| 00:15 | <annevk> | musgravejw: the contents of the cell that are really steps, but are written as an algorithm |
| 00:16 | <annevk> | tobie: π |
| 00:19 | <musgravejw> | annevk: gotcha. |
| 06:56 | <yoav> | annevk: FYI - it was decided yesterday (on the webperfwg call) to align TAO with CORS and avoid exposing entries on tainted redirection chains without explicit opt-in from all following hosts, including same-origin |
| 08:51 | <annevk> | yoav: π |
| 08:53 | <yoav> | annevk: related, there are questions around what TAO should do in the context of navigation timing. I'd appreciate your opinion on https://github.com/w3c/navigation-timing/issues/104#issuecomment-485765088 |
| 08:54 | <yoav> | that is slightly different from CORS AFAIU, as CORS doesn't allow exposing information about a) the previous document b) redirect responses |
| 08:58 | <annevk> | yoav: yeah exposing redirect count seems like a SOP violation |
| 08:58 | <annevk> | yoav: is this new? |
| 08:58 | <yoav> | not at all |
| 08:59 | <yoav> | :/ |
| 08:59 | <annevk> | Weird |
| 08:59 | <yoav> | just trying to define what's currently out there, and realized the current/previous TAO definitions don't make much sense |
| 09:01 | <yoav> | and not sure what implementations are currently doing, as I don't think this is covered by tests :( |
| 09:01 | <annevk> | Yeah, I guess you do the checks relative to the origin of the final document so you need to preserve some amount of data while navigating? |
| 09:01 | <annevk> | As you do not know what the final document might be |
| 09:02 | <yoav> | yeah, need to preserve the previous document's TAO headers (as well as those of the redirect chain) |
| 09:05 | <annevk> | I donβt immediately see many exploit angles since controlling the navigated to doc is required |
| 09:05 | <annevk> | But this is very different from CORS and the normal setup |
| 09:10 | <yoav> | yeah |
| 09:16 | <annevk> | yoav: not sure what bzβs concerns are though, perhaps a redirect to a data URL or the initial doc being a data URL |
| 09:22 | <yoav> | I understand bz's original concerns as related to the fact that the current TAO definition takes in a resource, and nav timing is providing it with a document |
| 09:22 | <yoav> | For those edge cases, I'm fine with saying TAO doesn't pass and that's it |
| 09:28 | <annevk> | yoav: I left a comment with a strategy I'd try out to solve this, hopefully bz will say something if he disagrees |
| 09:28 | <yoav> | π |
| 09:28 | <annevk> | yoav: it kinda makes me wonder if the TAO header is the header we're looking for to expose more about redirects |
| 09:30 | <yoav> | It's potentially already exposed. I need to write some tests to see how it currently works, which will give us a better idea of compat impact if we want to change |
| 09:54 | <hsivonen> | MikeSmith: I take it that the validator/validator GitHub ssh key additions for TravisCI and CircleCI are legitimate? |
| 10:25 | <hsivonen> | The 1024-byte <meta> scanning limit was based on WebKit behavior. Has WebKit changed its limit since? What mechanism makes http://www.thsrc.com.tw/index.html decode as UTF-8 in Safari? |
| 10:26 | <hsivonen> | (The charset meta is not within the first 1024 bytes) |
| 10:30 | <hsivonen> | oh, if it figures that </head> hasn't ended yet, it can parse past 1024 bytes |
| 10:30 | <hsivonen> | does this predate the spec or did WebKit just make stuff up here? |
| 11:08 | <annevk> | hsivonen: the spec allows reloading past 1024 bytes, no? |
| 11:08 | <hsivonen> | annevk: yes, but this isn't a reload |
| 11:09 | <hsivonen> | (not a reload in Safari, that is. It is a reload in Firefox) |
| 11:09 | <annevk> | hsivonen: and impls are not allowed to optimize those away? |
| 11:09 | <annevk> | (note that I don't think any of this is great) |
| 11:10 | <hsivonen> | possibly they are, but it's not like WebKit is optimizing all <meta> reloads away |
| 11:11 | <annevk> | hsivonen: it seems HTML also allows scanning more than 1024 bytes, it's not an enforced limit by any means |
| 11:12 | <annevk> | From what I recall it was always mostly a hope we could tighten that up, not something we had codified and reached impl agreement on |
| 11:12 | <hsivonen> | annevk: ok |
| 11:27 | <MikeSmith> | hsivonen: yes those ssh keys are legitimate |
| 11:30 | <hsivonen> | MikeSmith: ok |
| 11:31 | <MikeSmith> | context is that somebody raised an issue asking for Java9+ runtime images of the checker |
| 11:32 | <MikeSmith> | so, battling with TravisCI esoterica to automate building of those and to make them available once built |
| 11:36 | <MikeSmith> | the images are ~48MB, compressed |
| 12:20 | <hsivonen> | annevk: FWIW, it appears that our Cyrillic detector is a C++ port of https://www.neystadt.org/cyrillic/ |
| 13:44 | <dtapuska> | annevk: https://github.com/whatwg/fetch/pull/853 not sure what needs to be done to progress this again. There were questions of what Gecko does |
| 13:52 | <annevk> | dtapuska: if those questions need answers it'd be best to ask mayhemer |