Hello annevk I've been working on Deno MIME sniffing tests, but noticed that if we pass all mimesniff tests, FileAPI tests begin to fail. Could you take a look at: https://github.com/web-platform-tests/wpt/issues/36377

It seems Blob (FileAPI) and mimesniff spec/tests conflict with each other.

If somebody familiar with cache partitioning in current engines could weigh in on https://github.com/mdn/content/issues/21469 that would be much appreciated.

It would be nice to have some sources to cite that clearly show:

1. Major browser engines have all implemented cache partitioning.
2. Cache partitioning prevents Etag-based tracking.

annevk: MDN has https://developer.mozilla.org/en-US/docs/Web/Privacy/State_Partitioning#network_partitioning already too — but that document is Firefox-specific

However, it seems like that doesn’t need to be Firefox-specific and could be re-worked to also cover what’s implemented in other UAs too.

But making that so still depends on having info on exactly what’s implemented in the various engines (and ideally also on having more-specific info about how it affects Etag-based tracking in particular)

Well I guess for now I should just delete that “Etags are therefore similar to fingerprints, and might also be used for tracking purposes by some servers” sentence from the docs

Would be nicer to have something suitable to update/replace with it, but not really essential I guess

Right, my personal strat in full is:

1. If writing by hand, use unquoted attrs when I can do so safely. Otherwise, use quoted (and escape the quote char.). Always escape <; escape & if it's not surrounded by whitespace.
2. If writing HTML content with user-submitted content, always escape < and & in text, and always quote attributes and escape the quote character and & in attr values.
3. If in a live webpage, always use the DOM APIs to insert user-submitted text, so no escaping is needed whatsoever. Exposing user content to the parser is a landmine.