Agenda 2025-09-15 Originator Profile (OP)

[TzviyaSiegman]

Meeting information

[filmenczer]

How to join? The meeting page says "Instructions are restricted to W3C users with Member access." Am I not a member? In the past I was only able to join one meeting, due to scheduling conflicts. Thanks.

[TzviyaSiegman]

@filmenczer create a W3C Account. to get access to the meetings.

[filmenczer]

@filmenczer create a W3C Account. to get access to the meetings.

I do have a W3C account, that is why I asked... I do not seem to have Member access?

[hearvox]

Is this the Originator Profile group that will be presenting Sep 15?
https://originator-profile.org/

[shigeya]

Is this the Originator Profile group that will be presenting Sep 15? https://originator-profile.org/

Yes, that is correct.

[shigeya]

The current version of the specification is available to the public:

https://docs.originator-profile.org/en/

Please read the Architectural Overview first.

[TzviyaSiegman]

Reading material: https://docs.originator-profile.org/en/

[shigeya]

(UPDATE: fixed the dates to the real publication date)

Note:

Due to the document deployment process, while the document says its last update is today, the 'Architectural Overview' document has not been updated since Sep 12.

Last real update:

Date: Fri Sep 12 09:37:26 2025 +0900

We're not planning to update before the workshop. Therefore, there will be no change in the document while the date is updated.

We're sorry for the confusion. We'll fix this.

[jyasskin]

Unfortunately I won't be able to attend, but I'm curious about the following details. I'm starting from https://docs.originator-profile.org/en/aov/, which seems to serve the purpose of an explainer for this technology, although I'm also skimming it rather than reading in detail, so apologies if I've missed something.

• I don't see a description of what happens when an Originator misbehaves. I see the charter, which gives some general principles about what constitutes misbehavior: do you have a list of potential consequences? Have you thought about who would make the necessary judgement calls about what consequences are appropriate for specific violations?
• Some of this system assumes that governments are honest. Do you see this scaling to the United States, where the national government is actively trying to undermine many of the principles in the draft charter?
• I'm concerned that https://docs.originator-profile.org/en/opb/content-integrity-descriptor/html/ tries to verify the integrity of HTML by serializing it using outerHTML. The impression I get from security folks is that 1) we usually want to verify things before displaying them, and 2) we almost always want to verify the byte string that then gets parsed, rather than trying to re-serialize it identically across implementations. Have you tested that browsers' outerHTML results are consistent enough to use for this? Do they change over time as things like Declarative Shadow DOM get adopted, which would also break this verification?
  • How should this mitigate the risks for portal sites, which will need to embed the HTML exactly as it was provided by the Originator in order to pass verification? The Originator could provide hostile or simply vulnerable HTML, but sanitization is likely to change the outerHTML value.
• I'm concerned that the content integrity descriptors identify parts of the page using CSS selectors, while a hostile page could use other CSS to ensure that the user doesn't see the expected content, either by moving it off the page or rendering hostile content on top of it or part of it. What are the minimum requirements on user-agents to prevent users from being mislead?
• How does this mitigate the difficulties that EV certificates had in showing human-understandable names?

[shigeya]

@jyasskin Thank you very much for reading the doc, and also for the questions!

I understand your concerns. I can answer some of the questions right now, but it'd be better to have a Q&A session at the workshop first. Please wait.

[shigeya]

The presentation material I'll use is this:
https://drive.google.com/file/d/1jz9YLhwy-pW38OLlV1B-Fec0VN-xVImc/view?usp=drive_link

See you soon!

[TallTed]

The images in the AO document have lots of black shapes, which seem likely to have been intended to have labeling inside those shapes.

Example problematic image resource: https://docs.originator-profile.org/en/aov/Drawings/BaseModel-Issuing_OP_CP+PA.drawio.svg

Live image:

That image appears to be the same as on slide 7 of the presentation, to which I cannot provide a direct link.

[TallTed]

@filmenczer — You should just need to log in to the calendar (sign-in link at upper-right), to see the protected zoom link.