| 00:00 | <Hixie> | i'm not even talking about what he's saying |
| 00:00 | <Hixie> | just the formatting |
| 00:06 | <zcorpan> | Hixie: my guess is that bugzilla made his lines wrap |
| 00:06 | <AryehGregor> | Yes, he must have composed the thing in something that wraps lines, then Bugzilla re-wrapped them. |
| 00:47 | <AryehGregor> | sicking, are you going to comment further on bug 586763, or you're just saying r+ and that's it? Also, who should I ask for superreview? |
| 00:48 | <sicking> | AryehGregor: wasn't planning on any further comments, patch looked good |
| 00:48 | <sicking> | AryehGregor: i'm sure I can come up with some changes if you really want me to? :) |
| 00:48 | AryehGregor | is really quite surprised that there's only one response on decentralized-extensibility so far after four days -- didn't other issues almost always get more comments faster? |
| 00:49 | <AryehGregor> | sicking, no, it's fine. I just wondered if you were writing up a reply now or something (although I guess that makes no sense, Bugzilla UI lets you set r+ at the same time as commenting). Who should I ask for superreview? |
| 00:49 | <Hixie> | sicking: btw, while i have you here, did you see the muted="" discussion on whatwg? |
| 00:50 | <Hixie> | sicking: http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2010-September/028755.html |
| 00:52 | <sicking> | AryehGregor: :jst is a good sr for that bug |
| 00:52 | <sicking> | Hixie: looking... |
| 00:52 | <sicking> | Hixie: yeah, i did see that |
| 00:52 | <Hixie> | sicking: specifically, you said you wanted muted="" and .muted to reflect each other, but i am worried that would set a bad precedent |
| 00:52 | <Hixie> | sicking: and am curious if my proposal of a defaultmuted="" and .defaultMuted would be ok instead |
| 00:52 | <Hixie> | (maybe with a better name) |
| 00:52 | <Hixie> | (if i can find one) |
| 00:53 | <sicking> | Hixie: was your concern mutating the dom during parsing? That i agree shouldn't happen, but i don't understand why it would |
| 00:53 | <Hixie> | yes |
| 00:53 | <Hixie> | let me explain: |
| 00:53 | <Hixie> | suppose the user has set his defaults to always mute videos |
| 00:53 | <Hixie> | so .muted is always true |
| 00:54 | <Hixie> | now support you have a page with <video src="x.ogg"></video> |
| 00:54 | <Hixie> | for .muted to be true, the element now needs a muted="" attribute, if it's reflecting |
| 00:54 | <AryehGregor> | Why does the default value of .muted depend on user preference? That seems like it will cause lots of bugs, since authors will assume it defaults to false across the board. |
| 00:54 | <Hixie> | sicking: so either the user preference doesn't apply, or the reflection breaks, or the DOM mutates |
| 00:54 | <AryehGregor> | And if they realize it doesn't, then the logical thing to do would be to just set .muted = false always right away. |
| 00:55 | <AryehGregor> | Why not have the preference be invisible to the author? |
| 00:55 | <AryehGregor> | That's how preferences generally work, no? |
| 00:55 | <Hixie> | the API is exposing the UI here |
| 00:55 | <Hixie> | if we don't expose the user preference, the UI will be out of sync |
| 00:56 | <sicking> | Hixie: i wouldn't expect user settings to be reflected in .muted? |
| 00:56 | <sicking> | Hixie: or is it expected that there will be user settings that the page can override? |
| 00:57 | <AryehGregor> | The UI won't be out of sync. It's just that there are multiple levels of muting, logically. |
| 00:57 | <AryehGregor> | So for instance, if I mute at the OS level, an individual application's UI still thinks it's unmuted. |
| 00:57 | <Hixie> | if the controls don't say "muted", but the audio doesn't play, that will be very confusing. |
| 00:57 | <AryehGregor> | If I turn off my speaker, the OS will still think it's unmuted. |
| 00:57 | <AryehGregor> | Similarly, if the user tells the browser to mute things, the page doesn't have to know about it. |
| 00:58 | <AryehGregor> | Having the default value of an attribute reflect user preference seems like a really bad idea overall. Is there any precedent for it? |
| 00:58 | <AryehGregor> | It will make things extremely inconsistent for authors. |
| 00:59 | <Hixie> | how would it be inconsistent? the whole point here is to have an API that lets you build a UI that the user can use |
| 00:59 | <Hixie> | users aren't going to want to unmute the video in 2 places |
| 00:59 | <Hixie> | they're just going to click the video's unmute button |
| 00:59 | <AryehGregor> | It's extremely inconsistent from an author perspective, because 98.6% of users will have it set to false by default, so they'll assume it's always set to false. |
| 00:59 | <AryehGregor> | Then their scripts will break when someone actually has the preference set to true. |
| 01:00 | <Hixie> | why would a script in any way depend on this |
| 01:00 | <AryehGregor> | Is that a serious question? |
| 01:00 | <AryehGregor> | Do I need to refer you to the topic? :) |
| 01:00 | <AryehGregor> | But it's very likely. |
| 01:01 | <Hixie> | can you give an example? |
| 01:01 | <AryehGregor> | E.g., you have a button you show for "muted" and another for "unmuted". |
| 01:01 | <AryehGregor> | When you initialize the UI, you start off with the "unmuted" button presented. |
| 01:01 | <AryehGregor> | Because that's always correct when you test it. |
| 01:01 | <AryehGregor> | Then when the user clicks, you mute and set the muted attribute, or unmute and unset it. |
| 01:01 | <AryehGregor> | This will display incorrectly if the muted attribute is ever true by default. |
| 01:02 | <Hixie> | that's hardly "broken", it just means the user will have to click twice |
| 01:02 | <AryehGregor> | It's buggy. |
| 01:02 | <AryehGregor> | Moreover, exposing the preference this way lets authors override user preferences, which is wrong. |
| 01:02 | <Hixie> | the whole point of this API is to let authors override the user's preferences |
| 01:02 | <AryehGregor> | My first reaction as an author if I hit this situation would be "set muted to false when I initialize the controls, that way it's consistent". |
| 01:03 | <AryehGregor> | Is it? I thought the point is to allow them to implement their own UI for things like muting. |
| 01:03 | <AryehGregor> | If the user wants all videos to be muted until they unmute them explicitly, the page shouldn't be able to override that. |
| 01:04 | <AryehGregor> | All this goes for volume too, by the way. |
| 01:04 | <AryehGregor> | These should have a single fixed default value, they shouldn't depend on user preference. |
| 01:04 | <Hixie> | if the user's preference is that the video start playing when they click play, but the author starts playing when they want, they're overriding the user's preference |
| 01:04 | <AryehGregor> | Users are used to having several levels of volume control that multiply together, and likewise several levels of muting. |
| 01:05 | <AryehGregor> | Yes, so if the browser allowed the user to express such a preference, the browser would have to ignore play() unless the user triggered it. |
| 01:05 | <AryehGregor> | But this is all theoretical. |
| 01:05 | <AryehGregor> | Do you have any reason to believe that browsers will want to implement such preferences in such a fashion? |
| 01:05 | <AryehGregor> | I doubt it. |
| 01:06 | <Hixie> | i don't have any reason to believe browsers will want to implement anything other than just providing authors with a default as to whether to start muted or not either |
| 01:06 | <AryehGregor> | I don't follow. |
| 01:06 | <Hixie> | i'm saying the spec is fine |
| 01:07 | <AryehGregor> | I'm saying browsers will ignore the whole "the muted state may start as muted" thing and just always start it as false. |
| 01:07 | <AryehGregor> | So your concern about reflecting is not practically relevant, you'd just have to remove that provision, which will be unused forever anyway. |
| 01:07 | <Hixie> | and have a separate per-tab mute control? ew |
| 01:07 | <AryehGregor> | Am I wrong? Does any browser ever start it off as true? |
| 01:08 | <Hixie> | well right now they barely implement the basics of the API, so it's too early to really say what's going to happen |
| 01:08 | <AryehGregor> | You could ask them. |
| 01:08 | <Hixie> | i've not found that to be a reliably indicator :-) |
| 01:08 | <Hixie> | reliable |
| 01:10 | <AryehGregor> | Well, if I'm right, your defaultMuted API is a pretty bad idea. |
| 01:11 | <Hixie> | but if i'm right, the muted API is even worse :-) |
| 01:11 | <Hixie> | (as a content attribute, i mean) |
| 01:12 | <AryehGregor> | Yes, certainly. |
| 01:15 | <Hixie> | i love how all the people using the whatwg style sheet now having a spinning circle in their header because they don't also run the script that gets rid of it :-) |
| 01:15 | <Hixie> | (e.g. http://dvcs.w3.org/hg/domcore/raw-file/tip/Overview.html#historical ) |
| 01:15 | <Hixie> | er |
| 01:15 | <Hixie> | minus the #historical |
| 01:19 | <david_carlisle> | Hixie (or anyone else who's managed to embed the html parser in their head better than I have), is there an example that can help me see what effect the diff at |
| 01:19 | <david_carlisle> | http://html5.org/tools/web-apps-tracker?from=5520&to=5521 |
| 01:19 | <david_carlisle> | makes for mathml in html? |
| 01:19 | <Hixie> | nothing if your markup is valid |
| 01:19 | <david_carlisle> | oh I'll go to bed then, night |
| 01:20 | <Hixie> | :-) |
| 01:20 | <Hixie> | it's stunning how much more time figuring out how to parse invalid content has taken |
| 01:21 | <Hixie> | is taking |
| 01:22 | <david_carlisle> | well has anyone suggested a draconian model where anyone who submits invalid content is hung drawn and quartered? I believe that was popular around 1998 |
| 01:22 | <david_carlisle> | that way you don't need to worry about it |
| 01:22 | <Hixie> | lots of people have suggested it :-) |
| 01:23 | <david_carlisle> | good night, I really am going this time. |
| 02:23 | <MikeSmith> | hamaji: you at the GDD 2010 event today? |
| 03:02 | <macpherson_ojan> | Hixie: yt? we are looking at some XHR issues that point to the XML fragment serialization algorithm. |
| 03:03 | <macpherson_ojan> | Hixie: not quite sure why the spec lists all the exceptions |
| 03:03 | <macpherson_ojan> | Hixie: unless we're testing it wrong, it doesn't seem that any browser fires these exceptions |
| 03:04 | <macpherson_ojan> | Hixie: e.g. serializing an element node with two attributes with the same local name doesn't give an exception in any browser |
| 03:04 | <macpherson_ojan> | Hixie: is using an xhtml strict doctype the correct way to this this algoritm? |
| 03:04 | <macpherson_ojan> | s/this this/hit this |
| 03:05 | <macpherson_ojan> | Hixie: http://tc.labs.opera.com/apis/XMLHttpRequest/send-entity-body-document-bogus.htm expects an error because of this, but it's not clear to us that it's worth implementing all these exceptions |
| 03:38 | <Hixie> | macpherson: well we have to do something, throwing an exception seemed like a simple thing to spec |
| 03:38 | <Hixie> | macpherson: if there's something else we can do, we can spec that |
| 03:55 | <macpherson> | Hixie: ojan is at lunch and will have more input, but our observation is that existing browsers don't throw an exception, but instead produce sanitized output |
| 03:55 | <Hixie> | works for me |
| 03:56 | <Hixie> | file a bug saying how each bug is to be sanitised and i'll spec that instead |
| 03:56 | <macpherson> | Hixie: will do. thanks. |
| 04:10 | <ojan_> | Hixie: is filing a bug better than emailing whatwg@? |
| 04:11 | <ojan_> | Hixie: also, are we testing this correctly? is using an XHTML strict doctype and then grabbing innerHTML or outerHTML the right way to hit what is supposed to be this codepath? |
| 04:25 | <Hixie> | ojan_: bug or e-mail makes no difference in practice |
| 04:26 | <Hixie> | ojan_: so long as you're in XML, the DOCTYPE shouldn't matter |
| 04:26 | <ojan_> | Hixie: so, what do i need to do in order to hit this codepath to see what browsers do? |
| 04:37 | <Hixie> | ojan_: simplest way is probably to use createDocument() to generate an XML doc, and then generate its DOM using the createElement() and company and then serialise that |
| 04:37 | <Hixie> | probably with innerHTML if that's supported |
| 04:37 | <ojan_> | Hixie: ok, that's what i thought, just wanted to make sure i understood. we'll give that a go |
| 04:38 | <Hixie> | you can also use XHR or just navigate straight to an XML doc, and the mutate it into the bogus state |
| 04:38 | <ojan_> | Hixie: FWIW, XHR doesn't seem to hit at least one of these exception cases in any browser |
| 04:40 | <ojan_> | Hixie: should an XHTML document hit this? |
| 04:41 | <ojan_> | Hixie: i tried an RSS feed and none of the nodes have an innerHTML/outerHTML |
| 04:41 | <Hixie> | what do you mean by "an XHTML document"? |
| 04:42 | <wirepair> | Hixie, i had a question for you regarding the use case for the Document open's replace ability. I searched mailing lists and the rationale wiki and couldn't find anything. Any thoughts? |
| 04:42 | <wirepair> | (http://dev.w3.org/html5/spec/Overview.html#dom-document-open if you need a refresher) |
| 04:42 | <ojan_> | Hixie: a .xhtml file that is proper xhtml? |
| 04:42 | <Hixie> | ojan_: if you mean xml, then yes |
| 04:42 | <Hixie> | wirepair: what's the question? |
| 04:43 | <wirepair> | like what is the purpose/use of document.open having a replace flag |
| 04:43 | <wirepair> | Causes the Document to be replaced in-place, as if it was a new Document object, but reusing the previous object, which is then returned. |
| 04:43 | <wirepair> | as in, why would anyone want that |
| 04:43 | <Hixie> | no idea |
| 04:43 | <ojan_> | Hixie: i guess the part i'm confused by, is what causes a page to be considered an HTML document. |
| 04:43 | <Hixie> | ojan_: the MIME type |
| 04:43 | <Hixie> | ojan_: text/html = HTML |
| 04:44 | <ojan_> | Hixie: hm. ok. |
| 04:44 | <Hixie> | ojan_: text/xml = XML |
| 04:44 | <Hixie> | wirepair: document.open() as a whole seems a bit weird to me |
| 04:44 | <crankharder> | it this a good forum for a WebDB question? |
| 04:44 | <Hixie> | wirepair: it's all historical at this point |
| 04:45 | <Hixie> | crankharder: if you mean Web SQL Database, then yes, but be aware that it's essentially dead |
| 04:45 | <wirepair> | yeah |
| 04:45 | <wirepair> | ok was just curious if there was a particular reason, as i see no mention of it on mailing lists, it just sort of 'appeared' in the spec as far as i can tell |
| 04:45 | <wirepair> | thanks :) |
| 04:45 | <crankharder> | Hixie: it is? :( |
| 04:46 | <ojan_> | Hixie: ah. i am now able to reproduce some of these errors :) |
| 04:46 | <crankharder> | whats the backstory on that? |
| 04:46 | <Hixie> | wirepair: it appeared because it was pointed out that it was needed for back compat, i would imagine |
| 04:46 | <Hixie> | crankharder: yeah, mozilla and microsoft said no to implementing it, so we gave up |
| 04:47 | <Hixie> | crankharder: Web Indexed DB is replacing it in spirit |
| 04:47 | <Hixie> | crankharder: but i don't work on that |
| 04:47 | <crankharder> | I was totally find w/ telling users to get FF/chrome <sadface> |
| 04:48 | <Hixie> | FF didn't do it |
| 04:48 | <Hixie> | :-) |
| 04:48 | <Hixie> | FF = mozilla |
| 04:48 | <crankharder> | is this what i want? http://dvcs.w3.org/hg/IndexedDB/raw-file/tip/Overview.html |
| 04:48 | <crankharder> | probably not implemented, eh? |
| 04:58 | <ojan_> | Hixie: anyways, sorry for all the questions. i understand the situation now. |
| 04:58 | <ojan_> | Hixie: the html5 spec seems fine. we might need to tweak XHR though. |
| 04:59 | <ojan_> | not sure yet. |
| 05:06 | <Hixie> | ojan_: k |
| 05:06 | <Hixie> | crankharder: url looks right, dunno off-hand though |
| 05:57 | <micheil> | MikeSmith: yeah, the validator for css is still a little slow. |
| 05:57 | <micheil> | but it's quicker then it was yesterday afternoon |
| 06:12 | <Hixie> | I'm interested in the opinion of others on the usefulness of having an element to convey the semantic "indicates that the contents are no longer accurate or no longer relevant". www.w3.org/Bugs/Public/show_bug.cgi?id=9429 |
| 06:13 | <micheil> | yeah, it'd probably be useful |
| 06:13 | <micheil> | or, put it, I could see use-cases |
| 06:14 | <micheil> | especially in the realtime arena, for instance with applications like Storify, where facts may change very quickly, making old data on the page become out-dated |
| 06:15 | <micheil> | I might write up a reply on that ticket later; after I've finished this judging.. |
| 06:49 | <abarth> | othermaciej: the issue about NPN not working for Java is sadface |
| 06:50 | <othermaciej> | abarth: yeah, though it would be sad to design the protocol around JDK release cycles... |
| 06:51 | <othermaciej> | I tend to think products like RoR or Node.js or Django will be the killer early adopters |
| 06:51 | <othermaciej> | that or a good apache module that integrates with some popular scripting language commonly used via Apache (PHP?) |
| 06:52 | <abarth> | i should learn more about node.js |
| 06:52 | <abarth> | it seems to be the new hotness |
| 06:52 | <othermaciej> | abarth: do you think we sound like Roy Fielding in our responses to Greg? |
| 06:53 | <abarth> | to some extent, probably |
| 06:53 | <abarth> | in retrospect, i was a bit too harsh |
| 06:53 | <othermaciej> | I try to balance any perceived harumphing with detailed explanations of the actual issues but he seems to skip over that part |
| 06:53 | <abarth> | i get along much better with roy no that I assume he has good intentions |
| 06:53 | <abarth> | and is just tired of talking with folks who don't understand http |
| 06:54 | <abarth> | s/no/now |
| 06:54 | <othermaciej> | of course he has good intentions - no one is the villain of their own story, in real life |
| 06:54 | <abarth> | like the bit about 307 and notifying users |
| 06:55 | <abarth> | he's right that browsers screwed this up a long time ago |
| 06:55 | <othermaciej> | what's the "this" that browsers screwed up? |
| 06:56 | <abarth> | allowing cross-origin non-safe methods |
| 06:56 | <othermaciej> | in a way 307 only exists because browsers screwed up on implementing the other 3xx codes |
| 06:56 | <othermaciej> | well that's a fair point |
| 06:56 | <othermaciej> | CSRF is a direct consequence |
| 06:57 | <othermaciej> | although disallowing it or making it opt-in might have made the Web in some ways less open, or led to more abuse of GET for unsafe operations |
| 06:57 | <abarth> | there's an opportunity to do something better with PUT |
| 06:57 | <othermaciej> | however, user notification is not really a solution |
| 06:57 | <othermaciej> | do you think there's anything good we can do for PUT in forms, or should we just drop that? |
| 06:58 | <abarth> | ignoring semantics for a moment |
| 06:58 | <abarth> | if all browsers had PUT forms |
| 06:58 | <othermaciej> | my inclination: drop b/c it doesn't have much of a use case as a form method |
| 06:58 | <abarth> | that only worked same-origin |
| 06:58 | <abarth> | that would be fantastic |
| 06:58 | <abarth> | basically, you'd just use PUT when you wanted CSRF protection |
| 06:59 | <othermaciej> | that's an interesting suggestion, although it would violate HTTP, including in ways that may have a material effect |
| 06:59 | <othermaciej> | (PUT is idempotent, POST is not) |
| 06:59 | <abarth> | can we invent a new method |
| 06:59 | <abarth> | that is not idempotent |
| 06:59 | <othermaciej> | POST2? |
| 07:00 | <Hixie> | LOCAL-POST |
| 07:00 | <abarth> | POST_THE_WAY_IT_WAS_SUPPOSED_TO_BE_DARN_IT |
| 07:00 | <othermaciej> | what about sites composed of multiple domains that want CSRF protection against servers outside that set? |
| 07:00 | <abarth> | CORS |
| 07:01 | <othermaciej> | I guess they can just use POST + Origin check + secret token |
| 07:01 | <abarth> | all these things run into confused deputy problems |
| 07:01 | <abarth> | if you POST2 to URLs of the attacker's choice |
| 07:01 | <othermaciej> | true |
| 07:02 | <othermaciej> | though that would be somewhat unlikely, if you can't POST2 cross-origin |
| 07:02 | <abarth> | there are deeper problems here if you want protection from active network attackers |
| 07:03 | <othermaciej> | (presumably the case where you dereference a URL to yourself unexpectedly is when you expect your counterparty to give you a third-party URL) |
| 07:03 | <abarth> | the fact that the network attacker can overwrite your cookies kind of screws you |
| 07:03 | <othermaciej> | can overwriting cookies have worse consequences than making a transaction fail, in the CSRF-type scenario? |
| 07:04 | <abarth> | we're writing a paper about this stuff now |
| 07:04 | <abarth> | it turns out that CSRF is only half the equation |
| 07:05 | <abarth> | that's about the server changing state because it thought a request came from the client |
| 07:05 | <abarth> | the flip side of that |
| 07:05 | <abarth> | is the client changing state because of a response sent by the server |
| 07:05 | <abarth> | when the attacker overwrites the user's cookies |
| 07:05 | <abarth> | the server thinks its sending the response to the attacker |
| 07:05 | <abarth> | but the response arrives at the client's machine |
| 07:07 | <abarth> | http://pastebin.com/Ui8ZXvVj |
| 07:07 | <abarth> | is a painfully detailed explaination |
| 07:07 | <othermaciej> | cookies suck |
| 07:07 | <abarth> | of what can go wrong |
| 07:07 | <abarth> | (not sure why the numbers show up twice) |
| 07:08 | <othermaciej> | why is she called "The Alice"? |
| 07:08 | <abarth> | haha |
| 07:08 | <abarth> | i think it used to say "the user" |
| 07:09 | <abarth> | the paper is very rough at the moment |
| 07:09 | <othermaciej> | clever |
| 07:09 | <othermaciej> | this reminds me of an attack against a university's online auth protocol in a paper that someone (maybe you?) pointed me to |
| 07:10 | <abarth> | yes |
| 07:10 | <abarth> | it's similar to that |
| 07:10 | <abarth> | in that the attacker spams his credentials onto the user's browser |
| 07:10 | <othermaciej> | would this work against HTTPS? |
| 07:10 | <abarth> | yes |
| 07:10 | <abarth> | HTTP can overwrite HTTPS cookies |
| 07:10 | <abarth> | cookie provide confidentiality but not integrity |
| 07:11 | <abarth> | it works against OAuth / OpenID too, as far as we can tell |
| 07:11 | <othermaciej> | I see, example.com doesn't even need to actually have port 80 open for this to work |
| 07:11 | <abarth> | right |
| 07:11 | <othermaciej> | evil! |
| 07:11 | <abarth> | a web site can actually defend against it today, but it's a big pain |
| 07:12 | <abarth> | you need to store a nonce in localStorage |
| 07:12 | <abarth> | since localStorage actually respects the same-origin policy |
| 07:12 | <abarth> | then you send the nonce explicitly in every request in a custom HTTP header |
| 07:12 | <abarth> | b/c custom HTTP headers cannot be sent across origins (without opt-in) |
| 07:12 | <abarth> | but that means you are restricted to only using XMLHttpRequest to communicate with the server |
| 07:14 | <Hixie> | wait, you can set cookies on port 80 that get sent on port 443? |
| 07:14 | <abarth> | yes |
| 07:14 | <Hixie> | what kind of crazy nonsense is that! |
| 07:14 | <abarth> | cookies don't care about ports |
| 07:14 | <abarth> | cookie are insane technology from a bygone era |
| 07:14 | <Hixie> | wow i had no idea |
| 07:14 | <Hixie> | that is so utterly bogus |
| 07:15 | <abarth> | building something better is actually really easy |
| 07:15 | <abarth> | you just have a nonce for each origin |
| 07:15 | <abarth> | that the browser makes up itself |
| 07:15 | <abarth> | and then it sends in a header |
| 07:15 | <abarth> | with every request |
| 07:15 | <abarth> | to that origin |
| 07:15 | <Hixie> | it's even easier than that... just don't cross origins when setting cookies! |
| 07:16 | <abarth> | unfortunately, a couple important sites use cookies ;) |
| 07:18 | <Hixie> | oh you mean building something better that's compatible with the world today |
| 07:19 | <Hixie> | per-origin nonces would be a privacy leak unfortunately |
| 07:20 | <Hixie> | but you could use the new thing we have to ensure use of TLS to also ensure that cookies don't get set cross-origin |
| 07:20 | <abarth> | why are per-origin nonce more of a privacy leak than localStorage? |
| 07:21 | <Hixie> | because the user has no way to know the origin is using it |
| 07:24 | <abarth> | i see. i just assume every web site i visit is setting a cookie |
| 07:24 | <othermaciej> | abarth: I think the UI parts of your attack don't quite connect |
| 07:24 | <abarth> | because Alice ends up with two tabs to example.com? |
| 07:24 | <othermaciej> | how does the request in step 8 result in the experience in step 11? |
| 07:25 | <othermaciej> | Alice was looking at a specific window/tab, and the request in step 8 won't affect what that original tab displays |
| 07:25 | <abarth> | it's slightly tricky to arrange for it to be picture perfect |
| 07:25 | <abarth> | but you can certainly do it with a UI flash if |
| 07:26 | <othermaciej> | in fact it seems like that original tab would tell Alice she wins, unless the network attacker somehow prevents the response from getting through, in which case it will seem to be waiting indefinitely |
| 07:26 | <abarth> | 1) the original example.com tab has a name |
| 07:26 | <abarth> | 2) the attacker can open a new tab for the results page on top of the old tab |
| 07:26 | <abarth> | 3) the attacker can close the old tab |
| 07:27 | <abarth> | those three things revolve around how the original example.com tab came into existence |
| 07:27 | <othermaciej> | so either the attacker is the opener of the example.com tag, or has it enframed, or it somehow otherwise has a guessable reachable name |
| 07:28 | <abarth> | or the attacker can bypass the popup blocker and alice don't notice that a new tab has been created on top of the old tab |
| 07:28 | <abarth> | the security model doesn't prevent the attacker from doing any of these things |
| 07:28 | <abarth> | so we, pessimistically, assume that the attacker can do whatever isn't forbidden by a security property |
| 07:29 | <abarth> | "tabnapping" is aza's term |
| 07:29 | <abarth> | but i think he's playing a joke on the security community |
| 07:29 | <abarth> | (although aza assumes users don't read the address bar, whereas we assume they do) |
| 07:42 | <othermaciej> | "tabnapping" as described by Aza seems to be based on some of the same assumptions as phishing |
| 07:43 | <othermaciej> | phishing (without spoofing the address field) is sometimes not considered a |
| 07:43 | <othermaciej> | "real" attack, but evidence seems to be that it does really work |
| 07:43 | <Hixie> | abarth: we have data showing they don't, so it's not an unreasonable assumption ;-) |
| 07:43 | <othermaciej> | I can see how "tabnapping" could be more effective, because when switching tabs the user could be less vigilant than when following a link or clicking on a mysterious scary email |
| 07:44 | <abarth> | i suspect he's poking fun at the security community for inventing silly names for attacks |
| 08:27 | <othermaciej> | bugzilla queries seem to be broken :-) |
| 08:27 | <othermaciej> | er |
| 08:27 | <othermaciej> | :-( |
| 11:05 | <zcorpan> | othermaciej: it happens that editors drafts have an older date than a published draft, because the publication date is written down in the draft before it is actually published, and then the editor's draft could have changed back to editors draft before the actual publication date |
| 11:05 | <zcorpan> | othermaciej: not sure if that's the case with aria though |
| 11:05 | <othermaciej> | zcorpan: in this case there seems to be at least one missing edit in the ED that is in the WD |
| 11:06 | <zcorpan> | ah, ok |
| 11:09 | <annevk> | didn't get much back from @james_clark http://twitter.com/james_clark/status/25746086798 |
| 11:17 | <jgraham> | Ah, twitter, that great conduit of intellectual discourse |
| 11:17 | <othermaciej> | jgraham: I somewhat regret paying more attention to the hybi list |
| 11:17 | <jgraham> | it seems strange to say that you don't like the porcess for something without saying what about the results of the process you don't like |
| 11:18 | <jgraham> | After all the two are tightly coupled |
| 11:18 | <jgraham> | othermaciej: I, on the other hand, am grateful for your contribution |
| 11:19 | <jgraham> | Although I am still concerned about hybi in general |
| 11:20 | <othermaciej> | I am a bit frustrated at repeatedly explaining cross-protocol attacks and my seeming inability to get the ideas across |
| 11:22 | <jgraham> | I guess it is subtle. I certianly don't fel like I have a deep understanding like you or abarth. And it is harder if you can't demonstrate a real exploit for proposals, only point out that they depend on weak assumptions |
| 11:23 | <jgraham> | I'm not sure giving up on the group now is good in the long run because you will ikely be one of the people who has to put out the fires if an exploit is found |
| 11:23 | <jgraham> | +l |
| 11:25 | <annevk> | hybi is so sad |
| 11:25 | <jgraham> | On the other hand, we may already have lost; -76 might gain enough traction that we are forced to support that handshake forever |
| 11:25 | <annevk> | we could've had something cool for developers by now |
| 11:26 | <jgraham> | We do, kind of |
| 11:28 | <annevk> | true |
| 11:31 | <zcorpan> | is accessKeyLabel another fingerprinting feature? |
| 11:35 | <annevk> | I suppose that depends on the complexity of user agent implementations |
| 11:35 | <annevk> | but I suspect you cannot get more from it than platform + user agent which are already exposed |
| 11:40 | <zcorpan> | if the browser chooses a key based on the user's keyboard layout, then it exposes information about the user's keyboard layout |
| 11:40 | <annevk> | yup |
| 12:45 | <annevk> | http://twitpic.com/2spyxf heh |
| 12:47 | <zcorpan> | so true |
| 12:47 | <annevk> | yeah, we don't really know what we want |
| 12:48 | <Firefox> | s/allready/already/ |
| 13:01 | <loucapo> | good morning everyone |
| 13:02 | <loucapo> | i still could use some help with the xmlhttp request level 2 |
| 13:04 | <annevk> | feel free to drop questions |
| 13:05 | <loucapo> | annevk...stuck at the same point i was yesterday |
| 13:06 | <annevk> | did you read the things I pointed out? |
| 13:06 | <annevk> | and did you check if the server handled preflight requests? |
| 13:07 | <loucapo> | i changed my content-type on the request to application/x-ww-form-urlencoded |
| 13:07 | Philip` | always reads that as "pref-light" |
| 13:07 | <loucapo> | yes the server definitely does handle them |
| 13:07 | <annevk> | what is the page again? |
| 13:08 | <loucapo> | http://ozoli.comuf.com |
| 13:08 | <loucapo> | the server is just a simple php page that responds with whatever code u enter into the querystring |
| 13:09 | <loucapo> | if u enter a 200 u can see the status 200 in the console |
| 13:09 | <loucapo> | if u enter a 304 for example, u see status is 0 |
| 13:09 | <annevk> | so if the browser before doing the actual request does a request with OPTIONS the server handles that? |
| 13:10 | <annevk> | mkay |
| 13:10 | <loucapo> | sure |
| 13:10 | <loucapo> | and i set the allowed origin to be whatever the requested origin is, knowing thats not something i would do in production |
| 13:10 | <annevk> | check if the error event is dispatched on the XHR object |
| 13:11 | <annevk> | could just be a bug :/ |
| 13:12 | <annevk> | loucapo, so WebKit says this in their console |
| 13:12 | <loucapo> | i thought in reading the spec a version or two ago it said if there is any error, treat it as a network error..then in reading the network error it seemed like it was supposed to return a 0 |
| 13:12 | <annevk> | "XMLHttpRequest cannot load http://quitdev.host22.com/response.php?code=304. Origin http://ozoli.comuf.com is not allowed by Access-Control-Allow-Origin." |
| 13:12 | <loucapo> | yea, i think that is a bug...i didnt start to see that until i got the chrome dev channel |
| 13:13 | <annevk> | they also fail for 200 |
| 13:13 | <loucapo> | do u know php? |
| 13:13 | <annevk> | yes |
| 13:13 | <loucapo> | here is what i have in the php page for that |
| 13:14 | <loucapo> | header('Acces-Control-Allow-Origin: '.$_SERVER['HTTP_ORIGIN']); |
| 13:14 | <loucapo> | oops, typo just then |
| 13:15 | <loucapo> | header('Access-Control-Allow-Origin: '.$_SERVER['HTTP_ORIGIN']); |
| 13:16 | <loucapo> | and the options call has this in the response: Access-Control-Allow-Orig... http://ozoli.comuf.com |
| 13:18 | <annevk> | so as far as I can tell 304 does not work because the PHP script is bypassed or some such |
| 13:18 | <annevk> | at least when inspecting with curl |
| 13:19 | <loucapo> | its anything thats not a 200 |
| 13:19 | <annevk> | curl --header "Origin: http://test/"; http://quitdev.host22.com/response.php?code=501 --head |
| 13:19 | <annevk> | seemed alright to me |
| 13:19 | <annevk> | but maybe there's a bug in Minefield |
| 13:21 | <loucapo> | i mean there is noting in my php to do anything special based on the code |
| 13:22 | <loucapo> | i had a guy from google looking at this a few weeks back but he seems to have gotten pulled away |
| 13:22 | <Philip`> | Sounds like Apache might have something to do something special based on the code |
| 13:23 | <loucapo> | based on the code and if uxingXHR? |
| 13:24 | <loucapo> | cuz if i set them to the same domain this does not happen |
| 13:27 | <Philip`> | The curl command with ?code=304 doesn't give any of the extra headers, and with e.g. ?code=309 returns a "200 OK" instead, so it just looks like there's some rewriting happening after your PHP script |
| 13:27 | <Philip`> | regardless of how it's being accessed |
| 13:28 | <loucapo> | hmm, strange |
| 13:28 | <annevk> | but e.g. 402 works but fails in Firefox |
| 13:28 | <annevk> | afaict |
| 13:29 | <Firefox> | That’s right. |
| 13:29 | <annevk> | oh wait |
| 13:29 | <annevk> | loucapo, the OPTIONS request requires a 200 response |
| 13:30 | <annevk> | not sure if Firefox already requires that, but they might |
| 13:31 | <loucapo> | that is getting a 200 in my net |
| 13:36 | <annevk> | minefield's console says otherwise |
| 13:36 | <loucapo> | not sure what minefield is |
| 13:37 | <annevk> | Firefox nightlies |
| 13:38 | <loucapo> | i see |
| 13:38 | <loucapo> | whats it saying the satus is? |
| 13:40 | <annevk> | 0, as it seems to be failing to process the preflight |
| 13:40 | <annevk> | per the console only one request is made |
| 13:41 | <annevk> | loucapo, if you remove the setting of custom headers as well you should not get a preflight |
| 13:41 | <annevk> | might make it easier to determine what goes wrong |
| 13:41 | <loucapo> | i thought preflight was required on cross origin |
| 13:42 | <annevk> | not always |
| 13:42 | <loucapo> | hmm |
| 13:42 | <loucapo> | let me see my headers |
| 13:43 | <annevk> | see http://dev.w3.org/2006/waf/access-control/#cross-origin-request |
| 13:43 | <loucapo> | what would u consider a custom header? |
| 13:43 | <loucapo> | x-requested-with? |
| 13:43 | <annevk> | yes |
| 13:43 | <annevk> | anything apart from this whitelist: http://dev.w3.org/2006/waf/access-control/#simple-header |
| 13:44 | <loucapo> | wait r u sure? i think u need x-requested with for cross origin to work |
| 13:44 | <annevk> | i am sure |
| 13:45 | <loucapo> | ok, removing |
| 13:46 | <loucapo> | when i do that Firefox fails the options call |
| 13:46 | <annevk> | it already did |
| 13:47 | <loucapo> | well i removed it |
| 13:47 | <loucapo> | now even 200 returns 0 |
| 13:48 | <annevk> | did you write all the server code yourself? |
| 13:49 | <annevk> | i don't really see why x-requested-with would matter unless your server is depending on it somehow |
| 13:49 | <loucapo> | my colleague did, its quite short |
| 13:49 | <annevk> | anyway, at this point it might be better to go to stackoverflow.com or something |
| 13:54 | <loucapo> | i did post there |
| 13:55 | <loucapo> | got no answer |
| 13:55 | <loucapo> | lol, i just realized u edited the spec last |
| 13:55 | <annevk> | yes, I'm that person |
| 13:56 | <loucapo> | so i understand...u do not need to set x-requested-with on an ajax request using xmlhttprequest level 2? |
| 13:57 | <annevk> | you have never needed that, ever |
| 13:58 | <loucapo> | so to enable CORS, u just need to set the allow origin? |
| 13:58 | <loucapo> | btw...http://stackoverflow.com/questions/3440371/problem-using-html5-for-cross-origin-resource-sharing |
| 13:58 | <annevk> | xml:space is soo fucked up |
| 13:59 | <annevk> | loucapo, yes |
| 13:59 | <loucapo> | how intereting |
| 13:59 | <annevk> | loucapo, what the server needs to implement is explained here: http://dev.w3.org/2006/waf/access-control/#resource-processing-model |
| 14:00 | <loucapo> | reading |
| 14:05 | <loucapo> | i think i got all of what that section says |
| 14:06 | <loucapo> | hey miketaylr, i spoke to u via twitter a few weeks back and u sent me here...thanks for that. |
| 14:06 | <miketaylr> | heh, no problem |
| 14:07 | <loucapo> | though i still cant get it working |
| 14:07 | <loucapo> | sigh |
| 14:15 | <annevk> | loucapo, I don't really have the tools to look into it properly unfortunately |
| 14:16 | <annevk> | loucapo, if sshfs was not such a pain on Mac I would have made something working |
| 14:16 | <annevk> | I guess I should learn vim or emacs or another sucky terminal editor so I don't have to bother with sshfs |
| 14:17 | <loucapo> | lol |
| 14:17 | <loucapo> | would it help at all if i sent u the php page? |
| 14:17 | <annevk> | might help yes |
| 14:19 | <loucapo> | how should i send? |
| 14:19 | <Philip`> | annevk: Or you should use something like KDE that lets all its applications open files across SFTP/etc connections exactly like local files |
| 14:19 | <Philip`> | though I suppose that might not be too great if you're using OS X |
| 14:19 | <variable> | annevk, sshfs is quite nice. Or if you don't want to bother with a big learning curve use nano |
| 14:20 | <variable> | tis a nice editor with syntax highlighting - but very easy to use |
| 14:21 | <annevk> | loucapo, annevk⊙oc works or just put it online somewhere? |
| 14:21 | <ben_alman> | miketaylr: hi |
| 14:21 | <ben_alman> | who should i be talking to? |
| 14:22 | <hsivonen> | annevk: fwiw, I think Julian is right about xml:space. |
| 14:22 | <miketaylr> | ben_alman: dunno if adam barth hangs here |
| 14:22 | <ben_alman> | he's the url api guy? |
| 14:23 | <ben_alman> | hmmn.. well i'd like as easy a format as possible for discussing the working draft |
| 14:23 | <ben_alman> | chat would be preferred to long email chains |
| 14:23 | <miketaylr> | yeah |
| 14:23 | <ben_alman> | i don't have the time |
| 14:23 | <ben_alman> | but i see some clear deficiencies |
| 14:23 | <miketaylr> | spend less time with your cats |
| 14:24 | <ben_alman> | most notably (imo) is the ancient idea that only location.search contains a serialized data object, when in reality the fragment can (and maybe should) as well |
| 14:24 | <annevk> | hsivonen, xml:space should be removed from XML; everything assumes whitespace is always kept and it's a hint anyway so not even useful |
| 14:25 | <ben_alman> | also, the serialization algorithm is maybe too basic |
| 14:25 | <annevk> | hsivonen, and it's a constant source of confusion |
| 14:25 | <ben_alman> | it would be nice to come up with a standard algorithm |
| 14:25 | <ben_alman> | that handles nested objects |
| 14:25 | <Philip`> | miketaylr: abarth often seems to be around here |
| 14:26 | <ben_alman> | then again, we should probably just use JSON to encode everything :P |
| 14:26 | <miketaylr> | Philip`: that's what i thought, thanks |
| 14:26 | <Philip`> | (but not now, presumably due to timezones) |
| 14:26 | <ben_alman> | well miketaylr if he shows up ping me and him |
| 14:26 | <annevk> | ben_alman, putthing data in fragments is kind of a hack though to work around other limitations |
| 14:26 | <miketaylr> | lol ok. can i get you a sandwich too? |
| 14:26 | <annevk> | ben_alman, that pushState etc. hopefully solve |
| 14:26 | <loucapo> | annevk...just sent |
| 14:26 | <ben_alman> | pushState will solve that for sure |
| 14:27 | <annevk> | ben_alman, but you should just email him and cc some list |
| 14:27 | <ben_alman> | annevk i don't have the time for email tbh |
| 14:27 | <ben_alman> | i need a quick chat |
| 14:27 | <ben_alman> | :) |
| 14:27 | <annevk> | i don't see the difference |
| 14:27 | <ben_alman> | i do. |
| 14:27 | <ben_alman> | chat is quick, you can respond to each line in real time |
| 14:28 | <ben_alman> | email requires you to ingest the whole response and formulate a reply, if you choose to reply to individual points you start getting into this kind of unmanageable branching |
| 14:28 | <ben_alman> | plus i'm really anal about emails with spell checking etc |
| 14:28 | <ben_alman> | chat, not so much |
| 14:36 | <hsivonen> | annevk: xml:space has utility in generic XML editors like oXygen than don't otherwise know if it is OK to rewrap text node content |
| 14:36 | <hsivonen> | annevk: I agree that it's a source of confusion |
| 14:37 | <zcorpan> | wouldn't it be better for oXygen to have some knowledge about XHTML? |
| 14:38 | <hsivonen> | zcorpan: that would be even more useful, sure |
| 14:38 | <annevk> | loucapo, your PHP file does not handle OPTION requests |
| 14:40 | <annevk> | loucapo, i.e. the preflight requests I kept mentioning |
| 14:40 | <loucapo> | hmm i swear my colleague told me it did...i dont know much php so i will get my colleague to look at that |
| 14:40 | <loucapo> | and fix it ASAP |
| 14:40 | <loucapo> | thx for the help |
| 14:41 | <annevk> | //header('Access-Control-Allow-Origin: ozoli.comuf.com'); is also wrong fwiw |
| 14:41 | <loucapo> | thats commented out |
| 14:41 | <annevk> | an origin includes the scheme |
| 14:48 | <Philip`> | The xml:space thread is terribly confusing, since I seem to be receiving all the messages out of order |
| 14:48 | <jgraham> | Philip`: I assumed I just wasn't recieveing messages from Julian |
| 14:49 | <Philip`> | Hmm, http://lists.w3.org/Archives/Public/public-html/2010Sep/ looks misordered too |
| 15:34 | zcorpan | adds "RegExp.prototype.compile changes the regexp in place. In Carakan/Nitro/V8 the method returns undefined; in SpiderMonkey it returns the regexp object." to http://wiki.whatwg.org/wiki/Web_ECMAScript#RegExp |
| 15:34 | <zcorpan> | mozilla javascript people: fancy changing your impl to match opera/safari/chrome? :) |
| 15:46 | MikeSmith | didn't know about http://wiki.whatwg.org/wiki/Web_ECMAScript |
| 15:48 | <MikeSmith> | I can add those contents as annotations to the annotated HTML version of the spec |
| 15:49 | <zcorpan> | that'd be cool |
| 16:05 | <loucapo> | annevk, can you rechk my page? i think we have the options stuff right now. |
| 16:05 | <loucapo> | but i still see status 0 |
| 16:06 | <annevk> | karlcow, someone on twitter says we hired you |
| 16:06 | <annevk> | karlcow, if so, welcome |
| 16:07 | <annevk> | loucapo, i'd rather check the source code again |
| 16:07 | <loucapo> | sure |
| 16:07 | <loucapo> | will send |
| 16:09 | <loucapo> | sent |
| 16:10 | <loucapo> | annevk, i also found the part of the spec i was taking about |
| 16:10 | <loucapo> | http://www.w3.org/TR/XMLHttpRequest/#response |
| 16:15 | <jgraham> | karlcow: Oh, nice :) |
| 16:16 | <annevk> | loucapo, still don't get what you mean and that is not Level 2 |
| 16:19 | <loucapo> | if a 404 comes back, is the error flag not set? |
| 16:19 | <annevk> | loucapo, it never says it would be set |
| 16:19 | <annevk> | loucapo, so now your request no longer requires a preflight |
| 16:19 | <annevk> | loucapo, I guess you should put something in the response body as well and see what responseText returns |
| 16:20 | <annevk> | loucapo, to see if the bug is in Firefox or in your code |
| 16:20 | <loucapo> | but i still cannot tell what happened...ie a 500 |
| 16:21 | <annevk> | I can in Chrome now |
| 16:23 | <loucapo> | really? |
| 16:25 | <annevk> | no, I'm just kidding... |
| 16:26 | annevk | sighs |
| 16:26 | <loucapo> | maybe we are having a communication issue? |
| 16:26 | <loucapo> | i cannot see the status even in chrome |
| 16:27 | <annevk> | well I can for 402, 500, etc. |
| 16:27 | <annevk> | 304 of course still fails |
| 16:28 | <loucapo> | i was doing a 404, which i guess should fail too |
| 16:28 | <annevk> | works here |
| 16:32 | <karlcow> | annevk: yes, I'm starting on November 1st :) - ODIN Team |
| 16:32 | <karlcow> | thanks :) |
| 16:38 | <jgraham> | karlcow: Do you get to do a scandinavian tour as part of the induction? |
| 16:40 | <hober> | karlcow: congats! |
| 16:44 | <karlcow> | jgraham: I will be visiting I guess in January. Is the induction painful? ;) |
| 17:01 | <loucapo> | annevk, what if i need or want to set a custom header? why would that cause all of this to fail? |
| 17:02 | <annevk> | presumably because either your are not doing the preflight correctly or the browser has some kind of bug |
| 17:03 | <loucapo> | chrome, safari both? |
| 17:18 | <rubys> | just checking... is Date.parse intended to handle RFC3339 formatted dates? |
| 17:18 | <rubys> | seems to with a recent firefox, but not with a recent chrome... |
| 17:19 | <Philip`> | http://wiki.whatwg.org/wiki/Web_ECMAScript#Date_Parsing may be relevant |
| 17:19 | <rubys> | TODO:This is a mess |
| 17:19 | <Philip`> | (Not necessarily useful, though) |
| 17:19 | <rubys> | doesn't look like it has any relevant info |
| 17:20 | <jgraham> | rubys: Date.parse is intentionally unspecified |
| 17:20 | <Philip`> | http://sideshowbarker.github.com/es5-spec/#x15.9.4.2 - "the function may fall back to any implementation-specific heuristics or implementation-specific date formats" |
| 17:20 | <jgraham> | Apart from a requirement to handle ISO dates |
| 17:20 | <jgraham> | (which AFAIK are typiucally not supported) |
| 17:21 | <paul_irish> | philip jager.... who does video for opera.. someone help me out with his twitter or somesuch? |
| 17:21 | <jgraham> | So if you really mean "intended", then the answer is "no" |
| 17:21 | <Philip`> | paul_irish: http://twitter.com/foolip |
| 17:21 | <jgraham> | paul_irish: foolip |
| 17:22 | <paul_irish> | thx |
| 17:37 | <loucapo> | paul_irish u are at google, right? |
| 17:38 | <paul_irish> | loucapo: yes |
| 17:39 | <loucapo> | rey told me to talk to you...i tweeted at u the other day |
| 17:39 | <loucapo> | u got a few min? |
| 17:39 | <paul_irish> | loucapo: sure. PM away |
| 17:41 | <loucapo> | i'm such a newb on IRC, not sure how to PM, :-( |
| 17:42 | <tabatkins> | Do /msg <name> <msg>, or /query <name> and then send messages. |
| 17:43 | <loucapo> | thx |
| 17:56 | <MikeSmith> | rubys: I wonder if you may be running into a bug that was in the V8 code prior to v2.4.3 that caused it to fail on date-times like 2010-09-23T01:15:30+09:00 that have a timezone offset but no milliseconds component, by succeed on date-times like 2010-09-23T01:15:30.003+09:00 that have the milliseconds specified |
| 17:57 | <MikeSmith> | I'm not sure how you can check your chrome to see what V8 version it was built against |
| 17:58 | <rubys> | That could be. It produces NaN for 2010-09-28T12:33:46-04:00 |
| 17:58 | <MikeSmith> | yeah |
| 17:58 | <rubys> | Chrome 6.0.472.63 beta FWIW |
| 17:58 | <MikeSmith> | if you try 2010-09-28T12:33:46.000-04:00 I bet it will work |
| 18:00 | <rubys> | http://intertwingly.net/tmp/localize_dates.js |
| 18:01 | <rubys> | Instead of replacing the parseRFC3339 function, I added the first two lines to it. |
| 18:17 | <zcorpan> | Hixie: oh, i wondered why the're a spinning circle there. could you make it not appear if the relevant script(s) aren't loaded? |
| 18:17 | <Hixie> | i guess i could make them appear when a script runs to make them appear |
| 18:17 | <Hixie> | and put that script right at hte top of the page or something |
| 18:18 | <Hixie> | or i could just hide it |
| 18:18 | <Hixie> | i was just using it to tell at a glance how long the browser was locking up for when repainting or running scripts |
| 18:19 | <zcorpan> | yeah, i'm not going to miss it if you hide it altogether :) |
| 18:23 | <gsnedders> | jgraham: ping |
| 18:32 | <gsnedders> | jgraham: At the moment treewalkers have a really messy API for attributes. They return a list of name,value tuples, where the name varies massively between which tree is used. Some give QName, some give localname, some give Clark notation |
| 18:33 | <gsnedders> | jgraham: We really to make that consistent before we build anything much off that API… say, a serializer with foreign content support |
| 18:34 | <gsnedders> | jgraham: I think the two basic choices are to go for a three-tuple of namespace URL, local name, value or to go for dicts (like we do for tags) with "name", "namespace", and "value" indexes |
| 18:34 | <gsnedders> | jgraham: Opinions? |
| 18:34 | <gsnedders> | (Anyone else is free to have opinions too, though) |
| 18:34 | <tabatkins> | dicts++ |
| 18:35 | <tabatkins> | But I'm not familiar enough with common Python library styles to know if tuples are more idiomatic. |
| 18:36 | <gsnedders> | A list of dicts is less common, as you'd tend to want to use something lighter-weight for attributes… But there again, you don't want the tuples to get too big. |
| 18:36 | <zcorpan> | about cookies, i think cookie2 has a way to respect ports, but only opera supports it and no-one uses it |
| 18:37 | <zcorpan> | maybe we should convince everyone else to migrate to cookie2 |
| 18:37 | <gsnedders> | zcorpan: I think Philip`'s dump of HTTP data had some instances of it :P |
| 18:37 | <gsnedders> | Yeah, three instances of set-cookie2 (and 5105 of set-cookie) |
| 18:38 | <zcorpan> | gsnedders: i rest my case :) |
| 18:38 | <gsnedders> | Three instances is not "no-one"! :P |
| 18:38 | <zcorpan> | sure it is |
| 18:38 | <zcorpan> | just like you are no-one |
| 18:39 | gsnedders | cries |
| 18:39 | <gsnedders> | I'm a real person! |
| 18:40 | <gsnedders> | jgraham: Oh, there appears to be some tree-walker that gives a four-tuple of prefix, local, url, value |
| 18:43 | <gsnedders> | jgraham: SimpleTree gives a four-tuple, DOM gives a two-tuple (QName, value), etree gives Clark Notation |
| 18:43 | <gsnedders> | (well, Clark Notation, value) |
| 18:44 | karlcow | hands tissues to gsnedders |
| 18:50 | <hsivonen> | Hixie: thanks for mentioning xml:space for those of us who aren't sure how to understand what XML 1.0 says about it in a non-DTD validation context |
| 18:53 | <Hixie> | XML is crystal clear as far as I can tell |
| 18:53 | <Hixie> | "A special attribute named xml:space may be attached to an element to signal an intention that in that element, white space should be preserved by applications." |
| 18:54 | <Hixie> | what more is needed? |
| 18:54 | <gsnedders> | karlcow: Also: congrats on joining us! (The plot for world domination continues!) |
| 18:55 | <karlcow> | hehe |
| 18:55 | <karlcow> | merci ! |
| 18:56 | <zcorpan> | yeah welcome and congrats |
| 18:56 | <zcorpan> | what are you going to do? :) |
| 18:56 | gsnedders | was about to ask that |
| 18:57 | <karlcow> | ODIN Team. |
| 18:58 | <zcorpan> | ah |
| 19:15 | <Hixie> | AryehGregor: i don't recall where the discussions about <time> happened that led to what we have now, but i think it was whatwg⊙wo (re bug 10318) |
| 19:33 | <gavin> | what does ODIN stand for? |
| 19:38 | <karlcow> | gav in: developer relationships |
| 19:38 | <karlcow> | http://my.opera.com/ODIN/blog/ |
| 19:39 | <karlcow> | http://my.opera.com/ODIN/members/ |
| 19:41 | <gavin> | yeah, I found that, but none of it explains what "ODIN" means |
| 19:41 | <gavin> | I assumed it was an acronym... |
| 19:41 | <gavin> | is it norwegian? :) |
| 19:42 | <tabatkins> | Opera Developer Insurrection Network. |
| 19:43 | <karlcow> | ga vin: ODIN is one of the major gods of Norwegian mythology |
| 19:43 | <karlcow> | or more exactly Norse mythology |
| 19:44 | <karlcow> | http://en.wikipedia.org/wiki/Odin |
| 19:44 | <tabatkins> | Right, but having it in all caps makes it look like an acronym, not a proper name. |
| 19:45 | <Philip`> | You're meant to shout it |
| 19:48 | gavin | wonders why karlcow keeps inserting strange characters in his nick :) |
| 19:48 | <gavin> | (I only notice because it fails to ping me) |
| 19:50 | <zcorpan> | gavin: you should make your client ping you when karlcow sends strange characters |
| 19:53 | <karlcow> | Do I really send strange characters? |
| 19:53 | <karlcow> | I thought I was just sending "karlcow" |
| 19:53 | <jgraham> | gsnedders: That is the _output_ from the treewalkers? The series of tokens? |
| 19:53 | <tabatkins> | karlcow: In gavin's nick, not yours. |
| 19:54 | <tabatkins> | In one there's a strange character after the v, in the next there's one after the a. |
| 19:55 | <gavin> | http://grab.by/6BvZ |
| 19:55 | jgraham | is guessing that karlcow has some strage character encoding and a weird symbol next to v on his keyboard |
| 19:56 | <karlcow> | ah interesting… hmm I wonder if it's xchat autocompletion system. |
| 19:56 | <jgraham> | Yeah, my theoy doesn't work in light of tab completion |
| 19:57 | <tabatkins> | Well, it sorta does, if tab completion is broken. If he hit tab after typing "gav" in one circumstance, and after "ga" in another, that would mesh with the placement of the weird character. |
| 19:57 | <karlcow> | when I tab for autocompletion the nick is showed with a yellow background and I usually finished it by hand. |
| 19:58 | <karlcow> | test gavi |
| 20:00 | <karlcow> | ah interesting bug the grab.by piece of code doesn't display in Opera :O) |
| 20:01 | <karlcow> | but works perfectly in Safari |
| 20:03 | <zcorpan> | karlcow: now you just need to figure out why it doesn't work in opera and file a bug :) |
| 20:23 | <karlcow> | javascript/css issue |
| 20:24 | <Hixie> | hsivonen: i don't understand why it's a pretense that foreign content is an insertion mode |
| 20:25 | <Hixie> | hsivonen: in what way is it _not_ an insertion mode? It's very similar to how "in table" works, no? |
| 20:25 | <gsnedders> | jgraham: yeah |
| 20:27 | <jgraham> | gsnedders: I don't understand how anything works, then |
| 20:28 | <jgraham> | Why don't things break if the different treebuilders all have inconsistent token formats? |
| 20:29 | <gsnedders> | jgraham: Because the serializer supports both |
| 20:29 | <gsnedders> | (which works okay for HTML namespace stuff) |
| 20:32 | <Hixie> | hsivonen: btw i commented on http://www.w3.org/Bugs/Public/show_bug.cgi?id=9843 while the mails weren't going out |
| 20:33 | <jgraham> | gsnedders: In principle I like the idea of dicts, but I guess they might be slow |
| 20:34 | <jgraham> | It might not matter of course |
| 20:34 | <jgraham> | Compared to the other slowness |
| 20:34 | <gsnedders> | jgraham: Not a bottle-neck, is my attitude |
| 20:35 | <jgraham> | Right |
| 20:35 | <gsnedders> | jgraham: I pushed what I had locally, which means the treewalker tests actually run all the tests, as well as the first couple of fixes (and disabling it entirely for Genshi, because that was really broken and everything failed) |
| 20:36 | <jgraham> | gsnedders: OK, great |
| 20:37 | <gsnedders> | I'd really like to get runtests.py running again. |
| 20:37 | <gsnedders> | Because, uh, until then, we can't really claim to be able to properly test. |
| 20:40 | <jgraham> | Things That Are Confusing vol. 1: Finding that songs you have liked for years are actually covers |
| 20:41 | <jgraham> | e.g. I have long enjoyed spotify:track:4KLlwC9yoOmsTDWQM4CdY1 without ever knowing about spotify:track:5eos4i4cbrBtq9Rr1IB565 |
| 20:42 | <Dashiva> | Cool URIs don't start in spotify |
| 20:44 | <jgraham> | http://open.spotify.com/track/4KLlwC9yoOmsTDWQM4CdY1 and http://open.spotify.com/track/5eos4i4cbrBtq9Rr1IB565 if you prefer |
| 20:45 | <hober> | Hixie: why not use -vendor-attr=""? |
| 20:45 | <tabatkins> | Can't start an attribute with -. I forget why. |
| 20:45 | <hober> | pros: mirrors CSS, doesn't conflict with comment syntax or data-* |
| 20:46 | <jgraham> | Probably osn't work in XHTML |
| 20:46 | <jgraham> | *doesn't |
| 20:46 | <jgraham> | Although gsnedders is the one who memorises all the productions |
| 20:47 | <jgraham> | (I think vendor.attribute personally) |
| 20:47 | <jgraham> | s/think/like/ |
| 20:48 | <hober> | does [vendor.attribute] work as a selector? |
| 20:48 | <tabatkins> | No reason why it shouldn't. |
| 20:49 | <tabatkins> | Well, apparently there is. It doesn't work. |
| 20:49 | <zcorpan> | it doesn't |
| 20:49 | <tabatkins> | You have to escape the . in the selector, and write [foo\.bar] |
| 20:50 | <hober> | I think whatever we pick should be usable in a selector without escaping |
| 20:50 | <tabatkins> | Agreed. |
| 20:50 | <hober> | Why not just use vendor-foo="bar"? |
| 20:50 | <zcorpan> | because it clashes with everything (since vendor can be anything) |
| 20:51 | <tabatkins> | I guess to avoid accidental collisions of "vendor" and a prefix from an actual attribute? |
| 20:51 | <hober> | x-vendor-foo="bar"? |
| 20:51 | <gsnedders> | jgraham: An attribute name in XML must start with a NameStartChar |
| 20:51 | <tabatkins> | Doing something that is unambiguously not a normal attribute prevents that (starting with _ or using -- in HTML, or starting with - in CSS). |
| 20:51 | <jgraham> | gsnedders: No shit |
| 20:51 | <hober> | that has the added benefit (benefit? really?) of matching webos's x-mojo-bleah="stuff" |
| 20:52 | <gsnedders> | jgraham: Oh, that's only fifth edition that calls it that. Otherwise just the first char of Name is special-cased |
| 20:52 | <jgraham> | gsnedders: What I haven't memorised (but you have) is the full range of constraints tht implies |
| 20:52 | <gsnedders> | jgraham: I didn't quite know, I knew it was Letter and a few punctuation characters :) |
| 20:52 | <gsnedders> | jgraham: So it's Letter, : and _ |
| 20:52 | <gsnedders> | Namespaces for XML means we can't use : |
| 20:52 | <jgraham> | Yah |
| 20:53 | <jgraham> | *Yeah |
| 20:53 | <gsnedders> | (And yeah, I do actually remember far too many such productions) |
| 20:53 | gsnedders | wishes he remembered less |
| 20:53 | <zcorpan> | gsnedders: do you know the xml-stylesheet productions by heart? |
| 20:54 | <gsnedders> | zcorpan: I expect I'm fairly close to it |
| 20:54 | <hober> | now that I'm looking at it, I'm surprised to find I don't mind x-vendor-attr="" |
| 20:54 | <jgraham> | gsnedders: My advice is that, for picking up girls, you use the 70s underground rock knowledge you get from this channel rather than the XML productions |
| 20:54 | <gsnedders> | zcorpan: Ah, I only forgot about PredefEntityRef from that |
| 20:55 | <gsnedders> | jgraham: I seem to be having more success with Apocalyptica knowledge ;P |
| 20:55 | <jgraham> | It would be nice if we could spell out experimetal. But I guess people wouldn't go for that |
| 20:55 | <zcorpan> | gsnedders: i'll ask again in 6 months |
| 20:55 | <gsnedders> | zcorpan: :) |
| 20:55 | <jgraham> | Well I can't spell experimental at all it seems |
| 20:56 | <jgraham> | gsnedders: Still, best to stay off the XML productions :) |
| 20:56 | <gsnedders> | jgraham: :) |
| 20:56 | <gsnedders> | jgraham: Y'know, the lecture I have which is mostly girls isn't CS, surprisingly enough. |
| 20:57 | <jgraham> | Really? Shocking |
| 20:57 | <gsnedders> | (I know, I know, you were wishing secretly I'd fall in love with a CS girl and have an excuse to go back to Lkpg…) |
| 20:57 | <gsnedders> | (Because, uh, blatantly they all aspire to work for Opera Sweden) |
| 20:58 | <tabatkins> | Dude, you *don't* want to fall in love with a CS girl? |
| 20:59 | <gsnedders> | tabatkins: I dunno, at the moment I'm not sure I really want to fall in love at all. |
| 20:59 | <tabatkins> | It's pretty good times. |
| 20:59 | <jgraham> | gsnedders: Oh I thought you would just like to fall in love with *a* girl |
| 21:00 | <jgraham> | (OK I amit the lst line was entirely for the White Stripes reference) |
| 21:00 | gsnedders | was wondering if that reference was intentional, and expecting it was |
| 21:00 | <gsnedders> | tabatkins: Meh. |
| 21:01 | <jgraham> | gsnedders: Anyway, certian rumors at your disappointment at the lack of cute CS girlsmay or may not have reached me |
| 21:02 | <jgraham> | (of course it might be that there are any number of nice irls and you just have bad taste) |
| 21:02 | gsnedders | wonders what rumours |
| 21:03 | <gsnedders> | Eiyj? She's not a CS girl… |
| 21:04 | <jgraham> | Taht's not even a real name, it's just a collection of letters |
| 21:04 | <jgraham> | (and note the word "lack") |
| 21:04 | <gsnedders> | Well, yeah. That's kinda the point. But it was funny at the time. |
| 21:08 | <zcorpan> | Hixie: i found a typo in your utf-8 text ("must be replace with") |
| 21:10 | <tabatkins> | Urgh, all these [0] scattered around my code are ugly. I much prefer Lisp's multiple return values paradigm over Python's. In Lisp, unless you specifically handle the extra values they just get dropped on the floor, so you can ignore them easily. In Python you have to remember what functions return a tuple to simulate multiples return values, and handle it every time if you only want the one value. |
| 21:12 | <jgraham> | tabatkins: Fixed in python 3 |
| 21:12 | <tabatkins> | Of course, in Lisp, you have to be careful to handle multiple values properly if you're writing a generic wrapper that should just pass the return value of the wrapped function through. |
| 21:13 | <jgraham> | But really doing value_I_care_about, b,c,d =foo() doesn't seem that hard |
| 21:13 | <jgraham> | Unless you don't know how many values the function will return |
| 21:13 | <gsnedders> | But that's just API-badness |
| 21:14 | <jgraham> | Well if the function returns a generator |
| 21:14 | <tabatkins> | Well, simple example is get_or_create in django, which returns the value and a bool telling if it was found or not. I don't care whether it was found or created, so I keep having to do "Foo.get_or_create(...)[0]". |
| 21:15 | <tabatkins> | In Lisp, GETHASH works similarly, but you can just not pay attention to the bool return value if you don't want it. If you do want it, it's easy to bind it. |
| 21:15 | <jgraham> | why not just do, value, created = Foo.get_or_create() |
| 21:15 | <tabatkins> | Because that doesn't say what I mean. |
| 21:15 | <jgraham> | and ignore created |
| 21:15 | <jgraham> | tabatkins: Yes it does |
| 21:15 | <jgraham> | It is much clearer than taking [0] |
| 21:16 | <tabatkins> | No, it says that I care about the second value enough to create a variable for it. I don't care about it at all, though. |
| 21:16 | <tabatkins> | Hmm, using a _ to indicate an ignored variable seems like a relatively clean way to do it. |
| 21:16 | <tabatkins> | "value,_ = Foo.get_or_create()". |
| 21:17 | <jgraham> | Doesn't really work if there is > 1 extra value |
| 21:18 | <tabatkins> | Sure it does. |
| 21:18 | <tabatkins> | You just set _ twice. But you're ignoring it anyway, so who cares? |
| 21:19 | <tabatkins> | And it's consistent with the pattern matching syntax in Prolog, Haskell, and probably others. |
| 21:20 | <Philip`> | ML too |
| 21:20 | <jgraham> | Yeah, I don't really like the fact that it looks magic, but it's not, it's just odd |
| 21:25 | <zcorpan> | maybe x-foo-bar makes people think that they are allowed to use x-* attributes instead of data-* |
| 21:25 | <jgraham> | vnd-foo-bar? |
| 21:25 | <tabatkins> | vendor-vendor-attribute. Where the second vendor is a variable. |
| 21:26 | <tabatkins> | vendor-webkit-foo. |
| 21:26 | <jgraham> | ua-foo-bar |
| 21:26 | <zcorpan> | vendor is a bit long, but vnd could work |
| 21:26 | <jgraham> | ua-opera-magic |
| 21:26 | <zcorpan> | 'ua' is a bit opaque and people don't know what it means |
| 21:27 | <jgraham> | No more opaque than vnd, really |
| 21:27 | <zcorpan> | true, but i think more people understand what vnd means |
| 21:27 | <jgraham> | I would call it browser- or clarity, but people would scream blue murder |
| 21:27 | <zcorpan> | but i might very well be wrong about that |
| 21:28 | <tabatkins> | I would have absolutely no idea what vnd meant if I weren't just now part of this conversation and saw it next to "vendor". |
| 21:29 | <zcorpan> | there's application/vnd.ms-excel etc in mime types |
| 21:29 | <tabatkins> | Is that what vnd is supposed to mean there? |
| 21:29 | <zcorpan> | yeah |
| 21:29 | tabatkins | really had no clue - he assumed it was some arcane MS-ism. |
| 21:29 | <gsnedders> | VeNDor |
| 21:29 | <tabatkins> | It being a TLA contributes, I think, to it being opaque. |
| 21:30 | <zcorpan> | maybe it doesn't matter that people don't know what it means, so long as they don't use it |
| 21:31 | <zcorpan> | maybe it should be do-not-use-this-opera-feature="" |
| 21:31 | <gsnedders> | I'm not sure marketing would like that |
| 21:31 | <tabatkins> | Hahaha. |
| 21:32 | <Philip`> | zcorpan: Who is "they"? |
| 21:32 | <zcorpan> | Philip`: authors who should be using data-* instead |
| 21:33 | <tabatkins> | Or authors creating public pages that aren't just experiments. |
| 21:34 | <zcorpan> | tabatkins: well authors use vendor extensions in css in production all the time |
| 21:34 | <Philip`> | People use e.g. text/vnd.sun.j2me.app-descriptor and text/vnd.abc; should the same kind of people be allowed to use vnd-* attributes for the same kind of thing? |
| 21:34 | <Philip`> | (where by "use" I mean "make up new strings of that form") |
| 21:34 | <tabatkins> | zcorpan: Right, but they shouldn't be. ^_^ |
| 21:35 | gsnedders | realizes trying to look through a corpus looking for instances of singular they isn't worth his time |
| 21:36 | <zcorpan> | Philip`: text/vnd.sun.j2me.app-descriptor is a registered mime type, so i assume it is a real vendor extension and not something Joe Author made up for private use |
| 21:36 | <tabatkins> | gsnedders: Why would you be doing so? |
| 21:36 | <zcorpan> | same with vnd.abc |
| 21:36 | <zcorpan> | so yes |
| 21:37 | <jgraham> | tabatkins: To be fair, if it was up to you, we would likely get two words stuffed together to make the name |
| 21:37 | <tabatkins> | ?_? |
| 21:37 | <gsnedders> | tabatkins: To find out how common its usage is to avoid a pronoun with a specific gender, and whether this has become more common since the 70s or so |
| 21:37 | <jgraham> | following the "frex" template |
| 21:37 | <gsnedders> | (because, y'know, it's interesting?) |
| 21:38 | <tabatkins> | gsnedders: I know it's attested back since Shakespeare at least. No idea on relative frequency. |
| 21:38 | <gsnedders> | tabatkins: Further back than Shakespeare |
| 21:38 | <tabatkins> | jgraham: Dunno. |
| 21:38 | <gsnedders> | tabatkins: I'm not interested in its age, I know it's old :) |
| 21:38 | <tabatkins> | gsnedders: Ah, kk. |
| 21:39 | <tabatkins> | gsnedders: Then I imagine you'd be doing lots of manual verification. I doubt you can programmatically distinguish a plural and singular they. |
| 21:39 | <gsnedders> | tabatkins: You can't. Welcome to the world of linguistics. :) |
| 21:39 | <gsnedders> | ("They" is a particuarly bad word to choose, as it's particuarly common.) |
| 21:40 | <tabatkins> | Hmm. I think I'll go spend some time running the CSS2.1 test suite now. Woo! |
| 21:41 | <gsnedders> | Using interns ftw! |
| 21:41 | <gsnedders> | (Okay, this is strictly untrue. It wasn't _just_ interns who did it for us…) |
| 21:43 | <jgraham> | tabatkins: Is this a masochistic streak? |
| 21:52 | <tabatkins> | jgraham: Nah, just something that needs to be done, and I'm the person to do it. I don't have any interns to fob it off on. |
| 21:54 | <gsnedders> | tabatkins: automate it! |
| 21:55 | <tabatkins> | That's the idea, yeah. But I can't automate 10k tests in time for the impl report deadline of mid-Oct. |
| 21:55 | <jgraham> | tabatkins: You don't have any way to use pure visual tests in your regression tracking system? |
| 21:56 | <jgraham> | (or maybe that is Google Secret Information) |
| 21:56 | <tabatkins> | We do, but you have to use reference images. |
| 21:56 | <gsnedders> | tabatkins: See my post to public-css-testsuite from earlier today. Get a list of all tests with the same screenshot, create references for them, starting with the ones that automate the most tests, and then you can automate half the testsuite in a week or so, and you get a net-gain for the mid-Oct deadline |
| 21:56 | <gsnedders> | jgraham: It's not, it's all in the public WebKit repo. |
| 21:57 | <jgraham> | gsnedders: It seems plausible that Google *also* have their own internal QA facilities |
| 21:57 | <gsnedders> | (actually, that was only a net-gain for all vendors combined) |
| 21:57 | <gsnedders> | jgraham: Well, yeah. But they at least have screenshot-based comparisons with reference images in the public tree |
| 21:58 | <tabatkins> | gsnedders: I'd also have to learn how our regression testing system works, which I haven't had to interact with yet. |
| 21:58 | <jgraham> | Having fixed reference images seems to be major badness |
| 21:59 | <tabatkins> | Yup. |
| 21:59 | <gsnedders> | jgraham: Probably just more random noise, more than anything else. And more effort to create initially. |
| 21:59 | <jgraham> | gsnedders, tabatkins: Make sure people coordinate so we don't get 4 different reftest versions of some tests and none of others |
| 22:00 | <gsnedders> | jgraham: Well, apart from dsinger and dbaron making vague comments about prodding people, I see little evidence that anyone apart from me has done anything. |
| 22:01 | <dbaron> | I wrote the python script that I sent to the list in order to separate out the tests |
| 22:01 | <jgraham> | gsnedders: tabatkins just said he planned to automate them |
| 22:01 | <dbaron> | oh, you mean specifically for turning things into reftests? |
| 22:01 | <gsnedders> | dbaron: yeah |
| 22:01 | <dbaron> | I didn't say I'd do anything at all for that |
| 22:01 | <gsnedders> | (I think it was you who said that from Mozilla at the F2F) |
| 22:02 | <gsnedders> | I remember dsinger and someone else, Moz IIRC, saying that |
| 22:03 | <jgraham> | My understanding is that enough of the tests have similar reference images that one doesnt have to produce anything like 10k refs to get a sizable fration of the tests |
| 22:04 | <gsnedders> | Indeed. |
| 22:04 | <gsnedders> | 100 references gets you around 3.5k |
| 22:04 | <tabatkins> | That sounds like some awesome low-hanging fruit. |
| 22:05 | <gsnedders> | Well, I sent a patch to the list for 830 with four references. |
| 22:05 | <gsnedders> | (those were 1, 2, 3, and 5 in terms of lowest hanging fruit) |
| 22:05 | <jgraham> | Yeah, if I believ gsnedeers numbers you get 1k with the top 6 |
| 22:06 | <jgraham> | Wow that was amazingly bad typing |
| 22:06 | <gsnedders> | No shit |
| 22:20 | <Hixie> | zcorpan: thanks |
| 22:28 | <Hixie> | any opinions on http://www.w3.org/Bugs/Public/show_bug.cgi?id=10113 ? (making </rt> optional in WebSRT cue text) |
| 23:38 | <karlcow> | running the css 2.1 TS the other day, I realized that would be cool if I could see 20 tests at once with radio button under each and click pass, fail, etc. |
| 23:41 | <Philip`> | karlcow: Like http://philip.html5.org/tests/canvas/suite/tests/reportgen.html?100,0 ? |
| 23:41 | <Philip`> | (only that one does most of them automatically) |
| 23:42 | <karlcow> | Philip`: yes |
| 23:43 | <karlcow> | because we loose a lot of times in the transition when accessing the next test |
| 23:44 | <Philip`> | It's much more convenient when you simply have to press 'y' or 'n' and then it goes onto the next test instantly |