@Context Processing

[nadalin]

"It is RECOMMENDED that dereferencing the URIs results in a document containing machine-readable information about the context"

This should be removed, this can be a very large security attack vector

[dlongley]

That statement does not say that it is recommended that verification software perform dereferencing. It recommends that if the URI is dereferenced, the result should be a document that contains machine-readable information about the context (as opposed to something else or nothing at all).

[nadalin]

@dlongley Should not RECOMMEND any dereferencing, this should be able to be just treated as a string as there is no reason to expect that URI is dereferenced, the result should be a document that contains machine-readable information.

[dlongley]

Dereferencing is not being recommended. No statement is being made encouraging that the URI be dereferenced nor is a statement made about the process by which that "dereferencing" would occur.

For example, a "dereferencing process" could involve a URI urn:foo:this-is-my-context#sha256-d21db12bd21 that can be found as a key in a hard-coded, in-memory registry where the value is a document with machine-readable information about the context -- and it even includes a content-integrity hash. And... maybe this isn't used by verification software but by promotional software that helps users understand what kind of VCs they could potentially issue with some interesting comparison visualization. The spec is silent on all that.

The spec merely recommends that a context URI should be understandable as a reference to some document that a machine could read with information about the context.

[nadalin]

@dlongley My point is that goes too far in the recommendation, it should just be treated as a sting value

[stonematt]

From VCWG call on April 30, 2019:
RESOLUTION: Dereferencing a value in the @context property should result in a document containing machine-readable information about the context. Non-normative clarification text should be added to the specification to underscore that dereferencing machine-readable @contexts is optional. Issue #558 should be closed when the PR #564 is merged.

[nadalin]

@stonematt Totally disagree, should just be a sting value and no dereferencing should be in the description

[TallTed]

@nadalin - Have you read the reworded text? I just want to be sure we're all working from the same base.

As seen in the rendered doc, it is now --

It is RECOMMENDED that each URI in the @context be one which, if dereferenced, results in a document containing machine-readable information about the @context.

Do you have any suggestions of how to make this more clearly a guidance for VC issuers, about how to choose the URIs they include in the @context property?

[burnburn]

PR has been in for a long time, no dereferencing is recommended in the text. Closing.