| 00:04 | <Hixie> | othermaciej: thanks |
| 00:07 | <Hixie> | foolip: the photo gallery example from the spec doesn't generate any RDF? |
| 00:08 | <Hixie> | is that a bug in the spec? |
| 00:09 | <Hixie> | doesn't show the JSON either |
| 00:21 | <bzed> | hmm.why are the unit tests missing in the released file of 0.90? |
| 00:35 | <TabAtkins> | Hixie: Where's the photo gallery example? |
| 00:39 | <foolip> | Hixie: it does for me, perhaps it's a bug in my javascript? |
| 00:39 | <foolip> | Hixie: oh, that example, will check... |
| 00:55 | <othermaciej> | Hixie: btw, if you manage to get the conformance/etc changes for Microdata done, my other request would be to deal with details/figure, both to settle the HTML WG issue on it, and so WebKit is not prevented from implementing it by uncertainty |
| 00:57 | <othermaciej> | Hixie: re cut/copy/paste, I figure you can get unobfuscated source to at least some of those sites, or talk to their developers, but the additional thing I could do is make WebKit ignore attempts to set listeners for those events and see what happens |
| 00:58 | <othermaciej> | Hixie: the effects might be subtle though, I know at least some Google sites use them to fix up some of the details of copy/paste in rich text editable areas to match what they like, and I don't know what failure would look like |
| 05:56 | <Hixie> | for the last 3 hours i have gone through the following process about 10 times: |
| 05:56 | <Hixie> | 1. look at my emacs window. remember that i'm trying to write an example for <iframe srcdoc>. |
| 05:56 | <Hixie> | 2. decide that the best way to do that is to find an actual blog post with comments that would be suitable for a spec example. |
| 05:57 | <Hixie> | 3. decide a good place to find such blog posts might be a news aggregator like reddit. |
| 05:57 | <Hixie> | 4. go to reddit fully intending to find a blog post of that nature. |
| 05:57 | <Hixie> | 5. read reddit. |
| 05:57 | <Hixie> | 6. forget about #2-#4. |
| 05:58 | <Hixie> | 7. run out of posts to read |
| 05:58 | <Hixie> | 8. decide i'm going to work on html5. |
| 05:58 | <Hixie> | 9. goto 1. |
| 06:04 | <othermaciej> | lol |
| 10:12 | <Lachy> | Hixie, in the note about escaping characters in srcdoc, it says "... and then to quote all U+0022 QUOTATION MARK (") and U+0026 AMPERSAND (&) characters" |
| 10:12 | <Lachy> | s/quote all/escape all/ |
| 10:21 | <Hixie> | oops |
| 10:26 | <Dashiva> | Has Adobe made any kind of guarantee that flash will remain free in the future? |
| 10:33 | <Hixie> | it's not free _now_, is it? |
| 10:36 | <hsivonen> | the player is free as in beer, though, but only for end users on certain platforms |
| 10:38 | <Dashiva> | Free as required for the case "I want to make sure that when a child in India or Brazil or Kenya discovers the internet, there isn’t a big piece of it (video) that they can’t afford to participate in." |
| 10:46 | <Hixie> | i do not believe they've made that guarantee, no |
| 10:58 | <Hixie> | hsivonen: is there a spec for the NPAPI? |
| 10:59 | <Hixie> | all i've found is https://developer.mozilla.org/en/Gecko_Plugin_API_Reference |
| 10:59 | <Hixie> | but if there's an actual spec, i'd love to update the reference in html5 |
| 10:59 | <hsivonen> | Hixie: I was thinking of that, but I can see why you wouldn't count it as a spec |
| 11:01 | <Hixie> | it's a vendor-specific reference, for one |
| 11:01 | <Hixie> | and seems rather vague |
| 11:02 | <Hixie> | i mean, look at this: https://developer.mozilla.org/en/NPN_GetProperty |
| 11:02 | <Hixie> | it's almost too vague to pass as an API reference, let alone a spec |
| 11:03 | <hsivonen> | it would be good if someone wrote a real spec, yes |
| 11:04 | <Dashiva> | Do all the browsers using it implement their own copy? |
| 11:04 | <hsivonen> | Dashiva: I believe they use the same header files but their on code backing the headers |
| 11:06 | <hsivonen> | Hixie: I guess NPAPI is a multivendor standard that doesn't have open list archives or a real spec |
| 11:07 | <hsivonen> | Hixie: HTML 4 didn't have an open list archive or a real spec, so I guess you don't need those to be a standard |
| 11:07 | <hsivonen> | open list archives and a real spec are righteous, though |
| 11:08 | <Hixie> | HTML4 was almost as bad, yes |
| 11:08 | <Hixie> | (worse, in some respects, better in others) |
| 11:34 | <erlehmann> | Dashiva, the only guarantee you can have is open standards. „trusting someone“ usually doesn't work when applied to corporations. |
| 11:36 | <Dashiva> | There's a difference between "This is closed, but you have a free perpetual license to use it" and "This is closed, and you can use it until I tell you to stop" |
| 11:46 | <Philip`> | The child in India or Brazil or Kenya could just download an old free version of the Flash player, regardless of what Adobe changes in the future |
| 11:46 | <Philip`> | (and I don't think the child will care much about the details of the licensing terms) |
| 11:48 | <Dashiva> | The argument seems to be that they will |
| 12:01 | <erlehmann> | I fail to see what exactly how that could play a role in choosing whether to abandon Flash or not. |
| 12:02 | <Dashiva> | Because h264 is involved |
| 13:00 | <AryehGregor> | Dashiva, India, Brazil, and Kenya don't have software patents AFAIK, so they can use H.264 in <video>. :) |
| 13:01 | <Dashiva> | AryehGregor: Well, apart from Firefox refusing to let them |
| 13:01 | <AryehGregor> | Right. |
| 13:01 | <AryehGregor> | I don't think third-world countries are a legitimate reason for opposing H.264 at this juncture. |
| 13:01 | <AryehGregor> | The impact is mainly on Americans. |
| 13:02 | <AryehGregor> | Who are rich and can afford the tax for the next seven years. |
| 13:03 | <AryehGregor> | On the other hand, Flash imposes much bigger practical problems, so killing it ASAP would be nice. |
| 13:03 | <AryehGregor> | If everyone were to use Theora, that would be great, but . . . |
| 13:03 | AryehGregor | will stick to supporting Theora-only for now, but hey, GIF didn't kill the web. |
| 13:03 | <Dashiva> | At the current juncture, it's more a question of which is the lesser evil in the meantime |
| 13:03 | <AryehGregor> | Pretty much, yeah. |
| 13:04 | <AryehGregor> | How many extra people can Mozilla pressure into using Theora by only supporting it? |
| 13:04 | <Dashiva> | How many people can they pressure into sticking to Flash |
| 13:04 | <jcranmer> | well, if MPEG-LA decides to require licenses for creating H.264 |
| 13:05 | <AryehGregor> | They can get some people to use Theora, but not so many as long as 1) authors have to maintain a Flash fallback to support old browsers/IE anyway, 2) they have to trade Firefox against Safari. |
| 13:05 | <AryehGregor> | jcranmer, if that happens, game over, we win. No problem there. |
| 13:06 | <jcranmer> | I guess it comes down to IE, then |
| 13:06 | <AryehGregor> | I'm guessing they won't charge any more than they think the market will bear. |
| 13:06 | <AryehGregor> | IE will surely hook into DirectShow or whatever, like Safari hooks into Quicktime. Microsoft already has a video-display framework that they're invested in, why would they make up a whole new one for IE? |
| 13:06 | <Dashiva> | I'd say it's reasonably certain microsoft is in the h264 camp |
| 13:06 | <AryehGregor> | The question is whether MS will package Theora codecs by default. But like Apple, it's an MPEG-LA licensor. |
| 13:07 | <jcranmer> | having H264 is pretty much given |
| 13:07 | <AryehGregor> | And it has a strong historical tendency to try quashing free formats via patents. |
| 13:07 | <jcranmer> | the question is whether or not it takes Theora as well |
| 13:07 | <Dashiva> | I'd guess they won't support theora directly, but if the users installs it manually it will work |
| 13:08 | <AryehGregor> | That would be my guess too. |
| 13:08 | <AryehGregor> | But the upshot in that case will be everyone except Mozilla supports H.264. |
| 13:08 | <AryehGregor> | And only Firefox, Chrome, Opera support Theora. |
| 13:08 | <AryehGregor> | So forget it, H.264 wins. |
| 13:08 | <AryehGregor> | As I say, GIF didn't kill the web. Theora is a lot further along than PNG was, too, relatively speaking. |
| 13:09 | <jcranmer> | the other possibility is that MPEG-LA gets greedy, and you see a backlash like what happened with GIF |
| 13:09 | <AryehGregor> | That could happen, yeah. |
| 13:09 | <Dashiva> | PNG had significant improvements over GIF, though |
| 13:09 | <AryehGregor> | Right, but Theora is improving. |
| 13:09 | <jcranmer> | Theora apparently outperforms H.264 at low bitrates |
| 13:10 | <AryehGregor> | Also, we have Google's purchase of whatever that company is. They might suddenly drop a new free-as-in-speech codec on everyone that outperforms H.264. |
| 13:10 | AryehGregor | can't remember its name. |
| 13:10 | <Dashiva> | On2 |
| 13:10 | <AryehGregor> | Oh, well. This stuff will mostly be decided by people with more expensive suits than us. We get to sit and wait. |
| 13:10 | <jcranmer> | I personally think that the "submarine patent" argument is bull... that pretty much applies to every software technology if you look deep enough |
| 13:11 | <Dashiva> | jcranmer: That's not the real argument, though. The argument is attack surface. |
| 13:11 | <jcranmer> | well, let's see where Bilski goes |
| 13:11 | <AryehGregor> | jcranmer, it was more plausible before Google started deploying it. |
| 13:12 | <AryehGregor> | Yeah, we'll see about that. Maybe the Supreme Court will decide it wants to use Bilski as a chance at patent reform. |
| 13:12 | jcranmer | wonders if he should write his representatives to propose a "use it or lose it" rule for patents |
| 13:13 | <Dashiva> | "Your" representatives |
| 13:13 | <AryehGregor> | A ban on software patents seems more likely. "Use it or lose it" seems kind of contrary to general principles of property ownership. |
| 13:13 | <AryehGregor> | Besides, it wouldn't help much. |
| 13:13 | <AryehGregor> | All the patent trolls would just put up some trivial implementations of everything for sale, which no one buys, and that will be enough. |
| 13:14 | <Dashiva> | They could hide it deep inside some completely unrelated application |
| 13:14 | <jcranmer> | the current theory on Bilski is that it will pretty much kill business method patents but keep software patents in limbo for another case |
| 13:14 | <AryehGregor> | The Supreme Court likes ruling narrowly, yeah. |
| 13:15 | <Dashiva> | Except on letting businesses buy politicians :P |
| 13:15 | <jcranmer> | SCotUS is also a big fan of narrowing patentability |
| 13:16 | <AryehGregor> | Dashiva, no, it ruled narrowly there too. The opinion of the court said they only considered constitutionality because they had no other option, since the corporation was clearly in violation of the law as written. |
| 13:16 | <AryehGregor> | Well, I guess they could have artificially restricted themselves to not-for-profits or something. |
| 13:16 | <Dashiva> | But they ruled in the general case, much wider than the specific instance the case was about |
| 13:17 | <AryehGregor> | Well, yeah. They don't rule only for one specific case, but they decide only as much law as necessary to decide that case. |
| 13:18 | <AryehGregor> | So if they can reasonably make a ruling on Bilski that only covers business-method patents, probably they'll do so. |
| 13:18 | <AryehGregor> | But one never knows. |
| 13:19 | <jcranmer> | basically, they'll probably kill the State Street test "useful, tangible result" |
| 13:20 | <jcranmer> | which puts software patents on shaky grounds (Diamond v. Diehr held that software per se was unpatentable) |
| 17:15 | <Philip`> | Hmm, <iframe sandbox> sounds like a handy way to make a Flash-blocker for browsers that don't provide one (like Chrome?) |
| 17:16 | <Philip`> | Just make a page that embeds a user-chosen URL in a sandbox that disables plugins |
| 17:20 | <TabAtkins> | Philip`: Interesting. |
| 17:24 | <AryehGregor> | Chrome has a Flash-blocker extension by now, surely? |
| 17:25 | <AryehGregor> | (also, I get the best possible Flash blocking from it, namely --disable-plugins, since if I don't use that then the browser crashes all the time) |
| 17:25 | <Philip`> | You should use Opera, it has a handy context menu for globally disabling plugins :-) |
| 17:26 | <AryehGregor> | If you can find the option in a sea of three hundred and eighty-one other options. |
| 17:26 | <Steve^> | globally disabling isn't what you normally want? |
| 17:26 | <Steve^> | You want a whitelist |
| 17:29 | <Philip`> | AryehGregor: The context menu only has 14 options |
| 17:29 | <Philip`> | Uh, probably not actually a context menu; it's just what you get when you hit F12 |
| 17:29 | <AryehGregor> | Philip`, and how many of those open up to a whole other submenu of options? Chrome's has eight, no submenus. |
| 17:30 | <Philip`> | AryehGregor: 0 |
| 17:30 | <AryehGregor> | F12 doesn't do anything in Chrome, so it has zero of those. :) |
| 17:30 | <Steve^> | none, actually |
| 17:30 | <Philip`> | (unless you count "Edit site preferences..." which opens a whole dialog) |
| 17:30 | <Steve^> | I've been wondering though, is Chrome too simple to be mainstream? |
| 17:30 | <AryehGregor> | Oh, F12 is just Tools -> Quick Preferences. |
| 17:30 | <Philip`> | AryehGregor: Yes |
| 17:30 | <AryehGregor> | Well, Chrome still has zero prefs in that menu, so it wins for simplicity. ;) |
| 17:30 | <Philip`> | but quicker |
| 17:30 | <Steve^> | I was spoken to a woman who was recently switched to Firefox and could no longer find her beloved File -> Email to option (apparently IE has one of those) |
| 17:31 | <Steve^> | How will she fare with Chrome and not even a menu bar? |
| 17:31 | <Steve^> | *i was speaking |
| 17:31 | <AryehGregor> | Opera has 16 options in context menus, two of which are submenus. |
| 17:32 | <TabAtkins> | Steve^: In my experience, most users have no idea their browser *has* options. |
| 17:32 | <TabAtkins> | To be honest, *I* have no idea what many of the options do, or at least don't care. |
| 17:32 | <AryehGregor> | Steve^, I suspect that mostly, people don't mind simplicity. Niche features like that aren't as important as a) working consistently, b) being responsive. |
| 17:32 | <Philip`> | AryehGregor: I'm not sure why you seem to be arguing that Chrome wins because of its simplicity, when you've already admitted you have to use command-line arguments just to stop it crashing :-) |
| 17:32 | <TabAtkins> | Which is why I use Chrome for daily browsing. ^_^ |
| 17:32 | <AryehGregor> | Philip`, well, I'm using the Linux beta, that doesn't count. |
| 17:32 | <AryehGregor> | Actually, I'm on the dev channel. |
| 17:33 | <AryehGregor> | It also crashes randomly when I leave it running for a while, although I can just restore, so it's not a big deal. |
| 17:33 | <Steve^> | TabAtkins, but that isn't an option, its a function |
| 17:33 | <Philip`> | AryehGregor: We should only count mythical browsers that don't have any problems? |
| 17:33 | <AryehGregor> | Philip`, no, you should only count the stable channel of Chrome, just like you shouldn't count Opera alphas. |
| 17:33 | <Philip`> | I'd prefer to count the browser versions that I would use :-) |
| 17:33 | <Steve^> | pardon myself for using the word option before |
| 17:33 | <TabAtkins> | Steve^: Still something that I didn't even know IE had, nor, I suspect, do the majority of people know that it exists. |
| 17:34 | <Steve^> | ok, how about the print button? |
| 17:34 | <TabAtkins> | Do browsers have a print button normally exposed? |
| 17:34 | <Steve^> | TabAtkins, but there isn't a file menu to get to it either |
| 17:34 | <Philip`> | (and since there seemingly isn't a version of Chrome on Linux that claims to be stable, I'd have to count the beta/dev versions) |
| 17:34 | <TabAtkins> | The little paper-thingy menu gets you there. |
| 17:35 | <Steve^> | there;s a "paper with folded corner" menu |
| 17:35 | <TabAtkins> | Since there's only two buttons that aren't obviously navigation-related, you'll find it pretty quick. |
| 17:35 | <AryehGregor> | Philip`, if we're talking about us, then the relevant notion of simplicity is thoroughly different. |
| 17:35 | <twhee> | Hello everyone |
| 17:35 | <twhee> | is there any documentation/samples for using python html5lib? |
| 17:36 | <Philip`> | AryehGregor: I was talking about us, since you said "I" and I said "you" |
| 17:36 | <twhee> | http://code.google.com/p/html5lib/wiki/UserDocumentation : page not found |
| 17:36 | <AryehGregor> | Philip`, well, then there's nothing complicated about a command-like switch. It's the GUI I care about, and that's horribly cluttered in Opera and *extremely* slick and well-designed in Chrome. |
| 17:36 | <Philip`> | twhee: http://html5lib.googlecode.com/svn/wiki/UserDocumentation.wiki is what ought to be on that page |
| 17:36 | <AryehGregor> | Also, if we're talking about us, I prefer open-source browsers. :P |
| 17:36 | <Steve^> | TabAtkins, I hope so, I've just been wondering. Older users find the menu bar as a safe haven for finding this sort of stuff |
| 17:36 | <twhee> | Oh, thanks |
| 17:37 | <Steve^> | I quite like how Chrome still has a status bar at the bottom, when you hover a link. Unlike safari which I believe doesn't have one at all |
| 17:38 | cardona507 | too |
| 17:38 | <Steve^> | and my mum is happy that it logs her into Facebook, so maybe it does have a future |
| 17:38 | <TabAtkins> | Yeah, I've been thinking of putting my status bar back on my work machine's firefox. |
| 17:38 | <othermaciej> | Steve^: Safari does have a status bar, it's just off by default |
| 17:38 | <TabAtkins> | I like simplicity, so I removed it, and the link-icon thinger I have helps a lot, but still. |
| 17:38 | <othermaciej> | turning on the status bar is one of the very few changes I make to the default preference settings |
| 17:38 | <Steve^> | I think we can agree "off by default" is almost identical to not having a feature |
| 17:39 | <Steve^> | I didn't even consider looking for that |
| 17:40 | <othermaciej> | a transient hover overlay might be good, though Chrome's particular design looks kinda fugly to my eye |
| 17:40 | <othermaciej> | I do agree that most users don't change defaults at all |
| 17:41 | <Steve^> | everyone on the web seems to agree that choice is bad |
| 17:41 | <AryehGregor> | It is. I've been meaning to write an essay. |
| 17:41 | <AryehGregor> | Chrome is really excellent about not giving people unneeded choices. |
| 17:41 | <othermaciej> | "users don't change defaults" isn't the same as "choice is bad" |
| 17:42 | <AryehGregor> | That's one of the great things about it. They don't say "Well, status bars are cluttery but some people like them, so let's make it an option." They find a compromise that works well for everyone. |
| 17:42 | <Steve^> | just a few minutes ago people were comparing the number of menus they had in their browsers |
| 17:42 | <AryehGregor> | othermaciej, it does mean that you should never have a choice as a substitute for putting work into finding just the right default. |
| 17:43 | <AryehGregor> | "Give the users a choice" is often a way to avoid making a decision. |
| 17:43 | <Steve^> | Chrome has done well, which is why I gave it to my mum. She can type whatever she likes in that box and it'll browse the web for her |
| 17:43 | <othermaciej> | that is indeed a pathology that is common in open source projects |
| 17:43 | <AryehGregor> | Since it shuts up all the people who don't like the default, since they're just told to change it. |
| 17:43 | <Steve^> | But then I use Linux and Opera, I like the other side of the scale |
| 17:43 | <AryehGregor> | othermaciej, not in closed-source projects? I can name you examples from Windows, for sure . . . |
| 17:43 | <AryehGregor> | Like a dialog box asking you whether you want help files indexed, for crying out loud. |
| 17:44 | <othermaciej> | almost every open source project I worked on that was supposed to be UI-oriented was very quick to reach for "let's just add a preference" |
| 17:44 | <othermaciej> | Apple is mostly at the opposite extreme |
| 17:44 | <AryehGregor> | So is Google (including Chromium). |
| 17:44 | <Steve^> | Apple is a step too far, I find it difficult to find settings I need to change |
| 17:44 | <AryehGregor> | Also GNOME, although IMO GNOME doesn't do as good a job at it. |
| 17:44 | <othermaciej> | those are my only two experiences seeing major projects up close |
| 17:45 | <othermaciej> | Apple's design philosophy is that there should be no such thing as "settings you need to change" |
| 17:45 | <AryehGregor> | GNOME gets the "don't give a preference" part right, but forgets the "and make the default good" part . . . and also doesn't make it obvious how to change things that *are* changeable. I'm still trying to figure out how to make Document Viewer my default PDF reader instead of scribus. The latter isn't even installed anymore AFAICT. |
| 17:45 | <AryehGregor> | Yeah, that's the right philosophy. |
| 17:45 | <TabAtkins> | I've been lucky to be dictator of all of my projects so far, so I get to decide what the best thing is and just leave it alone. |
| 17:46 | <Steve^> | AryehGregor, simple, replace the scribus executable with a link pointing to evince :) |
| 17:46 | <AryehGregor> | It should figure almost everything out somehow. If there are settings, they should mostly be contextual, not in some big preferences menu. |
| 17:46 | <AryehGregor> | Steve^, haha. |
| 17:46 | <AryehGregor> | That would work. |
| 17:48 | othermaciej | is fixing an HTML parser bug to atone for time-wasting mailing list posts |
| 17:51 | <AryehGregor> | Does WebKit have any plans to switch to an HTML5 parser like Gecko does? |
| 17:53 | <othermaciej> | we'll eventually have an HTML5-compliant HTML parser |
| 17:54 | <othermaciej> | I have no timeline to give on that however |
| 18:05 | <Steve^> | Does anyone know if Google Chromes recent blanket-advertising campaign in the UK has done much? |
| 18:06 | <AryehGregor> | I'm sure Google knows. :) |
| 18:07 | <AryehGregor> | The UK will be affected by the ballot box rolling out soon, won't it? That will probably increase Chrome market share massively in the EU. |
| 18:10 | <AryehGregor> | Why is David Hyatt listed as an editor in the W3C copy of HTML5? He doesn't actually edit it, does he? |
| 18:13 | <Philip`> | AryehGregor: To placate people who weren't happy with having Hixie be the sole editor |
| 18:14 | <AryehGregor> | It's rather misleading. |
| 18:15 | <Philip`> | Sure |
| 18:18 | <Steve^> | I wonder what kind of web browser the iSlate will have |
| 18:18 | <Steve^> | if the fantasies of a reinvented personal computer experience are anything to go by, the browser is surely a part |
| 18:19 | <AryehGregor> | I can't imagine it would be anything but Safari, of some stripe. |
| 18:19 | <AryehGregor> | Maybe modified, like the iPhone Safari, but still Safari, surely. |
| 18:20 | <Steve^> | indeed, the content will be the same |
| 20:16 | <AryehGregor> | Hmm. Why doesn't HTML5 require a minimum level of image support for visual UAs? It's realistically necessary to support certain specific images to not break the web, shouldn't the list be documented? |
| 20:23 | <Dashiva> | AryehGregor: Surely it can't break any worse than the equivalent of network errors or 404s |
| 20:24 | <AryehGregor> | No, but it won't be a marketable browser. Same as, e.g., not implementing the correct insane parser algorithm. |
| 20:24 | <AryehGregor> | The latter is far more complicated, of course, so has much more reason to be specced. |
| 20:26 | <Steve^> | that's a good idea |
| 20:26 | <AryehGregor> | I imagine it's a pretty short list, of course. |
| 20:27 | <AryehGregor> | GIF, PNG, JPEG. BMP? TIFF? I'm not actually sure. |
| 20:28 | <Steve^> | BMP yes |
| 20:29 | <Dashiva> | I'm sure there's a dozen smaller image formats that you could argue for or against |
| 20:29 | <Steve^> | which is why there should be a list |
| 20:29 | <Dashiva> | Which is why the list will just be a bikeshed |
| 20:30 | <AryehGregor> | Dashiva, just make the list contain precisely the formats supported by every browser. |
| 20:31 | <AryehGregor> | Same as with character encodings, that was discussed before on the mailing list. |
| 20:31 | <AryehGregor> | (one of them) |
| 20:31 | <AryehGregor> | You could make it contain fewer, if people think a particular format isn't really needed for web compatibility. |
| 20:31 | <AryehGregor> | But if any major browser gets away without shipping support for a particular format, obviously that's not critical for web compat, so should be off the list. |
| 20:33 | <Steve^> | can a style element be placed within body? |
| 20:34 | <daedb> | yes |
| 20:34 | <AryehGregor> | But usually shouldn't be, to avoid FOUC. |
| 20:36 | <Steve^> | FOUC? |
| 20:37 | <daedb> | Flash of unstyled content |
| 20:37 | <Steve^> | I'm looking at the HTML5 specs and it suggests that style belongs in the head |
| 20:38 | <AryehGregor> | That's the best place to put it. |
| 20:38 | <Steve^> | I'm thinking about emails and wiki pages, where I don't have full control over the document |
| 20:38 | <Steve^> | (I don't know what would happen in an HTML email if I put full markup in there) |
| 20:39 | <AryehGregor> | Then you might want it in the <body>. It's allowed. |
| 20:39 | <AryehGregor> | Webmail clients would probably block it, though. |
| 20:42 | <Steve^> | why? |
| 20:42 | <Steve^> | HTML emails aren't allowed style? |
| 20:44 | <AryehGregor> | <style> would apply to the whole document, including the mail interface. |
| 20:44 | <AryehGregor> | Unless they put the mail itself in an <iframe>, but without seamless, I doubt any do. |
| 20:44 | <AryehGregor> | Since theey have to be fixed-size. |
| 20:45 | <Steve^> | oooo, that's a good point |
| 20:45 | <Steve^> | anyway, that isn't my concern |
| 20:45 | <Steve^> | I was just wondering whether it is illegal to put style in the body or just disliked |
| 20:46 | <AryehGregor> | It's legal. |
| 21:15 | Philip` | likes how htmLawed takes the approach of offering a zillion options with no indication of which ones are potentially insecure |
| 21:15 | <Philip`> | e.g. if you set safe=1 and cdata=3 then <![CDATA[]>]><script>alert("foo")</script>]]> will execute script in (at least) current versions of Firefox and Opera |
| 21:43 | <foolip> | why is it that data: URIs can't be used instead of srcdoc=""? |
| 21:46 | <Dashiva> | foolip: Because they're a lot more complicate |
| 21:46 | <Dashiva> | d |
| 21:48 | <foolip> | really? anything apart from the escaping (which isn't complicated) |
| 21:49 | <foolip> | or is it just to make sure it can't work in older browsers which support data: URIs but not the sandboxing? |
| 21:51 | <Dashiva> | It's the escaping |
| 21:53 | <foolip> | that sounds like the strangest reason to make up a new attribute ever, unless I'm missing something about escaping (encodeURL?) |
| 21:56 | <Philip`> | You need a URL encoding function that encodes characters like # |
| 21:56 | <Philip`> | and I imagine it's easy to pick a function that isn't quite right |
| 21:57 | <foolip> | and with srcdoc you only need to escale < and " ? |
| 21:57 | <foolip> | escape |
| 21:59 | <Dashiva> | Yes |
| 22:00 | <Philip`> | No |
| 22:00 | <Philip`> | & and " |
| 22:01 | <foolip> | so there's no browser that would be confused by e.g. <a href="</a>">? |
| 22:02 | <Philip`> | No, as far as I'm aware |
| 22:02 | <Philip`> | (It's not well-formed XML, though) |
| 22:02 | <foolip> | that's surprising, but good if it's true |
| 22:03 | <Dashiva> | Yeah, as long as you get the " right you're "safe" |
| 22:03 | <Dashiva> | And if you don't, then it'll most likely break visibly all over the place |
| 22:13 | <TabAtkins> | foolip: It's not just the escaping. Legacy concerns exist too - legacy browsers that understand data: but not @sandbox will show your content without sandbox security measures. |
| 22:14 | <TabAtkins> | I think that using text/sandboxed-html in the data: url would fix that, though. |
| 22:16 | <AryehGregor> | I don't think escaping is a really compelling reason here. urlencode() should work fine here, no? |
| 22:16 | <Philip`> | What is urlencode? |
| 22:17 | <AryehGregor> | I mean, it's more complicated if you're writing things from scratch, but I assume you're using a normal programming language that supports basic Internet-related escape functions. |
| 22:17 | <AryehGregor> | PHP's urlencode(), for instance. |
| 22:17 | <AryehGregor> | Or Python/Perl/Ruby/etc. equivalents. |
| 22:17 | <AryehGregor> | "Returns a string in which all non-alphanumeric characters except -_. have been replaced with a percent (%) sign followed by two hex digits and spaces encoded as plus (+) signs." |
| 22:17 | <AryehGregor> | http://us.php.net/manual/en/function.urlencode.php |
| 22:17 | <AryehGregor> | That would work fine, right? |
| 22:17 | <AryehGregor> | But it would look a lot uglier, and you'd have the extra data:text/sandboxed-html,<!doctype html> boilerplate. |
| 22:18 | <Philip`> | Encoding spaces as + won't work |
| 22:18 | <Philip`> | See e.g. data:text/html,a+b |
| 22:18 | <AryehGregor> | The + isn't translated to a space there? |
| 22:18 | <AryehGregor> | Then I agree it's more of a pain. |
| 22:18 | <Philip`> | No |
| 22:19 | <Philip`> | What does urlencode do with Unicode? |
| 22:19 | <TabAtkins> | You have to escape it as %20 |
| 22:19 | <Dashiva> | That's the point, isn't it? Encoding data: is too easy to do wrong |
| 22:19 | <Philip`> | by which I mean: I assume urlencode doesn't do anything with Unicode, since PHP is stupid |
| 22:19 | <AryehGregor> | It probably treats it as binary. |
| 22:19 | <AryehGregor> | So if the input string is UTF-8, it will encode as UTF-8. |
| 22:20 | <Philip`> | so I guess it's okay iff you store strings internally with UTF-8 encoding before passing to urlencode |
| 22:20 | <AryehGregor> | Anyway, granted, this is more complicated than necessary. |
| 22:20 | <TabAtkins> | The result of urlencode("…") is %E2%80%A6. |
| 22:20 | <Philip`> | If you do a simple replace-"-and-& encoder then you don't have to worry about encodings (or at least no more than for any other user input displayed on your site), since the input and output encodings will be identical |
| 22:21 | <Philip`> | (whereas URL encoding requires UTF-8 output, which is a pain if the input isn't UTF-8) |
| 22:22 | <AryehGregor> | TabAtkins, only if you save the file as UTF-8. Save it as UTF-16 and try again. (Probably PHP will barf because it's not ASCII-compatible, though.) |
| 22:22 | <AryehGregor> | Or try any other encoding. |
| 22:23 | <AryehGregor> | For literals, it just goes by the format of the file. |
| 22:23 | <TabAtkins> | Well, I'm passing the character in through a GET param. |
| 22:24 | <TabAtkins> | I don't know what the implications of that are wrt encodings. |
| 22:24 | <AryehGregor> | Then it probably decodes the GET param as binary. |
| 22:24 | <AryehGregor> | PHP just treats everything as binary. |
| 22:24 | <AryehGregor> | It's actually very simple. |
| 22:24 | <TabAtkins> | (Really, all I know is that when things occasionally save as Windows-1252 I get pissed.) |
| 22:25 | <TabAtkins> | I certainly understand Unicode and it's encodings, but I don't understand why there has to be so many compat problems between various levels. >_< |
| 22:34 | <TabAtkins> | Can anyone go test Python and/or Ruby real quick to see what they do when you pass "a b" to their url escaping function? |
| 22:58 | <AryehGregor> | TabAtkins, >>> import urllib |
| 22:58 | <AryehGregor> | >>> urllib.quote("a b") |
| 22:58 | <AryehGregor> | 'a%20b' |
| 23:02 | <Dashiva> | See what happens with < and " too |
| 23:04 | <mpilgrim> | >>> import urllib |
| 23:04 | <mpilgrim> | >>> urllib.quote("a b") |
| 23:04 | <mpilgrim> | 'a%20b' |
| 23:04 | <mpilgrim> | >>> urllib.quote("a/b") |
| 23:04 | <mpilgrim> | 'a/b' |
| 23:04 | <mpilgrim> | >>> urllib.quote("a/b", safe="") |
| 23:04 | <mpilgrim> | 'a%2Fb' |
| 23:04 | <mpilgrim> | >>> urllib.quote_plus("a b") |
| 23:04 | <mpilgrim> | 'a+b' |
| 23:05 | <mpilgrim> | (that's python 2.6.1, for TabAtkins) |
| 23:05 | <AryehGregor> | mpilgrim, . . . were you, like, reading the logs and came on IRC specifically to say that? |
| 23:05 | <Dashiva> | mpilgrim: What about " and <? |
| 23:05 | <mpilgrim> | yes |
| 23:06 | <mpilgrim> | >>> urllib.quote('a"b') |
| 23:06 | <mpilgrim> | 'a%22b' |
| 23:06 | <mpilgrim> | >>> urllib.quote('a<b') |
| 23:06 | <mpilgrim> | 'a%3Cb' |
| 23:07 | <AryehGregor> | Neat, Google Reader suggested an RSS feed that contained a personal attack on me. |
| 23:07 | <AryehGregor> | Never had that happen before. |
| 23:07 | <TabAtkins> | Woo! |
| 23:07 | <TabAtkins> | Thanks, mpilgrim. |
| 23:07 | <TabAtkins> | Is / safe in data urls? |
| 23:07 | TabAtkins | goes to see if he can find the answer. |
| 23:10 | <Philip`> | >>> urllib.quote(u"\u0123") |
| 23:10 | <Philip`> | Traceback (most recent call last): |
| 23:10 | <Philip`> | File "<stdin>", line 1, in <module> |
| 23:10 | <Philip`> | File "/usr/lib64/python2.6/urllib.py", line 1223, in quote |
| 23:10 | <Philip`> | res = map(safe_map.__getitem__, s) |
| 23:10 | <Philip`> | KeyError: u'\u0123' |
| 23:10 | <Philip`> | Guess you need to find a UTF-8 encoding API too |
| 23:12 | <Philip`> | (For extra fun, it works fine if you test with u"x" and starts throwing an exception when a user on your site enters non-ASCII data) |