[hack1312]

Dan my concern is explicitly that did:web is not the same experience for users as a did:plc.

If I host AT Proto infra for my community and want to give people <usename>.<domain> accounts, I can either host a did:web for them which ties their account permanently to that domain, or they have to register with the centralized PLC to actually have all the benefits of a migratable DID. did:web does not provide the same UX as did:plc

From the post I was responding to:

> Second, even if you're on a PDS, you're still reliant on the Public Ledger of Credentials (PLC) to host your Distributed ID (DID) document. The PLC is run by Bluesky, although they've taken steps to make it easy to notice if they were to do something fucky with the PLC. But let's say we don't like that. There is a solution: you can host your DID document on a normal web server. Problem solved?

>

> Well, if you were setting up an account for the first time, then yes, the problem is actually solved, you're 100% independent of Bluesky. But if you made the mistake of registering an account normally, you have a did:plc identity. And one core principle of ATProto is that identity names never ever ever change. So if you go and make a did:web identity, it's like having a second account, there is no way to tie your old did:plc identity into it. In fact, I'm pretty sure you can't even redirect one did:web identity to another (say if you need to switch domain names)

[danabramov]

I did read your post :) Yes, you can't migrate between PLC and WEB methods. It's not possible. I get that it's frustrating if you learn about it after making an account. Is that the whole concern?

I was replying to this:

>not being able to self host a true alternative to did:plc has put a halt to that for now while I figure out what I want to do.

I'm saying I don't know what this means. You can fully self-host with `did:web`. Yes, it's unfortunate that you've already made an account by the time you've realized that. I think that's still different from "not being able to self host".

Unless I'm just parsing what you wrote incorrectly, which is quite possible!

[hack1312]

My understanding is that if I want to host AT Proto infra for my community and want to give people <usename>.<domain> account, I can either host a did:web for them which ties their account permanently to that domain, or they have to register with the centralized PLC to actually have all the benefits of a migratable DID, while tying themselves to a central authority. Ergo, did:web does not provide the same UX as did:plc and there’s currently no way (that I know of) to provide such UX to users without requiring them to register did:plc accounts

[danabramov]

>want to give people <usename>.<domain> account

To clarify, do you mean you want their domain handles to look like this, or do you want to make them all have `did:web` identities? These are two different questions. Domain handles would work either way (with `did:plc` or `did:web`).

Indeed, the choice between `did:plc` and `did:web` is precisely "would I rather host tie identity JSON document to an entry in a centralized open source publicly verifiable registry that is moving to be maintained as neutrally as possible, or would I rather choose to tie my identity JSON document to a domain". And that choice has to be done at the account creation because every DID, by design, is immutable.

What options are lacking in that choice? It feels like it has an option for a pragmatist and an option for a purist.

>Ergo, did:web does not provide the same UX as did:plc

I mean, that is the difference between them. `did:web` means "I don't want to depend on anyone except domain authorities; I'm fine with losing identity if I lose the domain". Choosing `did:plc` means "I'm okay with depending on a central registry and find the threat model around it acceptable; I never worry about losing a domain". Both options are available.