vc-data-model
vc-data-model copied to clipboard
Re-evaluate support for `@vocab` in base VCDM v2 context
Previously, the VCWG decided to define a @vocab value in the base context (see https://github.com/w3c/vc-data-model/issues/953). Recently, a security disclosure (which is still under debate) has resulted in a number of individuals that had previously been in support of defining an @vocab in pulling their support for the feature since it is, at best, not very well understood, and at worst, leads to unexpected security-related concerns for those that do not understand the ramifications of using it.
We no longer have consensus for the feature (this is the new information that the security disclosure has highlighted). At a minimum, we need to poll the group again to see if @vocab has the support it needs to remain in the VCDM v2 base context.
There are additional proposal options, which include:
- For the "Getting Started" section, create a "development context", which might just be the
examples/v2context. - Strongly advise against the use of
@vocabin a production setting (but still allow it). - Ban the use of
@vocabin any production setting (and implement normative specification text and tests that enforce the behaviour). - Create an "issuer-defined" context that moves the
@vocabdeclaration to that document (for those that want to continue to create/use "private term" VCs).
We'll gather feedback in this issue and then implement whatever achieves consensus.