| 03:31 | <Domenic> | What are peoples thoughts on adding crossorigin="" to all <link>/<script>/<img> in specs? Per https://github.com/tabatkins/bikeshed/pull/1312/files . Maybe it is good to opt-in to actual-SOP-enforced mode? |
| 03:33 | <Domenic> | Maybe there should even be a Bikeshed feature to automatically do that to everything in the spec? |
| 04:48 | <annevk> | Domenic: we can’t do it for stuff referenced by CSS, but otherwise seems ok; should be a no-op assumimg we send out the header already |
| 12:34 | <gsnedders> | Random thought: I wonder if we should try and limit storage quotas on insecure origins? Given the more data stored locally, the bigger the risk of a MiTM attack reading (and posting elsewhere) the stored data. |
| 12:35 | <annevk> | gsnedders: I like it |
| 12:40 | <wanderview> | annevk: I think we need to propagate the request fragment... https://twitter.com/annevk/status/1034409399702487040 |
| 12:41 | <wanderview> | or at least, when firefox implemented using the response URL, we ran into web compat issues when we did not propagate the fragment |
| 12:41 | <wanderview> | specifically, there was a site that was using the fragment to select a particular icon out of an svg file and dropping the fragment broke that |
| 12:57 | <annevk> | wanderview: but Firefox doesn't seem to be using the response URL at all per my tests |
| 12:58 | <wanderview> | annevk: in the bug I filed I linked to a glitch that shows that it does (if the SW provided response was a followed redirect) |
| 12:59 | <annevk> | wanderview: but if that's true and that was for a non-navigation, I guess that means we should do that |
| 12:59 | <annevk> | wanderview: so in that scenario the response didn't have a fragment right? |
| 12:59 | <wanderview> | correct |
| 12:59 | <annevk> | hmm, meeting, but I'll dig up the details later I guess |
| 12:59 | <wanderview> | well, the response had no fragment because its stripped today |
| 13:00 | <wanderview> | I think the SW was trying to do a pass-through |
| 13:00 | <wanderview> | but I think if it was pulling from cache API then it probably would not have a fragment |
| 13:00 | <wanderview> | install event probably installs the entire SVG with the bare URL |
| 13:56 | <annevk> | wanderview: ah yes, https://github.com/whatwg/fetch/pull/696#issuecomment-365373835 |
| 13:56 | <annevk> | wanderview: so yeah, we should totally copy it there too, I'll update the PR |
| 14:33 | <annevk> | wanderview: reading https://github.com/whatwg/fetch/issues/505#issuecomment-365373835 more carefully I think we do have several options here |
| 14:34 | <annevk> | wanderview: including not forwarding the fragment from the request URL |
| 17:04 | <devsnek> | since when does html spec have unhandledrejection and rejectionhandled events |
| 17:06 | <annevk> | devsnek: Fri Oct 2 15:58:22 2015 -0400 |
| 17:06 | <devsnek> | really? |
| 17:07 | <annevk> | yes |
| 17:07 | <devsnek> | weird lol |
| 17:07 | <annevk> | perhaps a couple minutes later, it takes some time to build |
| 17:07 | <TimothyGu> | lol |
| 17:07 | <TimothyGu> | any plans to implement in Fx |
| 17:07 | <TimothyGu> | ? |
| 17:08 | <annevk> | I didn't realize we don't have them. I guess maybe because bz complained about report an exception being underdefined and that being hard to fix? |
| 17:08 | <TimothyGu> | ah fair |
| 17:09 | <annevk> | Anyway, I don't know, but we'd take a patch for sure |
| 17:09 | <TimothyGu> | random question, is null in specs defined anywhere? |
| 17:09 | <devsnek> | like the js primitive null? |
| 17:10 | <TimothyGu> | no like the spec null |
| 17:10 | <TimothyGu> | like how strings are defined in infra |
| 17:10 | <devsnek> | https://infra.spec.whatwg.org/#nulls |
| 17:11 | <TimothyGu> | oh heh |
| 17:11 | <TimothyGu> | thanks |
| 17:11 | <devsnek> | lel |
| 19:28 | <Domenic> | MikeSmith: so I actually mean "certs" where I wrote "scripts" |
| 19:28 | <Domenic> | Do they get generated automatically? |
| 19:36 | <MikeSmith> | ah |
| 19:37 | <MikeSmith> | yeah they get generated by running one of those scripts |
| 19:38 | <MikeSmith> | the 01-certbot script |
| 19:38 | <MikeSmith> | which just calls ../common/scripts/certbot DOMAINS |
| 19:39 | <MikeSmith> | but that 01-certbot script needs to be run manually |
| 19:39 | <Domenic> | ah gotcha |
| 19:39 | <MikeSmith> | yeah, basically, any time we make config changes to the environment, we have to re-run all those 0* scripts in order |