2023-05-02 [11:46:22.0077] > <@annevk:matrix.org> And it's not like we really govern `file:` fetching to begin with, it's pretty explicitly undefined Thanks. It sounds like that issue was invalid from the start. I'll review Fetch and see about petitioning implementations to support it. 2023-05-03 [05:18:15.0786] Domenic: on reflection, it should probably be `Document.parseHTML()`. If we ever wanted to tackle non-HTML cases we could do a whole swath of XML-named variants. [05:47:31.0558] Dominic Farolino: did you forget to push in https://github.com/w3c/csswg-drafts/pull/8759? If not, my first comment still applies I think. Please clarify if you think it doesn't. [05:48:28.0474] Oh hmmm... yeah it looks like I did. Sorry, let me fix that in a bit. [05:49:49.0585] I'm pretty sure I made the commit somewhere... maybe on a different computer & never pushed it heh 2023-05-04 [01:57:26.0408] Domenic: not sure I'm totally onboard yet, but it might be interesting to figure out how often `stopImmediatePropagation()` is used and whether we could make it controlled by yet another boolean controlled by the dispatcher [09:32:35.0028] bkardell: oops, did I leave too early [09:32:38.0358] I'll try to review the pr [09:32:51.0821] ping me if I don't [09:32:59.0479] (I was traveling last week) [09:44:45.0679] > <@smaug:mozilla.org> bkardell: oops, did I leave too early nope, I just said what it was really and please have a look [09:55:02.0283] annevk: sorry about that - i think I fixed the things you mentioned last week. I expect that line wrapping bit is gonna be a general thing to fix in the other :dir PR too [09:55:58.0870] (in the silly 9088 one https://github.com/whatwg/html/pull/9088) [10:14:21.0209] bkardell: it would be great if any nits are fixed ahead of general review as the nits tend to make reviews very noisy [10:53:22.0571] Andreu Botella: thanks again for https://github.com/whatwg/url/pull/735#issuecomment-1441503315! I will try to find some time to write tests soon [10:53:34.0340] sure! [11:00:36.0593] > <@annevk:matrix.org> bkardell: it would be great if any nits are fixed ahead of general review as the nits tend to make reviews very noisy You mean on the dir one? [13:08:55.0053] > <@bkardell:igalia.com> You mean on the dir one? hopefully done with my last commit! Unless I've misunderstood, which is totally possible 2023-05-05 [18:11:57.0769] Anyone been seeing some weird ref box formatting like this? [20:30:27.0326] > <@domfarolino:matrix.org> Anyone been seeing some weird ref box formatting like this? Probably related to https://github.com/whatwg/meta/issues/271 [23:29:22.0694] annevk: I guess https://github.com/w3ctag/design-reviews/issues/392#issuecomment-510855073 has been addressed? [23:34:12.0375] zcorpan: at least partially I think, but it's been a while and HTML's terminology around this changed. [23:34:59.0884] zcorpan: it used to do checks on the number of top-level bcs in a bcg, I think, but again, it's been a while. [23:43:18.0916] annevk: ok yeah, seems to be step 6 in https://wicg.github.io/scroll-to-text-fragment/#restricting-the-text-fragment [02:24:05.0889] This room is now also being logged to https://archive.matrix.org/r/whatwg:matrix.org The logs have timestamp links — but somewhat unfortunately, the links are matrix.to URLs rather than being URLs for the archive.matrix.org logs themselves. So that means that anybody wanting to view the messages needs to have a Matrix client installed in order to read them. That seems… suboptimal — so I’m hoping there will eventually be a way to share timestamp URLs to the archive.matrix.org logs themselves. (I’ve pinged the maintainers already to ask.) [05:20:34.0076] bkardell: so `data-x="valid custom element name">` does have break opportunities as well... [05:20:54.0798] bkardell: do you want to try one more time or should I take over? [05:21:38.0495] where is the break opportunities, the spaces in the attribute? [05:21:52.0514] * where is the break opportunities, the spaces in the attribute? annevk [05:22:03.0126] no I'd really like to understand, thanks for your patience [05:22:52.0942] bkardell: yeah exactly, essentially if you put it all on one conceptual line, any space is a break opportunity (for the purposes of the HTML Standard) [05:22:53.0051] * where are the break opportunities, the spaces in the attribute? annevk [05:23:02.0858] ok [05:23:56.0208] bkardell: it's documented at https://github.com/whatwg/html/blob/main/CONTRIBUTING.md#source-formatting [05:27:09.0031] ok I _hope_ i got it submitted correctly now [05:28:36.0443] * ok I _hope_ i got it submitted correctly now annevk [05:33:31.0862] bkardell: https://twitter.com/htmlstandard/status/1654464175890989056 \o/ [05:33:52.0908] woohoo thanks [05:34:29.0301] now that we landed the super easy editorial one the realy hard directionality one should be a piece of cake :-p [06:04:11.0488] https://github.com/matrix-org/matrix-public-archive/issues/137 [14:04:15.0386] sideshowbarker: Heya, the CSSWG drafts server now just employs an internal redirect to the github.io versions, so I've set up some redirects to ensure that anyone hitting those github URLs gets kicked over to the drafts server URL. Do you still need the timestamps.json file? At the moment I've just killed it, but I can restore it if needed. 2023-05-08 [00:11:37.0030] > <@tabatkins:matrix.org> sideshowbarker: Heya, the CSSWG drafts server now just employs an internal redirect to the github.io versions, so I've set up some redirects to ensure that anyone hitting those github URLs gets kicked over to the drafts server URL. Do you still need the timestamps.json file? At the moment I've just killed it, but I can restore it if needed. Thanks for the heads-up. Yes, please, if you can restore the `timestamps.json` file, I’d much appreciated it. Without the old Last-Revised header — and with the Last-Modified header not showing the actual publication date — there’s otherwise no good way to programatically from client code to determine the dates of the published specs. (That is, without resorting to parsing or scraping the HTML from a response, or running a git command to check when the last update was made to the corresponding git source). [00:12:23.0380] > <@tabatkins:matrix.org> sideshowbarker: Heya, the CSSWG drafts server now just employs an internal redirect to the github.io versions, so I've set up some redirects to ensure that anyone hitting those github URLs gets kicked over to the drafts server URL. Do you still need the timestamps.json file? At the moment I've just killed it, but I can restore it if needed. * Thanks for the heads-up. Yes, please, if you can restore the `timestamps.json` file, I’d much appreciated it. Without the old Last-Revised header — and with the Last-Modified header not showing the actual publication date — there’s otherwise no good way programatically, from client code, to determine the dates of the published specs. (That is, without resorting to parsing or scraping the HTML from a response, or running a git command to check when the last update was made to the corresponding git source). [00:13:05.0992] * Thanks for the heads-up. Yes, please, if you can restore the `timestamps.json` file, I’d much appreciate it. Without the old Last-Revised header — and with the Last-Modified header not showing the actual publication date — there’s otherwise no good way programatically, from client code, to determine the dates of the published specs. (That is, without resorting to parsing or scraping the HTML from a response, or running a git command to check when the last update was made to the corresponding git source). [02:22:17.0215] Andreu Botella: I don’t know you’re aware already, but the spec build for the unversioned CSS specs is currently broken. I think Tab has an idea how to fix it and may just need to make time to do that once he’s back online — but in the meantime maybe you have some insight on an elegant way to get it working again, given the current state of things. And the current state of things appears to be that drafts.csswg.org is now just proxying w3c.github.io/csswg-drafts — while requests to w3c.github.io/csswg-drafts are now redirecting to drafts.csswg.org — but only partially. (How that setup is actually working at all, I don’t really understand yet.) The related build changes are in https://github.com/w3c/csswg-drafts/commit/52077ef4b1b0459f2aef3179dcf47a6c3e185012 and https://github.com/w3c/csswg-drafts/commit/8523f13a005f7213c39200e24944f8549e9e5227, and what’s partial about the redirect behavior is this: - All _versioned_ CSS spec URLs (such as https://w3c.github.io/csswg-drafts/css-backgrounds-3/) are now being redirected to their corresponding drafts.csswg.org URLs (such as https://drafts.csswg.org/css-backgrounds-3/) - However, all _unversioned_ CSS spec URLs (such as https://w3c.github.io/csswg-drafts/css-backgrounds/) are _not_ being redirected but are instead now just 404s. And among other things, that means all the current 1000+ spec links in CSS articles in MDN are now 404s. At https://github.com/w3c/csswg-drafts/issues/8798#issuecomment-1536775277 Tab mentions it'd be a bunch of trouble to get the redirects for the unversioned spec URLs working. But since I think you originally wrote the build code, it seems possible you might have some idea of how to do it with less trouble. [02:23:10.0519] * Andreu Botella: I don’t know you’re aware already, but the spec build for the unversioned CSS specs is currently broken. I think Tab has an idea how to fix it and may just need to make time to do that once he’s back online — but in the meantime maybe you have some insight on an elegant way to get it working again, given the current state of things. And the current state of things appears to be that drafts.csswg.org is now just proxying w3c.github.io/csswg-drafts — while requests to w3c.github.io/csswg-drafts are now redirecting to drafts.csswg.org — but only partially. (How that setup is actually working at all, I don’t really understand yet.) The related build changes are in https://github.com/w3c/csswg-drafts/commit/52077ef4b1b0459f2aef3179dcf47a6c3e185012 and https://github.com/w3c/csswg-drafts/commit/8523f13a005f7213c39200e24944f8549e9e5227, and what’s partial about the redirect behavior is this: - All _versioned_ CSS spec URLs (such as https://w3c.github.io/csswg-drafts/css-backgrounds-3/) are now being redirected to their corresponding drafts.csswg.org URLs (such as https://drafts.csswg.org/css-backgrounds-3/) - However, all _unversioned_ CSS spec URLs (such as https://w3c.github.io/csswg-drafts/css-backgrounds/) are _not_ being redirected but are instead now just 404s. And among other things, that means all the current 1000+ spec links in CSS articles in MDN are now 404s. At https://github.com/w3c/csswg-drafts/issues/8798#issuecomment-1536775277 Tab mentions it'd be a bunch of trouble to get the redirects for the unversioned spec URLs working. But since I think you originally wrote the build code, it seems possible you might have some idea of how to do it with less trouble. [03:35:21.0002] > <@sideshowbarker:matrix.org> Andreu Botella: I don’t know you’re aware already, but the spec build for the unversioned CSS specs is currently broken. I think Tab has an idea how to fix it and may just need to make time to do that once he’s back online — but in the meantime maybe you have some insight on an elegant way to get it working again, given the current state of things. > > And the current state of things appears to be that drafts.csswg.org is now just proxying w3c.github.io/csswg-drafts — while requests to w3c.github.io/csswg-drafts are now redirecting to drafts.csswg.org — but only partially. (How that setup is actually working at all, I don’t really understand yet.) > > The related build changes are in https://github.com/w3c/csswg-drafts/commit/52077ef4b1b0459f2aef3179dcf47a6c3e185012 and https://github.com/w3c/csswg-drafts/commit/8523f13a005f7213c39200e24944f8549e9e5227, and what’s partial about the redirect behavior is this: > > - All _versioned_ CSS spec URLs (such as https://w3c.github.io/csswg-drafts/css-backgrounds-3/) are now being redirected to their corresponding drafts.csswg.org URLs (such as https://drafts.csswg.org/css-backgrounds-3/) > - However, all _unversioned_ CSS spec URLs (such as https://w3c.github.io/csswg-drafts/css-backgrounds/) are _not_ being redirected but are instead now just 404s. > And among other things, that means all the current 1000+ spec links in CSS articles in MDN are now 404s. > > At https://github.com/w3c/csswg-drafts/issues/8798#issuecomment-1536775277 Tab mentions it'd be a bunch of trouble to get the redirects for the unversioned spec URLs working. But since I think you originally wrote the build code, it seems possible you might have some idea of how to do it with less trouble. I wasn't aware, I haven't really been keeping track of what was going on with the spec builds. But let me take a look [04:12:12.0819] Is the event firing order on the same node spec’d anywhere? I saw a blog post saying that the language regarding event firing order (“… in their order of registration.”) was present in the UI Event level 3 draft around 2011 but removed in 2016. It was indeed not explained in the currency UI Event spec, but the section on “changes from DOM level 2” did mention the event listeners is now ordered. I am very confused by that blog post… Post: https://blog.gslin.org/archives/2023/05/08/11176/ Current UI Event draft: https://w3c.github.io/uievents/#event-flow [04:12:49.0731] * Is the event firing order on the same node spec’d anywhere? I saw a blog post saying that the language regarding event firing order (“… in their order of registration.”) was present in the UI Event level 3 draft around 2011 but removed in 2016.
It was indeed not explained in the currenct UI Event spec, but the section on “changes from DOM level 2” did mention the event listeners is now ordered.
I am very confused by that blog post… Post: https://blog.gslin.org/archives/2023/05/08/11176/
Current UI Event draft: https://w3c.github.io/uievents/#event-flow [04:15:51.0535] What do you mean "event firing order"? Do you have a code example? [04:28:30.0870] > <@domenicdenicola:matrix.org> What do you mean "event firing order"? Do you have a code example? el.addEventListener(e => console.log("a") el.addEventListener(e => console.log("b") el.addEventListener(e => console.log("c") el.dispatchEvent(new Event("test")) [04:29:42.0133] Should console always print a,b,c per spec? [04:31:51.0554] Yes. This is specified in https://dom.spec.whatwg.org. [04:33:15.0840] Domenic: could you point me the section? Sorry I couldn’t find it. [04:34:31.0373] https://dom.spec.whatwg.org/#dispatching-events [04:35:03.0176] > <@domenicdenicola:matrix.org> https://dom.spec.whatwg.org/#dispatching-events Wonderful, thank you! [11:26:54.0615] sideshowbarker: Both unversioned symlinks and the timestamps.json file are back in place, lmk if anything is still wonky on your end. [15:55:57.0067] what happens if an author does something like this: ``` function generateBid(foo, bar, baz, setBid) { Promise.resolve() .then(() => setBid("post hoc")); } ``` an exception? 2023-05-09 [20:17:28.0034] > <@tabatkins:matrix.org> sideshowbarker: Both unversioned symlinks and the timestamps.json file are back in place, lmk if anything is still wonky on your end. Hot diggity dog 🎉 I’ll take a look now [20:29:54.0626] > <@tabatkins:matrix.org> sideshowbarker: Both unversioned symlinks and the timestamps.json file are back in place, lmk if anything is still wonky on your end. All working for me so far except for one problem: fragment IDs get don’t get handled right across the redirect; e.g., https://w3c.github.io/csswg-drafts/css-cascade-5/#layering ends up redirecting to https://drafts.csswg.org/css-cascade-5/#layering##layering — that is, the fragment part unexpectedly becomes `#layering##layering`. I can look at the code myself this afternoon my time to try figure out why that’s happening, and patch it (if you don’t get to it first) [20:30:29.0174] Oh lol whoops, I tested that, weird [20:30:49.0052] Maybe I tested the versions before my new fragment code got built in [20:30:53.0016] Will fix tomorrow [20:35:06.0370] Hai [23:24:26.0204] https://open.spotify.com/album/4k5cbXoFmZ5fgL06VT5tXR?si=prmDfLo5SY2eItQzgnWuYg&utm_source=copy-link https://docs.google.com/document/d/1O8UWReNENzJvCdLqQz9FMgyBPYYap_F-Sp6goCE9gS8/edit?usp=drivesdk&disco=AAAAh-Naur8 [23:28:50.0341] https://open.spotify.com/album/4k5cbXoFmZ5fgL06VT5tXR?si=prmDfLo5SY2eItQzgnWuYg&utm_source=copy-link_sideshowbarker_: [23:29:07.0441] https://docs.google.com/document/d/1O8UWReNENzJvCdLqQz9FMgyBPYYap_F-Sp6goCE9gS8/edit?usp=drivesdk&disco=AAAAh-Naur8 [23:29:38.0928] * https://docs.google.com/document/d/1O8UWReNENzJvCdLqQz9FMgyBPYYap_F-Sp6goCE9gS8/edit?usp=drivesdk&disco=AAAAh-Naur8 2023-05-10 [05:18:24.0901] > <@tabatkins:matrix.org> Maybe I tested the versions before my new fragment code got built in So I spent some time trying to learn how the redirects are set up, and to find where the code for the redirects lives — but so I’ve not been able to find anything at all, really. Given what I understand about what’s possible in on GitHub Pages hosting, and given that when I make requests with curl, I just get a 200s, and the index files that come back from curl requests don’t seem to have any kind of client-side redirects in them, at this point it’s kind of baffling to me how the redirects are actually work, or how they _could_ actually even work. The only clue I have so for is the BUILTBYGITHUBCI text macro I see in the bikeshed calls in the workflow file — but grepping around for that, I don’t find anywhere that’s actually used for anything. So I’m pretty much stumped :( [05:18:38.0635] > <@tabatkins:matrix.org> Maybe I tested the versions before my new fragment code got built in * So I spent some time trying to learn how the redirects are set up, and to find where the code for the redirects lives — but so I’ve not been able to find anything at all, really. Given what I understand about what’s possible in GitHub Pages hosting, and given that when I make requests with curl, I just get a 200s, and the index files that come back from curl requests don’t seem to have any kind of client-side redirects in them, at this point it’s kind of baffling to me how the redirects are actually work, or how they _could_ actually even work. The only clue I have so for is the BUILTBYGITHUBCI text macro I see in the bikeshed calls in the workflow file — but grepping around for that, I don’t find anywhere that’s actually used for anything. So I’m pretty much stumped :( [05:19:36.0234] I actually made some progress while investigating that [05:19:44.0119] https://github.com/speced/bikeshed-boilerplate/blob/main/boilerplate/csswg/abstract.include <- this is where that macro is used [05:19:48.0460] * So I spent some time trying to learn how the redirects are set up, and to find where the code for the redirects lives — but so I’ve not been able to find anything at all, really. Given what I understand about what’s possible in GitHub Pages hosting, and given that when I make requests with curl, I just get a 200s, and the index files that come back from curl requests don’t seem to have any kind of client-side redirects in them, at this point it’s kind of baffling to me how the redirects are actually work, and however they’re set up, how they could actually even work. The only clue I have so for is the BUILTBYGITHUBCI text macro I see in the bikeshed calls in the workflow file — but grepping around for that, I don’t find anywhere that’s actually used for anything. So I’m pretty much stumped :( [05:20:04.0914] oh — I’ll look right now [05:20:49.0510] that script only redirects if the page isn't being served by drafts.csswg.org [05:21:05.0811] ah, the separate bikeshed-boilerplate repo — that’s the one place I had not thought to look at so far. Now it seems obvious that’s where I should have looked [05:22:33.0059] > <@abotella:igalia.com> https://github.com/speced/bikeshed-boilerplate/blob/main/boilerplate/csswg/abstract.include <- this is where that macro is used OK yeah so it seems the `draftUrl += "#"+location.hash` step isn’t needed at all, maybe? [05:23:14.0295] yeah, shouldn't be [05:23:22.0755] OK [05:24:11.0424] (but even if that step were needed, it should instead be `draftUrl += location.hash`, since `location.hash already includes the `#` [05:24:18.0280] * (but even if that step were needed, it should instead be `draftUrl += location.hash`, since `location.hash` already includes the `#\` [05:24:28.0240] * (but even if that step were needed, it should instead be `draftUrl += location.hash`, since `location.hash` already includes the `#` [05:24:51.0440] so I see now that‘s why we end up with the doubled `##` [05:25:03.0605] e.g., https://drafts.csswg.org/css-backgrounds/#the-background##the-background [05:26:00.0390] For unversioned specs, it seems like the mapping to a version is handled purely in the drafts server, and then the versioned spec is proxied from the github pages site [05:26:31.0933] but since the github pages site doesn't build the index or the unversioned copies, opening those on the gihtub page [05:26:42.0478] * but since the github pages site doesn't build the index or the unversioned copies, opening those on the github pages site doesn't redirect to the drafts site [05:34:05.0809] Andreu Botella: thanks, opened a PR at https://github.com/speced/bikeshed-boilerplate/pull/39 which just reverts the entire change that added the `draftUrl += "#"+location.hash` part 2023-05-11 [18:37:50.0939] Is `toString` intentionally omitted from the Location object's IDL? https://html.spec.whatwg.org/multipage/nav-history-apis.html [19:23:06.0941] Actually, since `toString` could alternatively be defined in the additional creation steps but is not, I ought to ask: can someone tell me where `location.toString` is defined? (Chrome and Firefox expose it as an "own" property. Unlike what's spec'd for `location.valueOf`, the value is distinct from the corresponding property on the Object prototype.) [19:55:53.0131] This was the central topic of [this 2017 patch](https://github.com/whatwg/html/pull/2294), but the resolution is confusing me. The change to the specification seems to rely on prototypal inheritance of `Object.prototype.toString`, but [the corresponding tests added to WPT](https://github.com/web-platform-tests/wpt/pull/4623) expect an "own" property. [22:26:57.0310] question: - "resolve a URL-like module specifier" takes a string https://html.spec.whatwg.org/multipage/webappapis.html#resolving-a-url-like-module-specifier - but it calls "URL parsing", which takes a scalar value string, i.e. one with no unpaired surrogates https://url.spec.whatwg.org/#concept-url-parser how does that... work? is it implicitly "convert"ing strings to scalar strings? https://infra.spec.whatwg.org/#javascript-string-convert assuming yes, in which case Chrome has a bug - `import('./\ud800.js')` doesn't actually end up triggering a network request for `%EF%BF%BD.js”`, which is what it would do if it did the specified conversion (FF and Safari do trigger that request) [22:31:32.0330] TabAtkins: https://github.com/speced/bikeshed-boilerplate/pull/39 is a patch for making that change to fix the fragment-preserving redirect behavior for the CSS specs [00:19:15.0928] snek: I'm gonna take over your WebSockets work, hope that's okay [00:22:40.0497] bakkot: it's not, you found a bug, but Fx/Safari behave as the spec should read (it should call convert before it calls the URL parser) [06:43:40.0641] smaug: did you follow the discussion in https://github.com/whatwg/dom/pull/1152? Are you still okay with the PR as-is? [06:43:57.0021] smaug: I'm okay with it still I think, but I'd like at least one more set of eyes [07:20:00.0297] > <@annevk:matrix.org> snek: I'm gonna take over your WebSockets work, hope that's okay go for it fam [07:24:31.0044] snek: shall I add you to the Acknowledgments section? [07:25:35.0834] oh you opened a whole separate pr [07:25:55.0316] yeah some form of attribution would be nice [07:28:50.0165] does your change make it so that the resulting .url will still be ws scheme? [07:29:11.0749] I'm not a huge fan but I'll take what I can get [07:34:03.0406] snek: it does, I don't think it's worth supporting two sets of URLs (even though we later do rewrite back to HTTP(S)); it's unfortunate we added ws/wss, but they are what callers of `.url` expect [08:22:10.0176] Is there a way to click on a reference of a dfn in a spec, and immediately get a link to *that* reference? (Instead of having to go to the dfn, have the gray dfn box pop up, and binary search through it to find which reference I was at a second ago) [08:45:57.0189] Dominic Farolino: inspect element, copy id [08:46:30.0451] Yikes! In at least the HTML Standard inspecting by element gives me a huge layout shift due to DevTools being popped [08:46:43.0336] or select the link and click the file a bug link [08:47:27.0661] Dominic Farolino: if you have devtools at the bottom there's no layout shift [08:47:30.0218] What do you mean by "select the link"? Click it? Highlight it? [08:47:34.0591] That's true [08:47:56.0062] Highlight it [08:48:29.0675] annevk: hmm, I had missed possible change to existing behavior [08:49:24.0950] but I think the new behavior is better, if original is aborted first (in that fetch test) [08:49:35.0473] so, I think the pr should be fine [09:06:34.0125] smaug: thanks, checking with cdumez as well and then I guess I'll merge it tomorrow or early next week [10:06:05.0730] Is there anyone from Mozilla around? I'd like to gain access to https://bugzilla.mozilla.org/show_bug.cgi?id=1790311 (which is referenced on https://www.mozilla.org/en-US/security/advisories/mfsa2022-47/#CVE-2022-45411). The bug could presumably be made public, at this stage. [10:07:18.0508] annevk: Am I correct in assuming that CVE-2022-45411 is what prompted you to add `X-HTTP-Method-Override` and the other two as "conditional" forbidden request-header names? [10:07:47.0954] * annevk: Am I correct in assuming that CVE-2022-45411 is what prompted you to add `X-HTTP-Method-Override` and the other two as "conditional" forbidden request-header names? https://github.com/whatwg/fetch/pull/1541 [10:08:39.0754] jub0bs: I'm not familiar with CVE numbers [10:09:00.0216] * jub0bs: I'm not familiar with specific CVE numbers [10:09:30.0971] Oh, you linked something above. Seems likely? [10:22:17.0713] > Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript (such as cookies protected by HTTPOnly). To mitigate this attack, browsers placed limits on fetch() and XMLHttpRequest; however some webservers have implemented non-standard headers such as X-Http-Method-Override that override the HTTP method, and made this attack possible again. Firefox has applied the same mitigations to the use of this and similar headers. [10:23:15.0985] annevk: It has to be related, but your PR (#1541) on the Fetch standard doesn't make explicit reference to this. [11:08:33.0387] jub0bs: it's not something we keep track of when doing web standard security fixes [12:08:24.0304] sideshowbarker: Merged, sorry for the delay. 2023-05-12 [23:45:18.0053] Domenic: thoughts on using "nullable" instead of "null or": https://github.com/whatwg/notifications/pull/194/files? [23:46:08.0048] Huh. I guess it's OK, but I've never done it and slightly prefer what I do... [23:46:49.0470] Yeah, I similarly have mixed feelings. I guess I'll push back a bit and ask for an Infra discussion first, though even in IDL we kinda regret the ?-convention so maybe we should just not. [00:02:26.0085] Adam Rice: did you see https://github.com/whatwg/websockets/pull/45? [00:40:13.0125] Adam Rice: well that was embarrassing, fortunately tests and code did not make that mistake [00:48:12.0596] Hi Simon. Sorry to bother you. Any chance you or someone else from Mozilla could make the following ticket public? https://bugzilla.mozilla.org/show_bug.cgi?id=1790311 [00:48:43.0707] It's related to CVE-2022-45411, which has since been mitigated. [00:49:36.0038] Oh wrong thread. Sorry. [00:49:59.0281] zcorpan: Perhaps? [00:59:40.0663] Domenic: did you see my ping for review on the timer bits of https://github.com/whatwg/html/pull/4613? It's a relatively small PR, mainly JS asking HTML to run stuff at particular points in time. [01:00:11.0720] No, sorry I did not. Will flag it and get to it soon. [01:10:49.0381] freddy: ^ [01:12:57.0429] Done. [01:15:19.0175] annevk: for https://github.com/whatwg/websockets/pull/45 maybe we need new tests with multiple globals to check which one is used for the base URL? [01:17:05.0628] Excellent. Thank you, freddy . [01:20:37.0399] I have some thoughts about this, though I don't want to go into too much details in public yet. [01:21:57.0874] Some servers are still vulnerable, even after Chromium's and Firefox's fixes. But the servers in question deviate from the HTTP standard, and protecting them is probably not the responsibility of browser vendors. [01:24:04.0008] Not sure if it's worth raising an issue about that, but let me know if you're interested. [01:26:18.0018] ̉I think we would like to know more. A private issue in the fetch repo might be a good coordination forum, similar to how we dealt with this one. WDYT, annevk? [01:26:33.0120] zcorpan: not a bad idea, want to make one? [01:32:18.0084] annevk: sure. I found https://github.com/web-platform-tests/wpt/blob/master/html/browsers/browsing-the-web/navigating-across-documents/multiple-globals/resources/context-helper.js which seems helpful [01:52:19.0672] zcorpan: that looks nice, nothing for current seemingly [01:53:19.0179] zcorpan: or maybe current is what you put in `scriptToRun`? [01:57:06.0539] annevk: I haven't understood it properly yet, but looks like current isn't covered [02:04:21.0108] or I guess current is the test file itself [02:14:39.0823] https://github.com/web-platform-tests/wpt/pull/39978 [02:27:45.0939] I'm not sure Anne has seen this. Matrix threads aren't ideal for visibility, it seems. [06:19:41.0663] Seems fine. Or start with an email to some folks. [06:19:54.0198] And yeah, Matrix is hmm... [09:35:50.0697] annevk: Ok, thanks. [09:35:57.0113] @fr should talk to you first. Depending on what you think, we can proceed [09:36:32.0914] * freddy: Perhaps I should talk to you first. Depending on what you think, we can proceed with a security advisory or do nothing. [09:36:55.0353] If that's ok with you, let me know how I can contact you. [09:53:06.0421] jarhar: belatedly noticed some minor follow-up required in https://github.com/whatwg/html/pull/9178 [09:53:19.0261] jarhar: see comment at the end [09:53:50.0502] woo @mention notifications are working [09:53:54.0422] thanks ill take a look [10:15:24.0059] jarhar: they work vice versa as well, so feel free to ping if you feel like something is taking too long (though fair warning: my weekend has kinda started) 2023-05-13 [09:08:41.0633] annevk: > Or start with an email to some folks. Did you have somebody specific in mind? [09:08:48.0507] * annevk: > Or start with an email to some folks. Did you have somebody specific in mind? 2023-05-15 [00:21:30.0535] Did https://hacks.mozilla.org/2021/12/webassembly-and-back-again-fine-grained-sandboxing-in-firefox-95/ end up regressing how Firefox deals with innerHTML in XML? C.f. https://bugs.webkit.org/show_bug.cgi?id=181642 [00:23:40.0003] sorry, it was already end of day for me when this thread continued. I am fbraun@mozilla.com [09:38:27.0030] Does clicking accept/commit suggestions on a PR against HTML just not work because of the size of it or something? I always get an error suggesting that there's been new commits and I need to refresh, but it's never the case [10:25:42.0183] bkardell: that is correct, they won't work [10:26:26.0572] They're still a very useful way to get the point across, so that's why they're still used. But yeah, it's not the best. [11:19:01.0532] > <@annevk:matrix.org> They're still a very useful way to get the point across, so that's why they're still used. But yeah, it's not the best. It's good to know for sure, thanks annevk ... frustrating that the error is so misleading [13:16:27.0323] annevk: Domenic : so for WebSocket, since it's a constructor rather than a method, you can't use `.call(relevantGlobal)` and therefore relevant settings object doesn't make sense. Workers use current settings object: https://html.spec.whatwg.org/#dom-worker [13:57:28.0641] now that we ~have growable arraybuffers, thoughts on making TextEncoder's `encodeInto` able to grow the backing buffer? (probably as an opt-in option) [13:58:07.0865] e.g. if you are getting a stream of strings from somewhere and concatenating them all into a single buffer 2023-05-16 [17:47:49.0542] bakkot: Seems somewhat reasonable, although I'd be especially happy if someone could do the analysis for all similar web platform methods. I think that would be: byobStreamReader.read(), textEncoder.encodeInto(), maybe crypto.getRandomValues()? [21:40:07.0669] zcorpan: well, I think if we rewrote that to use "constructor steps" we'd use the relevant settings object of this, but you're correct that it'll be 1:1 with the current settings object [23:57:36.0941] bakkot: how does that work, exactly? If you pass in too big a string `encodeInto()` would end up growing the buffer? Can that be overloaded or would that some new signature? [23:58:57.0352] bakkot: anyway, seems worthwhile to write it down in a bit more detail in an issue. Might take a while, but it's always good to have ideas recorded in a logical place [10:30:13.0600] Private fields don't work on derived classes? Am I missing something? [10:31:34.0863] Instance private fields work, static private fields only work if you access them using `ClassName.#priv` and not `this.#priv` (even from static methods) [10:33:22.0093] nicolo-ribaudo: oh, maybe you can't declare them in the constructor? And I confused enclosing class with parent class, hmm [10:33:33.0431] Ok, good if so [10:35:52.0650] You can only declare them outside of the constructor, using the fields syntax [10:36:24.0934] If you want the inner class to have the same private fields as the outer one, that's not possible (even if you re-use the same name, it's a different "private key") [10:48:31.0409] freddy: No problem! Thanks. I'll shoot you an email on Thursday. [10:55:50.0830] Thursday is a holiday in Germany. I'll likely take a look on Monday then ;D 2023-05-17 [00:24:49.0826] annevk: I need your advice on algorithm invocation style. https://github.com/whatwg/fullscreen/pull/223 uses the style "Request removal from the top layer for element from its node document" and https://github.com/whatwg/html/pull/9093 uses the style "Request an element to be removed from the top layer given document and element." The first form has the arguments in the wrong order, but the second form is very wordy. What should we converge on? [00:30:47.0281] foolip: I left a comment somewhere that I don't understand the need for both element and node document to be arguments [00:32:12.0171] foolip: assuming a legit need, you could do something like "Request removal from the top layer given _element_ and _element_'s node document" or _element_'s node document and _element [00:32:19.0643] annevk: I agree that's weird, and I haven't seen a case in review yet where the document is anything other than the element's node document. [00:32:26.0104] * foolip: assuming a legit need, you could do something like "Request removal from the top layer given _element_ and _element_'s node document" or _element_'s node document and _element_ [00:33:33.0446] annevk: but my question is more about writing the invocation in a style that flows more naturally, like Tab is doing. If the arguments were all right, which style would you want? [00:34:29.0580] The style I double quoted above (though perhaps with the argument order reversed, depending)? [00:37:19.0550] Oh, I'm a bad reader. [00:41:18.0721] So in other words, use the "request removal from the top layer" form, but still "given" before the arguments, not the even more English-like variant. I agree with that. [00:41:30.0680] Let me file an issue about the document arguments... [00:49:17.0554] Looking at https://github.com/validator/validator/issues/1592 — it seems that bitbucket.io sites don’t allow HTTP 1.0 client requests, but apparently instead require HTTP 1.1 or greater. Is this a thing these days? I mean, or other servers doing this? (I haven’t noticed many — as far as the HTML checker goes, I know all of them would fail with the checker.) Is there some good reason for a Web server admin to disable HTTP 1.0 support? [00:49:31.0975] * Looking at https://github.com/validator/validator/issues/1592 — it seems that bitbucket.io sites don’t allow HTTP 1.0 client requests, but apparently instead require HTTP 1.1 or greater. Is this a thing these days? I mean, are other servers doing this? (I haven’t noticed many — as far as the HTML checker goes, I know all of them would fail with the checker.) Is there some good reason for a Web server admin to disable HTTP 1.0 support? [00:54:45.0947] annevk: I've filed https://github.com/w3c/csswg-drafts/issues/8849 [03:39:43.0347] > <@sideshowbarker:matrix.org> Looking at https://github.com/validator/validator/issues/1592 — it seems that bitbucket.io sites don’t allow HTTP 1.0 client requests, but apparently instead require HTTP 1.1 or greater. > > Is this a thing these days? I mean, are other servers doing this? (I haven’t noticed many — as far as the HTML checker goes, I know all of them would fail with the checker.) > > Is there some good reason for a Web server admin to disable HTTP 1.0 support? typically wanting the `Host` header, and being able to server multiple sites from a single IP… though most HTTP/1.0 implementations support that too [04:55:25.0147] freddy: No problem :) [07:57:06.0769] > <@pvanderbeken:mozilla.org> jugglinmike: the second bullet point in https://webidl.spec.whatwg.org/#es-stringifier specifies that `toString` becomes an own property Thanks, @peterv! I never would have found that on my own 2023-05-18 [01:09:21.0965] In retrospect `[SameAs=href] USVString toString();` or some such might have been better [01:10:18.0767] WebKit has something like that so you can implement getters that return the same thing once and it's lovely [05:58:46.0595] https://twitter.com/robpalmer2/status/1658914059578744835 made me think of a similar request I had seen for `AbortSignal` but I can't find it. Something like `AbortSignal.withAborter() -> { signal, aborter }`. [10:02:16.0314] Is the advice in https://webidl.spec.whatwg.org/#idl-USVString that "Specifications should only use USVString for APIs that perform text processing .... When in doubt, use DOMString." still the state of the art? It feels like a recipe for subtle implementation bugs if an implementation round-trips a lone surrogate through UTF-8 instead of WTF-8. [10:03:02.0975] * Is the advice in https://webidl.spec.whatwg.org/#idl-USVString that "Specifications should only use USVString for APIs that perform text processing .... When in doubt, use DOMString." still the state of the art? In cases where we expect most of the input to be text instead of 16-bit numbers, it feels like a recipe for subtle implementation bugs if an implementation round-trips a lone surrogate through UTF-8 instead of WTF-8. 2023-05-19 [18:19:57.0980] > <@annevk:matrix.org> https://twitter.com/robpalmer2/status/1658914059578744835 made me think of a similar request I had seen for `AbortSignal` but I can't find it. Something like `AbortSignal.withAborter() -> { signal, aborter }`. I think AbortController is that object: it has { signal, abort } properties. Promise only wants that because it followed the revealing constructor pattern; AbortSignal is not constructible. [18:20:58.0002] > <@jyasskin:matrix.org> Is the advice in https://webidl.spec.whatwg.org/#idl-USVString that "Specifications should only use USVString for APIs that perform text processing .... When in doubt, use DOMString." still the state of the art? In cases where we expect most of the input to be text instead of 16-bit numbers, it feels like a recipe for subtle implementation bugs if an implementation round-trips a lone surrogate through UTF-8 instead of WTF-8. The advice is state of the art. I don't understand your last point. Strings are 16-bit number collections from the JavaScript engine onward, so you're more likely to get subtle implementation bugs if you ignore that. [21:19:47.0944] > <@domenicdenicola:matrix.org> The advice is state of the art. I don't understand your last point. Strings are 16-bit number collections from the JavaScript engine onward, so you're more likely to get subtle implementation bugs if you ignore that. I'm happy to live with it given that confirmation, but I'm thinking of the fact that while strings are 16-bit sequences in Javascript, Chrome's Mojo system (https://chromium.googlesource.com/chromium/src/+/master/mojo/public/tools/bindings/README.md#primitive-types) pretty implicitly translates them to UTF-8 on their way to the browser process. [21:24:03.0939] > <@jyasskin:matrix.org> I'm happy to live with it given that confirmation, but I'm thinking of the fact that while strings are 16-bit sequences in Javascript, Chrome's Mojo system (https://chromium.googlesource.com/chromium/src/+/master/mojo/public/tools/bindings/README.md#primitive-types) pretty implicitly translates them to UTF-8 on their way to the browser process. Oh wow, that's kind of scary... [21:24:19.0955] :-D [21:24:36.0255] https://w3ctag.github.io/design-principles/#idl-string-types is a bit related [21:24:56.0143] "or operations which can’t handle surrogates in input (such as APIs that pass strings through to native platform APIs), USVString should be used" [21:25:17.0975] But I don't think that everything-Mojo is the intent of the "native platform APIs" clause [21:25:41.0515] It's more meant, like, displaying in a Window title bar or something [21:26:24.0234] Yeah. And Gecko + WebKit might be more consistent about keeping things in UTF-16, so they would be affected in different circumstances. [21:26:59.0214] I did notice that URL uses USVString, when the guidance would seem to imply DOMString. [21:27:57.0054] URL uses USVString because percent encoding [21:28:43.0343] Note also CSS just kinda decided not to do interop because it was more convenient for Gecko to use USVStrings in Stylo. And nothing has blown up yet... [21:29:12.0121] (Search for "CSSOMString") [21:30:04.0554] 😱 [21:31:01.0380] But yeah, I wouldn't expect this to be web-visible in most cases unless someone finds a way to use it maliciously. [23:38:40.0568] annevk or Dominic Farolino or anyone: some help appreciated on https://github.com/whatwg/html/issues/9310 , I feel like I'm going crazy [00:34:08.0171] Domenic: I see the same thing in Gecko, but not WebKit [00:34:27.0366] Oh nooooo [00:34:43.0291] How is this possibly non-interoperable... [00:35:34.0728] Probably poorly tested. [00:35:38.0660] Like you do `let w = window.open(); w.document.innerHTML = ""` and this only loads in WebKit? Really!? [00:36:08.0332] OK well now that I know it's an interop problem, I'll approach it differently, with test cases and such... on Monday. [00:39:35.0301] Yeah that works (with `document.body.innerHTML`), though when the popup is blocked it might fail, but that's expected I think [00:39:58.0339] I wouldn't be terribly sad to see it go [06:45:30.0802] http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!DOCTYPE%20html%3E%0A...%3Cscript%20type%3D%22text%2Fjavascript%E3%80%80%22%3E%0Aw(1)%0A%3C%2Fscript%3E hmmmmm [09:59:20.0432] Hi all There's no `reconnectedCallback` exist, but I think it could be used for this condition: When the element is disconnected from the DOM and then reconnected again It'd be useful for handling cases where an element is dynamically removed and inserted back into the DOM, for instance, when navigating between different views or performing dynamic updates. So, I dicided share it with you all, I think it would be useful in some areas, including virtualization techniques [10:00:37.0156] * Hi all There's no `reconnectedCallback` exist, but I think it could be used for this condition: When the element is disconnected from the DOM and then reconnected again It would be be useful for handling cases where an element is dynamically removed and inserted back into the DOM, for instance, when navigating between different views or performing dynamic updates. So, I decided share it with you all, I think it would be useful in some areas, including virtualization techniques [10:02:37.0722] * Hi all There's no `reconnectedCallback` exist, but I think it could be used for this condition: When the element is disconnected from the DOM and then reconnected again It would be useful for handling cases where an element is dynamically removed and inserted back into the DOM, for instance, when navigating between different views or performing dynamic updates. So, I decided share it with you all, I think it would be useful in some areas, including virtualization techniques [10:41:07.0223] Anyone out there in the WHATWG world have experience working with the backend of HTML and CSS? [10:49:40.0844] HTML has an example showing that you must not resolve a promise in parallel. Does that also imply you cannot resolve a Promise from _another_ Window event loop other than the one it was created in? [10:53:13.0059] if the windows don't share an event loop, no [10:53:39.0377] you'd have to queue a task in the promise's event loop [10:54:10.0294] * you'd have to queue a task in the promise's window's event loop [10:55:51.0336] I'd like to understand in greater detail the process whereby HTML and CSS are implemented between the machine code and the kernel (preferably Linux). Can anyone point me towards the binaries for the HTML Standard? If there's a way for me to return them in a Linux terminal or a Code Editor, I'm all ears. Thanky kindly... [11:04:44.0661] > <@domfarolino:matrix.org> HTML has an example showing that you must not resolve a promise in parallel. Does that also imply you cannot resolve a Promise from _another_ Window event loop other than the one it was created in? The prohibition against resolving a promise in parallel means that you shouldn't call both the `resolve` and `reject` functions of a Promise at the same time or in rapid succession. That's it [11:06:34.0362] In JS you don't have access to a promise's `resolve` and `reject` from a different thread, whereas in the spec text, or when implementing browser code, you do. That's what "parallel" means in the standards. [11:07:26.0996] And JS is single-threaded, and so is the implementation of JS in every engine; if you try to resolve a promise off-thread, you're likely to run into concurrency issues [11:08:04.0062] * And JS is single-threaded, and so is the implementation of JS in every engine; if you try to resolve a promise off-thread in browser code, you're likely to run into concurrency issues [11:09:53.0778] Ehsan Azari: that's very much not correct. "In parallel" is a spec-language term of art, which algorithms can invoke to mean "do this, potentially in another thread; we promise not to do user-observable things here so timing isn't made visible". [11:10:19.0154] Dominic Farolino: You can, you just have to do it via posting a task to the Promise's own event loop, same as you have to do when you're inside a parallel section. [11:20:26.0078] > <@burtboy144:matrix.org> I'd like to understand in greater detail the process whereby HTML and CSS are implemented between the machine code and the kernel (preferably Linux). Can anyone point me towards the binaries for the HTML Standard? If there's a way for me to return them in a Linux terminal or a Code Editor, I'm all ears. Thanky kindly... Okay, so the HTML, CSS, etc. standards are human-readable (or, well, engineer-readable; there's a difference 😅) descriptions of the behavior that has to happen. They're not compiled to binary (except for small machine-readable things like WebIDL). [11:20:55.0569] There are programs called web browsers (like Google Chrome, Firefox, Safari...) that take those text descriptions and turn them into code that then gets compiled [11:22:58.0954] Chrome and Firefox are open source, so you can browse the code – although be warned that it's a _lot_ of code. Safari isn't open source, but the part of it that actually does most of the HTML and CSS work (the browser engine) is, it's called Webkit [11:23:31.0889] * There are programs called web browsers (like Google Chrome, Firefox, Safari...) that are made up of code that implements those descriptions [11:24:25.0815] > <@burtboy144:matrix.org> I'd like to understand in greater detail the process whereby HTML and CSS are implemented between the machine code and the kernel (preferably Linux). Can anyone point me towards the binaries for the HTML Standard? If there's a way for me to return them in a Linux terminal or a Code Editor, I'm all ears. Thanky kindly... * Okay, so the HTML, CSS, etc. standards are human-readable (or, well, engineer-readable; there's a difference 😅) descriptions of the behavior that has to happen. They're not compiled to binary (except for small machine-readable parts like WebIDL). [11:28:36.0857] What I'd like to know is how each individual tag is defined for machine processing. I don't want the human (or engineer) readable standard common to most coders, I want to see the binaries processed by the machine for the implementation of each and every tag of the current (or minimally any) HTML Standard. In other words, I'd like to know how to reverse engineer the HTML language... [11:31:58.0932] HTML doesn't get compiled into machine code, if that's what you're thinking [11:32:46.0465] So how was it written? [11:33:35.0025] A browser is written in a compiled language (C++ usually), and it parses HTML, builds an in-memory representation of the structure of a document (which you can then change using javascript), and then uses CSS to apply rules to eventually render it [11:33:36.0603] Sir, I know for a fact that you are lying to me... [11:34:29.0450] The HTML absolutely must call some binary relative to the display of whatever display elements it defines... [11:34:41.0226] It's an absolutely true proposition... [11:35:03.0076] I couldn't compile a Post Table without them... [12:08:34.0340] > <@burtboy144:matrix.org> What I'd like to know is how each individual tag is defined for machine processing. I don't want the human (or engineer) readable standard common to most coders, I want to see the binaries processed by the machine for the implementation of each and every tag of the current (or minimally any) HTML Standard. In other words, I'd like to know how to reverse engineer the HTML language... Do you want this? [It's about languages and grammars Some are w](https://webidl.spec.whatwg.org/) [12:10:23.0272] Or you're talking about BNF or things like that? https://en.wikipedia.org/wiki/Backus%E2%80%93Naur_form [12:19:07.0773] Both suggestions have relevance to the context, and thanks for references by the way!! I'll give them a once over here and put them in a bookmark file for now... [12:22:14.0126] I will say though, that however tedious it sounds, I would like to know exactly what languages and environments were used to author the HTML language itself, so that if I wanted to reverse engineer the thing, I could do so by buying whatever support I needed and plugging in every last piece of syntax by hand... [12:23:10.0750] The Web IDL Standard looks like something worthwhile for me to become (at least cursorily) familiar. Thanks for that... [12:29:48.0917] The Backus-Naur thing looks like a generic grammar for defining the implications of human-readable punctuation and meta-language. More of a sound byte from a lazy afternoon than a specification requiring precision. IOW - I could fake it myself... [12:44:04.0512] If you're interested specifically in how browsers parse CSS, check (for Chrome) or (for Firefox). [12:44:18.0597] HTML parsers are elsewhere in the codebases, I just happened to already have those tabs open. [12:45:07.0617] Beyond simple parsing, the *behavior* of each HTML element or CSS property/etc is a *much* larger chunk of the code. [12:46:11.0434] But the specs (generally) describe the same behavior, just in a more readable form. Looking at the code can be interesting if you're wanting to write your own, but it's a huge complicated beast. [13:18:01.0156] I believe you when you tell me that understanding the behavior of parsers is important to how HTML is processed and served. And indeed, knowing how any of our more popular front-end browser engines handle languages like HTML when it is served to computer terminals around the world would be important to creating language standards that interoperate without crashing local machines or blocking regularly. What I am looking for however (which I think you understand to some extent) is not an abstraction. I'd like real word steps. Who can I go to? What can I read about? Which editors or languages should I learn? If I want to author a formal computer language comparable to HTML, how do I begin? For example, is there some company or industrial center (WHATWG or otherwise) where a student can book a tour to learn about this sort of thing? Is there a special editor that shows people the native process whereby an HTML tag can be written, even if it is only within the context of a single, local machine? If I were to attempt to author a language using the assembly specifications for a single type of computer and it's processor, what would it take to gain access to a machine in such a raw state of unprogrammed receptivity? If I built a custom machine, how deeply would I have to strip its operating system to watch myself invent the tags that served typographical elements in more well-manicured contexts? [13:21:44.0874] Once again, I'd like to author either an HTML-like language that solves the bidirectional problem, or invent a plug-in module that evolves the versioning process until raw bidirectional functions are standardized and Left-To-Right (LTR) service of hypertext is no longer the rule. It will certainly take several decades, but if I don't start now, that period only grows longer by the minute... [13:22:47.0256] * Once again, I'd like to author either an HTML-like language that solves the bidirectional problem, or invent a plug-in module that evolves the HTML versioning process until raw bidirectional functions are standardized and Left-To-Right (LTR) service of hypertext is no longer the rule. It will certainly take several decades, but if I don't start now, that period only grows longer by the minute... [13:50:34.0655] You are asking questions at the wrong level of abstraction, as others have said. It sounds like you think HTML is somehow implemented "directly" in code, and browsers just use that? That's not the case. Browsers load a page, they parse the page's text as HTML, they build a DOM from the parsing results, they display the DOM on the screen according to CSS's rules and react to user input; the entire thing is a complex multi-stage process. The actual "HTML" part is either a very small portion of this (if you're talking about HTML as a language, it's just the parser), or it's woven thruout the entire browser in complex ways (if you're talking about all the behaviors and interactions of how a webpage is displayed). [13:51:40.0700] But specifically about bidi, HTML already supports rtl and mixed (bidi) text just fine. In some aspects it *defaults* to laying out in a LTR manner, since the web was first created with english/european text and many things depended on that, but generally speaking rtl text and layouts work just fine. [13:56:52.0286] If you want to know how create a language that looks like HTML, read the HTML parsing spec (). If you want to know how to create *a web browser*, with all that entails, you'll need to read a whole lot more. If you just want to suggest a new feature, search for details about that feature or related things to see if it has already been discussed, and maybe even already solved. If you think there is a missing ability that hasn't already been talked about, read for how new features are proposed. [13:58:34.0282] If you want to get a feel for what how browsers are put together and what making a browser is like, I suggest https://browser.engineering/ 2023-05-20 [01:56:39.0118] Ms2ger: thanks for writing many `