This article is a great explainer of the basics underlying anonymous credentials. I look forward to the promised follow-up explaining real-world examples.
The key issue however is trust. The underlying protocols may support zero-knowledge proofs. But as a user I'm unlikely to be able to inspect those underlying protocols. I need to be able to see exactly what information I'm allowing the Issuer to see. Otherwise a "correct" anonymous scheme is indistinguishable from a "bad" scheme whereby the Issue sees both my full ID and details of the Resource I wish to access. Assuming a small set of centralized Issuers, they are in a position of great power if they can see exactly who is trying to access exactly what at all times. That's the question of trust - trust in the Issuer and in the implementation, not the underlying math.
It's great that you slip into this mode automatically.
For me, the reframing of "goal" to "quest" helps enormously with this change of mode. A "goal" is something I hope/want to achieve in future - but today I'm busy with day-to-day chores etc. A "quest" however is something you are on. So if I'm on a quest to do X, of course I need to do something toward it every day.
This Joel On Software article [0] is a good starting point. Incredibly it's now over 20 years old so that makes me feel ancient! But still relevant today.
The suggestion that the web should just use utf-8 everywhere is largely true today. But we still have to interact with other software that may not use utf-8 for various legacy reasons - the CSV file example in the original article is a good example. Joel's article also mentions the solution discussed in the original article, i.e. use heuristics to deduce the encoding.
Yes, this has happened. See this example from OpenJSF:
"The OpenJS Foundation Cross Project Council received a suspicious series of emails with similar messages, bearing different names and overlapping GitHub-associated emails. These emails implored OpenJS to take action to update one of its popular JavaScript projects to “address any critical vulnerabilities,” yet cited no specifics" [0,1].
Not for trains - there's a shared expectation that pedestrians should not access the track.
Similarly, not for a freeway.
Where some feel the balance is wrong, is at local-level streets. Today the assumption in most places is that cars have total right of way, and pedestrians must keep clear. It doesn't have to be that way. In a residential area, it's quite feasible to say all road users have equal right to use the space. And in that circumstance, put the onus on the car user (wielding a heavy, dangerous weapon) to not hit other road users.
The key issue however is trust. The underlying protocols may support zero-knowledge proofs. But as a user I'm unlikely to be able to inspect those underlying protocols. I need to be able to see exactly what information I'm allowing the Issuer to see. Otherwise a "correct" anonymous scheme is indistinguishable from a "bad" scheme whereby the Issue sees both my full ID and details of the Resource I wish to access. Assuming a small set of centralized Issuers, they are in a position of great power if they can see exactly who is trying to access exactly what at all times. That's the question of trust - trust in the Issuer and in the implementation, not the underlying math.