09 ... way to think about, how do I know which software is working correct today? Um, but… but I think we should… we should accept this. I think, you know, your change to this 15:33:17 ack manu 15:33:19 ... didn't create this question, Steven. I just wanted to raise it as it, you know… we're using the test suite for two different purposes, and I'm not sure the second one's really gonna help us 15:33:24 Manu Sporny: Uh, yeah, I... 15:33:28 Otto Mora: Mm-hmm. Uh, Lana?... 15:33:41 Manu Sporny: Uh, don't disagree with a lot of what you said, Joe. Um, and I think folks know my position on this. I think if we leave. a vacuum... 15:33:47 ... In the ecosystem, somebody else will fill it, and they may not have the same motivations that we do 15:34:05 ... And so, total plus one, totally agree. The purpose of W3C test suites is to… the primary purpose is to test the specification and the implementability of the specification 15:34:20 ... That is definitely not in question. We, Digital Bazaar, are seeing other organizations enter into the conformance testing sphere. And… A danger is that 15:34:25 q+ to say yes, perhaps someone with the actual capacity to fill it. 15:34:44 ... an actor that does not have the same sort of alignment that the DID Working Group decides that they're going to create conformance test suites for DIDs, and they're going to decide, you know, what validation should be, and they will write it into regulation, and that will become the way that 15:34:58 ... You validate, uh, implementations. The working group will totally lose its ability to, uh, guide that stuff. We are seeing some of this happen in the European Union already, um, with, you know, uh, testing organizations, finding businesses 15:35:08 ... business models implementing or, you know, creating test suites for, you know, some of the specifications that we're writing. So that is the… that is the danger that I'm concerned about. Um, uh 15:35:21 ... One way to address that is to make our test suites a little more aligned with the real world and what vendors need in the real world, which is the ability to point to something and say, like 15:35:35 ... We're not telling you that, you know, the… we're not telling you that this, you know, you can do your security compliance testing using this thing, but here's a general, like 15:35:53 ... litmus test that those security, uh, folks should be running at least as a minimum against the implementation, um, and then they should be doing a whole bunch of other stuff, you know, in the future there. And I agree with Joe, like, this is… this is a long-standing discussion at W3C. I don't think we solve it here, and I don't think we 15:35:53 should. Take too much 15:36:00 ... working group time doing it, I just wanted to air the concern that I have. Um, if we look at test suites in the traditional sense 15:36:09 q? 15:36:09 ... That W3C has been looking at them, which is outdated, you know, in the way that, you know, software is built these days. That's it 15:36:12 Otto Mora: Mm-hmm... 15:36:13 ack Joe 15:36:13 JoeAndrieu, you wanted to say yes, perhaps someone with the actual capacity to fill it. 15:36:20 ... It sort of sounds like it partially addresses Joe's concern, but not the larger concern. Is that the case, Joe? 15:36:35 Joe Andrieu: Uh, no, not at all, actually. I think this is… Mando and I just have different opinions, and I respect his opinion and the experience that's led him to have that position. Um, but right now, the W3C is struggling with strategic direction... 15:36:56 ... Um, and I don't see that creating more registries, creating more monitoring services that we expect volunteers to run is going to scale. Like, I don't think that's going to help us. I don't think we have the constitution, uh, as a body to do the kind of work that you're proposing, Manu. I think it is actually more appropriate 15:37:11 q+ to note wpt 15:37:17 ack manu 15:37:17 manu, you wanted to note wpt 15:37:21 ... for someone who has the authority to impose conformance to define conformance to their laws and regulations. What I don't think is useful is for the way that our organization is structured as volunteers contributing to voluntary standards. Um, I think we just don't have the wherewithal, um, to do what you're proposing 15:37:28 Otto Mora: Okay, uh, Banner?... 15:37:41 Manu Sporny: In general, for most working groups, Joe, I agree with you. I will point out web platform tests as a counterexample where the vendors did get together and put something in W3C-ish... 15:37:59 ... space and have, uh, you know, um, uh, something there that the vendors, it's not a voluntary thing, right? I mean, it's like they pay money and hire developers and, and fund, you know, open source, uh, you know, projects to, to create and maintain these things 15:38:11 ... Uh, so I'm not suggesting W3C take it on, uh, or it's taken on an involuntary basis, but there are examples of, like, very thorough, you know, operational test suites that the browser vendors use as part of their shipping strategy 15:38:19 markus_sabadello2 has joined #did 15:38:19 Joe Andrieu: Ha!... 15:38:22 Otto Mora: Okay... 15:38:25 Manu Sporny: where the work is done out in the open and, you know, somewhat in the orbit of W3C. But again, that's going to be my last comment on this. I want us to move on... 15:38:45 q+ to ask about what current did implementers should do with that test suite 15:38:46 Joe Andrieu: I also want to move on but I just wanted to say yes web platform test is exactly the kind of organization that should be doing it not W3C right they have web platform test suites for what WT specs for W3C specs like I think that should be the place we would put our attention because they are building that capacity I'm worried about 15:38:46 overwhelming like we we're struggling to manage the... 15:38:55 ... that did method registry, um, and people are misusing it as a form of endorsement and all sorts of other things, and I'm seeing registries sneak up in other places that I now have to go and try and talk people out of doing, so 15:39:04 ack danpape 15:39:04 danpape, you wanted to ask about what current did implementers should do with that test suite 15:39:06 ... So thanks for pointing to a great example of someone other than the W3C, who we don't feel is somehow morally bankrupt and taking advantage of the situation and doing something that we're afraid of 15:39:09 Otto Mora: Okay, Dan, last word, and then we'll move on... 15:39:23 Dan Pape: Hi, um, no, I just wanted to ask, as a DID implementer, um, who was actively writing to that. Resolution Test Suite... 15:39:27 ... Should I not be doing that, or should I just 15:39:34 q+ 15:39:36 ... Understand that that doesn't mean I'm 15:39:37 Otto Mora: someone can... 15:39:37 Dan Pape: I've got a good DID, it's just a DID that's passing the resolution test suite... 15:39:40 Otto Mora: Going... 15:39:43 ack joe 15:39:49 Joe Andrieu: Yeah I'll just jump in to to to say yes I think that's right I think I think it is useful but you should understand it's it's point was to test the spec. And so... 15:39:55 ... Take the results with a grain of salt about where you're at in your development pipeline 15:39:56 Topic: https://github.com/w3c/did-resolution/pull/344 15:39:57 q+ 15:39:58 bigbluehat has joined #did 15:39:58 Dan Pape: Sure. Okay, cool. Alright... 15:40:16 Otto Mora: Okay, thank you. So okay, so 3, 4, 4 now. So we had a conversation yesterday around this, and Stephen walked us through a presentation with some of his observations on the comments that folks had had raised... 15:40:20 ... Uh, and I think we, uh, made some good progress there, but then we also got, um 15:40:22 Just to note: https://github.com/web-platform-tests/wpt 15:40:34 ... into a deeper conversation about a client and. And so a different interpretation of it, I believe. So maybe the 15:40:46 ... The idea here was to have Joe explain to us how he's seeing it and why we might be looking at the concept of client a little bit differently 15:40:51 q- 15:41:01 Joe Andrieu: Sure. So I'm going to anchor an analogy that we've used before, but I think it's not working. So I'm going to try another one. But the analogy I've been using is... 15:41:14 ... It's like a web browser. And a web browser absolutely dereferences URLs. But what we don't have is a standard for a CLI that the browser itself exposes the result of the retrieval of web pages 15:41:20 present+ 15:41:24 ... Right? The browser is doing a display action. It doesn't have this function that's a library call where you pass in parameters and you spit out back the resources 15:41:25 q+ 15:41:30 A web server does the DID URL dereferencing. Not the browser. 15:41:34 ... Um, and my opinion is that what we are defining is the equivalent of HTTP, like how the browser actually goes and gets the resource. That's resolution 15:41:40 ... And in order to use HTTP correctly, we're describing what you do 15:41:58 ... What headers mean, what you do with the response, how you respond to a redirect URL, that sort of thing. But what we're not making the browser do is expose a particular function with a given signature and a given set of return values 15:42:03 ... Um 15:42:10 ... Another way to think about it is, with, sending an email. So, if you're writing an app, I'm going to pick Node.js just so we have something concrete 15:42:15 ... Um and I need my web server that I'm implementing in Node.js to be able to send an email 15:42:32 ... I'm almost certainly going to use some library. I'm going to go look at NPM JS and I'm going to find a library for handling mail. And that library is going to have some interface and I'm going to figure out if that interface works for me. Maybe it uses promises, maybe it uses callbacks, maybe it 15:42:44 ... It does things in any number of ways. At the end of the day, I'm expecting that with the right configuration profile, that that library will open a call to SMTP 15:42:53 ... And actually pass that message on to the email network. And so in in our situation we the SMTP is the resolve spec 15:43:08 ... And we are defining an HTTPS binding so that we can call a server and perform resolution, we get back a concrete result. But what we're not defining is we're not defining the interface that that Node.js library has to implement 15:43:25 ... And that's because we have use cases that have been excluded from the current definition, the attempt to create a dereferencer that I tried to point out and I got a lot of pushback and said, we'll just use a URL, magically everything's there. But that's not the case 15:43:38 ... The way I see this specification is that we need to define resolution. That is the method specific component that every DID method does differently. And what we're trying to do is create a standard interface to resolve 15:43:55 ... So that different software applications can all resolve, even if the DID method under the hood does something weird, right? The resolver for a given DID method understands that DID method, but what we're trying to standardize is how you call resolve 15:43:59 ... So 15:44:07 ... The way I see this is we are not creating a new piece of software that we are standardizing interface for that would call that. The only notion of a dereferencer in the approach that I'm taking is the client of Resolve 15:44:18 q? 15:44:22 ... So, some… some piece of software gets a DID URL, and it wants to work with it in some way. It is going to dereference that URL and get it to a handler, so the right handler can do the right thing. And as part of that, it calls resolution 15:44:29 ack markus 15:44:30 ... So I don't know if that new analogy helps at all, Steven, but hopefully that walks around the space a little bit with some more language 15:44:32 q+ to ntoe maybe we just add a word "resolution client"? 15:44:33 q+ 15:44:34 Otto Mora: Okay, thank you, Joe. Marcus... 15:44:50 Markus Sabadello: we're defining an interface for resolving, and we're also defining an interface for dereferencing, but these interfaces and these functions have always been meant to be completely abstract. I... 15:44:54 q+ we are not defining an interface for dereferencing. 15:44:58 q+ to point out we are not defining an interface for dereferencing. 15:45:05 ... Wrote a pull request, uh, yesterday, uh, 3… 56, uh, which is trying to explain that a bit better, because it… it seems that this is sometimes 15:45:06 ... Misunderstood. There's been 15:45:10 https://github.com/w3c/did-resolution/pull/356 15:45:11 ... There's some language in the specification which talks about these functions, the resolve function and dereference function 15:45:22