| 00:11 | <karlcow> | http://doc.s3.amazonaws.com/betadesign/Versioning.html versioning on S3 |
| 00:17 | <jwm> | I have an easy question.. can you make an entire canvas area scale pretty well? |
| 00:18 | <jwm> | I am designing an UI that I would like to have scale from 2560x down to smartphones |
| 00:18 | <jwm> | of course content will be added/removed to make things fit but I'd like to have the entire window scale also |
| 00:20 | <TabAtkins> | jwm: Yeah, <canvas> scales just fine if you, say, use CSS to resize it. It depends on whatever the browser's native scaling algorithms are, of course. |
| 00:20 | <TabAtkins> | Alternately, you can handle the scaling yourself using whatever algorithm you wish. |
| 00:21 | <jwm> | cool |
| 00:21 | <jwm> | that is good news |
| 00:22 | <jwm> | I want to mimmic webos kind of hehe |
| 00:22 | <jwm> | in my interface |
| 00:22 | <jwm> | not sure if canvas or svg or just regular xhtml/css would be good enough |
| 00:22 | <jwm> | hehe |
| 00:22 | <TabAtkins> | HTML/CSS with 3d transforms! |
| 00:22 | <jwm> | hehe |
| 00:22 | <TabAtkins> | It'll only work in Safari, but it'll be beautiful! |
| 00:23 | <jwm> | hah |
| 00:26 | <jwm> | I guess regular web tech xhtml/css will do what I want to do |
| 00:26 | <jwm> | was just trying to figure out what to use for graphics to rescale them |
| 00:26 | <jwm> | hehe |
| 00:31 | <Philip`> | <canvas> never does nice automatic scaling |
| 00:32 | <Philip`> | The size of the bitmap is determined by the width/height attributes on the element (possibly multiplied by a constant), and it does usually-ugly resampling to match whatever size CSS tells it to render at |
| 00:33 | <Philip`> | and you'd have to do some manual work if you want the bitmap dimensions to match the rendered size |
| 00:33 | <jwm> | crap |
| 00:33 | <jwm> | ok |
| 00:34 | <Philip`> | SVG is probably much more appropriate for scalable graphics, if you don't need canvas's immediate-mode API |
| 00:38 | <jwm> | yeah but it seems canvas has a lot more steam behind it |
| 00:38 | <jwm> | hehe |
| 00:38 | <jwm> | totally different things I know |
| 00:44 | <Philip`> | Steam doesn't seem so important, what matters is the functionality they provide |
| 00:44 | <Philip`> | (and they're not going to provide functionality much different to what they provide today) |
| 00:58 | Hixie | wonders how his IMAP server ended up with a "INBOX.INBOX.INBOX.INBOX.INBOX.Apple Mail To Do" folder |
| 01:01 | <jcranmer> | google hates you |
| 01:05 | <Hixie> | jcranmer: google? |
| 01:06 | <jcranmer> | oh, you're not using GMail? ;-) |
| 01:07 | <jwm> | hehe |
| 01:12 | <Hixie> | jcranmer: i am, but this isn't the gmail IMAP server in this particular case :-) |
| 01:12 | <jcranmer> | well, it's still fun to poke at gmail |
| 02:27 | <MikeSmith> | the lxml getprevious() and getparent() methods seem to cause the state to change |
| 02:33 | <MikeSmith> | gsnedders, jgraham - http://pastebin.ca/1766042 |
| 02:34 | <MikeSmith> | patch to make anolis --filter option work as expected |
| 02:35 | <MikeSmith> | summary: use element.drop_tree() instead of element.getparent().remove(element) |
| 02:38 | <MikeSmith> | actually, I guess you might as well just do: |
| 02:38 | <MikeSmith> | http://pastebin.ca/1766045 |
| 02:40 | <MikeSmith> | get rid of the remove(element) function altogether |
| 02:40 | <MikeSmith> | wait |
| 04:44 | <JonathanNeal> | hey guys what was that site that shows off html5 sites |
| 04:44 | <jwm> | |
| 04:45 | <JonathanNeal> | http://html5gallery.com/ |
| 04:45 | <JonathanNeal> | :D |
| 04:45 | <jwm> | :) |
| 04:46 | <JonathanNeal> | boaz in the ot told me |
| 04:46 | <jwm> | if you just type html5 sites |
| 04:46 | <jwm> | into google |
| 04:46 | <jwm> | it's the first result |
| 04:46 | <jwm> | :) |
| 04:47 | <JonathanNeal> | I searched for "sites running html 5" |
| 04:47 | <jwm> | ohh |
| 04:47 | <jwm> | if you searched for html5 sites |
| 04:47 | <jwm> | then it'd of pulled it |
| 04:47 | <jwm> | just like you typed :) |
| 04:52 | <JonathanNeal> | jwm, i'm sorry i didn't jfgi right |
| 04:52 | <jwm> | haha |
| 04:52 | <jwm> | nah I didn't mean that mean |
| 04:52 | <jwm> | I seriously didn't know where it was either |
| 04:53 | <jwm> | I don't understand what a html5 site would be |
| 04:53 | <jwm> | other than for inclusion of canvas and tables |
| 04:53 | <jwm> | hehe |
| 04:54 | <JonathanNeal> | http://www.liferay.com/ |
| 04:54 | <JonathanNeal> | we're all html'd up, well except that we have no need for canvas yet. |
| 07:22 | <hsivonen> | How is about:blank going? |
| 07:23 | <jwm> | heh |
| 07:23 | <jwm> | getting there |
| 07:23 | <jwm> | maybe some day |
| 07:41 | <MikeSmith> | hsivonen: so do I read mnot's comments correctly, the resolution of the rel-registry license sub-discussion is that it will in fact carry an MIT license? |
| 07:42 | <hsivonen> | MikeSmith: so it seemed, but I still have messages on public-html that I need to read and reply to |
| 07:44 | <MikeSmith> | hsivonen: fwiw, if Mark has gotten agreement from whomever else he talked with off-list, it doesn't seem necessary to respond any further to Roy's messages asserting that no license is necessary |
| 07:44 | <hsivonen> | MikeSmith: ok |
| 07:45 | <MikeSmith> | hsivonen: well, just imho |
| 07:45 | <hsivonen> | MikeSmith: understood |
| 07:46 | <MikeSmith> | anyway, if the rel registry will in fact have an explicit license, it seems like a case can been made for adding the same or similar license to the language-subtag and character-encoding-name registries |
| 07:46 | <hsivonen> | yeah |
| 08:35 | <jwm> | can you make bitmaps scale inside of canvas? |
| 08:35 | <jwm> | without javascript |
| 08:59 | <Philip`> | jwm: You can't use canvas at all without JS |
| 09:18 | <hsivonen> | Boo. Prototype uses browser sniffing :-( |
| 09:19 | <hsivonen> | I thought these canned JS libs were supposed to do things the Right Way |
| 09:19 | <hsivonen> | (with feature sniffing) |
| 09:27 | <jgraham> | hsivonen: IIRC MooTools uses browser sniffing too |
| 09:28 | <jgraham> | (or at least it changes the expected results of at least one of its tests based on whether it thinks you are Opera or not) |
| 10:10 | <gsnedders> | hsivonen: All the major libraries do |
| 10:10 | <gsnedders> | Sometimes with broken codepaths for some browsers, which lead to failing tests that they obviously don't care about. |
| 10:11 | <krijnh> | Whoops, somebody changed my IP :/ |
| 10:12 | gsnedders | blames krijn |
| 10:13 | krijnh | blames his little brother |
| 10:13 | <krijnh> | But I think the interwebs are faster now |
| 10:14 | <gsnedders> | The tubes you have now less blocked? |
| 10:15 | <krijnh> | Got a new connection, hope it improves /irc-logs/ speedyness :) |
| 10:21 | <hsivonen> | hmm. does WebKit save the form element source order for submission order instead of relying on the DOM order? |
| 15:37 | <TabAtkins> | All right, so, data urls vs @srcdoc. What are the problems again? (I'll list the ones I know, see if I missed any before I send this email.) |
| 15:38 | <TabAtkins> | 1) data urls will work in current UAs that don't understand sandbox, thus "failing open". Will the sandboxed html mime type help with this? |
| 15:38 | <TabAtkins> | 2) data urls have more difficult escaping requirements. Possibly not. PHP escapes things correctly with rawurlencode, python also has a built-in function that will do it properly. |
| 15:38 | <TabAtkins> | 3) ? |
| 15:39 | <AryehGregor> | 1) Yes, sandboxed HTML MIME type should solve that problem, I think. |
| 15:39 | <TabAtkins> | Maybe something with origins? data urls are automatically unique-origin, right? Could @sandbox=allow-same-origin just special-case override that? |
| 15:39 | <AryehGregor> | 3) You can save some annoying boilerplate with srcdoc="". |
| 15:39 | <TabAtkins> | Just the "text/html;charset=utf8" bit, right? |
| 15:40 | <Dashiva> | And the doctype |
| 15:40 | <TabAtkins> | Ah, right. And <title>. |
| 15:40 | <gsnedders> | TabAtkins: IE < 8 is still normally a consideration, IE8 is limited to 32KB |
| 15:40 | <gsnedders> | (or maybe KiB?) |
| 15:40 | <TabAtkins> | what's the limit on IE<8? |
| 15:40 | <gsnedders> | TabAtkins: they have no data uri impl |
| 15:41 | <TabAtkins> | Oh, well then. That's not a big deal, then, because they don't have a @srcdoc impl either. |
| 15:41 | <Dashiva> | I also dispute 2) |
| 15:41 | <TabAtkins> | But 32kb. That may be an issue. |
| 15:41 | <Dashiva> | Sure, PHP has _a_ function that does it right |
| 15:41 | <TabAtkins> | Dashiva: Dispute how? |
| 15:41 | <Dashiva> | But it's hardly given that people will choose the right one |
| 15:41 | <AryehGregor> | You don't really need to include <title>. |
| 15:41 | <TabAtkins> | And one that does it wrong in an immediately obvious (but not security-relevant) way. |
| 15:42 | <TabAtkins> | I mean, the very first comment I see that looks like "First+post+LOLOLOL", I'll know something's wrong. |
| 15:42 | <AryehGregor> | Yeah, I don't think the existence of urlencode() is a big deal. |
| 15:42 | <Dashiva> | Yeah, if you use that one |
| 15:42 | <TabAtkins> | Are there other url-encoding functions in PHP that we expect authors will use? |
| 15:43 | <gsnedders> | urlencode()? |
| 15:43 | <Dashiva> | I wouldn't be surprised if people tried with the html* functions too |
| 15:43 | <TabAtkins> | That's the one I just mentioned. |
| 15:43 | jgraham | assumes authors will use my_broken_url_encoder() |
| 15:43 | <TabAtkins> | htmlspecialchars? Hmm. I wonder how quickly that would fail. |
| 15:43 | <AryehGregor> | Dashiva, as long as it fails in an obvious way, it's not a big deal, you can't get much better than that. |
| 15:43 | <AryehGregor> | Some people will try urlencode() on srcdoc too. |
| 15:44 | <Dashiva> | AryehGregor: Yes, but then we have to first verify that all the obvious functions do fail in an obvious way |
| 15:44 | <Dashiva> | We can't just assume they will |
| 15:44 | <AryehGregor> | The same goes for srcdoc. |
| 15:44 | <gsnedders> | urlencode/rawurlencode are a lot easier to mix up though |
| 15:44 | <AryehGregor> | But the wrong one fails quickly and obviously, so I don't think we have to worry about it. |
| 15:44 | <TabAtkins> | And fails in a way that doesn't compromise security. |
| 15:44 | <gsnedders> | Sure, I know that urlencode encodes \x20 as + and rawurlencode encodes it as %20, but most authors don't. |
| 15:45 | <TabAtkins> | Most authors will use urlencode, see lots of +s in their page, and google for it. |
| 15:45 | <AryehGregor> | They'll figure it out pretty quickly. |
| 15:45 | <AryehGregor> | Not a big deal. |
| 15:46 | AryehGregor | wonders why browser release announcements seem to select benchmarks at random to show how much their performance has improved . . . do they just pick the most favorable one? A recent Chrome announcement gives improvement on "Mozilla's Dromaeo DOM Core Tests", previous ones have used SunSpider, V8's crazy tests, . . . |
| 15:47 | <AryehGregor> | Oh, neat, Chrome 4 supports STS. |
| 15:47 | <Dashiva> | AryehGregor: Kind of like how every new car was "car of the year" in at least one car magazine |
| 15:48 | <TabAtkins> | Hmm, can anyone think of something I can put in a data url that will pass through htmlspecialchars unscathed and cause problems? By default, it escapes <>"& (not '). |
| 15:49 | <AryehGregor> | TabAtkins, ' will cause problems, if the attribute uses ' instead of " for quoting. :) |
| 15:49 | <TabAtkins> | Yeah, but it fails even quicker than @srcdoc will if you forget to escape the ". |
| 15:49 | <TabAtkins> | Because people use ' all the time. |
| 15:49 | <AryehGregor> | "HTML5: Notifications, Web Database, Local Storage, WebSockets, Ruby support" <-- How many of these are actually part of HTML5? Maybe Ruby support? Is Notifications even a vendor-neutral spec? |
| 15:49 | <gsnedders> | But with larger security issues |
| 15:49 | <TabAtkins> | gsnedders: Yes, but with identical security issues to @srcdoc. |
| 15:49 | <gsnedders> | AryehGregor: Most of them _used_ to be HTML 5 |
| 15:50 | <AryehGregor> | I guess "HTML5" just means "cool new web features anyway". |
| 15:50 | <gsnedders> | All apart from Ruby were originally HTML 5. |
| 15:50 | <AryehGregor> | We should rename the HTML5 spec to "Some Random Subset of HTML5" to reflect common usage. |
| 15:51 | <Philip`> | I thought IE8 only supports data: for images, not HTML pages |
| 15:52 | <Philip`> | so its length limit is irrelevant |
| 15:53 | <Philip`> | TabAtkins: # breaks data: in Opera but not other browsers, I think |
| 15:53 | <AryehGregor> | Yeah, Opera treats stuff after a # as the URL fragment, right? |
| 15:53 | <AryehGregor> | Really annoying. |
| 15:53 | <AryehGregor> | Is there a spec that says whether that's right or wrong? |
| 15:54 | <TabAtkins> | Huh. Something's breaking my page in IE, and causing it to navigate to one of the data urls. |
| 15:55 | <TabAtkins> | Does IE8 'do' data urls in iframe @src? |
| 15:57 | <Philip`> | TabAtkins: I thought IE8 only supports data: for images, not HTML pages |
| 15:57 | <TabAtkins> | Possibly. Which means we can ignore the size limits of IE8, which is good. |
| 15:57 | <Philip`> | (It basically does the minimum needed for Acid2) |
| 15:58 | <AryehGregor> | IE8 doesn't support sandbox anyway, obviously, so who cares about it in this context? |
| 15:58 | <AryehGregor> | We have no backward compatibility here anyway. |
| 16:00 | <TabAtkins> | AryehGregor: Yeah, but we have to be careful about, frex, resource sniffing. |
| 16:00 | <AryehGregor> | Hmm? |
| 16:00 | <TabAtkins> | Wouldn't want IE to sniff a text/html-sandboxed page as text/html. |
| 16:00 | <AryehGregor> | Will it |
| 16:00 | <AryehGregor> | ? |
| 16:00 | <AryehGregor> | That seems unrelated. |
| 16:01 | <TabAtkins> | I know they sniff resources for html-ness normally. Of course, their complete lack of support for pages in data: urls means we don't have to worry about it. |
| 16:01 | <TabAtkins> | IIRC, it's somewhat difficult to serve html as text/plain to IE? |
| 16:02 | <Dashiva> | Shelley is planning on filing several thousand change requests? |
| 16:02 | <AryehGregor> | TabAtkins, they only sniff for certain MIME types, IIRC. |
| 16:02 | <TabAtkins> | Okay. |
| 16:02 | <TabAtkins> | Dashiva: Eventually, probably. |
| 16:02 | <AryehGregor> | I think someone tested this, no? |
| 16:02 | <TabAtkins> | I have no idea. I'm relying on hazy recollections. |
| 16:03 | <AryehGregor> | Mark Pilgrim's lastest WHATWG blog post says no current browser will execute text/sandboxed-html. |
| 16:03 | <Dashiva> | Just doing some calculations based on http://lists.w3.org/Archives/Public/public-html/2010Jan/1308.html |
| 16:03 | <Philip`> | I'm not aware of anyone testing it thoroughly |
| 16:05 | Philip` | wouldn't count unevidenced statements in blog posts as being particularly meaningful |
| 16:06 | <danbri> | interesting note from bengee - http://bnode.org/blog/2010/01/26/microdata-semantic-markup-for-both-rdfers-and-non-rdfers |
| 16:10 | <TabAtkins> | When opera breaks on unescaped #, it's an innocuous break, right? Just a malformed page, not busting content out into attributes? |
| 16:10 | <Lachy> | Interesting. "Atom, microformats, OpenID, Portable Contacts, XRDS, Activity Streams, these are all examples where RDFers tried, but failed to promote some of their infrastructure into the respective solutions" |
| 16:13 | <GarethAdams|Work> | I just noticed that HTML5 still doesn't me mark up inline lists. <p>I went shopping for <ul><li>lightbulbs,</li> <li>widgets,</li> <li>flozzbots and</li> <li>some milk</li></ul>, but I got distracted and ended up in the pub.</p> |
| 16:13 | <TabAtkins> | Sure it does. ul,li{display:inline;} |
| 16:13 | <AryehGregor> | TabAtkins, it just treats everything after # as the fragment portion of the URL, AFAIK. |
| 16:14 | <AryehGregor> | TabAtkins, not in <p>. |
| 16:14 | <TabAtkins> | AryehGregor: Cool, so that's innocuous. |
| 16:14 | <TabAtkins> | AryehGregor: Ah, you're right. Silly me. |
| 16:14 | <AryehGregor> | GarethAdams|Work, you can't put <ul> inside <p> in text/html, it's not compatible with legacy browsers. |
| 16:14 | <TabAtkins> | I always forget about <p>'s silly self-closing rules. |
| 16:14 | <TabAtkins> | That causes me problems sometimes. |
| 16:14 | <Philip`> | GarethAdams|Work: Why not write it like "<p>I went shopping for lightbulbs, widgets, ..."? |
| 16:14 | <Dashiva> | Also, <li> has a horrible delimiter story |
| 16:15 | <Dashiva> | E.g. if you want a list like apples | bananas | other fruits |
| 16:15 | <GarethAdams|Work> | ah, legacy browsers, shoulda guessed |
| 16:15 | <AryehGregor> | GarethAdams|Work, "legacy" meaning "all". |
| 16:15 | <GarethAdams|Work> | yeh |
| 16:15 | <GarethAdams|Work> | I forgot about the backward compatibility |
| 16:15 | <AryehGregor> | I mean, it's part of text/html parsing rules that <p>Foo <ul><li>Bar inserts </p> before the <ul> (effectively). |
| 16:15 | <GarethAdams|Work> | schoolboy error |
| 16:16 | <GarethAdams|Work> | Dashiva: the delimiter problem is down to bad support for `:after` and `content:` in CSS though |
| 16:17 | <Dashiva> | GarethAdams|Work: That's still a bad story |
| 16:17 | <Dashiva> | You need special casing for first/last element, etc |
| 16:18 | <Dashiva> | "There is a great deal of contention about the new srcdoc attribute." |
| 16:19 | <Philip`> | If you count number of emails, there has |
| 16:19 | <Philip`> | Maybe not so much if you count people |
| 16:20 | <Dashiva> | Maybe ask Sam to revive the frequent poster statistics |
| 16:21 | <TabAtkins> | So, the issues are (1) fail open, (2) harder escaping, (3) boilerplate, and (4) unique origins? Anything else? |
| 16:22 | <Dashiva> | URL size limit, potentially. We won't know until the future browsers are released, though. |
| 16:22 | <TabAtkins> | True, I'll bring that up. |
| 16:23 | <Dashiva> | Also, there's the dual source thing |
| 16:23 | <Dashiva> | With srcdoc, you can use src you provide fallback for browsers that don't support it |
| 16:23 | <Dashiva> | *use src to |
| 16:28 | <TabAtkins> | Right. |
| 16:28 | <AryehGregor> | Maybe we should use the Cooke method in the HTMLWG: http://www.rff.org/News/Features/Pages/The-Cooke-Method-A-Route-to-More-Reliable-Expert-Advice.aspx |
| 16:29 | <TabAtkins> | Though, you have to manually clean the @src content, which makes it kind of redundant. |
| 16:29 | <Dashiva> | No, you wouldn't clean it at all |
| 16:29 | <Dashiva> | It would say "Your browser doesn't support secure iframes, please upgrade or something, I don't know" |
| 16:30 | <TabAtkins> | Haha. |
| 16:30 | <AryehGregor> | Dashiva, browsers could just as well have a srcdoc size limit. |
| 16:30 | <AryehGregor> | Future ones, I mean. |
| 16:30 | <TabAtkins> | AryehGregor: Could, but that hasn't been demonstrated yet. |
| 16:30 | <AryehGregor> | Nor have limits on data URL length for sandboxed iframes. |
| 16:32 | <Dashiva> | AryehGregor: There already are quite real limits on data URLs, though. It's not a matter of possibly breaking, it's a matter of breaking unless it gets fixed. |
| 16:33 | <AryehGregor> | Introducing a whole new attribute and hoping there won't be comparable length limits seems like a roundabout way to address the problem. You could just mandate a minimum length for data URLs. |
| 16:33 | <AryehGregor> | I mean, minimum maximum supported length. |
| 16:34 | <Dashiva> | It's not a way to address the problem, it's a way to address lots of different problems |
| 16:35 | AryehGregor | is unconvinced. |
| 16:35 | <Philip`> | Has anybody pointed out use cases for srcdoc other than blog comments? |
| 16:35 | <TabAtkins> | Wiki pages. |
| 16:35 | <Philip`> | Things like 32KB length limits aren't really a concern in those cases |
| 16:36 | <TabAtkins> | Virtually all cases where untrusted users are uploading something you want to display. |
| 16:36 | <TabAtkins> | AryehGregor, any idea how big the largest page on wikipedia is? |
| 16:36 | <Philip`> | In most cases users aren't uploading HTML, so you just escape all "<"s and you're done |
| 16:36 | <Lachy> | personally, I'm not yet convinced of the use cases for srcdoc either |
| 16:37 | <TabAtkins> | I'm composing an email with a lot of discussion about data urls, their problems, and their possible solutions. |
| 16:37 | <Lachy> | but I think it would suck if pages like wikipedia started putting entire articles into srcdoc |
| 16:37 | <AryehGregor> | TabAtkins, in bytes? Actual articles or also maintenance pages and such? I wouldn't be surprised if the largest article is 1 MB |
| 16:37 | <AryehGregor> | . |
| 16:37 | <Philip`> | so it's only cases where users are uploading some subset of HTML, but a large enough subset that decent filtering is hard |
| 16:37 | <TabAtkins> | AryehGregor: Yeah, in bytes, and any page where you'd show untrusted user content, potentially via a sandboxed iframe. |
| 16:38 | <TabAtkins> | Philip`: Also, just the fact that you can guarantee that no scripts slip through your genius filtering is nice. |
| 16:38 | <AryehGregor> | This is a feature for a use-case that's kind of marginal to begin with, and data: URLs would work okay for it, so I really don't see what the point is. |
| 16:38 | <Philip`> | TabAtkins: If your filter just allows <b> and <i> and <a href> and nothing else, then you don't really need to worry about that |
| 16:39 | <TabAtkins> | If your filter is good enough to avoid all the crazy shenanigans hackers get up to. |
| 16:39 | <TabAtkins> | I just plain distrust filters. |
| 16:40 | <AryehGregor> | 1) htmlspecialchars() 2) strtr( array( '<b>' => '<b>', '</b>' => '</b>', ... ) ) |
| 16:40 | <AryehGregor> | Pretty hard for that to go wrong. |
| 16:40 | <jgraham> | Famous last words |
| 16:40 | <Lachy> | if you use proper HTML parsing, rather than a regex, and a whitelist that checks elements, attributes and attribute values (to e.g. disallow href="javascript:..."), then server side filtering should be sufficient |
| 16:41 | <gsnedders> | Lachy: And what major blogging package does this? |
| 16:41 | <Lachy> | I don't think I would choose to use srcdoc on my own blog |
| 16:41 | <AryehGregor> | Nobody uses proper HTML parsing. |
| 16:41 | <AryehGregor> | There's no such *thing* as proper HTML parsing prior to HTML5. |
| 16:41 | <Lachy> | I'm hoping that will start to change now that HTML parsing has been defined properly |
| 16:41 | <AryehGregor> | Yes, true. |
| 16:41 | <gsnedders> | Lachy: Parsing html in PHP is prohibitively slow. |
| 16:42 | <Philip`> | There's been proper HTML parser libraries long before HTML5 existed |
| 16:42 | <Philip`> | Why would people use HTML5 parsers when they haven't used those ones? |
| 16:42 | <Philip`> | (given that for blog comments you don't care about legacy compatibility, which is the only thing HTML5 adds) |
| 16:42 | <jgraham> | s/HTML/XML/ and you end up with the same conclusion |
| 16:42 | <gsnedders> | PHP5 has access to libxml's HTML parser, and nobody uses it. |
| 16:42 | <Lachy> | gsnedders, yes, I know. I don't think I would use PHP for a CMS. It's not a well designed language |
| 16:42 | <gsnedders> | Lachy: Yet the majority of CMSes on the web do. |
| 16:42 | <TabAtkins> | Argh, I find it ironic that Richard's emails about Canvas accessibility are almost unreadable to me because he uses HTML emails in some crazy size. |
| 16:43 | <Lachy> | yeah, I know they do |
| 16:43 | <gsnedders> | Lachy: What you personally would ues is irrelevant. |
| 16:43 | <AryehGregor> | Lachy, you would use PHP for a CMS if you wanted it to be as widely used as possible. |
| 16:43 | <jgraham> | (i.e. people don't always use XML parsers when producing XML, to oftentimes hillarious effect) |
| 16:44 | <Lachy> | AryehGregor, yeah, I understand that's why PHP is so common. |
| 16:44 | <Dashiva> | What about providing a santitation library in C or something |
| 16:44 | <Philip`> | jgraham: That's understandable, since XML parsers don't produce XML |
| 16:44 | <AryehGregor> | Also, by the way, there are no PHP libraries that are reliably available on shared hosts, unless they're written in pure PHP. |
| 16:44 | <jgraham> | Philip`: HTML5 parsers don't produce HTML |
| 16:44 | <AryehGregor> | (in which case you can bundle them) |
| 16:44 | <smaug> | what are "HTML5 notifications" ? |
| 16:44 | <gsnedders> | Dashiva: Even if you got that into PHP 5.3.3, it'd be years before I could rely upon that. |
| 16:45 | <Philip`> | jgraham: Indeed, and I've got no idea what relevance producing *ML has to the discussion :-) |
| 16:45 | <Dashiva> | No in PHP, separately |
| 16:45 | <AryehGregor> | smaug, it seems like they're a Google invention that has nothing to do with any standards body, but I didn't look very hard. |
| 16:45 | <Dashiva> | So it could be used for python and perl and whatnot too |
| 16:45 | <Lachy> | are there CMSs written in C or C++? |
| 16:45 | <gsnedders> | Dashiva: As AryehGregor says you can't run arbitary C code from PHP |
| 16:45 | <smaug> | AryehGregor: yet they are selling notifications as "part of HTML5" |
| 16:45 | <AryehGregor> | Not on all shared hosts, anyway. |
| 16:45 | <Philip`> | jgraham: Are you meaning XML serializers rather than parsers, or something? |
| 16:45 | <gsnedders> | Heck, you can't even rely upon all default enabled extensions being enabled. |
| 16:45 | <gsnedders> | And there might be random functions disabled. |
| 16:46 | <gsnedders> | I <3 PHP. |
| 16:46 | <jgraham> | Philip`: No I'm meaning parsers, as a first step in sanitizing user-generated content |
| 16:46 | <AryehGregor> | smaug, I think this falls under HTML5 as buzzword for "cool new technologies that push the boundaries of what the web platform can do", rather than HTML5 as a name for some boring old spec. |
| 16:46 | <jgraham> | (in the case when the output is XML) |
| 16:46 | <smaug> | well, usually whatever falls under HTML5 has been defined in some whatwg or w3c spec |
| 16:46 | <AryehGregor> | At least at some point, yeah. |
| 16:46 | <Philip`> | jgraham: Nobody expects users to enter XML (except annevk), so I don't see why you'd use an XML parser for that |
| 16:46 | <Dashiva> | Usually implies exceptions |
| 16:46 | <AryehGregor> | Kind of odd. |
| 16:47 | <AryehGregor> | I assume the person who wrote it doesn't really know what HTML5 is. |
| 16:47 | <Philip`> | I guess PHP shared hosts don't let you upload and run binary executables? |
| 16:48 | <Dashiva> | Don't ascribe to ignorance what can more easily be ascribed to competent marketing personell |
| 16:48 | <gsnedders> | Philip`: Nope |
| 16:49 | <Philip`> | Surely you could just find a buffer overflow bug in PHP and use that to run your C extension |
| 16:49 | <AryehGregor> | Philip`, some PHP shared hosts let you run binary executables. |
| 16:49 | <AryehGregor> | But to do that safely you have to have separate Unix users for each customer. |
| 16:49 | <gsnedders> | Yeah, probably, seeming most hosts run massively out of date versions of PHP… |
| 16:49 | <AryehGregor> | Which typically means you need to use CGI. |
| 16:50 | <AryehGregor> | Which doesn't perform as well as mod_php or FastCGI. |
| 16:50 | <gsnedders> | AryehGregor: But normally only via shell_exec in my experience |
| 16:50 | <AryehGregor> | gsnedders, well, yeah. |
| 16:50 | <gsnedders> | Which is fun combined with safe mode |
| 16:50 | <AryehGregor> | But that works. |
| 16:50 | <gsnedders> | Not with safe mode enabled |
| 16:50 | <AryehGregor> | If they use safe mode, yes, you're screwed. |
| 16:50 | <AryehGregor> | But some hosts don't, like 1and1.com. |
| 16:50 | gsnedders | needs to get around to moving stuff over to his VPS |
| 16:51 | <gsnedders> | Then I can run arbitary binaries :P |
| 16:51 | AryehGregor | is lucky in that his first foray into web hosting was an already-running dedicated server |
| 16:51 | AryehGregor | now has a dedicated 16-core machine with 16G of RAM and, soon, 1.6T of raw disk space to play around with however he wants |
| 16:52 | <gsnedders> | AryehGregor: So what's sqrt(pi)? |
| 16:52 | <gsnedders> | To a million digits? |
| 16:52 | <AryehGregor> | Bah, who needs decimal expansions? |
| 16:53 | <AryehGregor> | It's a perfectly good transcendental number, don't sully it with your base-10 nonsense. |
| 16:53 | <Philip`> | gsnedders: The same as 1/10^5*sum(exp(n^2/(10^10)),n=-infinity..infinity) |
| 16:53 | <Philip`> | apparently |
| 16:54 | <AryehGregor> | sum(exp(n^2/(10^10)),n=-infinity..infinity is infinite. |
| 16:54 | <TabAtkins> | gsnedders: √π |
| 16:55 | <gsnedders> | Hmm, apparently it has another root, what's that? :P |
| 16:55 | <gsnedders> | Or, if we want more fun, what are all three cube roots? |
| 16:55 | <AryehGregor> | That's trivial. |
| 16:56 | <AryehGregor> | Once you've got one, you just multiply by roots of unity. |
| 16:56 | <workmad3> | gsnedders: √π is the square root of π |
| 16:56 | <workmad3> | it's a multi-valued function |
| 16:56 | <AryehGregor> | If you take the principal nth root of x, the other nth roots are just that times e^(2k*i*pi/n), k = 1, ..., n -1. |
| 16:56 | <AryehGregor> | The principal square root function is not multi-valued. |
| 16:57 | <gsnedders> | Indeed. |
| 16:57 | <AryehGregor> | That only becomes a real problem with complex numbers. |
| 16:57 | <AryehGregor> | Where you don't have a continuous single-valued square root function, and there's no obvious candidate for the canonical one. |
| 16:57 | <Philip`> | Hmph, that's what I get for copying from a newsgroup posting |
| 16:57 | gsnedders | can't remember e^(2k*i*pi/n), k = 1, ..., n -1 off the top of his head though |
| 16:57 | gsnedders | guesses he must've known it once… like, a year ago. |
| 16:57 | <workmad3> | it rings bells |
| 16:57 | <Philip`> | It's meant to be 1/10^5*sum(exp(-n^2/(10^10)),n=-infinity..infinity) |
| 16:58 | <gsnedders> | Yeah, it looks familiar. |
| 16:58 | <workmad3> | haven't done anything serious along those lines since 1st year uni though... so almost 6 years ago now :( |
| 16:58 | <AryehGregor> | e^(2k*i*pi/n), k = 0, ..., n - 1 are the nth roots of unity (i.e., the nth roots of 1). |
| 16:58 | <Philip`> | Anyway, that equation gives you at least the first 42 billion decimal digits of sqrt(pi) |
| 16:59 | <AryehGregor> | If you know any nth root of a number, the others will just be found by multiplying by nth roots of unity. |
| 16:59 | <Philip`> | though it's not equal to sqrt(pi) |
| 16:59 | <Philip`> | Easily good enough if you just want the first million, anyway |
| 17:00 | <Philip`> | (http://www.cecm.sfu.ca/personal/pborwein/PAPERS/P56.pdf) |
| 17:01 | <AryehGregor> | Oh, dear, it's already past noon. |
| 17:01 | <AryehGregor> | I have to head off to my PDEs class. |
| 17:02 | <gsnedders> | PDEs? |
| 17:03 | <AryehGregor> | Partial differential equations. |
| 17:03 | <Philip`> | Particularly difficult equations? |
| 17:04 | <Philip`> | Oh |
| 17:04 | <AryehGregor> | Those too. |
| 17:04 | <AryehGregor> | And after that, an introductory cryptography course. |
| 17:07 | <TabAtkins> | Will a data url default to utf-8 if the charset isn't specified? Is that defined anywhere? |
| 17:08 | <gsnedders> | TabAtkins: AFAIK what is defined is a mix of mapping IRIs to URIs and then just whatever the MIME type is |
| 17:08 | <gsnedders> | the mapping of IRI to URI will leave it in UTF-8, but given something like text/html it'll try to use charset=windows-1252 |
| 17:08 | <TabAtkins> | So... no? |
| 17:08 | <gsnedders> | No. |
| 17:09 | <gsnedders> | Well, for application/xml it will |
| 17:09 | <TabAtkins> | Any idea on text/html-sandboxed? |
| 17:09 | gsnedders | hasn't read the spec for that |
| 17:09 | <TabAtkins> | kk |
| 17:10 | <Lachy> | wow! http://www.romancortes.com/blog/pure-css-coke-can/ |
| 17:11 | <TabAtkins> | Any clue on whether data urls without a doctype will trigger quirks mode? How can I quickly test this? |
| 17:11 | <Lachy> | TabAtkins, yes, they will trigger quirks mode |
| 17:11 | <TabAtkins> | Thanks. |
| 17:11 | <gsnedders> | TabAtkins: Yes, check parsing of <p><table> |
| 17:11 | <Lachy> | but you can test it easily by loading data:text/html,<p>some-html-here |
| 17:12 | <Lachy> | and then typing javascript:alert(document.compatMode); in to your address bar |
| 17:12 | <TabAtkins> | Ah, cool. Thanks. |
| 17:21 | <TabAtkins> | Ah, I understand how the cokecan works now. Crazy! |
| 17:23 | <zcorpan> | http://twitter.com/strangefunction/statuses/8235849998 |
| 17:27 | <Philip`> | Real Coke cans don't violate the laws of perspective :-( |
| 17:28 | <jgraham> | Real beer cans do, if you drink enough first |
| 17:35 | <GarethAdams|Work> | real coke cans don't violate using 55 extra divs on a page |
| 17:38 | <TabAtkins> | He didn't use 55 extra divs. He used 55 extra *<p>*s. |
| 17:38 | <TabAtkins> | Which is, of course, the wrong choice. It should have been <div>s. ^_^ |
| 17:38 | <TabAtkins> | But also, this is just a cool tech trick, that's all. |
| 18:36 | <Sidnicious> | I've been talking with some people in #javascript about forms' submit events. Right now, if a user wants to perform validation on a form before submission, or to prevent submission and handle the form asynchronously, the user has to scrape the form to get the value of each element, perform tests for disabled inputs, and special-case inputs like checkboxes to try to replicate the information that the UA has about the form. It's imposs |
| 18:36 | <Sidnicious> | get information about, say, which button was pressed to submit the form. I'd be much nicer if all that information were provided in the event. |
| 18:37 | <Sidnicious> | Ack, wall of text. I'm mostly curious about where the right place is to introduce the idea: here, the WHATWG list, or some W3C list. I don't know the politics involved here. |
| 18:40 | <TabAtkins> | whatwg is fine, or the htmlwg list. Subscribing to the whatwg list is substantially easier, though. |
| 18:41 | <TabAtkins> | What information are you wanting, exactly? The value of all the form elements, and relevant attributes such as disabled, plus the origin of the submit event? |
| 19:07 | <Sidnicious> | TabAtkins: Sorry, was afk. I want access to the data goes into creating the query string or post body, including the button that triggered submit, coordinates on image inputs, the works. |
| 19:07 | <Sidnicious> | The simplest implementation that gets us most of the way there would be an array of nodes that were involved in submission — only enabled inputs, only checked checkboxes, only the clicked button. That does not get us information like image coordinates, but it makes form scraping much more reliable: if I want the value of the to-be-submitted form, I just get the name and value of every element in the array. |
| 19:08 | <Sidnicious> | There are plenty of other ways this could be implemented. I like the idea of supplying an array of objects, each of which has a key property, a value property, and an node property, so it'd be possible to ignore the elements entirely (and minimize DOM access) and just look at the keys and values from the array. |
| 19:10 | <TabAtkins> | Hmm, that's interesting. |
| 19:10 | <TabAtkins> | And your use-case is validation, right? |