2021-01-01 [16:36:50.0000] 🎊 [18:08:01.0000] here's to having a better time in 2020 [18:08:09.0000] er [18:08:10.0000] in 2021 [18:08:14.0000] than in 2020 [18:08:24.0000] and also a better Date! [00:16:07.0000] 🥳 [00:16:09.0000] Happy New Year from the future, everyone! [00:17:50.0000] I think it's basically everywhere now :D 2021-01-05 [07:22:59.0000] who would be a good person to look at some changes related to super? [07:44:57.0000] ah, i just made the pr. now you all have to look at it 2021-01-08 [21:00:00.0000] hey all... I accidentally just pushed something really stupid to tc39/ecma262 master [21:00:26.0000] as I'm an admin I temporarily removed branch protection so I could force push and remove the offending commits [21:00:47.0000] I've re-enabled branch protection but may have not enabled all of the correct protections so someone may want to take a look at it [21:00:55.0000] I'm emailing the chair group as well to make sure folks are aware of thins [21:00:58.0000] extremely sorry :S [21:07:36.0000] MylesBorins: you only needed to uncheck "include administrators", for future reference, you don't have to delete all the settings [21:07:56.0000] GitHub was 404'ing when I tried to edit the rule [21:07:59.0000] ouch [21:08:06.0000] yeah... and I didn't want to leave those commits there [21:10:30.0000] huh, yeah, it worked the first time I clicked "edit" on the rule but now it's 500'ing [21:10:31.0000] fun! [21:10:49.0000] i'll get them set back up [21:11:27.0000] lol ok well i think i set them up right, but the "edit" page is 500ing so i can't verify [21:11:45.0000] perhaps someone who works at github could look into that :-p [21:12:18.0000] anyway the branch itself looks to be in a reasonable state, which is the most important part [21:12:31.0000] right, it's the same sha i expect from 3 hours ago [21:12:46.0000] yeah I knew the exact two commits I pushed so it was p easy to rollback [21:12:54.0000] I also have a "git mcfly" alias for just such an occasion [21:13:10.0000] https://github.com/MylesBorins/dot-files/blob/main/.gitconfig#L30 [21:13:13.0000] tempted to just repeatedly load the 500'ing page in the hopes of causing enough log messages that someone looks at it [21:14:14.0000] i wonder how many 500s it takes to trigger pagerduty [21:17:25.0000] MylesBorins your dotfile lacks an alias for "git push origin $CURRENT_BRANCH_NAME" [21:17:25.0000] https://github.com/tc39/ecma262/issues/2269 [21:17:39.0000] can I recommend `po = "!f() { git push -u origin $(git rev-parse --abbrev-ref HEAD); }; f"` [21:18:21.0000] oh I was on the right branch name [21:18:22.0000] I pushed the wrong remote [21:18:23.0000] should have removed the upstream remote the second I was up to tomfoolery [21:18:24.0000] that's on me [21:19:07.0000] ok gonna go chill out, thanks for being understanding about it :D [21:19:37.0000] all is well [21:19:40.0000] except github, github is broken 2021-01-12 [09:54:23.0000] rbuckton: are you planning to ask for stage 3 for /d for matchindices at the next meeting? 2021-01-13 [11:09:43.0000] The TC39 agenda looks pretty short. Should we start collecting topics for breakout groups? [11:15:14.0000] probably worth waiting til the deadline hits, people often add things last minute (i have one to add too) [11:17:56.0000] yeah same [11:31:29.0000] i wonder if there's ever been an empty agenda [12:05:53.0000] could always fill the time by arguing about NaN, PTC, or ASI /me ducks into TDZ [12:06:31.0000] i'd be down to argue about tail calls [12:08:06.0000] that's just because you weren't there the last time we did, so for you it wouldn't be recursion :-p 2021-01-15 [07:36:17.0000] rbuckton: as a reminder, a requirement for stage 4 eligibility is an editor-approved PR to the main spec [07:44:09.0000] ah, I’d forgotten 1713 :-) it will need the updates tho [09:38:10.0000] @Bakkot Will you be able to run the Google Speech for the forthcoming meeting, like last time? [09:42:04.0000] yup [09:55:01.0000] ty 2021-01-16 [17:17:14.0000] but will someone else be willing to give elocution lessons so that the speech transcription is more accurate? [17:17:28.0000] michael saboff is the reigning champ from last meeting iirc [17:27:41.0000] I am teaching it about all of our idiosyncrasies: https://github.com/bakkot/transcribe-to-gdocs/blob/e3bf9ac8682bbe2e5f823a171c91c961663b7b5f/replacements.js#L5-L26 [17:28:47.0000] since last meeting I've added the ability to hot-reload this list without interrupting transcription, so hopefully I'll be able to make common corrections in real time [21:10:20.0000] Bakkot: is this open source at all? it’d be broadly useful i think [21:24:09.0000] the source is on github: https://github.com/bakkot/transcribe-to-gdocs but since I didn't put a LICENSE file in it the OSI probably would say I shouldn't call it open source [21:41:10.0000] easy to rectify [04:48:13.0000] is there an audio equivalent of an avatar? if we could all use a realtime audio conversion service to make us sound like michael saboff, then kevin's bot will transcribe our words perfectly [07:40:50.0000] robpalme: https://www.entertainmentearth.com/product/ben-10-alien-voice-changer/ba27290 [07:42:03.0000] Sold out 🙁 2021-01-18 [18:23:26.0000] heads up that the spec URLs on ecma's website are all broken: https://github.com/tc39/Reflector/issues/349 [02:06:33.0000] yeah, Ecma does a lot of these moves without introducing redirects... we might need to email Patrick C and Istvan if they're not responsive on GitHub [08:16:12.0000] k, emailed them 2021-01-25 [09:44:08.0000] is anyone in the meeting yet? [09:55:23.0000] michaelficarra: to change your name, you have to leave and rejoin i believe. [09:59:38.0000] do we need to fill in the table on the docs? [09:59:46.0000] since we already have an attendance form? [10:02:00.0000] ryzokuken the table in the docs is useful for the note-takers, I think [10:02:14.0000] oh right [10:02:16.0000] thanks [10:02:47.0000] akirose: force quit and reopened the ipad app, and i briefly saw the BA again, then the slides popped in, so i'm good [10:03:09.0000] everyone does indeed look like themself, ha [10:08:12.0000] Teams doesn't seem to be working for me; is anyone else stuck on something like "You're not on Teams yet, but you can set it up for your organization"? [10:08:26.0000] gibson042: you have to sign in as a guest [10:09:09.0000] I don't even see a way to do that [10:09:16.0000] anyway, joining via browser seems to work [10:09:45.0000] transcription bot: `s/Baht/bot` [10:10:21.0000] gibson042: it's possible if you're logged into your microsoft passport account it skips that screen [10:14:00.0000] editors ready after this? [10:14:51.0000] hmm, now Teams is showing a "Sign in" screen but there is no guest option [10:15:06.0000] what the heck [10:15:26.0000] whatever, the web app is working so I'll stick with that [10:16:02.0000] It might work if you join as a guest using the web client [10:16:13.0000] yep [10:24:26.0000] I have had some informal comms with CalConnect folks, they are actively working on it, just as an FYI. [10:24:29.0000] sffc: wrt ECMA-402 updates, we should communicate we're doing the cut of ECMA-402 for the 2021 candidate. I believe the only next additions before the cut would be DTF formatRange and perhaps the current listed PRs if they get consensus in this meeting. [10:24:40.0000] gibson042: ^^ [10:27:51.0000] leobalter gibson042: I added a slide. Do you want to discuss it? [10:28:25.0000] (also, this is #tc39-delegates; we have #tc39-ecma402 for i18n discussions) [10:29:42.0000] moving the discussion there [10:30:46.0000] also for anyone considering taking notes, you should know that it usually does a better job than it was doing iwth Istvan [10:31:03.0000] e.g. it got dan almost perfectly [10:42:42.0000] "SDO" is also the acronym for standards orgs [10:43:16.0000] standards develop(ing|ment) organization [10:45:25.0000] I am so happy about this channge [10:46:02.0000] super great [10:47:26.0000] omg I'm so excited about this [10:47:32.0000] this is awesome [10:53:22.0000] Editor group has done amazing stuff [10:53:50.0000] That [10:55:06.0000] That's great news Bakkot [10:56:32.0000] btw a lot of these changes will apply to ECMA-402 as well, since they use ecmarkup [10:58:56.0000] littledan ystartsev we are, too! [11:00:07.0000] as editors, we spend a decent amount of time navigating the spec and we were constantly feeling the pains addressed by the SDO re-org [11:04:02.0000] I just noticed the reflector issue link in the room title is old. Current meeting is issue 340. [11:07:19.0000] rpamely: thanks, fixed [11:17:59.0000] 👏 [11:20:31.0000] the department of meta [11:34:06.0000] ok so `(console.log(0), null)[console.log(1)] = console.log(2);` logs 0,1,2 in my browser - what order does the current spec dictate? (Bakkot, ystartsev) [11:34:27.0000] ljharb it dictates 0, 1, throw, I believe [11:34:29.0000] i'd kind of expect 0, throw [11:34:30.0000] ah k [11:34:37.0000] not totally sure; might be 0, throw [11:35:35.0000] ah, I was right the first time [11:35:45.0000] that's part of why it's so painful [11:35:52.0000] because you look at the object, then the key, then the object again [11:36:57.0000] which is what you already have to do for `o[k]` in case o is a proxy or has a setter on o[k], no? [11:37:12.0000] i guess in those two cases you'd have to have the RHS first [11:37:46.0000] sorry, so, current spec dictates: [11:37:59.0000] object, key, object, rhs, object+key+rhs [11:38:16.0000] you do have to check for proxies or setters or whatever, but those happen as part of performing the assingment [11:38:20.0000] which happens after evaluating the HRS [11:38:24.0000] *RHS [11:39:03.0000] right [11:39:21.0000] so this would just become "object, key, rhs, all" [11:40:06.0000] yeah [11:41:25.0000] k, thanks [11:41:41.0000] sorry for the mixup earlier [11:42:05.0000] the chairing transition was a bit rough [11:43:15.0000] I think the note taker has stopped [11:43:27.0000] and it's back [11:43:28.0000] JaseW refresh [11:43:30.0000] yeah [11:43:35.0000] ljharb in fact it was even worse than that, now that I've looked [11:43:50.0000] it was, evaluate obj, evaluate prop, coerce obj to object, coerce prop to string, evaluate RHS, perform assignment [11:43:56.0000] and now? [11:44:11.0000] now it's just evaluate object, evaluate prop, coerce prop to string, evaluate RHS, perform assignment [11:44:23.0000] so the "evaluate prop" and "coerce prop to string" become adjacent [11:45:14.0000] ^ yeah that is the main change [11:45:21.0000] and "coerce obj to object" happens as part of "perform assignment" [11:45:26.0000] gotcha [11:45:56.0000] 46! [11:45:57.0000] yeah, ToObject basically does the same [11:46:44.0000] there is a more in depth write up in my test repo for it [11:56:49.0000] sffc: I got the thumbs up on #500 [11:56:55.0000] sorry for the delay and thanks for the patience [12:01:42.0000] ystartzev: thanks! [12:03:50.0000] rbuckton: yay, thanks for presenting [12:04:00.0000] 👍 [13:09:53.0000] rbuckton Someone on the JSC team ask a question about materializing "indices" and I didn't know the answer. [13:11:19.0000] rbuckton With the latest, just approved, version of the spec, is there a reason we don't set 'indices' to 'undefined' when the 'd' flag isn't present? [13:12:04.0000] I haven't run any perf tests on that variant and I don't remember it being discuss as part of the new option discussion. [13:12:53.0000] The team member noted that 'indices' has a different creation semantic than the 'groups' property. [13:25:23.0000] msaboff: No particular reason, other than not to have it if its not requested. If we unconditionally create the property (like we do for groups), and leave it as `undefined`, I would have no issue. [13:26:19.0000] rbuckton Okay. I can run perf tests to see if there is any issue. I'll try to get to that by the end of the meeting. [13:32:52.0000] +100 to ljharb 's point on the queue [13:46:31.0000] I get the same impression than Waldemar, same issue with Trusted Types! [13:47:04.0000] you must own/control the whole app, the whole code running for the app to make this any useful [13:49:34.0000] I don't think Mark's proposed constraint makes sense. I think it would be a very unreasonable constraint on the development of the JS standard library [13:49:48.0000] I agree that checking whether a template tag is literal is a rather low-level property [13:51:21.0000] From Google’s experience, controling the whole app is expected [13:52:20.0000] right! but majority of apps are not like that! anything using anything from NPM is automatically in the other category! [13:52:52.0000] I’m not sure I agree [13:53:22.0000] The point isn’t to guard against a truly malicious 3p script running on the page [13:53:33.0000] It’s to guard against accidental usage [13:54:28.0000] i don't think there's agreement that that's not the point [13:55:07.0000] Having `makeSafeUrl(codeIThoughtWasStaticButIsActuallyDynamic)` is a wholey different attack than `makeSafeUrl'https://im.actually.static'` [13:55:38.0000] Potecting against a page that’s exposed `eval`, you’re entire app is insecure, their’s no fixing that. [13:55:46.0000] there's sort of an interesting parallel between the shape of Mark's argument and previous arguments against SES-motivated features: both allege that the scenario where the feature is useful is impractical [13:56:01.0000] jridgewell: there's tons of ways to protect against eval [13:56:02.0000] I wonder if we could dig into this practicality and think about how to assess it more broadly [13:56:07.0000] jridgewell: eval doesn't break closures. [13:56:16.0000] ljharb: +1 [13:56:21.0000] jridgewell I still pretty much agree with waldemar [13:56:32.0000] if you are not concerned about malicious code, checking for "it's frozen and has a raw property" is good enough [13:56:38.0000] if you are concerned about malicious code, this doesn't help [13:58:08.0000] this is a sort of integrity feature. It gets exactly what you want in terms of "did this really come from syntax". A bunch of people asked me if this feature is related to my topic later, about tests like Map.isMap, and my initial reaction was "no" but now I've sort of come around to, they are kind of logically similar, in letting you check whether something really is something [14:07:42.0000] jridgewell: Module blocks are like module specifiers, not namespace objects [14:13:05.0000] If it was a _real_ ModuleSpecifier, you could do this... (though I'm unsure as to whether this is a good idea or not) [14:13:06.0000] ``` [14:13:06.0000] import { x } from module { [14:13:06.0000] export const x = 1; [14:13:06.0000] }; [14:13:06.0000] ``` [14:13:34.0000] I didn't realize you needed to import them. [14:17:50.0000] rbuckton: makes sense to me [14:31:12.0000] kind of seems like if we had `class.foo = bar` syntax we wouldn't have to use `this` [14:33:25.0000] i think ClassName suffices, still, kind of like kevin [14:33:38.0000] that was the conclusion from the subclassing hazard discussion [14:34:54.0000] it doesn't follow from that that we should *ban* `this`; i'm just saying ron's implication in the other direction that `this` is the natural way to assign static properties [14:35:03.0000] isn't that compelling [14:36:22.0000] i agree that repeating the class name is the status quo, and is "fine" [14:36:31.0000] but i also think repeating it sucks, and that's why i liked the `class.` proposal [14:36:50.0000] but we could go with "repeat the class name" here and still do `class.` later [14:37:12.0000] ah [14:37:22.0000] there are weird inconsistencies that cut both ways [14:37:28.0000] like Ron i feel _really_ strongly that vars shouldn't hoist out [14:37:29.0000] pls no [14:38:16.0000] this is 50% idealogical and 50% a very practical concern that this straight-up doesn't work for half the code I wrote, which has `await` [14:39:00.0000] I really think that this makes sense to treat like static field initializers [14:39:14.0000] both in terms of scoping and ordering [14:39:22.0000] Bakkot: you write a lot of code that sets static properties on a class and uses `await`? [14:39:24.0000] well, the proposal does not match filed initializers [14:39:41.0000] ljharb of the code I wrote that sets static properties on a class, 50% uses initializers [14:39:49.0000] interesting, k [14:39:53.0000] er [14:39:56.0000] 50% uses await [14:39:58.0000] right [14:39:59.0000] Bakkot: Well, it's fairly close; I'd prefer that it match entirely but I can buy the motivation for the changes [14:39:59.0000] sorry, too many words going on [14:40:02.0000] what about this proposal doesn't match field initializers? [14:40:08.0000] littledan this proposal is that static {} runs last, regardless of where it is relative to initializers [14:40:17.0000] right, I'd be up for changing that [14:40:49.0000] littledan fwiw the major upshot of this conversation is that I feel like static initializers should inherit the ability to `await` [14:41:10.0000] well... I'm happy that we designed them to behave like little methods instead [14:41:17.0000] that was a deliberate design [14:41:25.0000] mostly to match regular fields [14:41:30.0000] where it makes a lot of sense [14:41:34.0000] makes much less sense for static methods [14:41:40.0000] er, static initalizers [14:43:37.0000] Bakkot: notes, `a weight` should be `await` most often in the bot :-p [14:45:11.0000] in a phrase like "allow a weight to carry over" you can hardly blame it lol [14:45:20.0000] lol true [14:45:56.0000] ljharb I made that change a minute ago, just doesn't work if it ends up doing the post when it only has the `a` ready [14:46:02.0000] ah true [14:46:08.0000] it was not underspecified. It has been specified as undefined the whole time [14:46:42.0000] but the good thing is, the class features specs are all rebased and in great shape thanks to Ms2ger so this is more clear [14:47:04.0000] you can see the spec at https://arai-a.github.io/ecma262-compare/?pr=1668 [14:47:18.0000] oh good [14:47:39.0000] allowing multiple interleaving blocks in order seems the most JS-y thing [14:47:44.0000] (it = new.target in static field initializers) [14:47:44.0000] i see no good reason to limit to 1 [14:47:49.0000] shu: +1 [14:47:56.0000] would they interleave with static initalizers? [14:47:59.0000] (presumably yes?) [14:47:59.0000] yes [14:48:01.0000] i think that's the point yes [14:48:06.0000] top-down order seems pretty important [14:50:16.0000] oh god we've lost note taking [14:54:14.0000] would `var`s be shared? [14:54:24.0000] would they be visible to computed property names? [14:54:55.0000] i'd hope no [14:58:22.0000] Bakkot: yeah, i also hope each block would have its own var scope as the single initialized block does now [15:04:45.0000] woohoo! [15:06:13.0000] sorry, I'll help with notes tomorrow >_< [15:29:44.0000] the bot's unedited output definitely has some of the character of gpt2 [15:30:06.0000] where it's _almost_ coherent and _almost_ topical but it's also complete gibberish [15:41:06.0000] hubs is way shinier than before [15:41:16.0000] might just be a UI refresh but I like it 2021-01-26 [18:09:26.0000] Somewhat offtopic, but if there are any NodeJS implementers present that are familiar with Node's support for the W3C Web Performance APIs, can they reach out to me either via IRC or email? [20:40:03.0000] rbuckton: sup [09:40:33.0000] rbuckton: On Node.js Web APIs, are you in touch with James Snell or Matteo Collina? They're doing a lot of implementation these days. I can put you in touch by email if you want. [10:08:38.0000] I love everything about this proposal [10:10:55.0000] yep format*ToParts is universally great [10:11:32.0000] editing is still intense, wow [10:11:53.0000] the delay is large enough that it's easy to forget what was said by the time the mistake appears [10:12:13.0000] resizable arraybuffers are good [10:12:17.0000] rkirsling yeah :( [10:12:36.0000] littledan: that would help. We switched TS to leveraging the WC3 perf API for some performance monitoring in the TypeScript compiler and have run into cases where using perf_hooks is 20x slower than what we were doing before. [10:12:36.0000] a bit of that is introduced by me for dumb technical reasons [10:12:50.0000] rkirsling I kind of want to look into putting teams on a one-second lag while I'm taking notes [10:13:00.0000] ahh yeah [10:13:10.0000] rbuckton: i'm curious how that performs if you use node >=15 with `--turbo-fast-api-calls` [10:20:16.0000] rbuckton: Oh, I see. BTW you can find more information about people and discussions in this area at https://github.com/nodejs/diagnostics [10:21:00.0000] qard is also working on improving tracing api performance [10:21:02.0000] devsnek, littledan thanks! [10:27:19.0000] rkirsling are you still taking notes? [10:27:23.0000] I've been doing it but want to tweak the bot [10:27:29.0000] and it'll get behind if I step away [10:28:04.0000] Bakkot: I think my eyes are not strong enough to keep up with something like this [10:28:10.0000] kk, not to worry [10:29:43.0000] I'm struggling with them daily as it is but this feels more intense than your average competitive video game [10:31:24.0000] like I feel mildly sick from 20 minutes of it [10:32:07.0000] general newbie question for this topic: does this make page size observable? maybe it already is from wasm? [10:32:36.0000] are these slides published anywhere? i see other people looking at it but its not on the agenda or in the notes? [10:35:06.0000] ystartsev: they're in the agenda? [10:35:12.0000] https://docs.google.com/presentation/d/1lkDe1j1LcX8fg4KeLRKEeBG6VF0ffBz4Q_kA130V_aQ/edit?usp=sharing [10:35:15.0000] mark is current winner for person-who-bot-likes-best [10:35:32.0000] ah, i didn't refresh recently [10:42:36.0000] can someone fixup peter's acronym in the notes [10:42:39.0000] I don't have time to look it up [10:44:21.0000] Bakkot: PHE [10:44:22.0000] Bakkot: on it [10:44:25.0000] nvm [10:44:36.0000] already got it ljharb ;-) [10:45:50.0000] delegate shorthands are listed in https://github.com/tc39/notes/blob/master/delegates.txt FYI [10:46:05.0000] it's good to keep that handy when on note-taking duty [10:51:05.0000] queue needs to be advanced [10:53:11.0000] fwiw a ton of my packages have a necessary use of `Function` in their dep graph, so while getting rid of `eval` seems achievable, getting rid of `Function` seems significantly less so. [10:54:10.0000] i see that a lot too [10:55:07.0000] yeah, this is also related with his presentation yesterday. the fact that when using anything from someone else, having a global setting is not going to work. make it work usually wins over security issues unfortunately! [10:55:13.0000] what is the necessary use of Function? [10:55:55.0000] the d3-dsv readme just states that it's `(safe) use of dynamic code generation for fast parsing` [10:56:36.0000] rkirsling: objects only reachable from syntax - ie, AsyncFunction, GeneratorFunction, AsyncGeneratorFunction, etc. [10:56:41.0000] bot writes "eval" as "evil" like 80% of the time [10:56:55.0000] rkirsling: iow by making them "not globals", a significant percentage of the web ends up having use of `Function` ¯\_(ツ)_/¯ [10:57:03.0000] Bakkot: where's the error tho [10:57:10.0000] I see... [11:02:58.0000] i've had to make some big overhauls to the schedule, please lmk if you see any misses or conflicts [11:08:19.0000] note takers: the shorthand for the current speaker is KOT, not KKL [11:08:45.0000] oops, I probably did that all day yesterday too [11:08:49.0000] they're adjacent in delegates.txt [11:09:46.0000] nope, it's correct yesterday [11:11:55.0000] so if d3 can create a trusted types thing [11:12:12.0000] what stops some other random evil thing from creating a trusted types thing [11:12:27.0000] devsnek if you can create a policy you can already run arbitrary code [11:12:30.0000] is the assumption [11:12:53.0000] oh does the policy say "the d3 url" can create trusted types? [11:13:10.0000] no [11:13:13.0000] i guess i'm confused about the scoping of this [11:13:14.0000] am taking notes thoug hsorry [11:13:21.0000] no worries [11:22:33.0000] I feel the current concerns should be pre-stage 2, not post-stage 2 [11:22:43.0000] same [11:22:46.0000] I get the same impression [11:22:47.0000] same [11:22:57.0000] I am slightly sympathetic to Caridy's argument (which seems valid to hold Stage 2 for), but completely disagree with several of Mark's points. [11:23:06.0000] I don't think these should be thought about as the same point [11:23:09.0000] since they deal with "should this be in the language", that seems decidedly pre-stage-2 to me [11:23:18.0000] i'm actually fine w/ stage 2 but think it needs a fair amount of modification [11:24:07.0000] the queue kkotowicz https://snaps.akibraun.com/588t7.jpg [11:25:14.0000] thanks aki [11:25:26.0000] this item is 30mins (not 60 mins as tcq indicates) [11:26:03.0000] am I supposed to be seeing slides? [11:26:10.0000] no [11:26:11.0000] woah selfhosted screenshots [11:26:36.0000] rickbutton: Monosnap + AWS S3 + CloudFront [11:26:43.0000] i host my screenshots on s3 as well [11:26:48.0000] nice [11:26:53.0000] there's some bug where they don't charge me for s3 usage [11:26:57.0000] and i don't intend to tell them [11:27:14.0000] bezos covers your s3 bill with his pocket lint [11:27:51.0000] i got real upset when Evernote bought and ruined Skitch in 2012 so I decided never again and set up the above. [11:28:11.0000] i had to add this big scary sentence to the vm docs https://gc.gy/79394277.png [11:29:48.0000] devsnek: that ain't stopping people [11:29:51.0000] XD [11:30:05.0000] it did reduce the number of issues people opened asking if vm is safe [11:30:11.0000] fair [11:30:32.0000] if i don't observe the exploit it doesn't exist :P [11:32:03.0000] shu: we have some slides that show the cycle problem somewhere around here when we tried to figure out some stuff for Loaders [11:32:40.0000] syg there is another serious flaw with this approach [11:32:48.0000] remind me to talk about it [11:35:01.0000] Bakkot: "this approach" = sync message-passing? [11:35:06.0000] yeah [11:35:07.0000] put yourself on the queue? [11:35:11.0000] am notes [11:35:14.0000] ah [11:37:38.0000] am now on queue [11:40:35.0000] The font in TCQ needs some more weight IMHO. It's a bit hard to read sometimes [11:40:53.0000] +1 [11:42:39.0000] I agree on the queue screen in particular [11:42:54.0000] light font weight could be used for Agenda Item, Topic, and Speaking [11:43:32.0000] but using it for the values of those makes them harder to read [11:43:50.0000] bterlson is working on a new version [11:43:57.0000] but i guess for now we can update it to be easier to read? [11:50:39.0000] re Bakkot's point, if "we can fix some of it" is ok for trusted types, why isn't it ok for realms? [11:51:09.0000] the line about "spectre, so who cares" is pretty frustrating [11:51:55.0000] I think there is the option of renaming, and that might be a good direction [11:52:40.0000] i think the highlighting of membranes as a pattern rather than an end in it self is pretty important, and I am curious about some of the discussion that has been had here so far... what that middle road is [11:52:55.0000] I would like to see the fleshed out proposal [11:53:26.0000] honestly i'm still not 100% sure what a membrane is [11:53:51.0000] a bunch of code that isolates two sides of an object graph [11:54:11.0000] neat [11:55:01.0000] i've been thinking about it as telepresence [11:55:02.0000] i believe there is a wet and dry side [11:55:19.0000] yeah i remember the wet and dry side [11:55:35.0000] that was my first tc39 meeting 😅 [11:56:17.0000] Is the problem that we keep trying to define these "security" features piecemeal? Each individual piece doesn't solve a specific security issue and on their own seem to be considered a footgun. Do we need a comprehensive strategy for security boundaries and trust levels in synchronous code? [11:57:02.0000] i think mark would say yes we need a comprehensive principled approach [11:57:10.0000] i think we should ban the word security without a qualifier [11:57:59.0000] For example, I could see a built-in mechanism combining Proxies/Membranes, Realms, and import assertions to establish trust levels between imports and exports, such that when one module interacts with another module that it doesn't "trust", it goes through a membrane and isolates the other module/package. [11:58:10.0000] bradleymeck: there is a broader strategy they're executing on [11:58:12.0000] coop/coep [11:58:30.0000] features to nudge people to opt in to the process boundary and disabling those APIs otherwise [12:00:11.0000] i'm still surprised that major js engines don't support HMR better [12:01:08.0000] especially google after all that work on dart/flutter hot reload [12:01:09.0000] just to clarify, it seems that some folks are confused, the main issue solved by the counter proposal from google is to avoid the two objects graphs to be interconnected, basically, it avoid identity discontinuity all together [12:01:45.0000] shu: that isn't the strategy of others XD [12:02:00.0000] isn't isTemplateObject being driven by google? [12:02:16.0000] seems to be part of the identity discontinuity issue [12:02:17.0000] yes [12:02:20.0000] it is? [12:02:56.0000] actually i have to run for an hour, sorry will be unresponsive [12:03:02.0000] no worries [12:05:55.0000] shu: that is only the web contingent and doesn't work for things like Node, also has a large implication of same domain model [12:09:24.0000] devsnek the answer to your earlier question about policies (if I understand it correctly) is that policies have names, you have to put the names in the CSP header, and the names are use-once [12:09:38.0000] or at least this was my understanding last I checked [12:09:54.0000] so to use the d3 lib you would add "polices: d3-csv" to your CSP (or whatever the actual syntax is) [12:09:58.0000] and this would whitelist only d3 [12:10:01.0000] ah ok [12:10:19.0000] or, if some other dependency tried to use it, doing so would break d3 [12:11:07.0000] I am uhhhhhhhhh let me say "somewhat skeptical" that companies other that google will actually have the process in place to reliably go from "added a transtive npm dependency to some component" to "updated their CSP" [12:11:10.0000] but that's the theory [12:13:44.0000] doesn't that mean that it is only applied to an entire source text and doesn't do bundling issues? the slide on reasons people continue to use eval mentioned the usage of eval exactly because of bundling [12:13:57.0000] everyone bundles at some level, even Google [12:15:23.0000]