| 11:06 | <annevk> | andreubotella: I guess I should wait a bit with landing your PR to see if Wolf has thoughts? |
| 11:06 | <andreubotella> | annevk: sure |
| 11:07 | <annevk> | (spotted the Oxford comma issue only after your comment about inlining the assert looking weird) |
| 11:10 | <andreubotella> | right |
| 11:10 | <andreubotella> | and I went ahead and fixed it in the other convert algorithm too |
| 11:11 | <andreubotella> | Personally, I don't like the Oxford comma (probably because it's not common in Spanish), but I'm all for consistency |
| 13:44 | <zcorpan> | annevk: Domenic: for the tpac breakout, I was thinking of using a google doc for taking notes, and not IRC |
| 13:44 | <annevk> | zcorpan: sure |
| 13:46 | <annevk> | andreubotella: it’s not part of Dutch and German either, though it is in mine sometimes |
| 13:46 | <zcorpan> | Though the IRC channel for the breakout is on irc.w3.org |
| 14:43 | <zcorpan> | Heads up: WHATWG TPAC breakout session starts in ~20 minutes. Agenda and notes in https://docs.google.com/document/d/1fGGOXKC_zM7cYfdZYS3Ns3W2JpjaRwCRhP-5c32BV2s/edit?usp=sharing |
| 14:53 | <EveryOS> | Hey, I was taking a look at the spec when I noticed this https://usercontent.irccloud-cdn.com/file/y0rf26SI/image.png |
| 14:54 | <EveryOS> | It prevents inserting iframes, but I can't help but think there are ways to clickjack somebody besides inserting iframes |
| 14:54 | <EveryOS> | For example, you could write a clicker game where the user repeatedly clicks |
| 14:54 | <EveryOS> | And then use `document.location` to redirect to another page, no iframe needed |
| 14:55 | <annevk> | And hope the navigation completes before the user clicks again and the user doesn't notice? |
| 14:55 | <EveryOS> | Yea |
| 14:56 | <annevk> | I guess in theory that might apply yes, and maybe in practice at some point too |
| 14:56 | <EveryOS> | Yea. It could probably be fixed by having the UA temporarily disabling use input on a page load, for like a second or two |
| 14:58 | <hsivonen> | Where do I get the meeting password for the WHATWG breakout? |
| 14:59 | <zcorpan> | hsivonen: are you joining by phone or with Zoom? |
| 14:59 | <hsivonen> | Zoom |
| 15:00 | <zcorpan> | hsivonen: the "Join Zoom" link in https://www.w3.org/2020/10/TPAC/breakout-schedule.html#whatwg worked for me |
| 15:09 | jgraham | worries that these introductions are going to take 10 minutes |
| 15:10 | <annevk> | yeah |
| 15:11 | <andreubotella> | I have no clue what I'm doing ^^ |
| 15:12 | <MikeSmith> | andreubotella, welcome to the club :p |
| 15:12 | annevk | also does stuff |
| 15:13 | <Domenic> | In general I think intros only work for <10 people meetings |
| 15:13 | <Domenic> | This meeting is impressively popular |
| 15:14 | <annevk> | Especially given like 4 people registered on whatwg/html |
| 15:14 | <annevk> | I guess that method doesn't work and we should be more proactive |
| 15:17 | <Domenic> | I suspect part of it is people who decided they're going to attend a session for every open time slot |
| 15:17 | <Domenic> | i.e. their starting point is not WHATWG space but instead https://www.w3.org/2020/10/TPAC/breakout-schedule.html |
| 15:18 | <annevk> | Yeah, our only competition adtech |
| 15:18 | <annevk> | is* |
| 15:39 | <annevk> | zcorpan: FWIW, I'm interested in the image fetching and decoding problem, but someone else needs to drive it |
| 15:54 | <annevk> | It's like the module map without being specified :/ |
| 15:54 | <annevk> | (re caches for style sheets / images / ...) |
| 16:03 | <annevk> | nice job zcorpan |
| 16:03 | <zcorpan> | thanks annevk |
| 16:04 | <hsivonen> | Filed https://bugzilla.mozilla.org/show_bug.cgi?id=1673407 . Thanks. |
| 16:06 | <hsivonen> | The general problem seems to be that we lack a "do you need to change the speculative loader?" check list item in reviews for new features (CSP in this case). |
| 16:16 | <annevk> | I think ideally we don't disable it btw, we just let it take into account the CSP that we found |
| 16:16 | <annevk> | ah, that's what you wrote down |
| 17:54 | <zcorpan> | hsivonen: thanks! Out of curiosity, how does speculative `manifest` work? I thought it only worked on the first <html> token, and speculative parsing can only start at </script>. So any manifest seen during speculative parsing ought to have no effect? |
| 17:55 | <hsivonen> | The `manifest` travels from the parser thread to the main thread in the speculative op queue so that it is registered before any speculative loads can happen. |
| 17:56 | <zcorpan> | hsivonen: ooh. so it's not itself from speculation, but gets into the same queue |
| 18:04 | <hsivonen> | Right. It's not speculative but always committed to, because a `document.write` before it is impossible. |
| 18:05 | <hsivonen> | With CSP, we'd probably want to make them just stick and not have a mechanism to undo them. |
| 18:06 | <hsivonen> | even if a `document.write` could intervene |
| 18:45 | <EveryOS> | Sorry to nitpick, but the lack of a comma here confused me for a second https://usercontent.irccloud-cdn.com/file/fD1Sscqc/image.png |
| 18:47 | <MikeSmith> | EveryOS: yeah it rightly should have a comma |
| 18:47 | <MikeSmith> | can you raise a PR with fix? |
| 18:49 | <EveryOS> | Sure, just a second |
| 18:51 | <EveryOS> | I haven't PRd before, so I gotta read the prereqs. Tbh, I'd rather not add my name to the Acknowledgments section |
| 18:54 | <annevk> | You don’t have to, but the agreement does require a name |
| 18:54 | <annevk> | If you file an issue I’m happy to fix it though |
| 18:55 | <EveryOS> | I'll just file an issue |
| 19:09 | <EveryOS> | Submitted an issue |
| 19:09 | <EveryOS> | https://github.com/whatwg/dom/issues/906 |
| 19:22 | <EveryOS> | It does feel kind of weird that I opened an issue for something so trivial as the insertion of a single character |
| 19:42 | <innovati> | How do you view historic versions of the HTML spec - for example I'm trying to see when the text about HTML custom element tag names showed up |
| 19:45 | <zcorpan> | hsivonen: it seems I have a mistake in my test for document.write-ing a <meta charset>. I forgot that the main meta charset scanner looks inside <script>s, and that picked up what I intended to be only seen by speculative parsing in document.write |
| 19:46 | <zcorpan> | /html/syntax/speculative-parsing/generated/document-write/meta-charset-script-src.tentative.sub.html |
| 19:49 | <zcorpan> | hsivonen: see https://github.com/web-platform-tests/wpt/pull/24521/commits/b6757f4fbe08f7362903558bb9d73bda83a42ced |
| 19:51 | <zcorpan> | hsivonen: so, now the meta charset (backslash-escaped, in document.write) has no effect on the speculative fetch's url encoding in firefox. Is that what we want? |
| 19:53 | <zcorpan> | innovati: the history is in git. git log --grep can help |
| 19:54 | <Domenic> | innovati: https://html.spec.whatwg.org/commit-snapshots/ , but it might not be as helpful as you're hoping. |
| 19:54 | <innovati> | thanks both <3 |
| 19:54 | <Domenic> | innovati: it probably works best when combined with searching through commit messages |
| 19:54 | <zcorpan> | innovati: or searching for merged PRs in github. searching for "custom elements" I found https://github.com/whatwg/html/pull/1012 |
| 19:54 | <Domenic> | Ah, yeah, that's by far the best technique |
| 19:55 | <Domenic> | zcorpan: hsivonen: but note https://github.com/whatwg/html/issues/5913 |
| 19:55 | <innovati> | I'm used to CSS specs where previous versions are listed, but they're also not updated nearly daily so that would never work for HTML |
| 19:56 | <zcorpan> | Domenic: yeah |
