| 05:36 | <annevk> | TabAtkins: so CSS Paint having side channels seems like a big problem? I guess it depends a bit on what it gets to paint, but anything sensitive will have this issue |
| 05:45 | <TabAtkins> | We don't have anything sensitive exposed to selectors besides :visited, and I opened an issue to solve that part once and for all. |
| 05:45 | <TabAtkins> | The side channel is just a timing attack; there are multiple ways to achieve that, Paint is just higher bandwidth |
| 06:47 | <annevk> | Well from that issue it seems like there is a communication channel |
| 06:47 | <annevk> | With width |
| 06:48 | <annevk> | Which would allow fingerprinting of CSS paint impl specifics and such |
| 06:59 | <hayato> | smaug____: It doesn't look: https://cs.chromium.org/chromium/src/third_party/blink/renderer/core/dom/document.h?q=KLoadListener&sq=package:chromium&g=0&l=863 |
| 07:00 | <hayato> | smaug____: However, maybe I am not aware. I am aware only the list in document.h. |
| 09:06 | <smaug____> | k |
| 09:06 | <smaug____> | hayato: thanks. I'll keep debugging that bug |
| 10:59 | <zcorpan> | Hello whatwg |
| 11:53 | <Ms2ger> | Hello author |
| 13:57 | <annevk> | I suppose jyasskin is already on leave? I wonder if https://github.com/whatwg/fetch/issues/784 requires any action on my part at this point; I'm inclined to wait |
| 14:08 | <jyasskin> | @annevk: I'm not quite out, although definitely by Wednesday. But #784 doesn't need anything for now, unless you want me to handle the monkeypatches in WICG/webpackage#281 differently. Even that can probably wait until I get back in November. |
| 14:11 | <annevk> | jyasskin: thanks, and success juggling both of them! |
| 14:12 | <jyasskin> | :) |
| 17:28 | <annevk> | foolip: MikeSmith: we should do TLS 1.3 |
| 17:28 | <annevk> | https://blog.mozilla.org/security/2018/08/13/tls-1-3-published-in-firefox-today/ |
| 17:30 | <Domenic> | I have a feeling that will require bleeding-edge nginx extensions |
| 17:31 | <gsnedders> | yeah there's very little supporting TLS 1.3 at this point |
| 17:59 | <foolip> | annevk: if Domenic is right that would require more complicated setup, ot perhaps upgrading Debian |
| 18:00 | <jyasskin> | ekr or davidben are likely to know for sure. |
| 18:09 | <TimothyGu> | foolip: what debian version are we on right now? |
| 18:11 | <TabAtkins> | Domenic: omg, do you have do the the `.X\58X` thing in the stylesheet to avoid it getting blocked by filters? |
| 18:11 | <TabAtkins> | (context for others: https://github.com/whatwg/html/pull/3911/files#diff-36cd38f49b9afa08222c0dc9ebfe35ebL87) |
| 18:12 | <foolip> | TimothyGu: I'd have to log in to check, but I think stretch |
| 18:12 | <TimothyGu> | ah |
| 18:13 | <zcorpan> | TabAtkins: i'm not sure what filters you mean, but iirc the html build system complains about "XXX" (so it can be used to mark unfinished work) |
| 18:13 | <zcorpan> | that or it was used to track actual issues |
| 18:13 | <TabAtkins> | Ah, kk. I'm referring to braindead internet filters that block pages that contain strings that indicate porn or similar. |
| 18:14 | <zcorpan> | ah yeah it's not that |