19:58:17 RRSAgent has joined #vcwg 19:58:17 logging to https://www.w3.org/2022/03/02-vcwg-irc 19:58:25 zakim, start the meeting 19:58:25 RRSAgent, make logs Public 19:58:27 please title this meeting ("meeting: ..."), brentz 19:58:48 meeting: Verifiable Credentials Working Group 19:59:02 chair: Brent Zundel 19:59:14 present+ 19:59:44 acoburn has joined #vcwg 20:01:25 mkhraisha has joined #vcwg 20:03:32 present+ 20:03:36 present+ 20:03:39 JoeAndrieu has joined #vcwg 20:03:39 present+ 20:03:44 kristina has joined #vcwg 20:03:50 present+ mprorock 20:03:54 present+ 20:03:59 present+ 20:04:00 present+ 20:04:17 yes 20:04:20 scribe+ 20:04:33 rgrant has joined #vcwg 20:04:49 brentz: today's agenda has changed slightly. 20:05:01 ... the bulk of our time will be looking at issues. 20:05:09 ... before that we'll be looking at existing PRs 20:05:22 ... Any suggestions for items for the agenda? 20:05:33 manu: Maybe we could touch on timeline quickly. 20:05:41 kdeangs1 has joined #vcwg 20:05:57 brentz: sounds good. 20:06:08 ... Let's start off with introductions and re-introductions 20:06:14 ... Anyone new to the call? 20:06:27 topic: introductions 20:06:36 acoburn: I work with Inrupt. I know some of you from other contexts. We're doing a lot with VCs at the moment. 20:06:44 brentz: thank you 20:06:47 Welcome to the group, Aaron! :) 20:06:54 Super excited that you're here :) 20:06:54 topic: announcement 20:06:58 ... next a quick announcement 20:07:15 ... Our transition for candidate corrections to v1.1 has been approved. We did it! 20:07:18 Hooray (and cheering) 20:07:26 ... Moving forward let's talk about timeline 20:07:27 topic:timeline 20:07:44 ... Feel free to jump on queue 20:07:55 ... (Over the roar of muted cheering) 20:08:10 ... We want this to move forward as fast as possible, to present a charter to the AC 20:08:19 ... My goal is to get that done by the end of this month 20:08:36 ... Hop on the queue if you have questions or concerns 20:08:41 +1 to "finished charter by end of month" being a realistic timeline 20:08:57 ... Seems like the consensus progress has been going well and that deadline looks reasonable 20:09:06 topic: VCWG Charter PRs: https://github.com/w3c/vc-wg-charter/pulls?q=is%3Apr+is%3Aopen+sort%3Aupdated-asc 20:09:21 ... Here is a link to pull requests. Three. 20:09:28 ... We'll go through one at a time. 20:09:32 subtopic: https://github.com/w3c/vc-wg-charter/pull/93 20:09:40 q+ 20:09:45 ... first one #93 List of cryptosuites for standardization 20:09:48 ack manu 20:10:20 manu: this is in response to another request from Kristina in another PR. I did a full list and most of them got in, but these three. 20:10:21 q+ 20:10:31 ... so I added this as things we might get to. 20:10:43 ... The only difference is that these things have been done for a while. 20:10:49 ack kristina 20:11:10 kristina: Thanks, Manu. 20:11:42 kristina: we need some time to review, but we appreciate the progress. 20:12:25 brentz: would anyone oppose merging this pull request? 20:12:31 kristina: can I get time to review 20:12:45 brentz: of course. So we'll continue looking at that (no merge yet) 20:12:51 brentz: Next up #92 20:12:54 subtopic: https://github.com/w3c/vc-wg-charter/pull/92 20:13:05 merging PR 93 20:13:11 q+ 20:13:15 brentz: adds an input documents to conditional deliverables 20:13:33 ack manu 20:13:35 ... The names I made up on the spot, so we can bikeshed if desired 20:14:07 manu: the core thing that these PR does is add an inputs document column. To address what an input document is. This worked for the Registries PR 20:14:28 ... two concerns. there probably needs to be a general clean up re how we talk about these various deliverables 20:14:42 ... +1 to addition of column. -1 to some of the names 20:14:51 ... we need a discussion to figure out the names before we lock into that 20:15:18 brentz: structurally, I think this addresses some of the concerns about the additional deliverables. 20:15:56 joe: -1 to merging without name fixing, but if acknowledged we could do that later 20:16:07 brentz: anyone opposed to merging as is? 20:16:11 manu: yes. 20:16:14 joe: me too 20:16:23 subtopic: https://github.com/w3c/vc-wg-charter/pull/85 20:16:25 brentz: let's look at #85 20:16:28 q+ 20:16:35 ... this adds deliverable section 20:16:37 q+ 20:16:40 ack manu 20:16:57 manu: Sharing screen. This is the new section on registries. 20:17:23 ... took description of registries from somewhere, then Jeffrey suggested we add a "based on" column 20:17:26 q+ 20:18:09 ... also, Mike Jones asked for a change in the name of the CCG registry. That happened historically, before W3C had a registry process. 20:18:33 ... we can do more, we can do less, this is just a starting list 20:18:43 scribe+ 20:18:49 markus_sabadello_ has joined #vcwg 20:18:51 ack JoeAndrieu 20:18:55 present+ 20:19:51 JoeAndrieu: I want to reiterate - I expect I'm an outlier, so if I'm the only voice, don't expect to uphold consensus. I think DID Spec Registries was a nightmare, I know W3C Registries process exists... contact information was added because I added to it, don't think we're mature enough to take on registry functions. It has been a nightmare, I would prefer an architecture that doesn't presume centralized registries. 20:19:58 mprorock: I want to +1 Joe on that. 20:20:24 kdean: I agree, building and deploying registries is a major undertaking, even for something that has a relatively small number of records. 20:20:30 scribe+ 20:20:30 q+ 20:20:43 ack kristina 20:20:49 +1 to Joe 20:21:37 kristina: two things. One: Mike is on vacation. I have a message from him: On enumerating complete potential registries. He agrees with the text above the table. We'd work on the registries is good. More work to be done on enumerating the set. 20:22:16 ... On the registry at W3C, that seems normal because the process is new. Registries have been proven powerful in other SDOs, so I suggest we keep the text that we will work on registries. 20:22:19 q? 20:22:26 ack manu 20:22:26 ... We think we should have certain aspects of registries in charter. 20:22:45 manu: I wanted to +1 Joe. I don't think he's alone. the DID Spec registries has been a nightmare. 20:22:58 ... at the same time, I'm not going to -1 us working on registries. 20:23:15 ... It is going to take an enormous amount of effort. But I think we should do it. 20:23:26 ... It was used against us in the DID vote 20:23:57 ... The other statement about not enumerating registries is falling into the same trap is that people will argue that we shouldn't do it because it's not in the charter. 20:24:01 q+ 20:24:08 ... We know we ARE going to have registries 20:24:16 ... This helps us later on when people object. 20:24:24 q+ to question the assumption 20:24:26 ack kristina 20:24:52 kristina: Because the working group can decide what work items it can pick up or not... that argument doesn't stand. 20:25:01 Orie has joined #vcwg 20:25:15 present+ 20:25:24 ack JoeAndrieu 20:25:24 JoeAndrieu, you wanted to question the assumption 20:25:25 ... even if we do enumerate, even if we are to conclude specific concrete aspects of particular registries. we can't really merge until those are addressed 20:25:29 It's true that it's not a 100% guarantee, but I don't think that's what we're looking for. 20:25:32 scribe+ 20:26:05 scribe+ 20:26:05 JoeAndrieu: I thought I was going to be a lone voice, but Manu, part of your argument was the assumption that we were going to create registries. Given my comment, I'm not sure that's appropriate. 20:26:24 q+ 20:26:28 brentz: is it reasonable to produce a recommendation with intended extension points and not provide extension points for those to be registered 20:26:28 ack manu 20:26:30 q+ 20:26:47 manu: yes, it is reasonable, that is what we intended to do with DID Core 20:27:02 ... in this case, i do think it is a useful thing 20:27:10 ... and I'll be a part of that process 20:27:12 ack JoeAndrieu 20:28:37 q? 20:28:39 q+ 20:28:43 JoeAndrieu: That was not part of the original intention of DID Core - a significant goal of DIDs and VCs is to be decentralized, compromise between JSON-LD and JSON was a false compromise, and led to expectation of centralized registries. Violates ethos of what we're trying to do here. If we had managed DID Spec registries in compelling way, we failed to properly managed DID Spec registries, and I'm concerned about adding more registries w/o addressing 20:28:43 that. 20:28:44 +1 Joe, but not sure that the alternative is better. 20:28:51 it's not in scope of the charter to outline HOW we manage the registries 20:28:52 q- 20:29:05 Understood, Orie, the alternatives are also challenging 20:29:12 scribe+ 20:29:18 if we agree to potentially have them, that opens up the door to address the managing the registries problem 20:29:30 seems that a way to proceed may be to put in the charter that we "may" do this, but let the WG debate it. 20:29:34 +1 20:29:40 dlongley: seems that a way to proceed may be to put in the charter that we "may" do this, but let the WG debate it. 20:29:43 +1 dave 20:29:54 +1 to dave 20:29:57 and +1 to joe's concerns generally 20:30:08 topic: VCWG Charter - Issues 20:30:09 brentz: With that, let's move to next topic 20:30:34 manu: if I change the language, would that work? 20:30:45 JoeAndrieu: Good question, thinking... 20:30:51 i think it would be better to have time and space to litigate that in the group 20:31:21 +1 Joe, i would stick to explict charter suggestions 20:31:25 JoeAndrieu: Maybe, let's look at it again in a week, I feel like there is a certain inertia/momentum. When you acknowledged with a -1, but said +1 anyway, we're not thinking through these decisions, not convinced that'll lead to the right outcome. Maybe your proposal is the best way forward, need time to thik through that. 20:31:25 https://github.com/w3c/vc-wg-charter/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-asc 20:31:37 present+ shigeya 20:31:44 subtopic: https://github.com/w3c/vc-wg-charter/issues/67 20:31:53 brentz: on to #67 20:32:15 q+ 20:32:20 ack manu 20:32:24 ... each registry should have at least one standardized entry 20:32:35 q+ to comment on revocation, crypto suites 20:32:43 manu: Jeffrey is coming from a good place. If we have a registry, we should have at least one officially defined extension 20:32:54 ... points to the VC extension registry which is mostly empty 20:33:09 ... refresh methods, evidence methods, etc., we don't have normative examples 20:33:11 q+ to say a normatively defined extension for each require property makes sense 20:33:27 ... people have also been using all of those, but none of them standardized 20:33:45 ... So, while I agree with Jeffrey's intention, but there are concerns about registries 20:33:58 ack Orie 20:33:58 Orie, you wanted to comment on revocation, crypto suites 20:34:01 ... Is it just to document what "we" think is official, or to capture anything in the wild? 20:34:19 can non-W3C members come to VCWG meetings to discuss proposals to the registry? 20:34:34 orie: manu mentioned the obvious things this would put at risk: evidence, schemas, ... my opinion is that these items don't belong in the core suite 20:34:53 juancaballero, not really due to IPR issues... 20:35:07 ... I think there is a lot ot be gained from taking a very sharp knife. We looked at this is the first version. And we saw that these extension points were a nightmare for interoperability 20:35:25 q+ to note you can't extend if you don't have an extension point. 20:35:35 ... Why not let CCG continue incubating without requiring everyone to support these extension points 20:35:41 ack brentz 20:35:41 brentz, you wanted to say a normatively defined extension for each require property makes sense 20:35:43 ... We should cut out anything that doesn't have significant adoption 20:35:46 q+ 20:36:04 brentz: I think this is a good idea for those properties that are normatively required. 20:36:19 ... if its required, but there isn't a definition, it is a problem 20:36:32 ... but for optional properties, I think it's less of an issue 20:36:32 ack manu 20:36:32 manu, you wanted to note you can't extend if you don't have an extension point. 20:36:58 manu: +1 to what brent said. For things that are required, yes. But not for refresh, evidence, TOS, etc. 20:37:01 +1 manu, everything manu just said is optional. 20:37:17 ... orie, the danger in what you said is that then there are no ways to extend 20:37:45 ... that's my concern. It took 10 years for SVG to be standardized and it kept getting panned because it wasn't a standard yet. 20:38:07 ... It's premature to say these things are not useful. I know that all of these fields are being used in the wild. 20:38:20 ... I would be fairly big -1 to remove them at this point 20:38:22 I am in favor of experiments... I am not in favor of experiments in the core spec. 20:38:23 ack JoeAndrieu 20:39:18 JoeAndrieu: I want to echo the sentiment, Manu summed it up - options vs. required that Brent introduced is vital. My concern, we have to experiment, we don't know what's going to work, we're all still learning. All specs in this area has acknowledged that fact. We're not building a single monolithic system that everyone wants. There are pieces here that create value, but we don't know what all the pieces need to be. 20:39:40 JoeAndrieu: I know I've pointed out a number of these properties to my clients, the extension points are vital to having a standard that's relevant both today and tomorrow. 20:39:44 scribe+ 20:40:23 brentz: next issue #81 20:40:24 subtopic: https://github.com/w3c/vc-wg-charter/issues/81 20:40:38 ... rather than v2, perhaps we should call it level 2 to comply with other W3C recommendations 20:40:40 q+ to nope 20:40:45 ack manu 20:40:45 manu, you wanted to nope 20:41:07 manu: there's no rule in here that says use level 2 instead of version 2. It is confusing 20:41:11 -1 on this issue 20:41:16 q+ 20:41:20 ack JoeAndrieu 20:42:05 brentz: next up #84 20:42:05 JoeAndrieu: Level 2 to me, implied semantics, seems to me that Level 1 is still valid. It doesn't convey we're "updating that first version to newer version, where not all of the first thing might be valid anymore." 20:42:08 subtopic: https://github.com/w3c/vc-wg-charter/issues/84 20:42:12 > An earlier version of EPUB (EPUB 3.0.1) was published as an ISO standard ISO/IEC TS 30135:2014 (parts 1-7). This Working Group and ISO may consider updating that ISO specification once the new Recommendations are published. 20:42:12 Additionally, there are currently activities within ISO/IEC JTC 001/SC34 on specifications that rely on earlier versions of EPUB (e.g., EPUB Preservation, EPUB Accessibility). A liaison has to be maintained on, possibly, updating those ISO specifications to the latest versions of EPUB 3, specified by this Working Group. 20:42:23 s/Additionally, there are currently activities within ISO/IEC JTC 001/SC34 on specifications that rely on earlier versions of EPUB (e.g., EPUB Preservation, EPUB Accessibility). A liaison has to be maintained on, possibly, updating those ISO specifications to the latest versions of EPUB 3, specified by this Working Group./> Additionally, there are currently activities within ISO/IEC JTC 001/SC34 on specifications that rely on earlier versions 20:42:23 of EPUB (e.g., EPUB Preservation, EPUB Accessibility). A liaison has to be maintained on, possibly, updating those ISO specifications to the latest versions of EPUB 3, specified by this Working Group./ 20:42:35 (^from Iván's example) 20:42:37 ... add JwtProof2020 to charter 20:43:05 orie: There is an implementation of jwt-vc at DIF that is really an "internal" format, but it looks like an external one. 20:43:43 ... so I raised this to help resolve the issues. We also want to be able to find JWTs in a database 20:44:12 q+ to note that might be covered in VC-JWT spec, please stop the JwtProof2020 thing. 20:44:17 ... we could say this is not our business, but clearly the folks behind JWT-proof thought it might be useful to be explicit 20:44:26 ack manu 20:44:26 manu, you wanted to note that might be covered in VC-JWT spec, please stop the JwtProof2020 thing. 20:44:48 manu: A couple ways to address Orie's issues. If folks want to talk about storage, maybe that can be done in the VC-JWT spec 20:45:07 ... the way the spec is constructed now feels like noise. It'd probably be better to just shut that down. 20:45:14 q+ 20:45:21 ... I hesitate to pull it in when it isn't really a cryptosuite 20:45:37 ... My suggestion is DIF should shut it down or rename it to remove the confusion 20:45:41 ack Orie 20:45:49 btw, ignoring how people may use VCs entirely can lead to mistakes wrt priority of constituencies (e.g., making it easy for someone to write a spec or implement signing/verifying a VC, but harder for end users to use the verified data in a variety of ways) 20:45:59 there is no ongoing work to shut down 20:46:06 orie: you got part of it right, but one of the suggestions is the JWT part of the spec could comment on this to make it intelligible. 20:46:08 it's a historical document 20:46:14 q+ to ask what changes should be made to the charter 20:46:15 it should be marked as such 20:46:17 ... Not likely effective to depend on DIF to fix this 20:46:23 it should! 20:46:36 W3C got in serious trouble over the years by not marking old documents as historical or rescinded. 20:46:47 ... So maybe we talk about this as an implementation guide. That kind of comment, clarifying how not to do what the DIF spec is interpreted as. 20:46:50 and thus had to put that process in place. 20:46:51 q+ 20:46:57 q- 20:47:13 ... the best thing we could do is to comment on this format in a way that instructs and encourages contribution and removes security risks 20:47:25 ... I suggest that we do that in the JWT cryptosuite 20:47:42 q+ to ask DIF people on this call to mark it as historical, if it is historical. 20:47:54 ack brentz 20:47:54 brentz, you wanted to ask what changes should be made to the charter 20:47:58 ... alternatively we could take a harsh stance and decide we recommend AGAINST the DIF approach. In any case, we need to talk about storing JWTs to avoid the security issues from misunderstanding 20:47:58 q+ mprorock 20:48:47 ack manu 20:48:47 manu, you wanted to ask DIF people on this call to mark it as historical, if it is historical. 20:48:49 brentz: I appreciate the conversation. My read of the charter doesn't prohibit what has been proposed, so are we asking for changes to the charter, or just anchoring future discussions. 20:49:05 q+ to suggest changes to the charter to support "decoded credential formats" 20:49:06 manu: I won't be opposed to a sentence in the charter saying that we are going to talk about storage formats. 20:49:26 ... but we probably don't need it. The desire is on record and we can refer back to this discussion. 20:50:02 ... DIF needs to mark such specs as historical. W3C learned this the hard way and we need DIF to up its process to do something similar 20:50:10 ack mprorock 20:50:16 FWIW I would avoid looking at DIF documents in any way other than you look at CCG docs. 20:50:42 +1 20:50:46 +1 20:50:50 mprorock: Adding an explicit sentence just to clarify... maybe not "storage formats" per se, but we do need to clarify how JWTs and VCs relate and the implications of that 20:50:59 ... "What happens if you do X" 20:51:20 ... just because JWTs are out there, widely used for very similar operations. 20:51:36 ack Orie 20:51:36 Orie, you wanted to suggest changes to the charter to support "decoded credential formats" 20:51:39 ... Clarifying how these things actually work and what you should do there is valuable for us to tackle 20:51:40 to mike's point about documenting the JWT<--->VC relationship in the JSON section of the spec2.0 20:52:18 orie: what Mike said that I think is the important highlight for interoperability, there's the credential and there is a verifiable credential. 20:53:04 ... in v1 the credential is JSON with a separate proof. The JWT-proof breaks that model, but it does it for a good reason, so we have to consider that usage (querying in a data store) 20:53:20 +1 to the idea that we need to consider how VCs will be used, stored, etc. -- vs. *only* focusing on integrity proofs directly. 20:53:24 ... in some ways this could be solved by the VC-JWT clarifying its credential format is different from VCs. 20:53:41 q? 20:53:48 ... I do think the charter should clarify we will normatively defined what a credential and verifiable credential in the context of a VC-JWT 20:53:52 q+ to ask for a PR 20:54:12 ... If we are good about using those terms correctly and educating those who use it poorly, everyone is going to be better off 20:54:56 ... we can't allow people to refer to other things as if they were the normatively defined thing. We should address the difference between embedded and separated proofs. 20:55:08 ack brentz 20:55:08 brentz, you wanted to ask for a PR 20:55:12 ... Big +1 to Mike's comment 20:55:27 brentz: would you be willing to raise a PR so we can continue the conversation more concretely. 20:55:47 orie: I would if we have engagement on the issue itself. Once we get that, i'll draft a PR 20:55:51 subtopic: https://github.com/w3c/vc-wg-charter/issues/89 20:55:54 brentz: issue #89 20:56:41 q+ 20:57:01 orie: the tech we are working on here has ethical consequences, from expensive processes to digital human rights like freedom of movement, which can be impacted by adoption of VCs at scale 20:57:21 ack manu 20:57:21 ... what I don't want to do is get to the end of the process and have people oppose it then 20:57:35 kristina has joined #vcwg 20:57:42 manu: I'm concerned that this is like a honey pot for endless discussions of ramifications of technology 20:57:50 manu: I would be fine to say we are going to publish a note 20:58:01 previously a "note" was no sufficient to avoid FOs. 20:58:05 q+ to say I think this is a mistake 20:58:07 not* 20:58:39 manu: that not can be a centralized focus for those interested. but if we start taking up main call time, that would be a negative 20:58:47 ack JoeAndrieu 20:58:47 JoeAndrieu, you wanted to say I think this is a mistake 20:59:35 JoeAndrieu: I'm pretty opposed to this approach at all, it's creeping Nanny-state-ism. People will use it to attack things they don't like. That's not our role here. Our role is to step outside the "morality matrix". Our job is to put options on the table. 21:00:00 q? 21:00:09 JoeAndrieu: If we need to start the fight here, the EWP work is a mistake. That whole framework that the W3C should be the morality police is misguided. I don't think this is the right way to handle these problems. 21:00:40 thanks all! 21:00:48 rrsagent, draft minutes 21:00:48 I have made the request to generate https://www.w3.org/2022/03/02-vcwg-minutes.html manu 21:00:52 zakim, who is here? 21:00:52 Present: brentz, cel, manu, acoburn, mprorock, JoeAndrieu, dlongley, kristina, markus_sabadello_, Orie, shigeya 21:00:54 On IRC I see kristina, Orie, markus_sabadello_, kdeangs1, rgrant, JoeAndrieu, RRSAgent, Zakim, brentz, dmitriz, tzviya, manu, dlongley, mlemweb, dlehn, juancaballero, cel[m], 21:00:54 ... hadleybeeman, stonematt, bigbluehat, shigeya, cel, wayne, rhiaro 21:01:10 rrsagent, make logs public 21:01:13 rrsagent, draft minutes 21:01:13 I have made the request to generate https://www.w3.org/2022/03/02-vcwg-minutes.html manu 21:01:42 present+ kdean 21:02:13 present+ juancaballero 21:02:23 whoops thanks 21:02:29 present+ kdeangs1 21:02:32 np 21:02:51 present+ rgrant 21:03:11 zakim, end the meeting 21:03:11 As of this point the attendees have been brentz, cel, manu, acoburn, mprorock, JoeAndrieu, dlongley, kristina, markus_sabadello_, Orie, shigeya, kdean, juancaballero, kdeangs1, 21:03:15 ... rgrant 21:03:15 RRSAgent, please draft minutes 21:03:15 I have made the request to generate https://www.w3.org/2022/03/02-vcwg-minutes.html Zakim 21:03:17 I am happy to have been of service, brentz; please remember to excuse RRSAgent. Goodbye 21:03:21 Zakim has left #vcwg 21:03:25 rrsagent, bye 21:03:25 I see no action items