| 00:25 | <mattyp> | I have a question about the web-streams api |
| 00:25 | <mattyp> | is anyone here knowledgable? |
| 09:58 | <yoav> | annevk: if you're around, I'd appreciate your comments on the note in https://github.com/w3c/resource-timing/pull/172 and if it's still necessary given the (handwavy) https://github.com/w3c/resource-timing/pull/196 |
| 10:01 | <yoav> | I'd also love bz's review on https://github.com/web-platform-tests/wpt/pull/13823, but not sure how to grab his attention... |
| 10:02 | <annevk> | yoav: I thought I left a comment this morning? |
| 10:02 | annevk | looks |
| 10:02 | <annevk> | yoav: there's a comment there from me |
| 10:02 | <yoav> | you did! |
| 10:02 | <yoav> | but GH didn't show it without a reload... |
| 10:03 | <annevk> | bz hangs out in Mozilla IRC, but generally not before 5PM our time |
| 10:04 | <annevk> | yoav: having said that, I'd recommend reaching out to Markus Stange for anything you want bz for, he should be handling most Web Performance stuff these days |
| 10:04 | <yoav> | OK, I'll try to catch him there |
| 10:04 | <yoav> | ok |
| 10:04 | <annevk> | yoav: mstange btw (also email) |
| 10:04 | <yoav> | regarding your comment, I don't understand the scenario of the attack you're describing |
| 10:05 | <yoav> | if attacker adds TAO, it exposes information about itself to EXAMPLE |
| 10:05 | <yoav> | that is true, but not sure what attack/leak that enables |
| 10:05 | <annevk> | yoav: the idea is that if the attacker manages to be somehow in the middle they can confuse example |
| 10:06 | <annevk> | yoav: this is probably more true with CORS due to it encompassing much more data, but it seems good to keep the same kind of check |
| 10:07 | <annevk> | yoav: the idea is that once you've gone cross-origin stuff is tainted, and you better explicitly opt into that |
| 10:08 | <yoav> | can you point me to the related CORS discussion? I want to better understand the rational |
| 10:09 | <annevk> | Not easily |
| 10:09 | <annevk> | "confused deputy" might be a good search term (and that coupled with security might give you some insight into the theoretical background) |
| 10:09 | <yoav> | (I don't immediately see the damage in making EXAMPLE think that the resource is CORS-enabled/passes TAO) |
| 10:11 | <yoav> | I'm familiar with that, but not sure how that applies here. What is ATTACKER convincing the confused EXAMPLE to do? |
| 10:15 | <annevk> | That really depends on what EXAMPLE does with the readouts, e.g., perhaps ATTACKER could cause some kind of overflow |
| 10:17 | <annevk> | And it applies precisely because EXAMPLE thinks it's in control but actually ATTACKER could have influenced the results, that's a confused deputy |
| 10:39 | <yoav> | annevk: OK, so if I apply this specifically to TAO, if EXAMPLE reads timing values, ATTACKER can make those values arbitrarily higher. That doesn't seem particularly risky, and EXAMPLE should know that this is true, as it has put ATTACKER in its redirection path |
| 10:40 | <annevk> | It doesn't have to know if it's XSS or some such |
| 10:41 | <annevk> | Also, I don't think it makes sense to use a different model for TAO |
| 10:41 | <yoav> | in the XSS case, I think EXAMPLE has bigger problems |
| 10:42 | <annevk> | Not a good enough argument against this imo |
| 10:42 | <annevk> | I also don't see the problem with adopting a model that's equivalent to CORS, I thought we agreed on that long ago actually |
| 10:42 | <yoav> | OK, that seems like it's worth while to open a separate issue other than 152 on that, discuss it and reach conclusions in a wider forum |
| 10:42 | <annevk> | I thought this was that issue? |
| 10:43 | <annevk> | I explained this exact scenario several times in GitHub too... |
| 10:43 | <yoav> | It wasn't clear to me that this was the issue (as TAO handling was also lacking definition around redirections that don't include TAO) |
| 10:44 | <yoav> | I agree that aligning the model with CORS would be good |
| 10:44 | <yoav> | but want to discuss this extra restriction in a wider forum |
| 10:46 | <annevk> | yoav: I guess you can, but we already did |
| 10:46 | <annevk> | yoav: this is example 5 of https://github.com/w3c/resource-timing/issues/173#issuecomment-448450346 |
| 10:47 | <annevk> | yoav: sorry, example 2 |
| 10:48 | <yoav> | For the CORS case, is there an alternative mechanism for EXAMPLE to opt into CORS with a cross-origin redirect? |
| 10:48 | <annevk> | yoav: I don't understand |
| 10:49 | <yoav> | basically to say "I know I have a cross-origin redirect and I'm not confused about it" |
| 10:49 | <annevk> | yoav: yeah, set CORS headers |
| 10:49 | <yoav> | oh, ok |
| 10:50 | <yoav> | example 3 in the above issue |
| 10:50 | <annevk> | yes |
| 10:50 | <yoav> | fair enough |
| 14:16 | <yoav> | annevk: other than the algo refactoring, https://github.com/w3c/resource-timing/pull/197 looks fine? |
| 14:16 | <annevk> | yoav: yeah, I think so |
| 14:16 | <yoav> | awesome, thanks! :) |
| 20:13 | <zcorpan> | Does gecko have some hack to "support" the safari max(2em, env(safe-area-inset-left)) thing? |
| 20:14 | <zcorpan> | i try foo(bar, env(baz)) and it gives 0 in gecko |
| 20:15 | <zcorpan> | but change "env" to something else makes the declaration be ignored |
| 20:32 | <zcorpan> | https://bugzilla.mozilla.org/show_bug.cgi?id=1519519 |
| 21:33 | <TabAtkins> | Domenic: Jeez, looking at the "interfacing with IDB" example, I'm even angrier that we shipped IDB 1 without including a friendly version. |
| 21:33 | <Domenic> | ^_^ |
| 21:34 | <TabAtkins> | The only upside to that debacle is that you can now promise-ify the friendly version and it's automatically attractive solely from the friendliness. |
| 21:39 | <Domenic> | I still remain quite pleased with the example in https://wicg.github.io/kv-storage/#storagearea-backingstore |
| 21:43 | <TabAtkins> | this is v v good |