2011-09-01 [21:40:00.0000] cpearce: it looks like the spec currently lets you add alternate audio/video tracks either using fragments, or through the media.audioTracks[]/media.videoTracks[] interfaces [21:40:01.0000] you can likewise add text tracks through media.textTracks [21:40:02.0000] but you can't add alternate audio/video tracks through [21:40:03.0000] maybe that's just an oversight [01:58:00.0000] w3.org is offline? [01:58:01.0000] cannot connect to IRC or well, anything [01:59:00.0000] just a hickup it seems [02:02:00.0000] annevk: I can access www.w3.org without any issues [02:02:01.0000] annevk: maybe try pinging 128.30.52.37? [02:04:00.0000] it's working again [02:04:01.0000] very temporary :) [02:05:00.0000] i see [02:22:00.0000] alright [02:22:01.0000] time to add Node.contains() [02:25:00.0000] Nice. HTML context menus now supported in Firefox nightly. https://twitter.com/#!/codepo8/status/108989867278614528 [02:26:00.0000] just looks like they're using instead of . Not sure why though [02:29:00.0000] see some debate in a bug report somewhere [03:36:00.0000] so should we have [04:00:00.0000] Is there a name for an interface other interfaces inherit from that is never instantiated itself but only exists by virtue of the interfaces that inherit from it? [04:01:00.0000] Abstract? [04:02:00.0000] So "CharacterData is an abstract interface and does not exist as node. It is used by Text, Comment, and ProcessingInstruction nodes. [04:02:01.0000] " [04:03:00.0000] /me looks forward to OO pedants sending feedback about "abstract interface" [04:03:01.0000] If they suggest alternatives it will be all good :) [04:04:00.0000] This is just a non-normative note to clarify things since every other heading in that section is about a node [04:05:00.0000] Except Node [04:06:00.0000] I guess that should get the same note [04:21:00.0000] http://software.hixie.ch/utilities/js/live-dom-viewer/?x%3Cscript%3Edocument.body.firstChild.removeChild%28document.body%29%3C%2Fscript%3E [04:21:01.0000] Gecko: HIERARCHY_REQUEST_ERR, WebKit: NOT_FOUND_ERR [04:21:02.0000] I don't think http://dvcs.w3.org/hg/domcore/raw-file/tip/Overview.html#concept-node-pre-remove actually needs step 1 given step 2 [04:22:00.0000] Opera: NOT_FOUND_ERR [04:23:00.0000] What do you think Ms2ger? [04:23:01.0000] wfm [04:23:02.0000] Please do update the test :) [04:24:00.0000] I should check out the tests I guess [04:25:00.0000] now they are separated from the specification [04:26:00.0000] heh [04:26:01.0000] added 563 changesets with 1341 changes to 478 files [04:30:00.0000] Ms2ger, there is no test? [04:30:01.0000] Node-removeChild.html? [04:30:02.0000] yeah it does not have a HIERARCHY_REQUEST_ERR in it [04:31:00.0000] guess I can add something that makes Gecko fail [04:31:01.0000] it also does a bunch of Attr (node) tests [04:31:02.0000] Not anymore :) [04:35:00.0000] added a test for removeChild on a text node [04:35:01.0000] Thanks [04:35:02.0000] someone else can file a bug on Gecko [05:32:00.0000] I'm starting to think we should just go ahead and merge Range in [05:32:01.0000] Is there much else to do that I am missing? [05:33:00.0000] Also note it is prerequisite for adding modification listeners [05:33:01.0000] Ms2ger, AryehGregor, ^^ [05:34:00.0000] sURE [05:34:01.0000] /me hits caps lock [05:37:00.0000] does this count as written permission per the license? :) [05:38:00.0000] whoa [05:38:01.0000] https://bitbucket.org/ms2ger/dom-core/raw/tip/dom-core.html [05:39:00.0000] isn't this some giant XSS hole in bitbucket? [05:39:01.0000] Yes [05:42:00.0000] Ranges is actually pretty big [05:47:00.0000] 15 pages or so? [05:49:00.0000] yeah something like that [05:49:01.0000] 2000 lines :) [06:11:00.0000] that bitbucket thing is scary. has it been reported to bitbucket? [06:11:01.0000] Not by me [06:12:00.0000] and bitbucket has been created *after* people were supposed to know about origins [06:18:00.0000] it looks like a regression [06:19:00.0000] what is the "Assert:" stuff Ms2ger? [06:19:01.0000] can that be removed? [06:20:00.0000] Sure [06:20:01.0000] assert stuff? where?" [06:21:00.0000] DOM Range [06:22:00.0000] Ah. The asserts there are pretty much all just for WebIDL things> [06:22:01.0000] *? [06:22:02.0000] Yeah [06:22:03.0000] I'd say they don't add anything, then, really. [06:38:00.0000] the DOM Core spec exposed a bug in my new View Source impl... [06:39:00.0000] Oh? [06:41:00.0000] someone with a good term for "ancestors and the node itself"? [06:42:00.0000] XPath calls it ancestor or self [06:42:01.0000] Ms2ger: it appears that I broke the way View Source communicates the charset of the page to the main thread when I fixed https://bugzilla.mozilla.org/show_bug.cgi?id=675499 [06:45:00.0000] how about "reverse subtree" [06:46:00.0000] (the current term is "ancestor containers") [06:46:01.0000] annevk: wouldn't that be a supertree then? [06:48:00.0000] (I guess tree is not a good word to describe it though) [06:53:00.0000] the roof :) [06:54:00.0000] hasather, it's the best short word so far [06:54:01.0000] hasather, though very novel afaict [06:55:00.0000] and it might confuse people who are into this: http://en.wikipedia.org/wiki/Supertree [06:56:00.0000] annevk: yea, saw that too [06:57:00.0000] "subtree" sounds confusing because you'd think it's a tree with branches, when acually it's just a list [06:59:00.0000] /me has a book where "ancestor" includes the node itself, and "proper ancestor" doesn't [07:02:00.0000] subtree is standard terminology [07:02:01.0000] interesting [07:03:00.0000] subtree is standard when referring to the tree formed by the descendants of a node, but not when referring to the chain of ancestors, I think [07:05:00.0000] we'd use supertree for the the ancestor part [07:06:00.0000] "supertree" sounds confusing because you'd think it's a tree with branches, when actually it's just a list [07:07:00.0000] alternatives? [07:07:01.0000] /me would probably assume the supertree is the largest tree that contains the given node (i.e. the one rooted at the most distant ancestor) [07:10:00.0000] If "ancestor" is already defined to exclude the node itself, "ancestor or self" doesn't sound too bad (it's a bit ugly but short and clear), or maybe "inclusive ancestor" [07:13:00.0000] inclusive ancestor sounds rather clear and works a bit better in this context [07:16:00.0000] As someone who has no idea what you guys are talking about, "ancestor and self" is much easier to understand than "inclusivve ancestor" [07:19:00.0000] true enough, but understanding this term is the least of your worries when you implement range [07:19:01.0000] The term (and "ancestor" by itself) should be linked to a precise definition, so I guess it's not too bad if people have to click the link to find what you mean [07:20:00.0000] (It'd be worse if they thought they knew what it meant, so they didn't check the definition, but actually had the wrong idea) [07:21:00.0000] "Let's name it something nobody will be certain to understand and force them to look for the proper definition" [07:21:01.0000] Call it "concept #382" [07:21:02.0000] That needs some usability testing :p [07:21:03.0000] Philip`: hehe [07:24:00.0000] Then you just define "Concept #382: A concept #53 that is the target concept #53 or a concept #197 of it", and "Concept #197: A concept #53 that is a concept #382 of the target concept #53 but is not the target concept #53 itself", etc [07:25:00.0000] And throw in some false links to make sure they're paying attention and not just clicking along. [07:41:00.0000] I guess I should land Range before I make too many changes so people can follow on what is being changed [07:50:00.0000] went from 37 to 44 pages [07:51:00.0000] Should AryehGregor become co-editor of DOM Core now? I guess that would be a bit too unwieldy [07:51:01.0000] annevk: shouldn't it be s/and/or/ in https://bitbucket.org/ms2ger/dom-core/changeset/e126979296ce ? [07:57:00.0000] why? [08:00:00.0000] hmm. so IGs "endorse" bugs [08:06:00.0000] annevk: because it now says that objects that implements all of those interfaces are nodes [08:06:01.0000] annevk: whereas if an object implements only one of them is not a node [08:07:00.0000] hsivonen: which bug? [08:11:00.0000] thanks [08:20:00.0000] annevk, if you feel like updating Selection for your changes... ;) [08:20:01.0000] zcorpan: http://lists.w3.org/Archives/Public/public-html/2011Sep/0004.html [08:21:00.0000] annevk, go ahead and merge Range in, sounds good to me. [08:22:00.0000] Ms2ger, I was about to say, and then I got that email, damnit [08:22:01.0000] Don't take the Selection stuff, obviously. [08:22:02.0000] right [08:22:03.0000] I haven't [08:22:04.0000] I'll take that at some point soonish. [08:22:05.0000] Oh, I see, you took it already. [08:22:06.0000] Good. [08:25:00.0000] hsivonen: thanks [09:10:00.0000] heycam: hey. http://dev.w3.org/2006/webapi/WebIDL/#es-attributes - why does it say "Otherwise, it exists on the interface’s interface prototype object or on every object that implements the interface." ? why leave a choice between having it on the prototype and having it on the object? [09:38:00.0000] good morning, Whatwg! [09:42:00.0000] hey hey dglazkov [10:28:00.0000] good evening, dglazkov! [10:30:00.0000] annevk: do you like to travel? [10:30:01.0000] I do [10:31:00.0000] weird habbit :) [10:31:01.0000] habit(sp?) [10:31:02.0000] hobbit [10:32:00.0000] too tall for a hobbit [10:32:01.0000] /me makes that typo too [10:32:02.0000] would love a home like Bilbo though [10:32:03.0000] rabbit hobbit habit [10:33:00.0000] annevk: your irc client doesn't have a spell checker? [10:33:01.0000] /me is using Nightly's spell checker (w/ freenode-webchat) [10:33:02.0000] yeah (ctrl+t, enter word, hit enter, and see what Google says), but I don't always use it [10:34:00.0000] eww [10:34:01.0000] i do ctrl+t, e, down, enter, type word [10:34:02.0000] e = https://encrypted.google.com/ [10:35:00.0000] but that's only when i don't have a text field available for Gecko's spellchecker [10:35:01.0000] http://evolutionofweb.appspot.com/ is pretty cool [10:36:00.0000] shiny [10:36:01.0000] nice [10:36:02.0000] annevk: who made that? [10:36:03.0000] found it at http://chrome.blogspot.com/2011/09/happy-third-birthday-chrome.html [10:37:00.0000] ah great [10:37:01.0000] it doesn't speak spanish :( [10:38:00.0000] MikeSmith: looks like something Google contracted out [10:38:01.0000] hrm [10:38:02.0000] the screenshots of opera are odd [10:38:03.0000] hsivonen: OK [10:38:04.0000] What's the deal with Netscape not having releases before 4 [10:38:05.0000] opera v1 screenshot is w3.x [10:39:00.0000] but 2.1 is a screenshot from wXP or newer [10:39:01.0000] and 3 is from w7 [10:39:02.0000] but 4 is from 9x [10:39:03.0000] also, Firefox 3.6 is missing [10:40:00.0000] as well as some significant Safari point releases [10:40:01.0000] and significant Opera releases [10:40:02.0000] there's a "credits and sources" link in the left bar at the bottom [10:40:03.0000] so, unfortunately, this doesn't work as a more complete "Modern browsers ship" visualization :-( [10:41:00.0000] they're also missing ie1/2 [10:41:01.0000] these wavy lines are a bit too mysterious [10:41:02.0000] but yeah, theyreally should have netscap 1, 2 and 3 [10:41:03.0000] and the mozilla suite [10:41:04.0000] they quasi cover that w/ netscape versions 6..8 [10:41:05.0000] but yeah [10:42:00.0000] have people followed the diginotar coverage? [10:42:01.0000] annevk, did you file a bug on HTML for the "root" thing? [10:42:02.0000] also, the colored band for Java gets wider over time [10:42:03.0000] Ms2ger, no [10:42:04.0000] timeless: somewhat followed [10:43:00.0000] hsivonen: it's interesting that there was an addons cert [10:43:01.0000] i wonder if it'd be reasonable for browser vendors to add a requirement for all cas that want to list of the form: [10:43:02.0000] Ms2ger, HTML uses concept-tree-root in a different manner? [10:43:03.0000] timeless: addons cert? [10:43:04.0000] if you ever try to issue a cert for any of our properties, you must contact us [10:43:05.0000] http://www.computerworld.com/s/article/9219663/Hackers_may_have_stolen_over_200_SSL_certificates [10:44:00.0000] Ms2ger, I do think we should maybe add subtree and root subtree for HTML [10:44:01.0000] > Mozilla confirmed that a certificate for its add-on site had been obtained by the DigiNotar attackers. "DigiNotar informed us that they issued fraudulent certs for addons.mozilla.org in July [10:44:02.0000] annevk, I copied the definition from HTML [10:44:03.0000] timeless: It seems like a no-brainer that CAs should check if the hostnames they are minting certs for already have certs from someone else [10:45:00.0000] hsivonen: sadly [10:45:01.0000] as for profit companies [10:45:02.0000] it's in your interest to steal your competitor's customers [10:45:03.0000] how exactly can you tell if someone already has a certificate? heh [10:45:04.0000] They informed Mozilla in July, or they informed Mozilla now that they knew they issued fraudulent certs in July? [10:45:05.0000] zewt: pretty easy [10:46:00.0000] if i ask for a cert for super.example.com [10:46:01.0000] then you try to visit https://super.example.com [10:46:02.0000] if you can connect securely, then someone has a cert! :) [10:46:03.0000] Philip`: my guess is informed nowish [10:46:04.0000] i have certs that i don't use for https [10:46:05.0000] and revoked in july [10:46:06.0000] (ftp, etc) [10:47:00.0000] Shouldn't there be some requirement that if they revoke certs (presumably because they know they were invalidly issued), they at least inform the rightful owners of those domains (immediately, not a month later)? [10:47:01.0000] Philip`: yeah well, um [10:47:02.0000] can someone have an epiphany and come up with a new signing system that fixes the increasing breakage we have now, heh [10:47:03.0000] i don't think i've ever seen that in requirements [10:47:04.0000] mozilla has a crypto policy newsgroup [10:48:00.0000] it can be proposed [10:48:01.0000] and i'd imagine it'd get pretty decent support [10:48:02.0000] Seems like it's important to make it more expensive for a company to cover up its mistakes than for it to admit to them immediately [10:48:03.0000] zewt: we don't have increasing breakage [10:48:04.0000] so much as more people willing to spend the minimal effort to attack a system [10:49:00.0000] Philip`: oh, that we're doing [10:49:01.0000] sure we do; more and more entities with the ability to sign certificates; certificate exception dialogs becoming more and more pointlessly annoying :) [10:49:02.0000] mozilla & co have killed diginotar [10:49:03.0000] zewt: you played that card earlier [10:49:04.0000] please don't replay a previously played card :) [10:50:00.0000] perfectly valid when the card is correct :P [10:50:01.0000] Would the same killing have happened if they had admitted it immediately? (in which case they'd have no incentive to not try hiding it) [10:50:02.0000] (there's a Hixie quote to be made here) [10:50:03.0000] Philip`: past experience w/ CAs who have screwed up and fessed up hasn't resulted in death [10:51:00.0000] which indicates, more or less, if you are honest and forthcoming you have historically gotten leeway [10:51:01.0000] I suppose that's good, then [10:51:02.0000] (although less good than if they didn't screw up) [10:51:03.0000] past experience is of course not a commitment to future behavior [10:51:04.0000] but, the goal is to provide carrot and stick [10:52:00.0000] we've played carrot a few times, and stick once (now) [10:52:01.0000] that's another breakage of the system: if a CA screws up and is dropped from browsers, there may be a *lot* of collateral damage [10:52:02.0000] zewt: in this case, Vasco (recent parent of diginotar) indicated it has minimal business in this area [10:52:03.0000] not frequently, but it's unpleasant that the possibility exists (of course, it's inherent to the system we have) [10:52:04.0000] i haven't checked on their pricing model, but you should be able to calculate customer count [10:53:00.0000] (not to suggest i know of any alternative model that doesn't have all of these problems, of course) [10:53:01.0000] and yes, ideally those customers will ask for money back from their vendor (diginotar) [10:53:02.0000] and take their business elsewhere (quickly, or lose customers while they dawdle) [10:54:00.0000] anyway, that's the best economy i can offer today [10:54:01.0000] /me wonders if phone vendors are taking any action to zap diginotar from the stock browsers on their phones [10:54:02.0000] hsivonen: generally no [10:54:03.0000] speaking from experience at nokia [10:54:04.0000] we asked about issuing updates [10:54:05.0000] and were turned down [10:54:06.0000] timeless: yeah, it looks like only iPhone and the Nexus series get any reasonable updates [10:54:07.0000] (This was from the previous CA disaster, and we sent things up the flagpole as hard as we could) [10:55:00.0000] i can't speak for my current employer [10:55:01.0000] though I don't know if either iOS or Android on Nexus got updates following the Comodo case [10:55:02.0000] hrm, although i could test a current build of our platform :) [10:56:00.0000] (for the record, previous disaster = comodo) [10:57:00.0000] I wish companies that ship mobile OSs acted more like real software vendors [10:57:01.0000] oh, fwiw MS hasn't gotten around to sending out kill bits for wXP [10:57:02.0000] (ms would kinda like people to stop using XP...) [10:58:00.0000] i've never even seen a browser update in android of any kind except during a full OS update [10:58:01.0000] the problem w/ classic hardware vendors is that they're hardware vendors [10:58:02.0000] it's bizarre but google doesn't seem to care much about the android browser [10:58:03.0000] they, like CAs don't have recurring revenues from past customers [10:59:00.0000] and thus the cost of doing support/maintenance is something which isn't factored in and doesn't make sense to them [10:59:01.0000] CAs do, since certs expire [10:59:02.0000] zewt: yeah, technically CAs do [10:59:03.0000] but only kinda [10:59:04.0000] heh reminds me of some fraud godaddy has [10:59:05.0000] they automatically set your cert to auto-renew (at the full rate, like $50/year), without asking or telling you [10:59:06.0000] (presumably buried in some 100-page "agreement") [11:00:00.0000] you have to go through a zillion menus to even find that it's on and get rid of it [11:00:01.0000] timeless: I wonder how many iPod Touch users bought OS updates. Has it been proven that mobile hardware companies cannot sell software updates? [11:00:02.0000] hsivonen: i didn't buy my update [11:00:03.0000] timeless: Apple has managed to sell software updates for desktop/laptop hardware [11:01:00.0000] the license agreement for my Finnish iPod as presented by iTunes was in Finnish [11:01:01.0000] and thus, I couldn't accept it [11:01:02.0000] so, i never bought the update [11:01:03.0000] i'm now in .CA [11:01:04.0000] timeless: you are weird [11:01:05.0000] heh [11:01:06.0000] When the TLS stuff was designed, was it expected that the response to fraudulent certificates would require multiple independent software vendors to ship updated versions, or was there meant to be a more elegant/robust way of handling it? [11:01:07.0000] software loves showing me things in japanese, even though my system language is english (because they incorrectly use the system codepage) [11:01:08.0000] and once I get around to plugging in one of my computers (probably my G5), I'll see about buying the update [11:01:09.0000] timeless: (so am I. I, too, today rejected a piece of software due to not having the time to wade through their legal stuff) [11:01:10.0000] (software from cisco) [11:02:00.0000] Philip`: do you mean TLS or SSL? [11:02:01.0000] timeless: I don't know [11:02:02.0000] TLS is a rather recent thing (since it's SSL3.1/3.2) [11:02:03.0000] timeless: Whatever makes the question make most sense [11:02:04.0000] the assumption in PKI / SSL [11:02:05.0000] was that the vendors would be few [11:02:06.0000] and would have decent and proper CRLs [11:03:00.0000] there was a limited amount of handwaving involving how CRLs would be deployed to devices [11:03:01.0000] but it mostly assumed devices would be connected enough to be able to retrieve them [11:03:02.0000] it also mostly assumed that you wouldn't have Rogue Countries [11:03:03.0000] or rather [11:03:04.0000] it accepted that you couldn't defeat a Rogue Country if you wanted to [11:03:05.0000] and thus it was out of scope [11:04:00.0000] Basically, if the US wanted to do something evil in VeriSign or RSA or whichever, it was assumed it could, but that was a risk one was willing to take [11:04:01.0000] plus in the US at least, sunshine and leaks were probably assumed to catch such things [11:05:00.0000] which actually is still applying to the current Rogue Countries [11:05:01.0000] as zewt notes, the system we have is the best anyone can really think of to date [11:05:02.0000] it isn't perfect [11:06:00.0000] when VeriSign bought Network Solutions, I sent my bank a question asking them what they are going to do now that the entity that can tamper with DNS and the entity that guards against DNS tampering are the same [11:06:01.0000] they actually forwarded it to someone technical [11:07:00.0000] who called me and said the situation wasn't good but they'd just acknowledge the situation and their powerlessness about it [11:10:00.0000] timeless, there's an easy solution: pin particular CAs for sites, using STS. AFAIK, Chrome already does this for Google sites, so anyone who tried to use the forged cert against Chrome users would trigger unrecoverable failure. [11:10:01.0000] hsivonen: you're looking forward to DNSSEC, eh? :) [11:11:00.0000] Alternatively, get certs-via-DNSSEC working properly and supported in all browsers, then only allow that. [11:11:01.0000] For sites that opt in. [11:11:02.0000] AryehGregor: you didn't read https://twitter.com/#!/moxie__/statuses/108567203829387264 ? [11:11:03.0000] timeless: actually I am considering that the current system already fails if the curator of the root goes rogue [11:11:04.0000] of course, it seems more likely that dnssec will be implemented, and both dnssec and tls certs will be accepted for most sites, giving two independent trees which are both points of failure... [11:12:00.0000] timeless, you can remove registrars with DNSSEC. Why not? Just have the registrar one step up revoke the cert, or not renew it. [11:12:01.0000] zewt, you could have a DNSSEC record that says "only use DNSSEC certs to access this site". [11:12:02.0000] AryehGregor: did you read the whole tweet thread with Moxie and Dan Kaminsky? [11:12:03.0000] Or, just use STS and bake a list of sites and approved CAs for each site into the browsers. [11:12:04.0000] hsivonen, no. [11:13:00.0000] AryehGregor: looks like we are going to have to replay it here [11:13:01.0000] heh [11:13:02.0000] but is there a TLS equivalent to say "never use dnssec"? [11:13:03.0000] AryehGregor: https://twitter.com/#!/moxie__/status/108331615004000256 [11:13:04.0000] zewt, you can use STS and have all browsers ship with hardcoded lists of all major sites (i.e., all likely attack targets). [11:14:00.0000] hsivonen: appreciated, since i'm not a fan of twitter [11:14:01.0000] hsivonen, nothing is realistically going to protect us against ICANN or the IANA going bad, unless we abandon centralized DNS. [11:14:02.0000] special casing to make the rest of the world second-class citizens? that's horrible [11:15:00.0000] hsivonen, basically they're not likely to do bad stuff unless the US forces them to, and if the US wants to learn about Google sites it has easier ways to do that. [11:15:01.0000] Like subpoenas. [11:15:02.0000] I mean, it's a possibility, but you can't defend against everything. [11:16:00.0000] Stopping Iran from intercepting Google-bound traffic is feasible, stopping the US or VeriSign from doing it is not so feasible. [11:16:01.0000] zewt: umm. the rest of the world is already second-class even on the legislative level [11:17:00.0000] Heck, the US government could nationalize Google if it really felt like it. Eminent domain, right? [11:17:01.0000] technically yes [11:17:02.0000] ... [11:17:03.0000] Are there ways to independently verify that browser vendors aren't doing bad stuff (like shipping binaries which whitelist some fake certificates), so that they're unlikely to be a point of failure? [11:18:00.0000] my website should not be a second-class citizen compared to any other website [11:18:01.0000] If the scenario you're worried about is the US government doing evil things to US corporations, I'm pretty sure you lose either way. [11:18:02.0000] zewt, the list could be one that anyone can add themselves to. [11:18:03.0000] Philip`: well, mostly [11:18:04.0000] certainly with firefox you can build it yourself [11:18:05.0000] and compare what you have against what is shipped [11:18:06.0000] E.g., it could just be a matter of Googlebot finding STS headers and building a list of all the ones with suitably long expiration dates. [11:18:07.0000] And publishing it. [11:18:08.0000] ... but then you're just expanding the problem, since now you have to verify that whoever's modifying that record is authorized to do so [11:18:09.0000] back to square one [11:19:00.0000] That's the browser vendor, who you have to trust anyway. [11:19:01.0000] They could be installing a backdoor for all you know. [11:19:02.0000] it's moderately painful since firefox has whole-program-optimization [11:19:03.0000] Entities you realistically have to trust to some degree here: the US government, your browser vendor, your OS vendor, possibly your computer's manufacturer. [11:20:00.0000] woohoo [11:20:01.0000] Entities you should not have to trust: every single two-bit company in the world that gets certified as a CA by someone. [11:20:02.0000] after 1 email and ~1minute, i can now see bug reports i file myself! [11:20:03.0000] /me likes this company [11:20:04.0000] at nokia, it'd probably have taken a month :) [11:20:05.0000] or 3 [11:20:06.0000] or 9 [11:20:07.0000] (possibly just getting a reply saying "do you still need this?") [11:21:00.0000] And why? [11:21:01.0000] Why what? [11:21:02.0000] Why one would want to see such bug reports [11:23:00.0000] (i don't understand the question--of course you want to be able to see your own bug reports) [11:24:00.0000] zewt: Opera seems to disagree :-) [11:24:01.0000] causing me to not (often) submit opera bug reports :) [11:24:02.0000] (but we've been over that :) [11:24:03.0000] Ms2ger: why would one want to see one's own bug reports? [11:24:04.0000] /me shrugs [11:24:05.0000] If I have long-running scripts, how can I stop the long-running script alerts? Is there some simple way I can spin the event loop in the middle or similar? [11:24:06.0000] zewt: i switched to sending opera bug reports by email to opera employees [11:25:00.0000] they reply eventually with updates :) [11:25:01.0000] /me sends them by IRC in this channel [11:25:02.0000] (this also more or less works for google bug reports) [11:25:03.0000] setTimeout(..,0)? [11:25:04.0000] AryehGregor: run a synchronous xhr to a php script that pauses? :P [11:25:05.0000] zewt, :( [11:25:06.0000] zewt-- [11:25:07.0000] Maybe you could use alert() to spin the event loop [11:25:08.0000] Ms2ger, will that slow stuff down if I do it a lot? [11:25:09.0000] alert("Please click OK") [11:25:10.0000] AryehGregor: on Gecko you can use a magic thing [11:25:11.0000] Like by interpreting 0 as 15 or something? [11:26:00.0000] generators [11:26:01.0000] if you can manage to get them to work [11:26:02.0000] 4, and only if nested, AIUI [11:26:03.0000] /me observes that if the tab is in the background, Chrome doesn't whine about long-running scripts, so doesn't see that it's worth the effort [11:26:04.0000] well, the theory is if you have long-running scripts they should be in workers [11:26:05.0000] of course, that's often hard in practice [11:28:00.0000] anyone here have /. mod points? [11:28:01.0000] /me needs something down-modded [11:30:00.0000] /me appears to have 13 [11:30:01.0000] http://it.slashdot.org/comments.pl?sid=2407244&cid=37271796 [11:32:00.0000] Why do you object to that? [11:32:01.0000] one sec [11:33:00.0000] "Educate people" heh [11:33:01.0000] eh? this would only fix something if the certificate client hard fails when it can't get CRL or OCSP working and only if mapping diginotar.nl happened to magically map www.diginotar.nl (which is where some of the CRLs live), plus service.diginotar.nl validation.diginotar.nl crl.pkioverheid.nl (which are home to OCSP/CRLs) [11:33:02.0000] any security mechanism that requires educating users fails [11:33:03.0000] Philip`: ^ is my response, but basically that hosts line doesn't do anything [11:35:00.0000] 386 time clearly [11:35:01.0000] ? [11:36:00.0000] xkcd.com/386 [11:37:00.0000] oh yes [11:37:01.0000] that's one of only 3 my browser knows [11:41:00.0000] timeless: I'm quickly losing my DNSSEC enthusiasm as I read more about it [11:42:00.0000] (my SIP enthusiasm also went down when I started reading about SIP) [11:43:00.0000] /me is still insufficiently disillusioned, perhaps [11:43:01.0000] /me is still enthusiastic about DNSSEC :) [11:45:00.0000] /me sighs very loudly about CSSOM incompatibilities [11:45:01.0000] /me makes AryehGregor a co-editor [11:46:00.0000] Is anyone even trying to follow this? http://dev.w3.org/csswg/cssom/#serializing-css-values [11:46:01.0000] It seems way too vague to follow anyway. "Where CSS component values of the value can be omitted without changing the meaning of the value (e.g. initial values in shorthand properties), omit them. If this would remove all the values, then include the first allowed value." [11:46:02.0000] This needs to be defined inline with each property, methinks. [11:46:03.0000] /me works around it, grumble grumble [11:48:00.0000] AryehGregor: DNSSEC does seem attractive as a defense against small-time wifi hijacking, though [11:48:01.0000] It has a lot of uses. [11:49:00.0000] That's one, yeah. [11:49:01.0000] I'm also excited about being able to have TLS without extra CAs. [11:50:00.0000] also if it allows delegating subdomains [11:50:01.0000] the inability to do that with tls is ridiculous [11:51:00.0000] btw, now that Moxie got mentioned: what's the business model of Whisper Communications? how do they make money? [11:58:00.0000] is Hixie the only one who has access to the server which has acid3 test? [11:58:01.0000] smaug____, I assume so. [11:59:00.0000] smaug____: I believe there are others who can access the *server* but probably not the relevant directory [11:59:01.0000] that is unfortunate [11:59:02.0000] Why? [12:00:00.0000] is something happens to Hixie [12:00:01.0000] /me discovers that he massively messed up his clipboard somehow by trying to copy and paste something huge into a terminal on a remote server [12:00:02.0000] but anyway, I wait Hixie to change the test [12:00:03.0000] If something happens to Hixie and his Dreamhost account goes down, yeah, that will be fun. :) [12:00:04.0000] smaug____: good luck. :-/ [12:00:05.0000] Tons of stuff is on that. Like whatwg.org. [12:00:06.0000] hsivonen: I think this change is agreed [12:00:07.0000] smaug____: nice [12:01:00.0000] doctype.ownerDocument test should be removed [12:03:00.0000] hsivonen: sorry to hear that re SIP [12:03:01.0000] yeah, i'm not sure where i stand on SIP [12:03:02.0000] i like it in theory, and some of my devices do a good job [12:03:03.0000] but sadly the uptake of classic SIP just isn't there [12:03:04.0000] for a while, Skype was the best hope [12:04:00.0000] there actually was some progress on that front, someone is selling Skype ATAs - http://voip.about.com/b/2011/09/01/skype-gets-fully-residential.htm [12:06:00.0000] so... [12:06:01.0000] i'm not really sure how dnssec is much different from having decent Sub CAs offered by each ISP [12:06:02.0000] or rather each DNS registrar [12:07:00.0000] not actually a Root CA, just a sub CA [12:07:01.0000] hsivonen: does whisper charge for speaking engagements? :) [12:12:00.0000] guhh [12:12:01.0000] gmail just logged me out *while i was writing an email* [12:12:02.0000] Is a draft saved, at least? [12:12:03.0000] yeah [12:12:04.0000] it's not even "we logged you out because", it's just surprise! you're at the login page [12:14:00.0000] zewt: at least your message was saved [12:14:01.0000] i've had other webmail things which helpfully eat my message [12:15:00.0000] and yeah, i've hit that logged out case w/ gmail [12:21:00.0000] hsivonen: hrm [12:21:01.0000] one of my devices doesn't trust www.diginotar.com [12:21:02.0000] or because of an update [12:21:03.0000] of course, that could be because it never trusted it [12:24:00.0000] err www.diginotar.nl [12:25:00.0000] iirc some phone vendors are slow to add CAs [12:25:01.0000] which in some cases is a good thing :) [12:35:00.0000] Nice, I froze the Chrome UI for once. [12:35:01.0000] congrats [12:35:02.0000] By accidentally trying to paste a super-giant URL into the URL bar. [12:36:00.0000] (several hundred KB at least) [12:36:01.0000] (not actually a URL, just some random text) [12:36:02.0000] so... [12:36:03.0000] clipboard is actually somewhat special anyway [12:36:04.0000] /me has to force-quit [12:36:05.0000] iirc there historically hasn't been a good async api for it or something [12:36:06.0000] (at least on windows) [12:36:07.0000] First time that's happened to me in Chrome for a long time. [12:36:08.0000] I'm on Linux. [12:36:09.0000] which meant one could get very stuck [12:36:10.0000] oh, the story on x11 is probably worse [12:36:11.0000] i don't think there are any good x11 apis :) [12:38:00.0000] AryehGregor: heh, "view image" on a canvas in firefox does that [12:38:01.0000] opens it as a gigantic data: [12:40:00.0000] /me remembers a time when the urlbar would stop painting text when it got too much content [12:40:01.0000] (doesn't crash, just chugs) [12:40:02.0000] /me also remembers a time when too many characters in the urlbar would kill x servers [12:40:03.0000] (there's at least one bugzilla bug on that in case people don't believe me) [13:09:00.0000] am I the only one that finds the firefox "save password" thing almost always disappears before I can do anything with it now? [13:09:01.0000] "save password? psyche!" [13:20:00.0000] . . . seriously? WebKit computes "font-style: oblique" to "font-style: italic"? [13:20:01.0000] http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!doctype%20html%3E%0A%3Cspan%20style%3Dfont-style%3Aoblique%3E%3C%2Fspan%3E%0A%3Cscript%3Ew(getComputedStyle(document.querySelector(%22span%22)).fontStyle)%3C%2Fscript%3E [13:20:02.0000] . . . [13:20:03.0000] Unsurprising [13:20:04.0000] Really? [13:30:00.0000] /me stabs browser CSSOM implementations. STAB STAB STAB STAB. [13:31:00.0000] Guess what node.style.length is for ? [13:31:01.0000] . . . 4. [13:31:02.0000] -moz-text-blink, -moz-text-decoration-color, -moz-text-decoration-line, -moz-text-decoration-style. [13:31:03.0000] This is a regression, too, I'm pretty sure. [13:31:04.0000] /me works around it, grumble grumble [13:34:00.0000] Could someone check what this outputs in Firefox 4 and/or 5 and/or 6 and/or 7 for me? http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!doctype%20html%3E%0A%3Cspan%20style%3Dtext-decoration%3Aline-through%3E%3C%2Fspan%3E%0A%3Cscript%3Ew(document.querySelector(%22span%22).style.length)%3C%2Fscript%3E [13:34:01.0000] In 8 it's 4. [13:34:02.0000] It should be 1. [13:35:00.0000] In 6.0 it's 4 [13:35:01.0000] Hmm, so not a recent regression. [13:35:02.0000] 6.0 is pretty recent [13:35:03.0000] Conceivably it's been since 4 or 5, yeah. [13:36:00.0000] AryehGregor, want to take over CSSOM? [13:36:01.0000] annevk, no. Have no time. [13:36:02.0000] More than enough editing stuff to do for now. [13:36:03.0000] Maybe someday. [13:36:04.0000] AryehGregor, the serializing stuff is going to be taken over by the individual modules btw [13:36:05.0000] Yeah, it definitely should be. [13:36:06.0000] There needs to be a central place where it defines some useful primitives, but for nontrivial properties the details need to be specced per-property. [13:37:00.0000] if you have details for the primitives and the grammar you should be okay [13:38:00.0000] which is what CSSOM has now, it's just not very detailed (and the way CSS is written makes it hard to hook into things) [13:43:00.0000] when at first you don't succeed, mail listserv commands to the list again [13:43:01.0000] (don't most lists try to detect that and stop it?) [13:52:00.0000] karlcow, don't get your comment on twitter [14:18:00.0000] jgraham, did you ever figure out why testharness.js was producing no output for my reflection tests anymore? [14:19:00.0000] /me is observing something similar in another file too, it seems [14:19:01.0000] Oh, never mind for the other thing. [14:20:00.0000] I wasn't running the tests before the load event. [14:20:01.0000] Reflection tests are still a question, though. :) [14:36:00.0000] . . . How is a JS file's encoding determined? [14:45:00.0000] AryehGregor, based on the referring file, BOM, HTTP [14:45:01.0000] and maybe a charset attribute on , the end readyState is 'loading' [13:29:01.0000] for , the end readyState is 'complete' [13:29:02.0000] for , the end readyState is 'loaded' [13:30:00.0000] also in IE the 'load' and 'readystatechange' events on script execution are async, not sync like in the spec or gecko [13:32:00.0000] AryehGregor: it isn't about how long it takes to run [13:32:01.0000] it's about how late a timer fires [13:32:02.0000] this is giving me a headache [13:32:03.0000] if you ask it to fire in 2minutes and it's a minute late, there's a problem [13:33:00.0000] basically, as long as you break your test into small pieces, and as long as your other timer can fire with limited latency relative to its expected firing deadline, things are ok [13:33:01.0000] but if you split things up and it doesn't fire close enough to on schedule, then it's probably paging to death [13:33:02.0000] Could be. [13:34:00.0000] annevk, I don't see path objects listed anywhere in the source of http://dev.w3.org/html5/2dcontext/ (and http://www.whatwg.org/specs/web-apps/current-work/ ) [13:34:01.0000] /me needs to write a demo of that and get people to deploy it [13:36:00.0000] kennyluck: I think it's a shared mental list, not one that's been written down explicitly [13:39:00.0000] ok [13:42:00.0000] $ grep v2 source | wc -l [13:42:01.0000] 138 [13:43:00.0000] oal: You can do corners like that currently by properly styling and positioning ::before and ::after. It's an interesting idea to keep in mind for the border-radius-style property when we develop it, though [13:43:01.0000] [13:44:00.0000] Ms2ger: you never have ? :) [13:44:01.0000] Ms2ger: also, you might try `grep -c v2 source` [13:45:00.0000] Pff [13:45:01.0000] sounds like an option added by someone who doesn't "get" unix [13:45:02.0000] "we need to combine TWO programs to do this?!" [13:45:03.0000] Exactly [13:45:04.0000] zewt: yeah, it's a gnuism iirc :) [13:45:05.0000] That's what pipes are for [13:45:06.0000] have you met busybox? :) [13:45:07.0000] might be useful for wildcard greps if it shows per-file [13:45:08.0000] (-c is specified by POSIX.) [13:46:00.0000] Says manpage [13:46:01.0000] I think canvas in on like v7 now, not v2 [13:46:02.0000] *is on [13:46:03.0000] [13:46:04.0000] [13:52:00.0000] kennyluck, seems Path objects are not explicitly listed [13:53:00.0000] some path related stuff is [13:58:00.0000] annevk, that matches what I figured. [14:00:00.0000] http://www.w3.org/Bugs/Public/show_bug.cgi?id=9236 [14:01:00.0000] baby steps [14:01:01.0000] see diff given below [14:01:02.0000] That's what stood out to me :) [14:02:00.0000] heh [14:09:00.0000] heh [14:09:01.0000] oops [14:22:00.0000] Ugh. This table takes two and a half minutes to lay out in Gecko. [14:23:00.0000] It has 56,000ish rows, but still . . . [14:23:01.0000] That's really excessive. [14:23:02.0000] Chrome does much better. [14:29:00.0000] Gecko does a pretty decent job of doing things "right", which means quadratic behavior. I think we cheat more in Chrome. [14:29:01.0000] Sounds like what Chrome would do [14:29:02.0000] Fucking cheaters. [14:30:00.0000] Yeah, no kidding [14:30:01.0000] If only we had Chrome people around... [14:31:00.0000] Yeah, too bad. [14:31:01.0000] TabAtkins, the table layout is fixed, I think. [14:31:02.0000] /me double-checks [14:31:03.0000] AryehGregor: Oh, then that *should* be relatively fast. [14:32:00.0000] Not quadratic in the size of the table, at least. [14:33:00.0000] table-layout is fixed, yep. [14:33:01.0000] File a bug on Firefox then, I guess. [14:35:00.0000] TabAtkins: Yes, it can be done, but I would definitely like to see it as a part of border-radius. :) [14:37:00.0000] oal: Yeah, like I said, it sounds interesting. It has potentially interesting effects on geometry. I suppose it's supposed to have no geometric effect, so the elements can overlap more easily. [14:41:00.0000] TabAtkins, flexbox seems to be missing references [14:41:01.0000] Oh yeah? [14:41:02.0000] Oh, I guess it doesn't refer to any [14:41:03.0000] heh [14:41:04.0000] Indeed. I need to make a pass through and decide what to reference. [14:55:00.0000] http://fosspatents.blogspot.com/2011/09/shocker-for-android-oems-google.html [15:02:00.0000] Android development has always been a sad story. [15:02:01.0000] Too bad it can't be more like Chrome. [15:02:02.0000] (ium) [15:03:00.0000] Random entertaining link: http://i.imgur.com/mgf1i.png [15:03:01.0000] Sad but so true. [15:22:00.0000] [15:22:01.0000] It's visible and display:block. [15:23:00.0000] The semantics police will arrest you [15:23:01.0000] its hidden's specificity essentially one less than an inline style? [15:23:02.0000] There's just a UA rule [hidden] { display: none }. [15:23:03.0000] Nothing special. [15:23:04.0000] @hidden is implemented via a "[hidden] { display: none; }" rule in the UA stylesheet, basically. [15:23:05.0000] Works the same as i { font-style: italic } or such. [15:23:06.0000] o right. dur [15:23:07.0000] And UA rules are below author rules. [15:24:00.0000] http://www.whatwg.org/C#hidden-elements [15:25:00.0000] It's potentially a good idea to add "[hidden] { display: none !important; }" to your author stylesheet, to avoid accidentally overriding it. [15:25:01.0000] TabAtkins: +1 [15:25:02.0000] Could we add !important to the UA stylesheet? [15:25:03.0000] Then only !important author rules would override it, right? [15:25:04.0000] AryehGregor: UA !important rules dont' officially exist. [15:25:05.0000] But then how will you override it in your awesome application with a reason to show them? [15:25:06.0000] Then we could add !veryimportant to the UA stylesheet [15:25:07.0000] They are used, though, and they're above all other rules. [15:26:00.0000] Oh, I see. [15:26:01.0000] i believe there was an !important UA style that was just lobbied to be removed successfully [15:26:02.0000] Philip`: No, !important-important [15:26:03.0000] There are only user and author important declarations. [15:26:04.0000] Not UA important. [15:26:05.0000] Oh well. [15:26:06.0000] !impooooortant gives you level-5 importancy [15:26:07.0000] I interpretted "User agents should not render elements that have the hidden attribute specified." as not being overridable (easily) [15:27:00.0000] (or unintentionally with CSS) [15:27:01.0000] Maybe require a password [15:27:02.0000] :| [15:27:03.0000] I do hate the "!" syntax for important [15:27:04.0000] Agreed [15:30:00.0000] very popular reset mechanisms will mess this up, btw, https://github.com/murtaugh/HTML5-Reset/blob/master/_/css/style.css#L25 [15:30:01.0000] http://jsfiddle.net/danbeam/MrEjL/ [15:36:00.0000] Well, reset style sheets just say "I think I know what I'm doing" [15:36:01.0000] That's usually wrong, but people still use them [15:37:00.0000] Maybe we need to offer a better way [15:37:01.0000] I'm just going to try to add [hidden] { display: none !important; } to the resets, then [15:39:00.0000] paul_irish: Maybe add ^^^ to HTML5 Boilerplate? [15:40:00.0000] https://github.com/paulirish/html5-boilerplate/blob/master/css/style.css#L21 [15:40:01.0000] just sans important [15:40:02.0000] paul_irish: that might make a big diff. [15:40:03.0000] especially as its at the top of the file and specificity means it'll lose. [15:41:00.0000] paul_irish: That'll be overriden by a ".foo { display:block; }". [15:41:01.0000] roger that. [15:41:02.0000] we'll do it right [15:42:00.0000] AryehGregor, re "We'd need some way of serializing a DOM perfectly", maybe you can reuse the HTML parsing test stuff [15:42:01.0000] Ms2ger, it's possible. On the other hand, it might make more sense to just call normalize() in a few key places so everything really serializes as-is. [15:46:00.0000] the specificity of the [hidden] thing is annoying, but on the other hand i've several times had need to implement [hidden] using something other than display:none [15:47:00.0000] we've been using the combo `display: none !important; visibility: hidden;` to successfully hide the content from screenreaders as well [15:52:00.0000] AryehGregor: serializing it perfectly? i.e., serializing such that parse(serialize(foo)) == foo? [16:01:00.0000] Hixie: sorry that that [15:29:04.0000] Alerts HTMLParagraphElement. [15:29:05.0000] chriseppstein: did it come from our conversation a month (or more?) ago? [15:30:00.0000] AryehGregor: thanks [15:30:01.0000] or did it just get invented by nex3? [15:30:02.0000] benschwarz: no. we've been talking about it for over a year [15:30:03.0000] implementation is good [15:30:04.0000] (the api) [15:30:05.0000] but I really needed it now :) [15:30:06.0000] since I'm using media queries [15:30:07.0000] then I needed to change them [15:30:08.0000] ugh [15:31:00.0000] :) I'll be putting it to use this week myself I reckon [15:31:01.0000] how far away is the sass release? [15:32:00.0000] benschwarz: we have one bug so far. if you put the same mixin in the content three times our infinite loop detection kicks in erroneously [15:32:01.0000] benschwarz: who knows. 2-3 months [15:34:00.0000] but I will start using the master branch right away in my project :) [15:36:00.0000] Is there a way to compress meta tags? [15:38:00.0000] compress? [15:38:01.0000] minify it. [15:39:00.0000] sure, but why? [15:39:01.0000] privacy thoughts [15:40:00.0000] I have a hard time following them [15:40:01.0000] nevermind, it was a fool question [16:40:00.0000] TabAtkins: why the change from "justify" to "distribute"? [16:41:00.0000] TabAtkins: is there another spec that uses that or is it just under the theory the justify doesn't make sense for vertical flow? [16:50:00.0000] Hixie: I thought that Document.load was a no-go due to backwards compatibility (introducing "load" in variable scope of scripts that didn't have it before). But I can't find any concrete evidence [16:50:01.0000] createDocument().load() is definitely not a no-op [16:50:02.0000] dunno about Document.load() in general [16:59:00.0000] document.load is painful, but so far we (Gecko) haven't managed to get rid of it 2011-09-15 [17:23:00.0000] Hixie: no-op? By saying "no-go", I meant that exposing load() on HTML documents may be unacceptable for compatibility [17:23:01.0000] ah, yeah, that's possible [17:25:00.0000] Hixie: so FWIW, Document===XMLDocument + existing XMLDocumentLoader.load still seems like a good plan to me [17:25:01.0000] Hixie: unless some vendor wants to test the waters with Document.load [17:25:02.0000] having XMLDocument.load not be the actual load() is not web compatible [17:26:00.0000] (webkit goes down a number of fallback codepaths because of that) [17:26:01.0000] Hixie: that Sarissa thing seems pretty unique, although admittedly rather common on the Web [17:28:00.0000] Hixie: introducing Document.load might the best path overall indeed. Hopefully someone remembers if there were actual known compatibility issues with that [17:36:00.0000] ap: it would mean "load()" would refer to document.load() and not window.load() in all event handler attributes (e.g. onload="load()" would change meaning) so you're probably right that it's a no-go. I commented on the bug again. [17:36:01.0000] http://www.w3.org/Bugs/Public/show_bug.cgi?id=14037 [17:42:00.0000] Hixie: that's an interesting combination of ideas that I didn't consider. It's pretty far from what WebKit implements now, so I can't confidently say that it's OK for us, but it seems OK [17:42:01.0000] it's basically what bz proposed before [17:42:02.0000] i was really hoping we could find a way to not have the onreadystate magic, which is why i had moved away from it before [17:43:00.0000] but i don't see a way around it [17:43:01.0000] Hixie: it's the "Regular XML documents <…> keep returning a regular Document object" part that I found new [17:44:00.0000] ah [17:45:00.0000] well it's basically what you said would be confusing in comment 27 :-) [17:45:01.0000] but i don't know that we have an option really [17:46:00.0000] i don't think it'd be that confusing though, it just means that createDocument() returns a special Document, effectively [17:50:00.0000] Lachy: yt? [17:50:01.0000] Lachy: (pondering :scope,