| 06:33 | <domfarolino> | zcorpan: https://github.com/whatwg/html/pull/4132 is blocked only on WPTs right? Seems like we have necessary chrome sign-off, and no other vendors are affected IIUC |
| 08:19 | <MikeSmith> | > zcorpan: in other news, I just noticed that <!----------> is no longer marked as a syntax error in github's html syntax highlighter |
| 08:19 | <MikeSmith> | neat ーmakes me wonder what HTML parser they’re using |
| 08:21 | <MikeSmith> | parse5? |
| 11:30 | <zcorpan> | domfarolino: i think it's just waiting on review of the spec change itself |
| 11:31 | <zcorpan> | MikeSmith: you're assuming they use an html parser. It's regexps |
| 11:31 | <MikeSmith> | oh lord |
| 11:31 | <domfarolino> | Ok; it LGTM, can approve it shortly |
| 11:32 | <zcorpan> | Sweet thx |
| 11:49 | <edent> | Morning. Have reported a small security issue to sg@ - is there a dedicated security address? |
| 12:17 | <annevk> | edent: there isn't |
| 12:17 | <annevk> | edent: I guess this is about security around infrastructure, not standards? |
| 13:08 | <edent> | Yup. Just a problem with the website. I assume the bug bounty is paid in laptop stickers ;-) |
| 13:14 | <annevk> | Heh, those can prolly be arranged; I believe Domenic had some |
| 13:23 | <annevk> | edent: wow, that's a pretty bad bug, thanks! |
| 13:38 | <MikeSmith> | hope I wasn’t the one responsible for causing that bug |
| 13:39 | <zcorpan_> | Now I'm super curious |
| 14:07 | <Domenic> | I think it's not technically exploitable since we have no per-user state on the website. But still pretty bad in theory. |
| 14:08 | <edent> | @domenic sure, but someone could email a user that link. They click, then the reflected XSS asks for their credentials. That's the most common attack I see. |
| 14:08 | <Domenic> | Ah makes sense |
| 14:10 | <annevk> | Yeah, being able to make the site say anything is bad |
| 14:10 | <annevk> | And not just in theory |
| 14:11 | <Domenic> | Yep. More evidence in the "don't try to say anything intelligent right after waking up" camp... |
| 14:34 | <nox> | Domenic: Where can I buy that t-shirt? |
| 14:50 | <annevk> | zcorpan_: was firing progress events at img elements something that got added by the picture element revision? |
| 15:07 | <zcorpan_> | annevk: no, 3bcbdf7c00a01631629d7a39ec904a69a28b48f9 |
| 15:08 | <zcorpan_> | there was a tweak in https://www.w3.org/Bugs/Public/show_bug.cgi?id=25795#c5 |
| 15:08 | <annevk> | ta |
| 15:29 | <Domenic> | annevk: next round of review drafts in mid-December, hmm. Maybe time to work on automation tooling. |
| 15:30 | <annevk> | Domenic: ooh June, hmm |
| 15:31 | <annevk> | Domenic: yeah, we're pretty close, though of course the remainder is pretty hard |
| 15:42 | <Domenic> | All better: https://participate.whatwg.org/agreement-status?user=%3Cscript%3Ealert(1);%3C/script%3E&repo=1 |
| 16:16 | <zcorpan_> | what happened here? https://travis-ci.org/whatwg/html/builds/448402954?utm_source=github_status&utm_medium=notification |
| 16:57 | <Domenic> | zcorpan_: restarted and fixed. 503 error on build tooling. |
| 22:16 | <smaug____> | elementFromPoint handling isn't too clear to me after all |
| 22:17 | <smaug____> | what if there are several nested shadow trees |
| 22:17 | <smaug____> | and display: contents stuff |
| 22:17 | <smaug____> | I guess elementFromPoint should return the first non-display: contents |
| 22:24 | <gsnedders> | yeah, elementFromPoint isn't that great at all |