00:06
<roc>
paul_irish: I believe CORS was first supported in Firefox 3.5. If not that, definitely 3.6
00:08
<paul_irish>
roger that. thx roc
00:35
<TabAtkins>
Why do I torture myself by continuing to use http://www.xanthir.com/pictures/llama.gif as my example picture when playing with images?
01:46
<divya>
I am curious why almost all CSS examples in whatwg has a @namespace defined? http://www.whatwg.org/specs/web-apps/current-work/complete.html#margins-and-padding
01:46
<annevk>
those are not examples
01:47
<annevk>
and it makes sure those styles only apply to HTML elements and not e.g. XML elements that happen to share the name
01:47
<divya>
oops. right. sorry.
01:53
<JonathanNeal_>
What do you think of: "ARIA (Accessible Rich Internet Applications) is a collection of metadata added to or implied in HTML for the purpose of increasing the accessibility of content and components." ?
01:54
<JonathanNeal_>
And: "Microdata is a collection of metadata added to HTML for the purpose of conveying contact information, geographic coordinates, calendar events, and the like." ?
02:06
<divya>
JonathanNeal_: microdata defn sounds a lot like microformats one
02:06
<divya>
http://www.whatwg.org/specs/web-apps/current-work/multipage/microdata.html#introduction-2 is a bit more broad.
02:06
<JonathanNeal_>
Well, they are very similar, I botched together a bunch of web definitions to come up with a quick definition.
02:07
<JonathanNeal_>
I'll check it out right now, thanks
03:33
<annevk>
omg what a bunch of FUD on the fonts list
03:34
<annevk>
because font formats might not be safe they should be same-origin? give me a break
03:41
<othermaciej>
annevk: by "not safe" they mean cause security exploits like buffer overruns?
03:41
<othermaciej>
same-origin is clearly not even remotely a defense
03:41
<othermaciej>
against that threat model
03:42
<annevk>
read and weep: http://lists.w3.org/Archives/Public/public-webfonts-wg/2010Apr/0054.html
03:42
<othermaciej>
I wonder if Apple ended up joining the Fonts WG or not
03:42
<othermaciej>
if we did then I guess maybe I should join the list
03:44
<annevk>
you haven't
03:44
<annevk>
afaict
03:45
<annevk>
see also: http://www.w3.org/2000/09/dbwg/details?group=44556 (W3C Member-only)
03:46
<othermaciej>
it is true that fonts are a potential exploit vector, beyond what (non-SVG) images can do
03:46
<annevk>
I'm not at all disputing that
03:46
<othermaciej>
but same-origin is not an effective defense
03:50
<annevk>
and the claim elsewhere in the thread that fonts are more special than scripts is also utter crap
03:50
<annevk>
in http://lists.w3.org/Archives/Public/public-webfonts-wg/2010Apr/0050.html
03:57
<othermaciej>
it seems like a plausible argument that fonts are more widely reusable and less contextual
03:58
<othermaciej>
but that's not really a security argument
04:00
<othermaciej>
people also seem to have confused beliefs about what a same-origin restriction would do
04:01
<annevk>
oh, I didn't notice that
04:01
<othermaciej>
e.g. http://lists.w3.org/Archives/Public/public-webfonts-wg/2010Apr/0044.html
04:01
<othermaciej>
"My clients are interested in serving their custom corporate fonts in a way that does not expose them to use by other parties"
04:03
<annevk>
oh right, I was thinking he meant some kind of intranet situation
04:03
<annevk>
maybe I should do a reply after all
04:04
<othermaciej>
I don't think he means preventing external sites from using intranet-hosted fonts when viewed inside the firewall
04:04
<othermaciej>
I think he means preventing others from using a font that's published on a public site and protected by a same-origin restriction
04:05
<annevk>
yeah, so that's utter crap
04:05
<annevk>
wget!
04:06
<roc>
I think there is a significant difference between using wget to copy a font from someone else's server to your server, and serving it from your server
04:06
<roc>
vs putting a reference to someone else's server in your style sheet
04:07
<annevk>
othermaciej, btw, since you implemented <section> and all you should probably also implement the h1 styling rules from http://www.whatwg.org/specs/web-apps/current-work/complete.html#fonts-and-colors
04:07
<annevk>
othermaciej, they're after the initial block
04:08
<annevk>
roc, that's not quite the scenario he is sketching though
04:08
<annevk>
roc, also, I don't think anyone is against having a header for font files that says From-Origin: same or some such
04:10
<roc>
what would that do?
04:11
<annevk>
if that header is present and the UA will only use the resource if its same-origin with the Document it will be used for
04:12
<othermaciej>
annevk: yeah, we'll do that at some point
04:12
<othermaciej>
annevk: I guess either with a combinatorial explosion of rules, or we'll implement -webkit-any()
04:12
<annevk>
othermaciej, I'm afraid that if you wait sites will start depending on the default style rules
04:13
<othermaciej>
we also didn't implement the default margins yet
04:13
<othermaciej>
annevk: well, sites can use <section> just fine in browsers with 0 support
04:14
<annevk>
yeah, all the more reason to get the default style rules out there, but I see your point
04:14
<othermaciej>
our native support effectively just adds display: block, makes the interface HTMLElement instead of HTMLUnknownElement, and adds implicit <p> closing (and similar parsing effects)
04:14
<othermaciej>
oh, it looks like Hixie took away the default margins for sectioning elements
04:15
<roc>
annevk: I believe the number of sites that want same-origin checks will greatly exceed the number of sites that want to serve fonts cross-origin
04:16
<othermaciej>
anyway, I'll have to ask hyatt if adding those rules for h1 would cause any perf issues
04:16
<othermaciej>
I vaguely recall that rules with lots of indirect ancestor combinators can be slow
04:16
<othermaciej>
so it might be worthwhile to add a :-webkit-section-level() pseudo or the like
04:17
<annevk>
roc, I believe most sites won't care, much like most don't care about other resources
04:17
<roc>
I believe that too
04:18
<annevk>
creating special solutions for fonts seems backwards to me
04:18
<roc>
well, it depends on how widespread commercial fonts become on the Web and how much Web authors care about their license agreements
04:19
<roc>
imposing a same-origin restriction for fonts really isn't all that special. It's not like we invented same-origin restrictions.
04:20
<annevk>
well I think it is special
04:21
<roc>
ok
04:21
<annevk>
so far we only used same-origin restrictions if certain conditions apply
04:21
<annevk>
they don't apply to fonts
06:28
<JonathanNeal_>
heyo!
06:30
<alt-dot-net-geek>
hello
08:04
<annevk>
hmm, so fetch does not disable Referer if the origin passed in is a unique identifier
08:04
<annevk>
maybe I should ask for a Referer flag or something
08:12
<othermaciej>
it seems like Fetch should disable the referer in that case
08:12
<othermaciej>
er
08:12
<othermaciej>
wrong capitalization but you get the idea
08:12
<othermaciej>
it would never be right to send a unique origin referer
08:13
<annevk>
well, the Document in question could still have an origin
08:14
<annevk>
and an associated URL
08:14
<othermaciej>
annevk: so Tyler says anonymous requests (or whatever we call them) should discard Set-Cookie headers in the response
08:14
<othermaciej>
annevk: are you going to do that? I don't think it is an automatic side effect of unique identifier origin
08:14
<othermaciej>
he also mentioned "It would also need to prohibit the reuse of a TLS
08:14
<othermaciej>
client authenticated connection or NTLM authenticated connection. It
08:14
<othermaciej>
would also need to prevent use of cache entries populated by
08:14
<othermaciej>
non-uniform requests."
08:14
<annevk>
what I just checked in discards setting cookies when the credentials flag is false
08:15
<othermaciej>
I see he also mentioned Referer so maybe you are looking at his issues
08:15
<annevk>
so it's affected by withCredentials not by unique origins
08:15
<othermaciej>
I need to re-review the drafts for possible subset violations
08:15
<annevk>
but for the "new API" it comes down to the same thing
08:15
<othermaciej>
yeah it should be withCredentials based
08:15
<othermaciej>
that makes sense
08:15
<annevk>
(as the new API has credentials set to false and a unique origin)
08:16
<annevk>
I'm not quite sure what I should say exactly about TLS NTML and cache entries
08:16
<othermaciej>
did you settle on a name yet?
08:16
<othermaciej>
I apologize for splashing so much paint on the bikeshed
08:16
<annevk>
not really
08:16
<annevk>
guess I should read that thread with suggestions one more time
08:16
<othermaciej>
I think TLS and NTLM should be effects of withCredentials
08:17
<othermaciej>
and would be covered by a suitable definition of user credential
08:17
<othermaciej>
NTLM does per-connection auth, you can't really share a connection that's been NTLM-authenticated for no-credential requests
08:18
<annevk>
we could do ContextFreeRequest I suppose which inherits from XMLHttpRequest and is therefore on the same prototype chain and all
08:18
<othermaciej>
it's a bit of a computer-sciencey name
08:18
<othermaciej>
though not obviously worse than the others
08:19
<annevk>
so maybe I have TLS/NTML already: http://dev.w3.org/2006/waf/access-control/#credentials
08:19
<annevk>
though I should rename credentials to user credentials
08:19
<annevk>
UniformRequest makes no sense to me
08:19
<annevk>
GuestRequest is pretty good
08:20
<annevk>
incognito is too hard to spell
08:22
<hsivonen>
Is discarding cookies something that Caja can control if UMP is implemented on top of XHR?
08:22
<annevk>
no
08:22
<annevk>
XHR is cookie-ignorant
08:22
<annevk>
API-wise that is
08:22
<hsivonen>
does Set-Cookie in an XHR response set cookie in the browser HTTP stack?
08:22
<annevk>
yes
08:23
<annevk>
or just GuestXMLHttpRequest
08:23
<annevk>
I'm not too interested in this rhetorical context Mark went on about
08:25
<annevk>
so remaining issues
08:25
<annevk>
1) Referer handling -- should maybe be fixed in HTML5
08:25
<othermaciej>
annevk: it would be nice if the name was something that implies "dropping privileges"
08:25
<othermaciej>
hsivonen: Set-Cookie is done in the http stack but I believe http stacks expose enough that the browser could inhibit it per-request
08:25
<annevk>
2) some kind of replacement for new XMLHttpRequest(true)
08:26
<othermaciej>
annevk: I could have sworn HTML5 handled Referer
08:26
<annevk>
3) maybe some twiddling with the definition of credentials and at least renaming it
08:26
<annevk>
othermaciej, it does, but it does not allow for disabling it
08:27
<annevk>
othermaciej, what we have here is a Document object with a known origin and an API that wants a unique origin; all HTML5 allows for here is including the Referer and setting Origin to null
08:27
<othermaciej>
annevk: "If the origin of the appropriate Document is not a scheme/host/port tuple, then the Referer (sic) header must be omitted, regardless of its value."
08:27
<annevk>
(i.e. context-free requests)
08:27
<othermaciej>
http://dev.w3.org/html5/spec/Overview.html#fetch Step 1
08:28
<annevk>
othermaciej, right, but the origin of _Document_ is a tuple, it's just that the XMLHttpRequest origin is not
08:29
<othermaciej>
annevk: ah - Referer is obtained from the Document's origin, not the passed-in origin
08:29
<othermaciej>
annevk: that is weird
08:29
<othermaciej>
annevk: perhaps Referer should also be dropped when the passed-in origin does not match the document's origin
08:30
<othermaciej>
I don't know what cases besides this new XHR feature use an explicit origin different from the document origin
08:32
<othermaciej>
I wish it was easy to find all references to the fetch algorithm
08:32
<annevk>
yeah, something like that might make sense
08:32
<othermaciej>
it's kind of hard to find which ones, if any, pass in an explicit origin
08:32
<annevk>
in the WHATWG copy you can click on "fetch"
08:32
<othermaciej>
I suspect nothing in HTML5 proper does
08:32
<annevk>
not sure if the W3C has the backreferences script
08:32
<othermaciej>
sold!
08:32
<othermaciej>
I only use the w3c copy because it's higher in the google rankings and I'm too lazy to type either URL
08:32
<othermaciej>
or even autocomplete
08:34
<othermaciej>
EventSource explicitly passes an origin, but the one it passes explicitly is the default one that would be used for an API
08:34
<annevk>
browsers should make the faster path to sites more convenient
08:34
<othermaciej>
likewise for importScripts
08:34
<othermaciej>
if I visit the spec enough times in a week it ends up in my Safari Top Sites
08:34
<othermaciej>
but I don't read it quite enough for it to stay there
08:34
<annevk>
what I think is actually the case here is that the origin argument is just used to determine whether the Origin header should be set to null or not
08:34
<othermaciej>
though I guess I could pin it if I cared to
08:35
<othermaciej>
the origin argument isn't actually passed in the Origin header?
08:35
<othermaciej>
no, that's not right "For the purposes of the Origin header, if the fetching algorithm was explicitly initiated from an origin, then the origin that initiated the HTTP request is origin."
08:36
<othermaciej>
I see - when the origin is *not* passed in, then you do "Origin: null"
08:36
<othermaciej>
kinda wacky
08:37
<annevk>
it's not very convenient either because you need to know beforehand whether to pass it or not based on whether it is a tuple or a unique identifier
08:37
<othermaciej>
if it's a unique identifier then I think it will produce "Origin: null" anyway
08:37
<othermaciej>
I guess the other places that hide the origin don't want to hide the referer
08:38
<annevk>
guess I should check up on that in the Origin draft
08:39
<annevk>
ah yes, you're right
08:40
<annevk>
the Origin draft deals with serialization
08:40
<annevk>
http://tools.ietf.org/html/draft-abarth-origin for people following at home
08:44
<annevk>
(renamed credentials to user credentials)
08:47
<hsivonen>
has any browser implemented the Origin header yet?
08:47
<annevk>
Gecko and WebKit I think
08:48
<annevk>
oh, and IE for XDomainRequest
08:48
<hsivonen>
annevk: for all requests or just for XHR?
08:51
<annevk>
for all I believe
08:51
<othermaciej>
I think WebKit implements it for all
08:51
<othermaciej>
but I am not sure
08:53
<hsivonen>
hmm. I can't easily test, because the Gecko builds I use are always ahead of extensions
08:53
<hsivonen>
the good thing about Opera's kitchen sink approach is that the kitchen sink is built with the rest of the app
08:54
<hsivonen>
ok. I managed to override Live HTTP Headers extension compat
08:54
<hsivonen>
it seems Gecko doesn't send Origin for all requests
08:56
<hsivonen>
even the GET to whatwg revision.dat doesn't have Origin according to Live HTTP Headers
08:57
hsivonen
sees "However, a centralized repository for mappings is an obviously desirable thing." in http://people.xiph.org/~xiphmont/lj-pseudocut/o-response-1.html
08:58
hsivonen
wonders if the TAG would agree
08:59
<othermaciej>
yeah, why don't they just embed URIs in the code stream, that map to prefixes, which are then embedded in each packet to identify the mapping
08:59
<othermaciej>
s/code stream/codec stream/
09:00
<othermaciej>
that's the more natural way to do it
09:06
<annevk>
filed http://www.w3.org/Bugs/Public/show_bug.cgi?id=9603 and http://www.w3.org/Bugs/Public/show_bug.cgi?id=9604
09:07
<gsnedders>
Dashiva: Hey, that still gives me a year to get married!
09:07
<annevk>
I handled setting cookies in a generic section for now, but it might make more sense to have it as part of fetching, since it is handled there already
09:07
<gsnedders>
Dashiva: And seeming I'm meant to be engaged to a Swedish girl by the end of August, that's plenty of time
09:07
<gsnedders>
*just under two years to get married
09:40
<jgraham>
gsnedders: GLWT
09:57
gsnedders
feels bad having to look up what GLWT means
09:58
<jgraham>
gsnedders: It's short for "all the best looking boys are taken, all the best looking girls are staing inside"
09:59
<jgraham>
*staying
10:04
<gsnedders>
So can I get a good looking, but not best looking girl/boy?
10:09
<annevk>
or maybe we should just stick to AnonXMLHttpRequest()
10:09
<annevk>
it wasn't a bad name
10:09
annevk
sighs
10:12
<roc>
it sounded good to me
10:12
<roc>
"Uniform" is a total head-scratcher
10:15
jgraham
wonders what the suggestions have been
10:15
<jgraham>
"GuestXML..." sounds very dubious to me
10:16
<jgraham>
I can't think of anywhere else on the Web where "Guest" is used to mean "without sending some data"
10:16
<jgraham>
And it's not obvious that that's what it does mean from the name
10:17
<annevk>
outside the web it usually means something like what it means here
10:17
<annevk>
guest accounts
10:17
<jgraham>
Yeah, I guessed that's where it came from
10:17
<jgraham>
But I still don't think it is obvious
10:17
<annevk>
would be great if there was any web platform precedent
10:18
<hsivonen>
XMLHttpRequestNoLogin
10:19
<annevk>
that would get the same objections as Anon
10:19
<Philip`>
XMLHttpRequest2
10:19
hsivonen
is unaware of the objection
10:19
<annevk>
see this subthread: http://lists.w3.org/Archives/Public/public-webapps/2010AprJun/thread.html#msg262
10:19
<annevk>
somewhere around there
10:20
<annevk>
Philip`, no
10:20
jgraham
is unaware of the whole thread other than what has been discussed here
10:20
<annevk>
alright, going for food now
10:20
<annevk>
will check logs later
10:20
<hsivonen>
annevk: anyway, I agreewith zcorpan's reasoning for having a suffix instead of a prefix
10:22
jgraham
has exactly no idea what semantic "Uniform" is supposed to convey
10:23
<Dashiva>
The same as URL, that is, nothing useful
10:42
<gsnedders>
So I found out yesterday that I have just over a week to decide about uni, which goes against what the guide said about when the deadline to decide was
10:49
<Philip`>
I thought you'd already spent about two years trying to decide, so another few weeks or months wouldn't make any difference
10:53
<gsnedders>
I thought three
10:54
<Philip`>
Three is about two
10:57
<gsnedders>
jgraham just bullied me into accepting it.
10:57
<gsnedders>
Now he rolling his eyes
10:57
<gsnedders>
And saying I speak like a foreigner
10:57
<gsnedders>
I must be Swedish already
10:57
<gsnedders>
No need to get married and stay here now
11:59
<hsivonen>
hmm. it sure is confusing that in the case of multiple <base> elements, the first one with href takes effect for href and the first one with target takes effect for target
12:05
<zcorpan>
hsivonen: is that implemented in gecko?
12:07
<hsivonen>
zcorpan: as of this week, yes
12:32
<mut>
hey, on canvas, how can i display a degrees symbol in text... like &deg
12:34
<gsnedders>
ctx.fillText("°", 0, 0)?
12:34
<mut>
hmm its not showing
12:34
<mut>
heh just shows a ?
12:34
<mut>
in a blackbox
12:34
<gsnedders>
ctx.fillText("\u00B0", 20, 20) if you don't want to actually have non-ASCII chars
12:34
<roc>
maybe your font doesn't have it?
12:34
<mut>
ah
12:35
<roc>
what browser?
12:35
<mut>
;) thanks
12:35
<mut>
err firefox
12:35
<mut>
chroime
12:35
<roc>
hmm
12:35
<gsnedders>
Yeah, that's the other likely thing
12:35
<mut>
and ie
12:35
<roc>
wait
12:35
<roc>
IE?
12:35
<mut>
yea with plugin
12:35
<mut>
sorry
12:35
<roc>
OK, no idea
12:35
<roc>
Firefox should display something if *any* font in your system supports that character
12:35
<roc>
which seems ... likely
12:35
<mut>
sweet that works now
12:35
<mut>
in ie too ;)
12:51
<jgraham>
hsivonen: Party time!
12:51
<gsnedders>
hsivonen: Congrats on getting it enabled by default at last
12:51
<hsivonen>
jgraham: yeah. and time to update the validotor, too. :-)
12:51
<hsivonen>
gsnedders: thanks
12:54
<gsnedders>
I guess the real question is whether you now get a load more bugs reported.
12:54
<hsivonen>
yes. interesting times.
12:58
<roc>
I'm glad our parser is deterministic now
12:58
<roc>
at least I hope it is!
13:03
<hsivonen>
roc: the tree shape should be deterministic now but the network loads started as the side effect of the parse aren't
13:29
<zcorpan>
hsivonen: data:text/html;charset=utf-8,x%c2
13:30
<zcorpan>
hsivonen: should give an U+FFFD, right? doesn't with html5.enable (haven't tested without)
13:30
<hsivonen>
zcorpan: yes, it should. thanks
15:23
Dashiva
wonders if the sarcasm tag will survive last call
15:25
<gsnedders>
Dashiva: Which sarcasm tag?
15:25
<Dashiva>
The one in HTML5
15:25
<gsnedders>
Ah, the end sarcasm tag ;P
15:27
<Dashiva>
It's a shame you need <sarcasm> as well to avoid the parse error
15:27
<jgraham>
Dashiva: What is this last call of which you speak
15:28
<jgraham>
?
15:28
<Dashiva>
It's a mythical golden age prophecized to occur in the near future
15:29
<Dashiva>
When all bugs and issues will be vanquished, and leading to the implementations rising to claim their heritage
15:30
<jgraham>
When have prophets even been right?
15:30
<Philip`>
jgraham: Whenever they've made a sufficient number of sufficiently vague predictions that some are bound to be interpreted after the fact as right?
15:31
<CoJaBo-Aztec>
the economy sucks. Not much prophets now :P
15:32
<cardona507>
good morning :)
15:32
<jgraham>
Philip`: This "last call" thing sounds altogether too specific in that case
15:32
<Dashiva>
No, no
15:32
<Dashiva>
You assume a concrete definition of bugs and issues in that case
15:35
<gsnedders>
Sitting cross-legged on my chair always ends up with on my legs being numb
15:35
<gsnedders>
That makes standing up challenging
15:35
<hsivonen>
well, the HTML5 parsing fun didn't last. http://hg.mozilla.org/mozilla-central/rev/ccb50d524490
15:37
<CoJaBo-Aztec>
randomorange?
15:37
<jgraham>
Orange == failed tests
15:38
<jgraham>
random orange == random failed tests
15:38
<jgraham>
== bad
15:38
<jgraham>
(I think)
15:39
<davidb>
yes random == hard
15:39
<gsnedders>
Random tests are my favourite.
15:40
<davidb>
what about random failures? :)
15:40
<jgraham>
The "I think wasn't about "== bad"
15:40
<jgraham>
s/k/k"/
15:40
<gsnedders>
davidb: They're just a subset of them
15:40
<davidb>
jgraham all your statements looked correct
15:43
<jgraham>
How does Mozilla deal with tests that currently fail? Are they just not run or?
15:43
<davidb>
Everything is a judgement call, but generally we back out anything that regresses tests
15:44
<jgraham>
Right but I mean if you, say, add the CSS testsuite but know that you don't support all of the functionality yet
15:44
<jgraham>
So some tests fail
15:45
jgraham
remembers the expected fail state
15:45
<jgraham>
but if an expected fail passes does it have to be manually updated to expected pass or?
15:50
<davidb>
jgraham: yeah there are expected fail type of options, as well as per test things like mochitest "todo" etc. lots of choices, but generally requires manually updating when they pass
15:50
<davidb>
sorry for lag, i'm multi-chatting/tasking
15:50
<davidb>
as are we all i know :)
15:52
<hsivonen>
jgraham: upstream tests don't get run before someone sees them as green locally and pushes them to mozilla-central
15:53
<jgraham>
davidb: np. Thanks for sharing :)
18:27
<jgraham>
hsivonen: Ah. That is quite different from our approach
19:03
<davidb>
jgraham: what is your approach?
19:18
<JonathanNeal>
Hey everybody.
19:46
<jgraham>
davidb: Basically we record the result of every test in every build and look for changes between builds
19:47
<davidb>
i see
19:47
<davidb>
regressions are what matter
19:48
<jgraham>
Well yes, they get particular attention.
20:33
<tonyg-cr>
Does anyone happen to know if first posts to public-webapps⊙wo are moderated and if so, who approves them?
20:35
<jwalden>
I don't believe they're moderated, but my knowledge is about a year old (I think)
21:13
<webben>
maybe interesting data point wrt OCR of images with missing @alt: the WebVisum extension (current status, maybe iffy, some of their links are down) for firefox actually did this: http://preview.tinyurl.com/27e8ubo