-
Notifications
You must be signed in to change notification settings - Fork 97
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
add representation property #348
Conversation
Signed-off-by: Drummond Reed <[email protected]>
While I would normally propose two new properties into two separate PRs, @brentzundel wisely suggested that both of these fit neatly as subsections of DID Subject under Core Properties. So I submitted them as one PR. A suggestion to commenters: put The The |
Reading the text with my Semantic Web hat on, the immediate question is "is this I presume the answer is (or should be) 'no': it is a term defined for the sole usage in DID Documents for DID subjects. (E.g., I presume it is not acceptable to use (One could bikeshed on whether the term |
index.html
Outdated
<dt>sameAs</dt> | ||
<dd> | ||
The value of <code>sameAs</code> MUST be a <a | ||
data-cite="INFRA#lists">list</a> where each item in the list is a <a>DID</a> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
we might want to relax this to be a URI...
did:example:123 owl:sameAs https://example.com/person/456
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@OR13 Per the other discussions on this topic, I changed the property name to sameSubject
. For reasons I will explain in a new Appendix I am composing, I favor keeping the value of sameSubject
restricted to DIDs.
index.html
Outdated
<dl> | ||
<dt>type</dt> | ||
<dd> | ||
The <code>type</code> property MUST be a <a>URI</a> that asserts the |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
is this a URI? I would expect application/json
, application/ld+json
... prefer to see examples here.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@OR13 Yes, that's a relative URI. I updated the PR to include your suggestion that the value SHOULD come from the IANA media type registry.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think @OR13 is stating that using type
is the wrong property to use here?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is excellent, I think we need to discuss:
- should sameAs work with any IRI (I suggest yes).
- should type be a value from this list: https://www.iana.org/assignments/media-types/media-types.xhtml
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There is a very long discussion happening over here that should be taken into account in this PR -- w3c-ccg/security-vocab#45
I think there is general consensus to support limited "alsoKnownAs" use cases. I will argue very strongly against "owl:sameAs" use cases as I'm almost positive that they violate large swaths of the DID security model... we're playing with fire here. Just calling that out.
I obviously disagree, see the comment manu linked :) From the charter:
Not everyone thinks about linked data the same way... and there is absolutely nothing wrong with using OWL with DIDs... every triple in an RDF representation of a DID Document has the same security issues.... there is nothing different about sameAs... except that its from a vocabulary set thats already widely used... all the statements about a subject in a did document are the same kind of thing... statements... made by a controller.
Each of these is only as "trustworthy" as the DID Method + the DID Controller's opsec... anyone can claim anything in their decentralized identity document... thats the whole point of being free... We are not "Solving Identity" on the Web... we can't make statements like "did:example:123 is/is not provably lord voldemort"... and we can't stop did:example:123 from claiming to be a dog, or a software package.... we can recommend for or against it... I'm in favor of running towards this problem by using OWL, and addressing this issue directly, not creating a new kind of equivalence... which is again only as trustworthy as the controller and did method. If my use case is I want to use OWL with DIDs... does my using AFAIK, this might be the first DID Document JSON-LD vocabulary term that is not primarily defined and maintained by the W3C CCG. Its also fundamental to the public DID use cases that @csuwildcat and others are so excited about: https://rubenverborgh.github.io/WebFundamentals/semantic-web/#timbl-linked-data See also:
I'm not opposed to supporting more than 1 kind of equivalence relationship... but specifically blocking support for existing semantic reasoning / software out of the gate feels like a bad move... OWL exists already... DIDs are new... let's build a bridge not an island. |
First, I was not aware of the CCG Security Vocab thread on @OR13 's sameAs PR when I posted this PR. Thanks to @msporny for pointing it out. As I posted there, I think I understand the concerns @msporny articulates on that thread. And I also appreciate @OR13 's desires to be able to pursue full owl:sameAs semantics. So let me just clarify that the purpose of this PR (despite the proposed So I'm wide open to giving this property a different name, and leaving Since I don't personally like the human semantics of the term "alsoKnownAs" (it feels too colloquial to me), I'd like to propose the property name Thoughts? |
@OR13 First I just want to clarify that my answer to your question assumes (per the comment I just posted) that we will split into two different properties—one called This PR only covers the latter (I will update it to the new property name as soon as we settle on it). Now, in that context, my answer is "No" to allowing IRIs (or other URIs that are not DIDs) because I think it is very important to restrict the |
@OR13 on #2, I agree that the value SHOULD be from that list. I'm wary of making it a MUST as a DID controller may have a reason to assert a type that has not yet been registered. What do you think? |
@msporny Would you be okay with |
interested to hear more about this, I would assume that such a restriction is not actually legal for JSON-LD / OWL / RDF... https://www.w3.org/TR/json-ld11/#iris When I add these up... I feel like making a restriction to DIDs only for |
@OR13 to be clear, I'm not proposing to restrict I agree with you that if a |
Signed-off-by: Drummond Reed <[email protected]>
I just revised the PR to change the name of the That's not to say that |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Let's split this PR up into two PRs... one for sameSubject
and another for representation
... I expect they will progress on different timelines, with sameSubject
being less controversial than representation
.
index.html
Outdated
<p class="note"> | ||
WARNING: A <code>sameSubject</code> assertion that two or more <a>DIDs</a> | ||
identify the same <a>DID subject</a> does not prove this assertion is | ||
true. A malicious <a>DID controller</a> may attempt to impersonate a |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
true. A malicious <a>DID controller</a> may attempt to impersonate a | |
true. A malicious <a>DID controller</a> might attempt to impersonate a |
index.html
Outdated
identify the same <a>DID subject</a> does not prove this assertion is | ||
true. A malicious <a>DID controller</a> may attempt to impersonate a | ||
<a>DID subject</a> by making a false <code>sameSubject</code> assertion. | ||
Therefore it is STRONGLY RECOMMENDED that a requesting party obtain |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Therefore it is STRONGLY RECOMMENDED that a requesting party obtain | |
Therefore it is strongly advised that a requesting party obtain |
index.html
Outdated
independent verification of a <code>sameSubject</code> assertion. One | ||
method for doing this is to resolve the <code>sameSubject</code> <a>DID</a> | ||
to its own <a>DID document</a> and then verify that it contains the | ||
inverse <code>sameSubject</code> assertion (i.e., a backpointer). See |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
inverse <code>sameSubject</code> assertion (i.e., a backpointer). See | |
inverse <code>sameSubject</code> assertion, also known as a back pointer. See |
index.html
Outdated
<code>owl:sameAs</code> assertion. In other words, it does not assert | ||
that two or more RDF graphs represented as <a>DID documents</a> can be | ||
merged. It only asserts that two or more <a>DIDs</a> identify the same | ||
<a>DID subject</a>. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
<a>DID subject</a>. | |
<a>DID subject</a>. Implementers are strongly advised against the use of <code>owl:sameAs</code> when processing <a>DID documents</a> as its use could expand the attack surface in a way that was not considered by the Working Group. |
</section> | ||
|
||
<section> | ||
<h2>representation</h2> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This property is begging to be abused from a GDPR perspective. :)
There are better and more specific properties in schema.org... image
, url
, etc. We shouldn't advise implementers to express this sort of information in the DID Document... it should be done externally.
Please split the representation
PR into a separate PR... as the sameSubject
PR is far less controversial. I'm concerned that this PR is going to be held up because of the representation
PR... they should progress on different timelines.
index.html
Outdated
</dl> | ||
|
||
<dl> | ||
<dt>uri</dt> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This should be id
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
+1
index.html
Outdated
</dl> | ||
|
||
<dl> | ||
<dt>type</dt> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
type
is being re-used in a way that is not compliant with the DID spec... this really should be mediaType
and the value isn't a URI.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I agree with that, but also want to mention that this PR seems to serve a similar purpose as various web linking and discovery technologies such as JRD and the HTML <link>
element. Both of those use type
to declare a media type, not an RDF class.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
if we have an opportunity to pick a better name, we should... id
and type
are used all over the place... +1 for not continuing to overload them.... Content-Type
isn't type
... https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Waiting on this to be resolved to do a re-review of this PR.
index.html
Outdated
</dl> | ||
|
||
<p> | ||
If both the <code>uri</code> property and the <code>value</code> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hrm, no, we should be using data URIs if we want to embed values directly... and we should put that value in id
(see above). Also see https://en.wikipedia.org/wiki/Data_URI_scheme for explanation on data URIs.
index.html
Outdated
<a>DID subject</a> by making a false <code>sameAs</code> assertion. | ||
Therefore it is STRONGLY RECOMMENDED that a requesting party obtain | ||
independent verification of a <code>sameAs</code> assertion. One method | ||
of doing this is to resolve the <code>sameAs</code> <a>DID</a> to its |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
of doing this is to resolve the <code>sameAs</code> <a>DID</a> to its | |
of doing this would be to resolve each <code>sameAs</code> <a>DID</a> to its |
index.html
Outdated
The <code>value</code> property contains a <a>representation</a> of | ||
the <a>DID subject</a>. This value MUST first be encoded in the MIME | ||
type indicated by the <code>type</code> subproperty. If necessary, the | ||
value MUST then be re-encoded according to the requirements of the |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
an example of this would be very helpful
@msporny Agreed. I probably should have done that at the outset. I will try to do that by EOD tomorrow (Wed 22 July). I'll wait to do the new PR before responding to some of your comments on |
Signed-off-by: Drummond Reed <[email protected]>
Revised PR to remove the sameSubject property, which is now addressed by PR #355. |
Co-authored-by: Brent <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please ignore my original approval. I thought I was reading the sameSubject property addition and saw it was moved to PR #355
For the representation property can, I'm not really sure I'm following the purpose of this. The only thing I'm coming up with is when the DID Subject is a online resource, but in that case I'm not understanding the advantages of using a DID rather than something like a URN. Could you provide me any additional use cases for this so I can understand it and reason about it better?
@kdenhartog You nailed it—the whole reason for this PR is that a DID can, in certain cases, be much better than a URN. Just take every use case for a URN, and add these advantages of a DID:
While it is true that each DID method also has its own concrete resolution protocol, the abstract DID resolution contract—and most importantly the resolution result (a DID document)—is standardized for all DIDs. That's a major advantage over URNs. Furthermore, with the How cool is that? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Waiting for other folks to weigh in on this PR... I personally feel it's a bit misguided -- the use case seems too generic -- but I may not understand the use case. Even if it isn't misguided, the PR uses uri
and type
in strange ways. Waiting for the PR to get revised or for the PR submitter to provide a clarifying use case and/or to review the use of uri
, type
, and value
.
index.html
Outdated
</dl> | ||
|
||
<dl> | ||
<dt>type</dt> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Waiting on this to be resolved to do a re-review of this PR.
index.html
Outdated
<dl> | ||
<dt>type</dt> | ||
<dd> | ||
The <code>type</code> property MUST be a <a>URI</a> that asserts the |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think @OR13 is stating that using type
is the wrong property to use here?
In this case, I'd put myself at a +0 then. I'm not thinking we'll (Mattr) use this for resource descriptions at this point, but I expect that down the road it will be useful for implementers who are expanding on the ways in which DIDs are used. I'd be much more willing to move to a +1 if we saw more use cases adopting DIDs in this manor. Do you know of any implementations already doing this (I was thinking the rich schemas might go in that direction, but I haven't see that happen yet.) |
index.html
Outdated
<code><a>serviceEndpoint</a></code>. | ||
</li> | ||
<li> | ||
<code><a>created</a></code>: defined in <a href="#created"></a>. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
did we agree that created and updated go in the did document? I recall strongly objecting to that.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We did not agree to put created
and updated
in the DID Document. We left it open that some DID Methods may choose to do that, but if they do, it's a statement asserted by the controller
of said document.
Signed-off-by: Drummond Reed <[email protected]>
I just pushed a rewrite of this property based on input from this thread and the discussion on today's DID WG special topic call on the proposed DID Appendices (see #373). This rewrite removes any direct references to those proposed Appendices so it can now stand on its own (though the proposed Appendices may still be helpful for understanding this property). |
This PR has been superseded by the proposed |
No comments since marked pending close, closing |
Signed-off-by: Drummond Reed [email protected]
Preview | Diff