Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

w3.org

Post reply on HN
Print view View original

11–20 of 199 posts

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#11

Post by fabrice_d »

Taek wrote: post #6

I've been following DID for a while and I really don't think its the right approach. The voices of concern from Mozilla and Google are spot on: the DID specs expect everyone to coordinate on finding the right structure for different types of data but the real world is messy and no "correct" structure exists. DID in my opinion is unlikely to succeed. Real builders don't use it, because it is cumbersome and requires ag…

Maybe usage will converge on a few dominant methods (be it did:key, did:web or some other one), based on successful applications. This is pretty similar to URIs, which were defined very openly, and where for instance http(s):// took over gopher:// and ftp://

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#12

Post by bawolff »

fabrice_d wrote: post #11
Taek wrote: post #6

I've been following DID for a while and I really don't think its the right approach. The voices of concern from Mozilla and Google are spot on: the DID specs expect everyone to coordinate on finding the right structure for different types of data but the real world is messy and no "correct" structure exists. DID in my opinion is unlikely to succeed. Real builders don't use it, because it is cumbersome and requires ag…

Maybe usage will converge on a few dominant methods (be it did:key, did:web or some other one), based on successful applications. This is pretty similar to URIs, which were defined very openly, and where for instance http(s):// took over gopher:// and ftp://

> This is pretty similar to URIs, which were defined very openly, and where for instance http(s):// took over gopher:// and ftp://

Urls were defined way after all those things, and were predominately created by the http people. I don't think its similar at all, and regardless, compared to the actual http (or gopher or ftp) protocol, the url syntax is the least interesting part.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#13

Post by bawolff »

ukulele wrote: post #7
aidenn0 wrote: post #4

Earlier quoted context omitted.

For those of us who aren't webdevs, what was the final fate of OAuth 2.0?

It's very widely used. Most SSO providers are using it, including the biggest ones.

Although personally i don't think its a great spec. Its a good enough spec (certainly better than saml, shudder) - "good" is not the same as works acceptably or popular.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#14

Post by abernard1 »

bawolff wrote: post #12
fabrice_d wrote: post #11

Earlier quoted context omitted.

Maybe usage will converge on a few dominant methods (be it did:key, did:web or some other one), based on successful applications. This is pretty similar to URIs, which were defined very openly, and where for instance http(s):// took over gopher:// and ftp://

> This is pretty similar to URIs, which were defined very openly, and where for instance http(s):// took over gopher:// and ftp:// Urls were defined way after all those things, and were predominately created by the http people. I don't think its similar at all, and regardless, compared to the actual http (or gopher or ftp) protocol, the url syntax is the least interesting part.

A better example perhaps is `www` or `mail` or `news`. Or magnet links. Or JWT on top of JSON.

In the era of The Information Superhighway, the World Wide Web, and spinning Netscape comets, people were quite ok standardizing on `www` as a prefix that used dns to route your web traffic to the web server. Meanwhile, AOL had a concrete use case of "keywords" that monopolized tv ad time for half a decade and went nowhere.

The web is full of standards that exist on top of other standards. This standard allows people to name things. People will figure out how to make interesting use cases with names without a central authority finding pre-existing use cases.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#15

Post by bawolff »

A standard flexible enough where you can do literally anything is usually a bad standard. The point of standards is to write up some small-ish base that everyone can agree on so that people can talk to each other. A standard containing everything where each implementation implements a different incompatible subset, is a failure.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#16

Post by bawolff »

abernard1 wrote: post #14
bawolff wrote: post #12

Earlier quoted context omitted.

> This is pretty similar to URIs, which were defined very openly, and where for instance http(s):// took over gopher:// and ftp:// Urls were defined way after all those things, and were predominately created by the http people. I don't think its similar at all, and regardless, compared to the actual http (or gopher or ftp) protocol, the url syntax is the least interesting part.

A better example perhaps is `www` or `mail` or `news`. Or magnet links. Or JWT on top of JSON. In the era of The Information Superhighway, the World Wide Web, and spinning Netscape comets, people were quite ok standardizing on `www` as a prefix that used dns to route your web traffic to the web server. Meanwhile, AOL had a concrete use case of "keywords" that monopolized tv ad time for half a decade and went nowhere.…

What exactly are you saying? That DID is as useful as an optional naming convention for server names that some people liked to use in the 90s?

If that is the comparable case, what is the value add of w3c standardizing this?

Personally this standard sounds closer to SOAP/WSDL/etc to me.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#17

Post by dathinab »

aidenn0 wrote: post #4
cratermoon wrote: post #3

Earlier quoted context omitted.

Where have I heard this before? https://www.wired.com/2012/07/developer-quits-oauth-2-0-spec...

For those of us who aren't webdevs, what was the final fate of OAuth 2.0?

OAuth 2.0 basically killed generic identity providers leaving us with a hand full of SSO providers you can use.

It also instead of a simple generic OAuth 2.0 library we had (and still have) separate libraries for the various OAuth SSO providers. Through this has converged a bit since the initial days. But the initial days where enough to cause harm to the ecosystem.

It also needs a variety of "extensions" you have to add to make it secure. But which can slightly differ between SSO providers. (Note sure but I thing some of this "extensions" have been added to the spec retrospectively.)

In conclusion I would say while OAuth 2.0 is widely used it also was widely harmful and lead to a further centralization and to users being more dependent on a few mega corporations.

In this context it has fully failed some of the initial ideas people had about it when it's design started.

Just because something is widely used doesn't mean it's not harmful or well designed. Adaptation of technology is often not driven by what is the technological best solution especially wrt. web technology.

Re: Mozilla and Google Objections Overruled on “Decentralized Identifiers” by W3C

#20

Post by fabrice_d »

teg4n_ wrote: post #19

I don’t understand the point of having a specification when 2 out of the 3 major browsers have objected. Who will implement it? Why bother with this?

The W3C doesn't produce only browser-related specifications. Service providers will implement, eg. instead of login with a user/password they will support some the DID methods.

I would say that the process worked as intended. There was disagreement among members, things got discussed (see https://www.w3.org/2022/03/did-fo-report.html for details) and a decision was made according to the W3C process. All good!

Post reply on HN