[Registry] Re-evaluate "freely available" requirement

[timcappalli]

As per the 2025-04-11 hybrid meeting discussion, this issue is to track future re-evaluation of the "freely available" requirement in the registry inclusion criteria as discussions between W3C and ISO continue and when ISO 18013-7 Annex C meets the other requirements to be added to the registry (protocol identifier, etc).

[bc-pi]

I know this tracking issue was part of a compromise to move the discussion forward in 2025-04-11 hybrid meeting. But I'm honestly still struggling to understand the push, albeit from a small number of people at the same company, to endorse pay-walled standards.

[plehegar]

We use a list of considerations when evaluating normative references for W3C Standards. While "Is the referenced document available on the Web at no cost and without limitation?" is one of the considerations, it's NOT a requirement.

For the case of registries, you'll often see criteria such as:

Each entry should include a link that references a public available specification (PAS) that defines the identified processor profile.

https://www.w3.org/TR/ttml-profile-registry/#Registration_Entry_Requirements_and_Update_Process

[hober]

What is the rationale for diverging from the Consortium-wide normative references policy (that PLH linked to) for this one document produced by this one group?

[hober]

What is the rationale for diverging from the Consortium-wide normative references policy (that PLH linked to) for this one document produced by this one group?

Put another way: if the rationale for divergence is "we disagree with the Consortium-wide normative references policy," then that's best taken up at the Advisory Committee, or the Process CG, or some other venue where Consortium-wide policy changes get deliberated on.

I'm looking for an argument of the form "for this specific registry/wg/whatever, there are these [explicitly identified] important additional considerations that don't apply to other WGs. in order to address them, diverging from the Consortium-wide policy in ways X, Y, and Z are necessary."

The burden of proof that such divergence is necessary lies with the people advocating divergence.

[plehegar]

There are several examples of W3C Recommendations linking normatively to ISO documents, eg 1, 2, 3, or using CIE 4.

The considerations for normative references was produced with W3C Recommendations in mind. W3C Registries, which is our case here, would not be subjected to the same level of scrutiny.

As a reminder, registry documents must not contain any requirements on implementations. As such, those are not covered under the W3C Royalty-Free licensing commitments. For example, the Encrypted Media Extensions Stream Format Registry.

[npdoty]

Part of the reasoning is that this is unlike normative references generally because registry inclusion requires privacy and security review of the registered protocols. We cannot meaningfully conduct privacy and security reviews of documents that are not publicly available, as we are not allowed to share the text of those documents to comment on them, even if everyone in the reviewing group paid to access them (which I also believe to be infeasible).

The Normative References guidance does indicate that there are multiple factors to consider, including availability and whether the standard was developed through a process following the OpenStand principles (including broad consensus, transparency, openness and availability). And in terms of evaluating the nature of the dependency, the registry is not just referring to a particular property or value of these protocols, instead, much of the functionality and the implications for user privacy, security and free expression are intended by this Working Group to be delegated to the protocols listed in the registry.

Given that extraordinary delegation, I think the existing Team guidance is consistent with the Working Group's decision to describe explicitly the necessary conditions, including security and privacy review and freely available specifications; indeed, I think the requirements should go further.

But also, I don't see anything in the Team guidance that prohibits Working Groups from evaluating references or registry inclusion criteria based on normative conclusions from the group. It would be an extraordinary policy to mandate certain normative references, or to prohibit Working Groups from using criteria to evaluate references or registry inclusions; that would be a controversial change to discuss with the Advisory Committee and I find it unlikely that such proposals could receive Consortium consensus.

It's also possible that the existing Team guidance is a little too vague in how to evaluate all these considerations when providing advice to Working Groups at transition time. I would be happy in parallel to also raise that issue for discussion with the Process CG.