| 00:11 | <AryehGregor> | IPv6 not working reliably for you? :) |
| 01:01 | <Hixie> | AryehGregor: what would <script>alert('&%dGVzdA==;')</script> alert, if anything? |
| 01:02 | <AryehGregor> | Hixie, I don't know, it's not my proposal. |
| 01:02 | <Hixie> | (and how about <script>alert(&%Jyk7YWxlcnQoZG9jdW1lbnQuY29va2llICsgJw;)</script>) |
| 01:02 | <Hixie> | k |
| 01:03 | <Hixie> | ah, anne answered my question |
| 01:10 | Philip` | notes that some pages write <a href="foo%20&%20;bar.html"> |
| 01:11 | <Philip`> | so it's not entirely clear the proposed syntax is safe |
| 01:12 | <Hixie> | well the character can be changed, certainly |
| 01:12 | <Hixie> | doesn't have to be *% |
| 01:12 | <Hixie> | &% even |
| 01:12 | <Hixie> | (i was wondering about that myself) |
| 01:13 | <AryehGregor> | It could be a multicharacter string, like "xn--". :) |
| 01:13 | <jcranmer> | just make it My |
| 01:14 | <jcranmer> | who'd use that? ;-) |
| 01:15 | <Philip`> | Seems a bit strange to me to design something based on the assumption that people are too uninformed to follow a few simple rules (like always quote attributes and use some particular escape function based on current syntax), but will be able to use a new syntax and escaping function without getting horridly confused |
| 01:15 | <Philip`> | particularly since for the next five years people will write articles saying not to use this syntax yet, since it's not backward-compatible with IE6 |
| 01:16 | <Philip`> | and after that people will continue reading those articles |
| 01:17 | <AryehGregor> | The only possible utility I see is easy escaping in <script>, and I'm far from sure that that justifies it. |
| 01:17 | <Philip`> | (Also everybody will get the character encoding wrong, and it's terrible for 'view source') |
| 01:17 | <AryehGregor> | "View source" can translate it, in principle. |
| 01:17 | <Philip`> | Then it wouldn't be 'view source' |
| 01:17 | <Philip`> | It'd be 'view something that's a bit like the source but not quite' |
| 01:17 | <Philip`> | and anyway my text editor won't translate it when opening an .html file |
| 01:18 | <AryehGregor> | Isn't that what "view source" already is, at least in Firefox? |
| 01:19 | <Philip`> | No |
| 01:19 | <Philip`> | as far as I'm aware |
| 01:19 | <Philip`> | unless you mean 'view selection source' |
| 01:19 | <Philip`> | which seems fancier |
| 01:19 | <AryehGregor> | I think it mangles the source. Maybe I'm wrong. |
| 01:20 | <Philip`> | Wouldn't this new syntax break blacklist-based XSS filters because you could write <span style="&%XhwcmVzc2lvbjphbGVydCgnb2ggbm8nKQo=;"> etc and sneak in forbidden properties? |
| 01:21 | <AryehGregor> | Probably. |
| 01:21 | <Philip`> | (Uh, I got that syntax all wrong) |
| 01:27 | <Hixie> | blacklist-based XSS filters are already broken |
| 01:29 | <Philip`> | People seem to design them to be sufficiently complex and conservative to successfully work in practice |
| 01:30 | Philip` | thought MediaWiki had something like that |
| 01:31 | <wirepair> | really? |
| 01:32 | <wirepair> | every site i've ever tested has failed |
| 01:32 | <wirepair> | ;) |
| 01:33 | <wirepair> | especially when developers are taking user input and assigning it inside of <script> </script> blocks |
| 01:33 | <wirepair> | it's impossible to create a blacklist for that |
| 01:34 | <Philip`> | http://svn.wikimedia.org/viewvc/mediawiki/trunk/phase3/includes/Sanitizer.php?view=markup#l744 - that kind of thing |
| 01:35 | <wirepair> | input validation/filtering is different than black listing |
| 01:35 | <wirepair> | when i think of blacklisting i'm thinking like lookign for <script> tags |
| 01:35 | <wirepair> | or whatever |
| 01:36 | <Philip`> | preg_match( '! expression | filter\s*: | accelerator\s*: | url\s*\( !ix', $value ) |
| 01:36 | <Philip`> | That's the blacklisting |
| 01:36 | <Philip`> | and first it does some filtering to remove escaping and spaces and comments and other potentially dangerous things |
| 01:37 | <Philip`> | but it looks like it probably will accept &%...; input unchanged |
| 01:37 | <Philip`> | which lets the input circumvent the blacklist |
| 01:38 | <wirepair> | yeah |
| 01:38 | <wirepair> | where is this new proposal anwyays |
| 01:38 | <Philip`> | WHATWG list |
| 01:39 | <wirepair> | got it |
| 01:50 | <wirepair> | hu, i mean i think it makes sense and protects elements in some cases |
| 01:56 | <mpilgrim> | othermaciej: yt? |
| 01:56 | <othermaciej> | mpilgrim: good day sir |
| 01:56 | <mpilgrim> | i'm having reports that http://diveintohtml5.org/detect.html crashes the iPad browser |
| 01:57 | <mpilgrim> | do you have access to an iPad to verify that? |
| 01:57 | <othermaciej> | sure I can test |
| 01:58 | <othermaciej> | cannot reproduce |
| 01:58 | <othermaciej> | it loaded fine for me |
| 01:58 | <mpilgrim> | well shit |
| 01:59 | <mpilgrim> | source of the bug report claims it happens for others too: http://twitter.com/al3xandru/status/22220332275 |
| 01:59 | <mpilgrim> | the only recent change i made was the font-face declaration, it now includes an SVG font (generated by fontsquirrel's awesome font-face generator) |
| 02:00 | <mpilgrim> | i'm waiting on reports about whether http://diveintohtml5.org/test.html (which is the same page, but without the SVG font-face declaration) also crashes |
| 02:00 | <paul_irish> | i can repro the crash on iPad |
| 02:00 | <mpilgrim> | aha |
| 02:01 | <mpilgrim> | when does it happen? on load? |
| 02:01 | <paul_irish> | test.html does not crash. |
| 02:01 | <mpilgrim> | hooray! |
| 02:01 | <mpilgrim> | er, |
| 02:01 | <mpilgrim> | you know what i mean |
| 02:01 | <paul_irish> | (yeah on load) |
| 02:01 | <mpilgrim> | ok |
| 02:01 | <mpilgrim> | it's definitely the SVG fonts then |
| 02:01 | <paul_irish> | the only difference is the url('f/essays1743-italic-webfont.svg#webfontmRs1TiYo') format('svg') and such? |
| 02:01 | <mpilgrim> | yes |
| 02:02 | <mpilgrim> | 5 or 6 instances -- two fonts with different styles/variants |
| 02:02 | <paul_irish> | Yeah sounds like ripe territory for a bug. |
| 02:03 | <othermaciej> | I tried a few more times and still no crash |
| 02:03 | <mpilgrim> | well, crashing is definitely a bug -- dunno if it's exploitable, but still |
| 02:03 | <mpilgrim> | i'd hate to be responsible for the next major jailbreak exploit :-D |
| 02:03 | <othermaciej> | I'm running iOS 3.2.2 |
| 02:03 | <othermaciej> | (7B500) |
| 02:03 | <paul_irish> | 3.2 (7B367) |
| 02:04 | <othermaciej> | would love to hear if it still happens for you after updating |
| 02:04 | <othermaciej> | I think odds are good that this is a fixed bug, as I recall hearing about a bug with svg fonts |
| 02:05 | <mpilgrim> | i wonder if google's font API team knows about this |
| 02:05 | <paul_irish> | i'll ping them about it. |
| 02:06 | <mpilgrim> | not sure how we would detect it |
| 02:06 | <mpilgrim> | UA sniffing, i guess :( |
| 02:06 | <mpilgrim> | hard to detect a browser crash ahead of time |
| 02:06 | <mpilgrim> | what with the halting problem and all that |
| 02:06 | <paul_irish> | yup. would have to. |
| 02:07 | <othermaciej> | people tend to update iOS pretty quickly, though maybe a bit less for for minor updates |
| 02:07 | <mpilgrim> | are you willing to upgrade your iPad for science? |
| 02:07 | <mpilgrim> | (@paul_irish) |
| 02:07 | <paul_irish> | dont have a cable handy at the moment, but as soon as we do, certainly will. |
| 02:08 | <mpilgrim> | ok |
| 02:08 | <mpilgrim> | i'll leave those SVG fonts up at their current locations, but i'm going to update my HTML to stop referring to them |
| 02:09 | <mpilgrim> | in lieu of doing minor-version UA sniffing, which is the kind of extreme optimization that my employer might be willing to do, but I personally am not |
| 02:21 | <variable> | Hixie, around ? |
| 03:08 | <wirepair> | Hixie do you have any license for your live DOM Viewer? I'd like to include it in my browser testing kit |
| 03:33 | <Hixie> | wirepair: what license is your browser testing kit? |
| 03:41 | <wirepair> | haven't decided yet ;) |
| 03:41 | <wirepair> | whatever license says you can use it / modify it, but can't just sell it without giving back source |
| 03:46 | <Hixie> | if you use MIT, BSD, GPL 2 or 3, or Apache 2, feel free to just use it under the same license |
| 03:47 | <wirepair> | thanks, is there any server side code? or what you see is what you get at http://software.hixie.ch/utilities/js/live-dom-viewer/ |
| 03:54 | <variable> | wirepair, just use the BSD licence - simple. easy. free. ;) |
| 03:54 | <Hixie> | there's some server-side code for the saving/loading, iirc |
| 03:54 | <Hixie> | but should be trivial enough to reimplement |
| 03:54 | <variable> | Hixie, about the type="username" proposal. If I understand correctly the issue was lack of any UA difference? |
| 03:56 | <Hixie> | variable: the main issue was that we already have solutions in place that people aren't using, so there's no reason to believe anyone will use new features |
| 03:56 | <Boogyman> | html5 discussion? |
| 03:56 | <variable> | Hixie, you don't think that browser vendors have more of a focus on HTML5 over other standards? |
| 03:57 | <Hixie> | like which? |
| 03:57 | <Hixie> | by "people" i meant authors, not browser vendors |
| 03:58 | <variable> | Hixie, or document authors. I'm fairly knolegeable of various web standards - but I've never heard of RFC3106 |
| 03:58 | <Hixie> | well, you've heard of it now :-) |
| 03:59 | <variable> | Hixie, only cause I followed that specific proposal before it made it to HTML5. For the document authors that care about semantics and use the HTML5 spec - but don't follow the development of the spec - they won't ever hear of it |
| 04:00 | <variable> | and IMHO a document author should not be expected to follow the WHATWG mailing list |
| 04:00 | <variable> | in order to find out how to mark up things properaly |
| 04:00 | <variable> | *properly |
| 04:02 | <Hixie> | variable: i think plenty of other specifications have managed to get plenty of exposure without being in the technology of the day (be that html5 or whatever) |
| 04:03 | <Hixie> | variable: if peoplereally want a solution, they'll use the one that exists |
| 05:40 | <MikeSmith> | brianleroux++ |
| 05:40 | <MikeSmith> | for lots of reasons |
| 05:42 | <MikeSmith> | but at the moment, for http://github.com/brianleroux/wtfjs |
| 08:05 | <annevk> | hmm, charset registration is also failing it seems |
| 08:05 | <annevk> | 3 months without answer |
| 08:05 | <annevk> | actually 4 |
| 08:06 | <annevk> | geez |
| 09:07 | <virtuelv> | Neat; http://joshduck.com/periodic-table.html |
| 09:08 | <annevk> | added responseBlob to XMLHttpRequest Level 2 |
| 09:09 | <annevk> | somewhat tempted to also add followRedirects |
| 09:11 | <virtuelv> | annevk: unconditionally follow them, or with limitations? |
| 09:12 | <annevk> | xhr.followRedirects would be a boolean |
| 09:12 | <annevk> | true by default (as it is now) |
| 09:12 | <annevk> | when set to false you simply get the response |
| 09:12 | <annevk> | e.g. 302 BLAHDIEBLAH\n\nLocation: somewhereelse |
| 09:13 | <annevk> | euh \r\n but you get the idea |
| 09:13 | <annevk> | it's low-level but allows people to implement everything they want |
| 09:15 | <virtuelv> | annevk: are there any security implications? |
| 09:15 | <annevk> | not as far as I know |
| 09:17 | <virtuelv> | off-site redirects and CORS? |
| 09:17 | <annevk> | virtuelv, off-site redirects are required to carry CORS headers |
| 09:17 | <annevk> | already |
| 09:18 | <virtuelv> | so no additional implications. good |
| 09:18 | <annevk> | i.e. cross-origin redirect responses without CORS headers result in a network error today |
| 10:19 | <jgraham> | (btw whatwg.org seems to be down) |
| 10:26 | <hsivonen> | jgraham: wfm |
| 10:29 | <jgraham> | Oh |
| 10:31 | <jgraham> | hsivonen: Fails for me from two different locations |
| 10:35 | <hsivonen> | http://lists.w3.org/Archives/Member/w3c-wai-pf/2010JulSep/0000.html (Member-only) |
| 10:37 | <annevk> | hsivonen, wtf |
| 10:38 | <annevk> | must be some fatal misunderstanding |
| 10:38 | <annevk> | also sad why they make all kinds of assumptions instead of simply sending an email with the question |
| 10:40 | <jgraham> | Yeah, WTF |
| 10:40 | <gsnedders> | Um, okay. |
| 10:40 | <hsivonen> | annevk: I wonder how many 'requirements' come about in a comparable way |
| 10:41 | <hsivonen> | but see also 0008 |
| 10:46 | <annevk> | keep getting surprised |
| 10:57 | <hsivonen> | Why does WebKit trt to clone IE where IE disallows innerHTML setter? |
| 10:57 | <hsivonen> | when html5 makes it work on every html node |
| 10:57 | <hsivonen> | s/trt/try/ |
| 11:11 | <micheil> | morning Rik` |
| 11:20 | <Rik`> | hi micheil |
| 11:47 | <annevk> | hsivonen, do they still do that with the new HTML parser? |
| 11:56 | <hsivonen> | annevk: looks like it but I'm not sure |
| 13:47 | <annevk> | xhr.followRedirects defined |
| 13:47 | <annevk> | including support in CORS |
| 19:39 | <Hixie> | should i just s/float/double/ ? |
| 19:39 | <Hixie> | people keep asking for changes along those lines? |
| 19:40 | <micheil> | float as in 1.5567633 |
| 19:40 | <micheil> | yeah? |
| 19:43 | <Hixie> | yeah |
| 19:44 | <micheil> | makes sense I guess |
| 19:44 | <micheil> | doesn't bother me either way |
| 19:47 | <Philip`> | What's the value in using float? |
| 19:47 | <Hixie> | no idea |
| 19:47 | <Hixie> | to be honest |
| 19:47 | <Philip`> | I assume the harm is that it doesn't match JS Numbers so you need rounding |
| 19:49 | <Philip`> | What APIs using floating point values? |
| 19:49 | <Philip`> | s/using/use/ |
| 19:50 | <Hixie> | anything that uses floating point numbers except valueAsNumber |
| 19:51 | <Hixie> | except the latter is currently buggy because of http://www.w3.org/Bugs/Public/show_bug.cgi?id=9886 |
| 19:51 | <Hixie> | i guess we'll change to double and see who complains |
| 19:52 | <Hixie> | all the canvas stuff is float |
| 19:53 | <MikeSmith> | micheil: have you had a chance to try http://github.com/aredridel/html5 at all yet? |
| 19:53 | <micheil> | umm.. no |
| 19:53 | <Hixie> | Philip`: would there be a compat problem if i changed canvas s/float/double/? |
| 19:55 | <Philip`> | Hmm, there's some thing some Opera people mentioned |
| 19:55 | Philip` | tries to find it |
| 19:57 | <Philip`> | CORE-32111 |
| 19:58 | AryehGregor | infers Opera probably uses JIRA |
| 19:59 | <micheil> | MikeSmith: I'll follow up in a min, just talking to someone about some audio stuff.. |
| 19:59 | <MikeSmith> | micheil: no problem |
| 19:59 | <Philip`> | Hixie: http://krijnhoetmer.nl/irc-logs/whatwg/20100818#l-737 |
| 20:00 | <MikeSmith> | micheil: was just asking out of curiosity |
| 20:00 | <Philip`> | Hixie: (If you don't round to float then the value is too large and it throws) |
| 20:01 | <micheil> | MikeSmith: yeah, listening to a podcast about audio mixing, and then I managed to get talking to a rep from a company I'm looking at getting some gear from, which was pretty cool |
| 20:01 | <MikeSmith> | great |
| 20:01 | <micheil> | MikeSmith: as for the html5 parser.. |
| 20:01 | <Philip`> | Hixie: (It could be made safe by not making drawImage throw exceptions (and treat things as transparent black) but I don't know whether that kind of behaviour change has other problems) |
| 20:02 | <micheil> | MikeSmith: if it uses JSDom, then it's probably going to be pretty good |
| 20:02 | <Hixie> | Philip`: yeah whether to fire an exception or not based on what you're dividing seems suboptimal |
| 20:03 | <MikeSmith> | micheil: cool, thanks… I'm just starting to take a look at some of this stuff today |
| 20:03 | <micheil> | MikeSmith: sure thing, doing node knockout? |
| 20:03 | <MikeSmith> | nope |
| 20:03 | <MikeSmith> | I lack the chops |
| 20:03 | <MikeSmith> | at this point |
| 20:04 | <MikeSmith> | looking forward to seeing the results though |
| 20:04 | <hober> | A bug in jsdom has been driving me crazy for weeks |
| 20:04 | <MikeSmith> | spectator sports |
| 20:04 | <MikeSmith> | hober: what kind of bug? |
| 20:05 | <hober> | setAttribute doesn't seem to work |
| 20:05 | <hober> | http://gist.github.com/551578 |
| 20:06 | <Hixie> | Philip`: maybe i should say to round to whole pixels |
| 20:08 | <Hixie> | no that wouldn't work for svg inputs or something |
| 20:08 | <Hixie> | like that |
| 20:08 | <Hixie> | hmm |
| 20:08 | <Philip`> | Hixie: That would seem a bit weird since the canvas API currently never cares about pixels (except the (get|put)PixelData aberrations) |
| 20:08 | <Hixie> | yeah |
| 20:09 | <Hixie> | i'll just make it transparent black outside and see if people complain |
| 20:09 | <hober> | MikeSmith: it's entirely likely that I'm just doing something stupid, but I haven't been able to figure out what that might be |
| 20:11 | <AryehGregor> | Does anyone know how to get e-mail notification from the IE feedback thing? I haven't figured out if there's any way. |
| 20:11 | <AryehGregor> | Do they really expect me to check manually all the time? |
| 20:12 | MikeSmith | looks through hobercode to see if he can find anything that looks funny |
| 20:12 | <Philip`> | AryehGregor: I remember getting emails from them automatically |
| 20:12 | <Philip`> | (on bugs that I filed) |
| 20:13 | <AryehGregor> | Hmm. |
| 20:13 | <AryehGregor> | Maybe they got filed as spam. |
| 20:14 | <AryehGregor> | Or maybe something choked on the address I provided. |
| 20:15 | <AryehGregor> | Interesting, this site's security certificate is revoked. I wonder how that happened: https://profile.microsoft.com/RegSysProfileCenter/Error.aspx |
| 20:16 | <AryehGregor> | Actually, the same is true for all of https://profile.microsoft.com/. Nice. |
| 20:16 | <AryehGregor> | I like how Chrome refuses to give me *any* option *whatsoever* to continue. |
| 20:16 | <AryehGregor> | This kind of security theater is asinine, no real attacker with half a brain would use a bad certificate and pop up a scary warning. |
| 20:17 | <AryehGregor> | Firefox doesn't pop up any warning at all . . . |
| 20:18 | <Philip`> | Maybe Google decided to revoke all of Microsoft's certificates for a laugh |
| 20:19 | <AryehGregor> | Also, editing my profile is completely and totally broken on Minefield/Linux. |
| 20:19 | <AryehGregor> | It has required drop-down fields that it gives me no options for. |
| 20:20 | <AryehGregor> | I used to think that Microsoft was actually competent at programming and just got lazy due to lack of competition, but sometimes I have doubts. |
| 20:21 | <Hixie> | AryehGregor: no real attacker with half a brain would use a bad certificate and pop up a scary warning, but if no scary warning popped up, they could just use any arbitrary certificate |
| 20:21 | <AryehGregor> | Like every time I use IE8, it prompts me about some inane thing I don't care about (not sure what), and the only "go away" option it gives is "Ask me later". Which it does. Forever. |
| 20:21 | <Hixie> | AryehGregor: so in this particular case, it's not security theatre |
| 20:22 | <AryehGregor> | Hixie, no, but you could just pop up a scary warning and allow easy clickthrough. Attackers still would be very unlikely to trigger that, so it's fine to allow reasonably easy clickthrough. |
| 20:22 | <AryehGregor> | Chrome in this case allowed no clickthrough *at all*. |
| 20:22 | <AryehGregor> | That's just stupid. |
| 20:22 | <Hixie> | people click through things without reading them |
| 20:22 | <AryehGregor> | Sure. |
| 20:22 | <Hixie> | so it wouldn't work |
| 20:22 | <Hixie> | didn't work |
| 20:22 | <Hixie> | anyway, lunch time, bbiab |
| 20:22 | <AryehGregor> | No, it would work fine. Because attackers are unlikely to ever trigger the error, since they can typically avoid it just as easily. |
| 20:23 | <AryehGregor> | So many users will just click through without reading, but that's okay, because it's almost certainly not an attack. |
| 20:23 | <AryehGregor> | The authors of this paper were unable to find a single case, ever, anywhere, where attackers used an invalid certificate: research.microsoft.com/en-us/um/people/cormac/papers/2009/SoLongAndNoThanks.pdf |
| 20:24 | <AryehGregor> | Hmm, looks like Chrome auto-http://-adding is buggy. |
| 20:25 | AryehGregor | registers and verifies his address, maybe didn't verify it before |
| 20:27 | <AryehGregor> | Anyway, the point is, certificates are obnoxiously complicated and an innocuous error is overwhelmingly more likely than an actual attack. Even if there were a tiny number of attacks, the inconvenience it causes is surely not even close to worth it. |
| 20:28 | <AryehGregor> | The concern should become basically obsolete with STS, anyway, when all e-commerce and other important sites switch to using that. |
| 20:28 | <AryehGregor> | Since that mandates hard failure, and actually closes up the gaping hole of HTTP redirecting to HTTPS. |
| 20:29 | <AryehGregor> | Of course, once DNSSEC is deployed, it will be very simple: use the cert from DNS no matter what, and if there's an error authenticating it, you can't even resolve the domain name, so people will fix it pretty quickly. :) |
| 20:30 | <AryehGregor> | SRP would be even better, though. That's insanely hard to get wrong, if you have a basic implementation. No certificates to juggle. And best of all, it completely kills phishing, which certificates can never do. |
| 20:31 | <AryehGregor> | But something like Account Manager is a prerequisite for that. Go Firefox! |
| 20:31 | AryehGregor | checks channel stats to see if they have a stat for "talks to himself", and if anyone else is even in the running for that one |
| 20:33 | <AryehGregor> | Hixie and MikeSmith beat me. |
| 20:33 | <AryehGregor> | :( |
| 20:36 | <AryehGregor> | Anyway, I tried arguing with the Chromium security mafia before, and they didn't listen to me, so I won't bother again. |
| 20:37 | <AryehGregor> | (I should say, the person who responded did respond in some detail to all of my points, but didn't back down even though the behavior in that case was clearly broken.) |
| 20:39 | <MikeSmith> | hober: fwiw, I get same result as you for your test file |
| 20:39 | <MikeSmith> | in my environment |
| 20:42 | <MikeSmith> | that is, no attributes |
| 20:42 | <MikeSmith> | at all |
| 20:43 | <hober> | hmm |
| 20:44 | <hober> | well, kindly upvote http://github.com/tmpvar/jsdom/issues#issue/9 and hopefully tmpvar will fix it. :) |
| 20:44 | <hober> | I keep meaning to carve out some time to debug what jsdom is doing myself, but never manage to |
| 20:44 | <MikeSmith> | hober: maybe worth asking on #Node.js to see if anybody else has insight |
| 20:45 | <hober> | yeah, I've asked, and have been warnocked |
| 20:52 | <Philip`> | Hixie: Did you intentionally change the drawImage behaviour without mentioning it in the commit message? |
| 20:52 | <Philip`> | (Seems like people might miss it) |
| 20:53 | <Philip`> | (Although, I suppose I should just update my test cases and they'll notice when they look into their failures) |
| 21:03 | <hober> | MikeSmith: my impl of the html->atom algorithm fails pretty spectacularly when it can't create attributes, as I'm sure you can imagine |
| 21:03 | <MikeSmith> | heh |
| 21:09 | <Hixie> | Philip`: yeah |
| 21:53 | <MikeSmith> | silly that github doesn't support display of HTML-formatted readme files |
| 21:56 | <AryehGregor> | It would have to sanitize them. |
| 21:57 | <AryehGregor> | As the people in this room should know, sanitizing arbitrary HTML is quite nontrivial. |
| 22:07 | <hober> | Why am I even having this conversation? (Re: Bug 10455) It's like talking to a brick wall. |
| 22:12 | <AryehGregor> | Talking to brick walls is much less stressful, since they don't talk back. |
| 22:12 | <AryehGregor> | Possibly more productive, too. |
| 22:12 | <AryehGregor> | I heartily recommend it, although walls made out of wood or sheetrock work fine too. |
| 22:23 | <jgraham> | Hixie: I don't suppose you have the overwhelming desire to comment in the opera bug that Philip` mentioned earlier, so you? |
| 22:24 | <jgraham> | s/so/do/ |
| 22:24 | <jgraham> | So that we don't fix to the old behaviour |
| 22:24 | jgraham | can do it of course |
| 22:25 | <Hixie> | uri? |
| 22:31 | <AryehGregor> | Do ex-employees keep access to Opera's bug tracker? |
| 22:31 | <Hixie> | some non-employees have access |
| 22:31 | <Hixie> | to some parts of the bug tracker |
| 22:31 | <Hixie> | not a direct correlation to previous employee status |
| 22:35 | <jgraham> | CORE-32111 |
| 22:35 | <jgraham> | So er https://bugs.opera.com/browse/CORE-32111 |
| 22:39 | <jgraham> | AryehGregor: See e.g. http://operawiki.info/TheElektrans |
| 22:41 | <jgraham> | Hixie: (URL above btw) |
| 22:41 | <Hixie> | jgraham: yes, i commented as soon as you pasted it :-) |
| 22:46 | <jgraham> | Hixie: Ah, wasn't sure if you had seen it :) |
| 22:52 | <sicking> | Hixie: with regards to .value. Is IE the only browser that changes the content attribute when .value changes? |
| 22:52 | <sicking> | Hixie: i've always liked the IE model and would love to switch to it, but it might not be safe to do so if only IE is doing that :( |
| 22:56 | <AryehGregor> | This alerts null in Minefield, Chrome dev, Opera 10.60, and "foo" in IE6 (ies4linux). <!doctype html><script>var el = document.createElement("input");el.value = "foo";alert(el.getAttribute("value"));</script> |
| 22:56 | <AryehGregor> | (if that's what you meant) |
| 23:05 | <Dashiva> | Yeah |
| 23:06 | <Dashiva> | .defaultValue assigns to @value, I believe |
| 23:42 | <Hixie> | sicking: the IE model has all kinds of problems |
| 23:42 | <Hixie> | sicking: e.g. it makes browser autocomplete mutate the DOM |
| 23:42 | <Hixie> | sicking: and it just moves the default value to an IDL attribute instead of the current value |
| 23:43 | <sicking> | Hixie: the latter sounds like a much smaller problem than the general confusion of having .value != getAttribute("value") |
| 23:43 | <sicking> | Hixie: the former i don't quite understand, please elaborate |
| 23:43 | <Hixie> | .value is the current value of the control, right? |
| 23:43 | <sicking> | yup |
| 23:44 | <Hixie> | if changing .value changes the DOM, then when the UA loads the page and autofills a control, the DOM has to change |
| 23:44 | <Hixie> | so you're making the browser mutate the DOM on page load |
| 23:44 | <Hixie> | this has all kinds of issues |
| 23:44 | <sicking> | Hixie: why is that a problem? |
| 23:44 | <sicking> | such as? |
| 23:44 | <Hixie> | well it kills round-tripping, for one |
| 23:45 | <sicking> | when does autocomplete happen during important round tripping? |
| 23:45 | <Hixie> | *shrug* |
| 23:45 | <sicking> | the parsing algorithm also kills round tripping, no? |
| 23:46 | <Hixie> | seems really bad to me to have the DOM not reflect the markup after load |
| 23:46 | <Hixie> | but in any case this is all highly academic, there's no way we can change all this now |
| 23:46 | <sicking> | well, autocomplete is basically the UA helping the author type |
| 23:46 | <Hixie> | user |
| 23:46 | <Hixie> | but yues |
| 23:46 | <sicking> | sorry, yes |
| 23:46 | <sicking> | and having the DOM change as a result of the user typing doesn't seem bad to me |
| 23:47 | <Hixie> | *shrug* |
| 23:47 | <Hixie> | tell brendan about 15 years ago |
| 23:47 | <sicking> | yeah, probably academic if all other UAs do it the other way |
| 23:47 | <sicking> | Hixie: actually, this wasn't a problem until DOM L1 |
| 23:47 | <sicking> | no getAttribute before that |
| 23:48 | <sicking> | and it wasn't really a problem until much later when gecko gained marketshare |
| 23:48 | <Hixie> | ok, tell vidur about 12 years ago |
| 23:48 | <sicking> | i think it's tell me+jst+a few other about 7 years ago |
| 23:48 | <sicking> | or possibly even tell you about 3 years ago when you wrote this |
| 23:49 | <Hixie> | by the time i specced it i was just speccing current practice |
| 23:49 | <Hixie> | and really put very little thought into the logic of it |
| 23:50 | <sicking> | well, you probably at that point could have chosen either IE behavior or gecko behavior |
| 23:51 | <sicking> | but possibly too late now i agree |
| 23:51 | <Hixie> | the IE behaviour really wasn't anywhere near as logical as you're making out |
| 23:51 | <Hixie> | e.g. it threw exceptions when you set .type |
| 23:51 | <Hixie> | which i hope we are in agreement is a non-starter |