| 06:13 | <roc> | am I right to conclude that http://www.w3.org/html/wg/drafts/html/master/rendering.html#frames-and-framesets suggests CSS borders and padding don't apply to <frame> and <frameset> elements? |
| 06:50 | <JonathanNeal> | why matches instead of is? |
| 06:50 | <JonathanNeal> | "matches" instead of "is", rather? |
| 08:58 | <jgraham> | darobin: Please sir, I have a complaint |
| 08:58 | <Ms2ger> | Here you have your fish license already |
| 08:59 | <darobin> | hmmmm? |
| 08:59 | <jgraham> | Ms2ger: Well you are the cause of the complaint (sort of) :p |
| 08:59 | <jgraham> | https://github.com/w3c/html-testsuite/pull/26 |
| 08:59 | <Ms2ger> | :D |
| 08:59 | <darobin> | a complaint? |
| 08:59 | <jgraham> | I fixed that |
| 09:00 | <jgraham> | But I can't push to that repo |
| 09:00 | <darobin> | is it the sort of complaint that can be addressed by making someone editor for polyglot? |
| 09:00 | <jgraham> | I suggets making annevk editor for polyglot |
| 09:00 | <Ms2ger> | jgraham, try again |
| 09:00 | <darobin> | jgraham: you're "jgraham" on GitHub, right? |
| 09:01 | <jgraham> | darobin: Yes |
| 09:01 | <jgraham> | Ms2ger: I hadn't tried yet |
| 09:01 | <darobin> | you're now part of team HTML |
| 09:01 | <jgraham> | I chose to believe it when it said "read only access" :) |
| 09:01 | <jgraham> | Is there a special handshake? |
| 09:01 | <darobin> | welcome to the HTML WG!!!! |
| 09:01 | <darobin> | moar srsly, you should be able to push |
| 09:02 | <Ms2ger> | On another note, I guess we need a tester group for the new web-platform-tests repo |
| 09:02 | <Ms2ger> | Good morning, polyglot editor |
| 09:02 | <jgraham> | Pushed |
| 09:03 | <darobin> | Ms2ger: yeah, I'll do that all together |
| 09:03 | <jgraham> | Thanks |
| 09:04 | <annevk> | Wearing my DocXS t-shirt today |
| 09:05 | <annevk> | Sort of apt it's black in hindsight |
| 09:06 | <jgraham> | Yeah, I like that shirt |
| 09:08 | <annevk> | Ms2ger: more like destroyer |
| 09:26 | <annevk> | Ms2ger: DOM says Mozilla now; okay? |
| 09:26 | <annevk> | Ms2ger: will update the rest as I get to them |
| 09:27 | <Ms2ger> | Sure :) |
| 09:31 | <Ms2ger> | jgraham, ping |
| 09:39 | Ms2ger | comments instead |
| 09:41 | <jgraham> | Ms2ger: Ooh iterative review |
| 09:42 | <Ms2ger> | I think I'm done now ;) |
| 09:43 | <jgraham> | I wonder if the spec changed or if these tests were always wrong |
| 09:44 | <Ms2ger> | The spec changed |
| 09:45 | <Ms2ger> | Somewhere after r7000 |
| 11:07 | <annevk> | Hmm, how hard can it be to find an Apple plug compatible with Switzerland |
| 11:12 | <karlcow> | http://www.w3.org/QA/2008/07/html5-parsing-howto.html#c4009627 |
| 11:14 | <annevk> | Can you pretty please do my homework? |
| 11:16 | <annevk> | Well that's great, the cycle club I signed up for does not support last names that contain a space |
| 11:16 | <annevk> | Guess I'm now an i18n victim |
| 11:17 | <karlcow> | heh. annevk I had not read it like this. ☺ but that could be a reading, indeed. |
| 11:18 | <annevk> | "Are you sure you want to update this details?" The IT infrastructure from the cycle club is not very impressive |
| 11:18 | <karlcow> | Schmidt, ex-Google: "people who are concerned can just change their names." |
| 11:18 | <karlcow> | ok it was about privacy :p |
| 11:19 | <karlcow> | take a generic name… like… hmm… Mike Smith ? |
| 11:20 | <annevk> | My brother and I have been discussing to change our last name to Van Kesteren (without contextual lowercase v) as that might work better internationally. But maybe we should make it VanKesteren as that would work even better. |
| 11:20 | <doublec> | try <script>alert('johnsmith')</script> as your name. Sounds like it might work. |
| 11:21 | <karlcow> | ah doublec might have the solution. van%20Kestern |
| 11:21 | <SimonSapin> | http://xkcd.com/327/ Bobby Tables |
| 11:21 | <karlcow> | van%20Kesteren |
| 11:22 | <annevk> | doublec: so I have Mr Anne <script>alert('johnsmith')</script> in the source now but no alert... |
| 11:22 | <doublec> | So <script> is unescaped? |
| 11:22 | <annevk> | <script>alert(1)</script> works :-) |
| 11:22 | <doublec> | hahaha |
| 11:23 | <doublec> | now try sql injection that actually updates the table to include your correct name ;) |
| 11:23 | <karlcow> | This cycling club seems to do stuff with injections. No good! think about Lance Armstrong. no good. |
| 11:23 | <jgraham> | Haha |
| 11:23 | <annevk> | Oh fuck |
| 11:24 | <annevk> | I can no longer change it because I added a space... |
| 11:24 | <annevk> | And since <script> is not escaped it eats the rest of the page |
| 11:24 | <doublec> | oops |
| 11:24 | <annevk> | (they strip everything after a space in the last name) |
| 11:24 | <karlcow> | sweet |
| 11:24 | <jgraham> | And now I am giggling like a lunatic in my office |
| 11:25 | <karlcow> | I imagine at the desk… "but what the fuck did you do that?" "I'm just a geek m'dam" |
| 11:26 | <annevk> | Fuck, now I need to "hack" this thing via the inspector |
| 11:26 | annevk | hopes that works |
| 11:26 | <doublec> | I feel sorry for the admin who next gets the list of cycle club members |
| 11:26 | karlcow | is keeping an eye on BBC homepage about a hacker who tried to steal the data of a cycling club. |
| 11:26 | <jgraham> | I think annevk should say sorry by offering to run their website :) |
| 11:27 | <annevk> | Ah great, I found the edit personal details URL and they're not echoing my last name there, except in an <input value> thingie which is somewhat properly escaped |
| 11:27 | <annevk> | (probably more due to how HTML works than anything on their part) |
| 11:27 | <doublec> | using <img src=http://xkcd.com/327/>; would have made a fun last name |
| 11:28 | <annevk> | if only it did not require a space |
| 11:28 | <doublec> | oh true |
| 11:28 | <annevk> | oh maybe via document.write() we can avoid that |
| 11:29 | <doublec> | that'd need a ' or " though |
| 11:29 | <doublec> | which looks like they escape at least ' |
| 11:29 | <doublec> | there's probably some fancy encoding scheme with a script to decode it and document.write it without using spaces |
| 11:30 | <doublec> | the JS equivalent of shell code |
| 11:31 | <jgraham> | You could always provide an array of ascii codepoints |
| 11:32 | <jgraham> | I think you could avoid space and quotes that way |
| 11:34 | <annevk> | Oooh, String.fromCharCode |
| 11:34 | <annevk> | document.write(String.fromCharCode(...)) with ... being <img src=http://xkcd.com/327/>; |
| 11:34 | <annevk> | as a sequence of code points |
| 11:35 | <doublec> | nice |
| 11:35 | <annevk> | I'll try that, for science |
| 11:38 | <doublec> | that 'src' would need to be the actual image file |
| 11:38 | <annevk> | oh doh |
| 11:38 | <doublec> | http://imgs.xkcd.com/comics/exploits_of_a_mom.png |
| 11:38 | <jgraham> | Yup |
| 11:38 | <jgraham> | http://software.hixie.ch/utilities/js/live-dom-viewer/saved/2105 |
| 11:39 | <doublec> | nifty :) |
| 11:39 | <annevk> | damnit |
| 11:40 | <annevk> | they have a fixed limit on last names |
| 11:40 | <annevk> | need to tinyurl it first |
| 11:40 | <doublec> | they might escape ; to |
| 11:40 | <annevk> | you don't need a ; |
| 11:42 | <doublec> | you can get rid of http: to |
| 11:42 | <jgraham> | while loop and multiple scripts? |
| 11:43 | <doublec> | for a protocol less url |
| 11:43 | <annevk> | success |
| 11:43 | <doublec> | \0/ |
| 11:43 | <annevk> | I'll put proof on twitter |
| 11:44 | <annevk> | <script>document.write(String.fromCharCode(60,105,109,103,32,115,114,99,61,104,116,116,112,58,47,47,103,111,111,46,103,108,47,87,107,81,49,51,62))</script> is what I used btw |
| 11:44 | <jgraham> | Oh, fromCharCode accepts multiple arguments? |
| 11:45 | <jgraham> | Hah, I forgot that. Makes to so easy as to be not fun :( |
| 11:49 | <annevk> | Using a loop would probably have hit the length limit |
| 11:52 | <MikeSmith> | hsivonen: bugzilla.validator.nu seems to be hurting |
| 11:53 | <annevk> | So could also document.write a <script src> using this technique I suppose and do evil stuff |
| 11:53 | <annevk> | Oh well |
| 12:00 | <sedovsek> | annevk: <script>document.write(Strin… Thumbs up! :) |
| 12:04 | <annevk> | Ms2ger: https://www.w3.org/Bugs/Public/show_bug.cgi?id=20925 ? |
| 12:05 | <Ms2ger> | I tend to agree with Hixie on this one |
| 12:06 | <jgraham> | Ms2ger: test review? |
| 12:06 | <Ms2ger> | ? |
| 12:07 | <Ms2ger> | I'm trying to also follow this class, so expect some lag :) |
| 12:08 | <annevk> | Ms2ger: meh |
| 13:05 | <MikeSmith> | Servo uses hubbub |
| 13:05 | <MikeSmith> | parser |
| 13:06 | <MikeSmith> | or did at least |
| 13:06 | <MikeSmith> | seems like it still does, a far as I can tell |
| 13:12 | <jgraham> | hsivonen was writing a servo backend for his parser transpiler at one point |
| 13:13 | <jgraham> | Seems to me that just writing a parser in servo wouldn't be all that much work. Or at least all the effort would be document.write |
| 13:13 | <jgraham> | s/servo/rust/ |
| 13:13 | <jgraham> | with the global flag set |
| 13:14 | <odinho> | I had a friend trying Hubbub, -- but it was not good enough for his use. |
| 13:15 | <smaug____> | I believe hsivonen is still converting his parser to rust |
| 13:20 | <jgraham> | I am using "was" in the Swedish sense ;) |
| 13:21 | <Ms2ger> | Damn Swedes |
| 13:22 | <smaug____> | my Swedish is very Rust-y :) |
| 13:22 | <jgraham> | Heh |
| 13:24 | Ms2ger | reads backscroll, joins jgraham in giggling like a lunatic |
| 13:24 | <jgraham> | (the point, which I guess wasn't obvious, is that a common mistake that Swedes make when speaking English is to use "was" for things that are still ongoing. For example if you are eating a meal and want to comment on its deliciousness, in English you would say "this is nice", but often here you hear people say "this was nice") |
| 13:30 | <odinho> | Not only Swedish, it's like than in Norwegian too. |
| 13:30 | <payman> | jgraham: I think that's the only place they use past tense (i.e. meal). |
| 13:31 | <odinho> | payman: In .no it's used all over the place. |
| 13:31 | <payman> | odinho: my Swedish is rusty too, so might be the case there as well. |
| 13:33 | <hsivonen> | MikeSmith: bugzilla.validator.nu should be a bit better now |
| 13:35 | <MikeSmith> | hsivonen: thanks |
| 13:35 | <MikeSmith> | was trying to respond to Jukka bug |
| 13:36 | <MikeSmith> | dude is such a pest |
| 13:37 | <MikeSmith> | I wish he'd find a different hobby |
| 13:43 | <hsivonen> | I'm not sure what bug you are referring to. I thought Jukka was contributing more constructively these days. |
| 14:19 | <MikeSmith> | hsivonen: bug filed today http://bugzilla.validator.nu/show_bug.cgi?id=964 about the validator not reporting an error for <body><link rel="stylesheet" href="foo.css"> |
| 14:19 | <MikeSmith> | which I agree ain't great but thanks to RDFa we're stuck with it |
| 14:22 | <annevk> | Making RDF opt-in is not easy? |
| 14:36 | <MikeSmith> | we include RDFa checking by default intentionally, because so many pages have Facebook <meta property="og:title" content="foo"> stuff |
| 14:37 | <MikeSmith> | annevk: ↑ |
| 14:38 | <annevk> | >sad panda< |
| 14:38 | jgraham | blames tobie ;) |
| 14:45 | <annevk> | slightlyoff: you around today? |
| 14:45 | <annevk> | slightlyoff: I think sicking's proposal of not doing events in Futures for now makes sense |
| 14:45 | <annevk> | slightlyoff: to just have "Future" as it were |
| 15:49 | <annevk> | Oh, Sylvain is leaving Microsoft. I guess he has been hinting at that for a while now... |
| 15:52 | <smaug____> | going where? |
| 15:54 | <Ms2ger> | Undisclosed, it seems |
| 15:54 | <annevk> | Yeah, afaict. |
| 15:55 | <darobin> | I guess Microsoft is slashing as part of its move to WebKit |
| 15:56 | <jgraham> | Microsoft slash fiction, you say? |
| 15:58 | <annevk> | http://news.ycombinator.com/item?id=5237967 I suspect that does not include jl / bratell, but I hope they leave anyway to do bigger things. |
| 15:58 | <annevk> | s/bratell/bratell \/ et al/ |
| 16:15 | <sangwhan> | It doesn't include jl or bratell |
| 16:16 | <sangwhan> | ...although it is still a mystery why I am still here |
| 16:17 | <annevk> | sangwhan: maybe you should post something inappropriate to nonsense |
| 16:17 | <sangwhan> | annevk: tried that |
| 16:17 | <sangwhan> | annevk: several times :) |
| 16:19 | <annevk> | Clearly you need to up the ante |
| 16:58 | <jgraham> | Why does someone at github think that putting a fixed width and overflow:scroll on code blocks is a good idea? It is just possible that if I have my browser window open on a large monitor I will find it immensely irritating to have to horizontally scroll all the time to read code when ~50% of the width of my display is unused |
| 16:58 | <jgraham> | s/open/maximized/ |
| 16:59 | <Philip`> | Code that is wide than 72 characters is not worth reading anyway |
| 16:59 | <zewt> | heh |
| 16:59 | <zewt> | <- wraps to ~120 |
| 17:08 | <annevk> | zewt: hey you have some time? |
| 17:09 | <annevk> | zewt: that is, if you commented on some XHR stuff a while back, otherwise I'm talking to the wrong guy :) |
| 17:10 | Philip` | recently looked at some code like https://github.com/raspberrypi/linux/blob/rpi-3.6.y/drivers/char/broadcom/vc_cma/vc_cma.c#L703 which got auto-formatted with 80-character wrapping and 8-space tabs and had a high level of nesting, which ends up making the code pretty much entirely unreadable |
| 17:10 | <zewt> | annevk: i've commented on a lot of xhr stuff, you'll have to be more specific :) |
| 17:11 | <zewt> | yeah i'll be around for a while |
| 17:11 | <annevk> | zewt: so my here's my idea to replace the silly terminate send() / abort() thing |
| 17:11 | <annevk> | zewt: abort() and open() set the error flag; abort() will no longer do all the event dispatching stuff it does now |
| 17:12 | <annevk> | zewt: under the "request steps" in send() where it says what to do if the user aborts we add a check for whether the "error flag" is set |
| 17:12 | <zewt> | Philip`: my favorite thing about PEP-8, which recommends hard wrapping at 79 characters, is the example immediately following it which, due to being wrapped at 79 characters, is utterly unreadable: http://www.python.org/dev/peps/pep-0008/#tabs-or-spaces |
| 17:12 | <annevk> | zewt: and then we remove all stuff about algorithms being able to be terminated as the error flag will take care of that |
| 17:13 | <zewt> | annevk: one sec, need to refresh my memory of those algorithms |
| 17:15 | <annevk> | I think this is basically the right approach and I'm kinda sad I never thought of it in the seven years or so of maintaining this text |
| 17:16 | <annevk> | hmm, almost seven |
| 17:20 | <zewt> | does that deal with abort()'s events being fired synchronously? |
| 17:21 | <annevk> | argh, are they? |
| 17:21 | <zewt> | yeah (per spec, and just tested to confirm) |
| 17:25 | <annevk> | hmm so instead we should have a separate entry for "error flag" that just cancels send() without doing anything else |
| 17:25 | <annevk> | abort() keeps its own event thingie |
| 17:27 | <annevk> | yeah that should work I think |
| 17:42 | <zewt> | http://msdn.microsoft.com/en-us/library/windows/apps/hh781216.aspx this page hurts my head |
| 17:42 | <zewt> | down below they go "release your blob urls!" ... but right at the very top they have "img.src = URL.createObjectURL" in an example |
| 17:43 | <zewt> | (and what the heck is "false" doing as the second argument to createObjectURL?) |
| 17:51 | <jgraham> | (fun but irrelevant fact: on the way home the bus driver decided to stop the bus's engine, and restart it, causing the computer system displaying the time and the next stop to reboot. Apart from a linux penguin, the boot screen also had a red lizard and claimed to be "powered by gecko") |
| 17:51 | <annevk> | this is what you get when people just make up APIs as they go without thinking shit through :/ |
| 17:53 | <annevk> | zewt: I still don't like using the URL parser for this though |
| 17:54 | <annevk> | zewt: can't we do better? |
| 17:54 | <annevk> | zewt: it's such a massive hack |
| 18:06 | <annevk> | zewt: in other news, I committed a fix for that XHR thing |
| 18:26 | <GPHemsley> | Thoughts on minifying? |
| 19:13 | <annevk> | GPHemsley: what do you mean? |
| 19:14 | <GPHemsley> | annevk: Open request for opinions on the act of minifying for the Web. |
| 19:14 | <annevk> | But what is minifying? |
| 19:15 | <GPHemsley> | Oh |
| 19:16 | <GPHemsley> | The act of removine whitespace and other characters that aren't crucial to the execution of a file. |
| 19:17 | <GPHemsley> | (HTML/CSS/JS/etc.) |
| 19:17 | <GPHemsley> | s/removine/removing/ |
| 19:17 | <zewt> | annevk: it doesn't necessarily have to be part of the parser as such |
| 19:18 | <annevk> | zewt: in my mental model either the parser touches the URL object, or it's touched much later on (e.g. during navigation or fetch) |
| 19:18 | <annevk> | (that'll become the platform model once I've written it all out) |
| 19:18 | <zewt> | could equivalently have a step after parsing eg. "if url is a blob URL, associate the underlying blob data with parsed url", it should just be something concise |
| 19:20 | <zewt> | or, could have a separate algorithm eg. "parse with blob association", which both calls the url parser (which would know nothing about blobs) and handles blob capture |
| 19:21 | <zewt> | annevk: not quite sure what you mean by touches |
| 19:23 | <zewt> | (eg. not sure how navigation relates here) |
| 19:28 | <annevk> | zewt: the URL is parsed at some point and then the URL object is stored somewhere until it's needed again (typically only when navigating or fetching) |
| 19:37 | <zewt> | right |
| 19:37 | <zewt> | like XHR does now |
| 19:39 | <zewt> | the idea is that the blob data assocaited with the url (if any) is stashed in the URL object (and follows it around, ultimately to the fetch algorithm), but that doesn't necessarily have to live in the core url parse algorithm |
| 19:44 | <annevk> | it wouldn't make sense for new URL() I think |
| 19:46 | <zewt> | this wouldn't touch the user-visible URL object, it's only for specs to define when their API calls grab blobs associated with urls they receive |
| 19:47 | <zewt> | eg. an XHR object would grab a reference to the blob when you call open(url), which is visible to scripts since the URL itself might be revoked by the time send() is called |
| 19:48 | <annevk> | sure sure |
| 19:48 | <zewt> | (just making sure we're talking about the same thing) |
| 19:53 | <zewt> | so, having new URL() do this wouldn't be harmful (it wouldn't have any visible effects), but yeah, having something like "parse url with base, capturing blobs" be a nested algorithm probably makes sense |
| 19:54 | <zewt> | and new URL wouldn't use that (and the "capturing" algorithm might want to live in HTML, next to fetch, instead of in the url spec, since that's what it's for and so the url spec doesn't have to depend on file api) |
| 19:55 | <zewt> | (wow that was a terrible sentence) |
| 19:55 | <annevk> | HTML fetch will move to Fetch |
| 19:55 | <annevk> | dunno about the File API stuff, maybe that'll move to Fetch too |
| 19:57 | <annevk> | Man, banks close early :/ |
| 20:03 | <zewt> | it's what they do |
| 21:01 | <annevk> | tobie: if you use OH, don't attribute it ;-) |
| 21:02 | <annevk> | tobie: or alternatively, if you attribute a quote, don't OH it |
| 21:02 | <annevk> | or maybe it doesn't matter |
