2017-05-01 [09:25:13.0000] https://w3ctag.github.io/design-principles/#casing-rules recommends "public-key" for an enumeration value, right? [09:25:34.0000] (Context: https://github.com/w3c/webauthn/pull/432/files#diff-ec9cfa5f3f35ec1f84feb2e59686c34dR419) [09:54:08.0000] One counter-argument in favor of using "publickey" for both the dictionary member and enum value is that then devs don't need to remember which is which. [10:06:12.0000] jyasskin: well, if it's two words, then the dictionary member should be publicKey [10:06:28.0000] (and "public-key" for the enumeration, yes) [12:11:03.0000] Hmm it's a holiday in Europe? [12:11:35.0000] Ah yes Labour Day apparently [12:13:12.0000] Domenic: most of the world, AFAIK [12:56:36.0000] Yes. [12:56:51.0000] Workers Day [12:57:18.0000] Though I guess on this IRC channel that better name is ambiguous. [13:24:06.0000] Worklet's Day is just the morning of May 1. [13:26:04.0000] *groan* [13:39:14.0000] whats the status of http://tabatkins.github.io/specs/css-nesting/ ? Any way to tell how far along the standards process that spec is? [15:03:28.0000] bret: as far as I can tell it's just an idea, no implementer interest yet. Not sure on the CSSWG's feelings on it though; maybe search their minutes? [15:11:54.0000] ok ill dig around [16:41:51.0000] Yeah, Stage 0 in tc39 terms 2017-05-02 [05:34:33.0000] Domenic: It seems a little surprising that moduleMap keys on URL and not URL + credentials. Or am I thinking about this wrongly? [05:36:38.0000] Domenic: Eg, if I'm deliberately trying to fetch a module with credentials, I may end up getting a non-credentialed version because some unrelated script imported it earlier without credentials [05:48:46.0000] JakeA: it doesn't seem overly problematic [05:49:05.0000] JakeA: and it's unclear whether the added complexity of the alternative is worth it [05:50:17.0000] annevk: Well, it just caught me out when I was creating a demo of script modules, but maybe it won't happen in the real world. [05:51:31.0000] JakeA: did you want both separately? [05:52:41.0000] annevk: Yeah, but I was creating a demo where one script didn't have credentials and the next one did, so it isn't a real world example [05:53:03.0000] Surprised me though [05:53:56.0000] JakeA: we also do this for SharedWorker, even across non-module/module boundaries [05:54:15.0000] JakeA: it's a little surprising, but I'm not sure it's worth making the key more complicated [05:55:16.0000] annevk: I guess I expected it to work like the cache [05:55:51.0000] In terms of using creds as part of the key anyway [06:09:46.0000] annevk: does a VARY header effect the moduleMap? [06:11:44.0000] wanderview: nope [06:14:25.0000] I guess module map is not long lived? [06:20:12.0000] wanderview: indeed, lifetime of the thing it's attached to [07:37:42.0000] foolip: considering being a total jerk and manually overriding the webrtc url in Specref. :D [08:08:18.0000] annevk: I think I finally understand response filtering in Fetch, but it took me a while. It also threw a couple implementors for a loop, so I'm trying to see if we can make it any more clear [08:08:57.0000] but I recognize that it's actually a kind of complicated behavior, so I don't know if I'll really be able to improve on what we have already [08:09:27.0000] jugglinmike: if you can that'd be great [08:09:48.0000] jugglinmike: annevk: did you guys come to a conclusion about the desired behavior? [08:10:06.0000] ah, no, wanderview--I didn't raise this with annevk [08:10:33.0000] I gotta go and I haven't seen an issue... [08:10:40.0000] annevk: this is the test that wanderview, Mek, and I all agreed was "correct" on Friday https://github.com/w3c/web-platform-tests/compare/master...bocoup:sw-resp-tainting [08:10:43.0000] I might be able to reply later today, but no guarantees [08:10:50.0000] ohh, okay [08:11:21.0000] jugglinmike: oh right, I did look at that, and it looked reasonable, but a description of what I'm looking at would've helped [08:11:47.0000] annevk: I think the issue is that the spec actually might say the opposite of what we all thought was correct [08:11:52.0000] I haven't been able to write a coherent issue because I'm not so confident that anything is wrong here... Just a little confusing [08:12:41.0000] Yeah, wanderview's point was that a "basic filtered" response shouldn't be considered a "filtered response" at all [08:12:52.0000] or rather, that was surprising to me [08:13:15.0000] I would expect step 14 of main fetch to increase the tainting level if the request tainting is greater than the response tainting [08:13:21.0000] anyway, we should probably put this all in an issue [08:14:21.0000] Hmm, yeah, does a synthetic response have any filter applied to it? [08:14:28.0000] Anyway, issue would be good I guess [08:14:43.0000] Ahh, wanderview that's the ticket. There may be a problem where the outer fetch needs *more* filtering [08:14:54.0000] Okay, that's the insight I needed to write something coherent [08:14:58.0000] I'll get on that now [08:15:41.0000] jugglinmike: thats essentially the way I wrote it in gecko... https://dxr.mozilla.org/mozilla-central/source/dom/fetch/InternalRequest.h#363 [08:16:09.0000] and in the synthesized case it gets used here: https://dxr.mozilla.org/mozilla-central/source/dom/workers/ServiceWorkerEvents.cpp#232 [08:22:49.0000] jugglinmike: thanks for working through this [08:23:09.0000] My pleasure (as unlikely as that may sound) [11:26:21.0000] Domenic: can't remember if you were part of this conversation...are , the response should still be avail in developer tools right? Either way, Issue with this is people say the data passed to window.onerror is obfuscated when window.onerror gets an error from script.js [16:28:23.0000] This gist: https://gist.github.com/domfarolino/28725582270679b9e17fa74922cbfd65 produces this output in Chrome: https://image.ibb.co/gSgWyF/Screen_Shot_2017_05_21_at_4_27_06_PM.png [16:28:59.0000] However in FF we don't get the "Script error" 0 0 thing...we just straight up get the real data [16:47:13.0000] domfarolino: yeah the response will always be available in devtools [16:47:35.0000] right, wanted to make sure we were on the same page [16:48:22.0000] as far as why there’s a difference between Firefox and Chrome in what you get from window.onerror I dunno [16:48:49.0000] it could be a bug in Firefox that it’s not conforming to the Fetch spec on this [16:49:02.0000] or I could just not be understanding [16:49:13.0000] but annevk will be able to give you a clear answer [16:53:03.0000] MikeSmith could you help find the section in the fetch spec you are referring to? I know that HTML refers to the `crossorigin` attribute and how it helps expose more specific error data (https://html.spec.whatwg.org/multipage/scripting.html#attr-script-crossorigin) but don't know where this sort of thing is in fetch 2017-05-22 [17:29:31.0000] domfarolino: I think what the Fetch spec requires browsers to expose in this case is an “opaque filtered response” https://fetch.spec.whatwg.org/#concept-filtered-response-opaque [17:29:39.0000] > An opaque filtered response is a filtered response whose type is "opaque", url list is the empty list, status is 0, status message is the empty byte sequence, header list is empty, body is null, and trailer is empty. [17:31:36.0000] because the “response tainting” is "opaque" https://fetch.spec.whatwg.org/#concept-request-response-tainting [17:32:34.0000] and the response tainting is "opaque" because the mode is "no-cors" [17:33:27.0000] and the mode is "no-cors" because that is the default unless some other part of the fetch algorithm sets it to something else [17:33:33.0000] https://fetch.spec.whatwg.org/#concept-request-mode [17:34:06.0000] the possible modes are "same-origin", "cors", "no-cors", "navigate", or "websocket" [17:35:15.0000] and since this is not a same-origin fetch, nor a navigation, nor a websocket fetch, nor a CORS-enabled fetch, the mode remains set at the default "no-cors" [17:44:48.0000] MikeSmith ok so does all that apply even though im using a script tag for the loading and not making a request with fetch? [17:46:24.0000] Even if so, not sure why it would be opaque? It is a CORS-enabled request (since I'm using crossorigin attr on script tag) [17:52:09.0000] the Fetch spec defines the primitives for all fetches, regardless of whether they ' [17:53:22.0000] *regardless of whether they’re done usin the fetch() method or if instead the UA is initiating the fetch (instead of it being initiated from JS) [17:54:40.0000] for (no crossorigin attr, so opaque response right?) [21:43:59.0000] Domenic: source: https://fetch.spec.whatwg.org/#concept-filtered-response-opaque [21:44:24.0000] Oh, that's easy. Dev tools have special powers. [21:44:36.0000] The important thing is you can't write code in your web page to read the contents. [21:44:48.0000] Haha alright....yes! that second message is what I was about to say [21:47:13.0000] Domenic: Sorry one more thing! So I couldn't get FF to show me an error message of "Script error" via running the following gist locally https://gist.github.com/domfarolino/28725582270679b9e17fa74922cbfd65 whereas Chrome was properly muting errors. [21:47:42.0000] Yeah, I'm not sure what's up with that; Firefox may be going against the spec. [21:48:33.0000] Gotcha..didn't know if my reproduction was bogus or not..Alright I may look into filing a bug I guess [21:48:53.0000] I assume errorjs.js is adding a window.onerror handler? [21:49:37.0000] errorjs.js has the exact same contents as the script loaded above it actually [21:49:56.0000] so I guess I'm adding the handler twice...which I didn't think about [21:50:26.0000] Interesting... [21:50:32.0000] I guess it should override it [21:50:38.0000] So it should still be muted [21:51:02.0000] although hmm the function redeclarations for a/b/c might confuse things... [21:51:50.0000] Ah true. I should change it up then. Maybe add the handler inline, and rename all functions. Regardless, Chrome gives me two different outputs in window.onerror...one muted, one not. FF gives both unmuted [21:52:25.0000] Yeah, presumably there's some interop bug here, although it's a bit harder to determine who's wrong. [21:52:32.0000] Anyway, bedtime for me :) [21:52:54.0000] Thanks for the info. gn [23:22:33.0000] domfarolino: thinking about the was CORS works, the fact you can always see a response in devtools is expected [23:23:04.0000] because the browser is what enforces cross-origin restrictions, not servers [23:24:29.0000] generally if you can get a response from a server using any other client, curl or whatever, then the browser is going to get a response too [23:24:41.0000] Right, I just didn't know how far that obfuscation reach was. As in...is both the user of the browser AND the site code that does not have access to opaque responses OR JUST the site code (meaning devtools can see all). But this was a naive thought anyways [23:24:53.0000] Yes the curl is a good examp [23:25:26.0000] yeah just the site code can’t see it [23:25:26.0000] but it’s not a naive thought [23:26:05.0000] because I think the CORS protocol is kind of non-intuitive [23:27:05.0000] I think most people are surprised to find out they can see a response in devtools but their code can’t get to it [23:27:25.0000] It is certainly kind of odd. Always struck me as odd that the browser was the one managing the security, not the server (prized resource)...but then I learned about preflighting which makes more sense. [23:27:32.0000] Yeah that makes sense [23:27:35.0000] right [23:28:41.0000] anyway the web runtime is always the oddball [23:28:49.0000] see the channel /topic and all that [23:29:54.0000] So moral of the story, any state-changing server endpoints that can be accessed via CORS should be written in such a way (seemingly accepting POST is sufficient) that requests to it will def be preflighted [23:29:58.0000] Yeah haha trueee [23:34:57.0000] Question: is it possible to programmatically get the response to a script requested with CORS (not using fetch). Like If I were to programmatically insert a script whose crossorigin attr was set, and I insert it into say the head..can I, even then, get at its response? Should be no prob from a websec standpoint, but is there a mechanism to do this? [23:38:31.0000] domfarolino: no mechanism do that as far as I know [23:39:08.0000] you’d instead need to initiate the request using fetch() or XHR rather than script element [23:40:37.0000] ✔ [03:14:54.0000] mkwst: https://github.com/whatwg/fetch/issues/546 - NSFW results when doing compat analysis is a bit annoying (for me); possibly worse than annoying for others. (I can cope fine with "regular" porn sites, though I didn't want to see animal porn...) Wonder if something can/should be done about this [03:32:32.0000] zcorpan: Sorry. I didn't actually visit all the sites, just `view-source:[site]`. I only pulled up the site when the hit wasn't in the actual body of the page. [03:32:42.0000] Which site should I have flagged? [03:33:03.0000] (Really, sorry. I didn't mean to send to you horribleness.) [03:33:57.0000] mkwst: I didn't look at these results, just noted you marked some as NSFW. The animal porn was from earlier analysis I did a while back, unrelated to this. Sorry for being unclear! [03:34:14.0000] Oh, good. :) [03:35:40.0000] I was going through `javascript:` URL navigation hits on Friday, and that seemed pretty bad, which lead me to the `view-source:` method today. [03:36:01.0000] It works pretty well. I only had to actually visit ~8 or so sites today. [03:36:42.0000] yeah I also opt for view-source: unless I want to see what's broken visually. Faster to load as well [03:39:17.0000] zcorpan: also, FWIW, there are places like the UK where the legal status of visiting such sites is dubious (i.e., visiting them *is* illegal, though unknowingly clicking on a link to them is legal, but it means that one probably doesn't want to spend time clicking around) [03:43:14.0000] I added a bullet point to https://docs.google.com/document/d/1cpjWFoXBiuFYI4zb9I7wHs7uYZ0ntbOgLwH-mgqXdEM/edit# [03:49:09.0000] Why is drafts.csswg.org often damn slow? [03:52:09.0000] nox: if it’s slower than normal the best person to give a heads-up to is plinss [03:52:55.0000] MikeSmith: Meh, fast Internet probably spolied me. [03:52:58.0000] spoiled* [03:53:16.0000] OK [06:43:08.0000] annevk: Getting back to https://github.com/whatwg/fetch/pull/442#discussion_r103624566 (finally) [06:43:46.0000] should the potential destination be linked to a specific request, or should it be a detached concept that translates to destination? [06:45:06.0000] yoav: I would say detached [06:45:20.0000] yoav: just like you can normalize a method without a request [06:45:34.0000] OK, makes sense [07:28:37.0000] Anyone want to review https://github.com/w3c/fxtf-drafts/pull/169 ? (non-normative, should be pretty quick, but blocks me sending an email proposing a WD) [07:32:27.0000] Domenic? ^ [07:32:37.0000] sure [07:32:48.0000] ❤️ [07:36:20.0000] Hmm, it seems a bit unfortunate it's new DOMPoint(x, y, z, w) but new DOMMatrix([m11, ...]), i.e. you need extra []s for DOMMatrix [07:36:28.0000] annevk: one more Q. Would you like the elimination of empty potential-destination happen at the caller, or as part of the translation into a destination? [07:36:49.0000] If it's the latter, I'd love some guidance as to how to define it [07:37:32.0000] Domenic: yeah... [07:38:41.0000] Domenic: could maybe change it, but extra churn, and another incompatible change from what gecko has shipped for a few years [07:39:03.0000] Yeah, probably not worth it. [07:44:44.0000] Domenic: I guess remove "Changed fromString() static method to overloaded constructor." since that didn't exist in the previous WD [07:46:47.0000] Oh, yeah, I'm not up to date on my WDs :P [07:47:18.0000] Domenic: ok PTAL [07:48:05.0000] Domenic: you mean you didn't read the previous WD cover-to-cover, multiple times, then backwards at least once?! [07:48:23.0000] zcorpan: gotta go afk for ~30 mins, sorry! But feel free to merge. [07:48:33.0000] annevk: nm. I think I figured it out [07:48:35.0000] ok. thx [08:29:50.0000] yoav: the caller would invoke this before creating a request, I'd think [08:30:07.0000] yoav: until we have some kind of lowercase-request creator algorithm [08:34:04.0000] Domenic: https://tools.ietf.org/html/rfc8174 [08:34:15.0000] Domenic: guess we need to fork 2119 [08:34:18.0000] Oh boy [08:35:27.0000] "2. Clarifying Capitalization of Key Words" "NEW" text seems rather IETF-specific and verbose. [08:35:51.0000] Oh I see the portion other specs are supposed to use is smaller [08:36:06.0000] I guess we should indirect everything through Infra and then Infra can say something about ignoring RFC 8174. [08:36:50.0000] Maybe we can move "willful violation" to Infra too hrm [08:42:25.0000] Domenic: when should I expect this definition to be available through Bikeshed? [08:43:15.0000] jugglinmike: usually less than 24 hours; my understanding is the ingestion process happens at some set time every day. (TabAtkins may know exactly when.) After it is then you need to do bikeshed update, or use the web service. [08:43:40.0000] got it. Thanks! [08:51:25.0000] Domenic: sgtm [08:52:51.0000] Will file an issue so I don't forget, maybe a PR later 2017-05-23 [19:19:33.0000] Domenic: briefly revisiting last night's conversation...since scripts "optionally" have a muted errors field (https://html.spec.whatwg.org/#muted-errors), does that mean that there really is no interop bug after all, because it isn't a "requirement" for browsers to mute errors from x-o scripts? [20:22:50.0000] domfarolino: it is a req [20:23:44.0000] domfarolino: I think that just means it is not always set, could be clearer [20:31:39.0000] Ok I see thanks annevk [20:35:09.0000] Would you consider a PR that either moves the word "optionally" down to the description as opposed to the title, or removes it altogether? [20:36:01.0000] I'm wondering if "A flag which, if set, means" covers the "optionally" aspect of setting that flag, while preserving its requirement of existing nevertheless [00:08:18.0000] hm [00:08:20.0000] https://jsfiddle.net/3vx88jtj/1/ [00:08:29.0000] is this behavior standardized somewhere? [00:08:48.0000] i.e. how canvas font sizes <1 are supposed to work with transforms? [00:12:42.0000] domfarolino: yeah, a rewrite to a flag of sorts would make sense [00:13:01.0000] domfarolino: sorry for the late reply, missed your follow-up [00:14:52.0000] ondras: Browsers are, in general, allowed to apply a minimum font size. See https://jsfiddle.net/3vx88jtj/2/ [00:15:09.0000] (Mine applies a min of 12px.) [00:16:52.0000] TabAtkins: based on my current experience (ff, chrome), the behavior is weird and inconsistent. [00:17:18.0000] for instance, the resulting height is ~always the same, ff+chrome [00:17:23.0000] for the whole input range of your fiddle [00:17:33.0000] but the letter spacing jumps rapidly [00:18:14.0000] and chrome fixes the ctx.font value on a minimum of "2px" for the rightmost 1/3 of the slider [00:18:28.0000] while still maintaining the proper size of the rendered result [00:19:19.0000] => chrome's .font getter returns different values than those that are actually applied [00:19:59.0000] anyway, apparently rendering text to a (highly) scaled canvas seems to be a large amount of pain [00:20:02.0000] damn. [00:20:25.0000] Ah, you might not have a meaningful min; mine blows up pretty quickly as soon as you start moving the slider to the right. [00:21:03.0000] my height is constant, the width/letterspacing jumps in an unusable fashion [00:21:43.0000] Yeah, font renderers don't really work on arbitrary floats; they all round to various precisions at various spots. [00:21:54.0000] okay [00:22:12.0000] sounds like I will have to cancel the transform for font rendering and compute it myself [00:33:38.0000] annevk: when defining a method, is there an equivalent to ASSERT_UNREACHED()? Should I throw in cases that should not happen? (e.g. because callers should collapse potential-destination values to known values before they call the translation method) [00:43:44.0000] yoav: see Infra, you can use Assert: [00:48:09.0000] cool, thx! [00:49:00.0000] so something like "Assert: this should never be reached."? [00:55:22.0000] yoav: prolly better to assert before the branch [00:55:41.0000] ok, makes sense [00:55:50.0000] Yeah, assert your preconditions. Failling the assert is a spec error, not a runtime error. [00:55:52.0000] yoav: Assert: destination is not fetch or some such [00:56:27.0000] If it's a runtime error, then you do indeed need to throw; asserts might be useful afterwards to remind the spec reader what values are left over. [01:01:36.0000] Asserts won't "run" after throw; throw terminates [01:07:03.0000] Right, I mean like "1. If |x| is a weird value, throw a TypeError. 2. Assert: |x| is a FooEnum value. 3. More stuff..." [01:09:21.0000] Ah [01:12:11.0000] annevk: https://github.com/whatwg/fetch/pull/547 [01:12:59.0000] annevk: so getting back to HTML checking for the Encoding files, we want to run the checker if any .text files change or if the visualize.py file changes? [01:13:20.0000] It's getting bikeshed errors regarding the linking of "preload destination". I'm not sure if it real errors or a bikeshed issue related to having a space as part of the linked term (there are other errors with space in them) [01:15:36.0000] There's definitely nothign wrong with ahving spaces in a term. [01:15:53.0000] MikeSmith: .bs or visualize.py I suppose [01:16:16.0000] yoav: That said, I don't see "preload destination" in the ref database. [01:16:18.0000] MikeSmith: hmm yeah, also addition of txt I guess [01:17:02.0000] or changes to the .txt files? I notice a recent commit that makes changes to them [01:17:11.0000] TabAtkins: that's probably because I just made it up and didn't know I should also add it to a ref database :) [01:17:37.0000] also s/preload destination/potential destination/ [01:17:55.0000] Oh! Jeez, no wonder I was confused when reading the PR. ^_^ [01:18:11.0000] yoav: I can review later today, but I'd have the steps in opposite order; early return for fetch, then assert it's a destination, then return input [01:18:31.0000] annevk: OK, I'll reverse them [01:18:36.0000] In the PR, you'll get a linking error because you're not defining a "potential destination" term; you're defining "potential-destination". [01:18:49.0000] MikeSmith: yeah I suppose [01:18:58.0000] TabAtkins: doh! [01:19:52.0000] TabAtkins: Still getting the error after deleting the "-" [01:20:11.0000] ...and replacing it with a space? [01:20:19.0000] yeah [01:21:11.0000] Push the change; you shouldn't be having any trouble. [01:21:31.0000] yoav: I don't think it's worth having a dfn for that [01:22:35.0000] yoav: if you wanted to define such a term you'd define it as a superset of destination [01:22:36.0000] annevk: OK, I'll remove it then [01:23:18.0000] Can replace it with just a |var| if you want the styling. [01:23:51.0000] annevk: but we do need HTML to link to it later on. Can we do that without a dfn? [01:24:19.0000] No. [01:25:17.0000] TabAtkins: pushed the change in the mean time. I still see the error (but I'm sure I'm holding it wrong :D) [01:31:27.0000] I'm extremely confused by what's going on here. [01:32:34.0000] TabAtkins: confused by my patch, or by the error? [01:34:12.0000] yoav: then you need to define it as a distinct type [01:34:36.0000] The error. [01:35:27.0000] I'll check more on this before bed, in heading to dinner now. [01:37:08.0000] TabAtkins: Thanks :) [01:37:31.0000] annevk: pointers to an example of defining as a distinct type? [01:40:29.0000] yoav: see eg dfn of method [01:40:52.0000] yoav: X is "fetch" or a destination [01:41:11.0000] yoav: on mobile due to sick kid btw [01:41:34.0000] Hence poor latency [01:43:26.0000] annevk: looking, and no worries RE latency. I know what it's like [01:49:57.0000] TabAtkins: Split out the definition. Now I'm longer seeing the error [01:50:31.0000] annevk: uploaded. Let me know what you think (when you have time) [02:03:25.0000] Oh shoot, I realize what's up with the error now. [02:04:47.0000] Looks like I don't special-case for=/ on a dfn to mean "no for value". So it was registering it with a for of /, which you can't actually specify on a link. [02:06:08.0000] When you split out the definition, you also just removed the for attribute from the dfn, which resolved the issue. [02:06:26.0000] This is a Bikeshed bug, tho. [02:17:12.0000] TabAtkins: OK, cool. Happy to find bikeshed bugs by doing things you normally wouldn't :D [03:00:13.0000] does the fetch spec say something about what should happen when the promise returned by fetch is resolved, but there is no scheduled work on the event loop (and so technically, we don't enter a microtask checkpoint)? [03:01:37.0000] jochen__: HTML would say something about that, but that can't really happen, since fetch resolves the promise from a task [03:35:33.0000] jochen__: in fact, promises never resolve without a task being involved [03:54:27.0000] ah, found it [07:32:47.0000] TabAtkins: while you're around and fixing BS bugs… [07:33:08.0000] TabAtkins: I'm having an issue where BS seems to rewrite an inline SVG [07:33:55.0000] TabAtkins: removing the namespace in the process, which then gets rejected by echidna's HTML validator. [07:35:23.0000] if that is about the xlink:href vs href I fixed that in the HTML checker at the end of last week [07:35:43.0000] if it’s about some other error I can fix that too [07:36:18.0000] MikeSmith: how do you know this? [07:36:30.0000] assuming it’s another case where the SVG changed the doc-confoormaces requirements in SVG2 [07:37:14.0000] MikeSmith: I have no idea. This thing displays is the limit of my understanding of namespaces in SVG [07:37:36.0000] MikeSmith: can I point you to the error, BS source and output? [07:37:43.0000] well as far as SVG checking I can make the checker do whatever creates the least problems for people trying to get real work done [07:37:46.0000] tobie: sure [07:37:59.0000] MikeSmith: source: https://github.com/w3c/sensors/blob/9335c1fa027fe309a3fd13b98914b7d479968252/index.bs#L735-L800 [07:38:36.0000] no version of the SVG spec has ever clearly stated actual doc-conformance requirements consistently anyway [07:38:39.0000] /me looks [07:38:53.0000] MikeSmith: echidna error: https://labs.w3.org/echidna/api/status?id=916cf371-4630-491c-abd6-c663b65e6bbd [07:39:20.0000] /me looks again [07:39:22.0000] MikeSmith: validator error: https://validator.w3.org/nu/?doc=http://owl.w3.org//916cf371-4630-491c-abd6-c663b65e6bbd/Overview.html [07:40:34.0000] MikeSmith: Bikeshed output of SVG: https://gist.github.com/tobie/d4a0e43cc7781fec2daa933674d099f5 [07:40:58.0000] ah I think that is a bikeshed bug [07:41:13.0000] [07:41:25.0000] Yup: the namespaces are all gone [07:41:40.0000] I guess that should be xmlns:xlink="http://www.w3.org/1999/xlink" [07:42:03.0000] so yeah I can' [07:42:16.0000] *I can’t really fix that in the checker [07:42:46.0000] because there is no “xlink” attribute defined anywhere [07:44:33.0000] Filing an issue against BS. Thanks for the help! [07:45:04.0000] cheers [07:53:48.0000] TabAtkins/MikeSmith: for reference: https://github.com/tabatkins/bikeshed/issues/1029 [08:19:12.0000] @jyasskin, @mounir, others: what are your thoughts on using "user triggered activation" as "information about the user’s intent" to determine whether to prompt or grant permission? [08:33:46.0000] Maybe @annevk also ^ [08:35:17.0000] Here's the PR on this topic: https://github.com/w3c/sensors/pull/207 [08:48:28.0000] tobie: what other information do you have? [08:57:29.0000] annevk: that's a good question. [09:04:20.0000] tobie: It's very easy to trick a user into providing activation, so it's not a reliable way to infer intent. I like demanding it for permission prompts because it helps avoid a popup-by-surprise and possibly clickjacking, but even that's gotten objections for the case where the entire point of a URL is to use a certain permission. [09:06:18.0000] tobie: I'm having trouble following the English in that PR. Is it just saying that some readings are only very slightly sensitive, so we don't need actual user consent to give them out, just evidence that the user has noticed the page? [09:08:49.0000] Ojan has been looking at some of that sort of feature for interventions. e.g. https://groups.google.com/a/chromium.org/d/topic/blink-dev/MRWIaGY4Txg/discussion for beforeunload and https://groups.google.com/a/chromium.org/d/topic/blink-dev/51WbTwn0M_Y/discussion for autoplaying audio [09:24:28.0000] jyasskin: I think the objection was more involved than that [09:25:12.0000] jyasskin: the objection was that if you don't persist the permission, the UX becomes really bad if the permission prompt effectively requires two interactions [09:25:43.0000] jyasskin: so by requiring user interaction, you effectively require persisting the permission [09:25:53.0000] annevk: Was there an example of that badness for pages that weren't requesting on load? [09:27:02.0000] e.g. it's probably a good thing to make foonews.com wait to ask for your location until after you've interacted. [09:27:04.0000] jyasskin: so the sensitiveness of the readings is highly debatable AND depends on the kind of sensors [09:27:37.0000] jyasskin: not sure, I wasn't too closely involved [09:29:20.0000] tobie: I think it'd be totally reasonable for some sensors to decide that they lie in that intermediate-sensitivity region, but I'm uncomfortable saying that the activation conveys user intent. [09:29:56.0000] Or, I suppose, uncomfortable saying that it conveys intent to grant that particular sensor. It's intent to interact with the page. [09:30:25.0000] tobie: I'll comment. [09:30:37.0000] jyasskin: thank you [09:31:56.0000] annevk: to answer your previous question, I don't think we have much info to determine user intent. [09:32:43.0000] annevk: I'm especially concerned about malicious use of motion sensors on drive-by sites. [09:34:14.0000] tobie: you might have noticed that we're removing these sensors from Fx [09:34:31.0000] annevk, jyasskin: I would considered tying sensor access to PWA installed status or similar. The use cases really involve app status, not drive-by websites. [09:34:43.0000] tobie: it's unclear if we'll add them back at this point, given that asking the user about them seems like a hard problem [09:34:45.0000] annevk: the ambient light stuff. [09:35:04.0000] annevk: but are you going to remove also the motion sensors? [09:35:27.0000] tobie: Installation definitely indicates user intent. [09:35:35.0000] I don't know [09:35:36.0000] jyasskin: I agree. [09:35:54.0000] annevk: they have similar issues but much more interesting use cases (indoor navigation, gaming, WebVR, etc.) [09:35:58.0000] I'm not a big fan of the whole PWA thing, it's not very webby [09:36:47.0000] annevk: well, it's much more webby than any of the previous iteration we've seen. [09:43:54.0000] annevk: when you have time please check https://stackoverflow.com/questions/44121783/fetch-api-default-cross-origin-behavior/44125919#44125919 and comment/correct/answer [09:44:08.0000] jyasskin: filed https://github.com/w3c/sensors/issues/211 [09:54:35.0000] annevk: FWIW, an installed PWA is a bookmark with better UI. We couldn't infer intent from bookmarks because users tended to accumulate them indefinitely, but we think there's some pressure to "uninstall" PWAs that you're not using, since they clutter your launch screen, so we're more willing to infer intent from them. 2017-05-24 [19:27:47.0000] about github webhoooks, does anybody here know if there is some way to get github to retry a webhook it if times out or fails? [19:37:26.0000] MikeSmith: I don't think it's possible. (I assume you meant when the POST from gitHub to your server has failed, because your server had a broken leg) [19:39:39.0000] payloads have also a max size of 5 MB. Above that the webhook will not happen. [19:39:46.0000] https://developer.github.com/webhooks/ [19:42:59.0000] Oh let me fix one thing [19:43:06.0000] There is a manual retrigger [19:43:30.0000] karlcow: thanks [19:43:42.0000] yeah I can manually re-run it from the github UI [19:43:45.0000] https://github.com/[owner_name]/[repo_name]/settings/hooks/unique_id [19:44:00.0000] under Recent Deliveries [19:44:04.0000] yeah [19:44:11.0000] that is what I use [19:44:17.0000] every day [19:44:23.0000] ouch [19:44:27.0000] for https://github.com/w3c/web-platform-tests/ [19:44:59.0000] yeah the thing is, for web-platform-tests it generates a *ton* of webhook requests every day [19:45:08.0000] dozens every day [19:45:21.0000] You are listening to "*" or specific events. [19:45:57.0000] well one thing is, github unfortunately does not give much granularity on what you can listen for [19:46:05.0000] on github.com/webcompat/web-bugs. We probably only generate 100 issues event a day. [19:46:30.0000] yeah most of the events are useless and you never want to do anything for them [19:47:01.0000] but for pull requests the important ones are “opened” and “closed” and “syncronized” [19:47:08.0000] For us it helps us to do labelling automagically depending on a couple of criteria [19:47:15.0000] right [19:47:33.0000] but we are using it to mirror the PR branches [19:47:52.0000] so for that all we care about is opened/closed/syncronized [19:48:02.0000] gotcha [19:48:17.0000] and not things like “edited” or “review requested” etc etc [19:48:29.0000] so if those fail I don’t care [19:48:42.0000] but if an opened/closed/syncronized fails I care a lot [19:49:14.0000] so what I do is, I have some bookmarklets I wrote to filter out all the noise from the Recent Deliveries logs [19:49:25.0000] so I can find just the opened/closed/syncronized fails [19:49:33.0000] :( [19:49:41.0000] yeah :( [19:50:02.0000] I have to just manually click the Redeliver button for those [19:50:27.0000] Maybe a good bug report for GitHub on having a URI with a list of all recent fails with a JSON format and a way to retrigger those. [19:50:30.0000] so... would much rather that Github just retried them some number of times if they fail [19:50:34.0000] yeah [19:52:01.0000] anyway it’s not a huge hardship [19:52:04.0000] just annoying [19:53:41.0000] add another point of failure by automating with webdriver api and selenium :) [19:55:53.0000] haha [19:56:47.0000] yeah but since I don’t know how to automate with webdriver I would ask somebody else to set it up and so they after that they would be responsible for dealing with the failures instead of me [19:56:54.0000] in other words, great plan [19:57:10.0000] good brainstorming! [19:58:50.0000] ;) [23:37:28.0000] mathiasbynens: 🍰🎉 [00:21:14.0000] hsivonen: does XUL require external DTDs? [00:25:14.0000] annevk: yes :-( [00:25:33.0000] annevk: that's the whole point. the DTD varies by localization, so the DTDs come from the language pack [00:26:43.0000] hsivonen: I'm on board with parsing the internal subset, I don't know how much the external subset varies from that, it might be that an implementation could reuse quite a bit of code and we'd just never expose it to the web [00:27:03.0000] hsivonen: but it sounds like there's not a real interest in addressing that issue [00:27:14.0000] hsivonen: addressing XML5, I mean [00:32:48.0000] annevk: it seems like this isn't the time for XML5. I can sympathize with not wishing to take on the scope creep of switching to XML5 if the goal is just to get memory-safety for XML 1.0 4th ed. [00:34:22.0000] WebIDL style opinion: I have a set of subclasses that all share an attribute. *One* of them wants to treat the attribute as readonly; the rest treat it as mutable. Should I do the technically-correct thing, and mark it as "readonly attribute" on the superclass, then "inherit attribute" on all but one of the subclasses; or do the easy thing and just put [00:34:23.0000] "attribute" on the superclass, then describe in prose that the one subclass ignores writes? [00:34:31.0000] hsivonen: yeah, makes sense [00:34:44.0000] hsivonen: given https://bugzilla.mozilla.org/show_bug.cgi?id=501837 I think we should consider XML 1.0 5th though [00:34:48.0000] hsivonen: but meh [00:35:24.0000] hsivonen: did you ever discuss with the JavaScript folks changing the JavaScript String type to be UTF-8 or UCS-2? [00:35:47.0000] hsivonen: I mean, supporting a UTF-8 string type [00:37:20.0000] hsivonen: I tried to convince Waldo he should give it a shot or at least strongly consider it, but not much luck thus far [01:21:02.0000] annevk: changing JS string internals to UTF-8 was discussed at one point [01:21:31.0000] annevk: quite a while ago [01:21:57.0000] annevk: but in good news, script parsing directly from UTF-8 seems to be going ahead [01:22:03.0000] hsivonen: so I don't really mean breaking the API contract with the web, just to have an additional internal string type (or replace the ASCII-only one) [01:22:18.0000] annevk: it's not ASCII-only, it's Latin-1 [01:22:23.0000] but yeah [01:22:32.0000] ok [01:22:36.0000] I didn't mean breaking the Web-visible API, either [01:23:11.0000] Ah, parsing from UTF-8 sounds nice, hopefully we don't have the V8 bottleneck then if you hit an emoji in a comment [01:23:23.0000] annevk: Thanks for reviewing https://github.com/whatwg/fetch/pull/547 Test-wise, I think the best way to go is to use potential destination as part of https://github.com/whatwg/html/pull/2588 and then land it alongside a Chrome CL with the right tests [01:23:38.0000] annevk: see also https://bugzilla.mozilla.org/show_bug.cgi?id=1355106 [01:24:03.0000] annevk: I've been trying to promote not repeating that V8 design [01:24:03.0000] yoav: that's reasonable, I forgot this requires changes to the HTML Standard, that should ensure the relevant bugs get filed at least [01:24:28.0000] hsivonen: great, I wasn't aware you were on top of all that [01:24:31.0000] annevk: AFAICT, we aren't headed towards that V8 design [01:26:30.0000] Domenic: would you be interested in adding the "potential destination" bits to your PR? Or would you like me to do it? [01:28:56.0000] annevk: "we don't have the V8 bottleneck then if you hit an emoji in a comment" [01:29:03.0000] What a time to be alive! [01:38:19.0000] do I want to ask what the V8 bottleneck is? does it convert everything to utf-16 codeunits when it hits a non-ASCII/latin1 byte? [01:39:32.0000] Emojis are so great at making people that otherwise wouldn't care put up the right i18n infrastructure [01:40:01.0000] gsnedders: I think that's basically it, though I don't think it has to redo everything [01:40:36.0000] gsnedders: but it's a Unicode performance cliff effectively [02:12:31.0000] tobie: _requiring_ a user activation for permission prompt might be a bit agressive but I know there are some experiment in this direction in Chrome [02:12:51.0000] tobie: if other browsers are okay with this, it might work [02:38:51.0000] annevk/Domenic: Related tests and Chrome CL at https://codereview.chromium.org/2903653005 [02:39:28.0000] I need to writeup an Intent to ship for this, as this modifies shipped behavior [02:40:18.0000] It'll also require some HTTPArchive digging to see that there aren't many sites already using the "onerror" fallback [02:40:51.0000] yoav: yay [02:41:06.0000] yoav: I suspect you know but Domenic isn't usually around until quite a bit later [02:41:37.0000] yeah, I'm assuming he'll catch up later, as he's logged in [03:09:16.0000] Is drafts.fxtf.org down? [03:09:50.0000] nox: loads here [03:10:02.0000] Ah it works again here. [03:14:41.0000] mounir: thanks feel free to comment on the PR (https://github.com/w3c/sensors/pull/207), the issue (https://github.com/w3c/sensors/issues/196) and loop the relevant people in, if necessary. [04:47:03.0000] Is it a problem that request headers such as * and _ end up as HTTP__ in CGI and that if you use both you get only a single HTTP__ for the last header transmitted? [04:47:17.0000] Seems there's at least some information loss [06:23:48.0000] I mean, I am not super surprised about CGI being a lossy translation of HTTP semantics [06:26:01.0000] does CGI not pass everything through as envrionment variables? [06:26:13.0000] any hence is limited by what's a valid env? [06:26:20.0000] Yes [07:42:04.0000] So I looked around and there is a document describing CGI but it doesn't cover this case: https://tools.ietf.org/html/rfc3875#section-4.1.18 [07:57:32.0000] I'm pretty much behind in github notifications. If something needs my attention, please @mention me or drop a link here [08:14:09.0000] zcorpan: there's a parser open issue, besides the mega PR... https://github.com/whatwg/html/issues/2704 [08:24:01.0000] Domenic: thanks [08:26:59.0000] hsivonen: I tried to do some more digging on the namespaces front, https://lists.w3.org/Archives/Member/w3c-xml-wg/1997Aug/0088.html seems to suggest RDF was important enough to consider a special case for, without necessarily solving it generically [08:30:26.0000] annevk: We'll see if anyone thinks this is important.. https://github.com/httpwg/http11bis/issues/26 [08:33:17.0000] jugglinmike++ [08:33:29.0000] :) [08:50:50.0000] annevk: https://archive.mozilla.org/pub/firefox/try-builds/hsivonen⊙mc/ has builds for Windows and Mac in case you are interested in trying a browser with Encoding Standard-compliant converters [08:51:18.0000] (not 100% compliant integration, though. some old BOM and EOF handling bugs remain and need follow-ups to fix) [08:53:57.0000] annevk: in any case, RDF has had the most committed to the "identifiers are URIs" meme and has been since before XMLNS and RDF/XML were final [08:56:32.0000] MikeSmith: hsivonen: https://github.com/validator/validator/blob/3530d33b339a64fb3dd76673257d1fb7b930b9ea/schema/svg11/svg-datatypes.rnc#L73 is sadness (and means doesn't get an error for the attribute value) [08:57:57.0000] zcorpan: indeed, those datatypes could use a custom library [10:50:00.0000] random thought: should the processing model section in the html spec somehow normatively suggest that user agents should not starve particular task queues? (case in hand, chrome currently has arguably a bug where posting messages to a messageport in the right way can cause chrome to starve all other task queues, which arguably is perfectly fine according to the spec...) [11:13:57.0000] had a question come up in microformats parsing, what is the textContent of a self-closing tag [11:14:05.0000] https://dom.spec.whatwg.org/#dom-node-textcontent says for Elements textCotent must be The concatenation of data of all the Text node descendants of the context object, in tree order. [11:14:20.0000] but is it Null or "" if there are no text node descendants [11:28:39.0000] full breakdown of what i am hitting is here https://github.com/indieweb/microformats-ruby/issues/72 [11:29:56.0000] ben_thatmustbeme: empty string [11:30:24.0000] thanks [11:32:20.0000] is there anywhere that is clear about that? [11:32:42.0000] i feel like that should be more clear, just don't know if i'm missing something [11:33:21.0000] ben_thatmustbeme: in general it's understood that the concatenation of an empty set of strings is the empty string; I guess we could eventually define that explicitly, but it's generally true in programming. [11:38:06.0000] guess i never thought about it. both ruby and php agree on that [12:27:39.0000] Mek: I'm not sure what you mean by starve [12:27:53.0000] Mek: maybe file a bug since I won't be able to follow-up properly for a while [12:29:27.0000] annevk: starve is the language the example used (" The user agent could then give [...] events preference over other tasks [...], keeping the interface responsive but not starving other task queues,"), but basically make sure that all task queues will eventually make progress [12:32:55.0000] Mek: as long as there are tasks on one task source, not handling the others is acceptable, but yeah, maybe it should not be, but not sure what you could require there meaningfully [12:33:13.0000] Mek: not all user agents implement the same task sources either [12:33:39.0000] Mek: and a lot of UI events seem to move from task sources to the "animation frame moment" [12:34:18.0000] Mek: so nothing there really seems stable enough to me to clean up and figure out an ideal model [12:34:35.0000] yeah, it definitely doesn't seem like something that can have strong requirements [12:35:33.0000] it just "feels" wrong that posting the "right" messages from an onmessage event can cause chrome to never get to any other tasks... but maybe that's just a quality-of-implementation thing [13:44:10.0000] JakeA annevk as far as I can tell, service workers should intercept synchronous XHR requests in the same way they intercept asynchronous XHR requests. Is that correct? [13:51:56.0000] jugglinmike: yes, but we don't in Chrome right now. It created a sort of deadlock. [13:55:41.0000] JakeA: I'll have to research a bit more. Chromium has a test for this, but I don't think it's correct [13:56:03.0000] not sure we have tested it, but i think sync xhr interception should work in FF [13:56:27.0000] our sync xhr spins the event loop, so I don't think we will deadlock... but who knows [13:56:50.0000] That's a bug in Fx though [13:57:18.0000] annevk: why? we're not running javascript on the main thread here [13:57:25.0000] But would be fun to test interaction with postMessage() and friends and such [13:57:40.0000] wanderview: UI event handlers run iirc [13:57:42.0000] Here's the test [13:57:45.0000] https://chromium.googlesource.com/chromium/src.git/+/master/third_party/WebKit/LayoutTests/http/tests/serviceworker/sync-xhr-doesnt-deadlock.html [13:58:03.0000] and https://chromium.googlesource.com/chromium/src.git/+/master/third_party/WebKit/LayoutTests/http/tests/serviceworker/resources/sync-xhr-doesnt-deadlock-iframe.html [13:58:16.0000] and https://chromium.googlesource.com/chromium/src.git/+/master/third_party/WebKit/LayoutTests/http/tests/serviceworker/resources/sync-xhr-doesnt-deadlock.js [13:58:23.0000] and finally https://chromium.googlesource.com/chromium/src.git/+/master/third_party/WebKit/LayoutTests/http/tests/serviceworker/resources/sync-xhr-doesnt-deadlock.data [13:59:21.0000] Currently, Chrome passes this test because the Service Worker doesn't intercept the request, and the `.data` file is retrieved from the server directly [13:59:35.0000] but I'm migrating this test to WPT, and Firefox fails it [14:00:24.0000] because in Firefox, the worker correctly intercepts the request and response with the result of fetching "404resource" [14:01:23.0000] So I'm removing the `.data` file, and having the worker respond to requests for it with a `new Response` [14:01:59.0000] that way, Chrome fails the test (because the worker doesn't intercept the request), and Firefox passes (because the work does intercept, and the frame does not deadlock) [14:02:23.0000] I guess that works [14:02:36.0000] I wouldn't lose much sleep if we just said sync XHR wasn't intercepted, thoguh [14:03:04.0000] Neither would I, but I can't submit a test like that without a spec change [14:03:41.0000] Now normally, when modifying a test like this, I would persist some alternate Chromium version in order to maintain test coverage [14:04:15.0000] but in this case, I don't think there is anything meaningful to maintain. As written, Chromium's version isn't really doing anything 2017-05-25 [21:44:11.0000] I wonder who thought making a full-fleged form element was a good idea [21:44:38.0000] It has the 6 validity APIs, and a form attribute [21:45:42.0000] I guess in Web Apps 1.0 people still thought might be a good thing, unifying iframe/img/applet/embed? Or maybe not, since they created audio/video? [21:57:56.0000] Domenic: I think it already was and Hixie didn't want to make things inconsistent [21:58:11.0000] Huh OK [21:58:41.0000] I wonder how that worked, back in the brief period where people were excited about implementing object [21:58:47.0000] Maybe some plugin actually created form data or something [21:58:52.0000] Domenic: there might have been some more love for early on too, until the complexity was more unearthed [21:59:22.0000] Domenic: yeah, maybe, I don't know [23:07:50.0000] MikeSmith: spam: https://www.w3.org/Bugs/Public/show_bug.cgi?id=30114 [23:08:43.0000] annevk: thanks yeah saw that and banned them already [23:09:08.0000] MikeSmith++ [23:11:23.0000] wish I could lock our old components there against changes from new users [23:13:37.0000] annevk: btw I am still not confident about my own understanding of “Main fetch” as far there being any default for the request mode when stepping through that algorithm [23:13:56.0000] MikeSmith: there's no default for request mode [23:14:07.0000] what I wrote in https://stackoverflow.com/questions/44121783/fetch-api-default-cross-origin-behavior/44125919#44125919 I’m not sure myself that’s correct [23:14:13.0000] MikeSmith: fetch() has a default though [23:14:18.0000] oh [23:14:48.0000] well see the part of that spec cited in that question: [23:14:50.0000] > A request has an associated mode, which is "same-origin", "cors", "no-cors", "navigate", or "websocket". Unless stated otherwise, it is "no-cors". [23:15:05.0000] that is what confused the OP [23:15:09.0000] and me, really [23:15:19.0000] MikeSmith: ah, the default is different for fetch() [23:15:41.0000] OK I figured so but I could not find where the spec expicitly says that [23:15:47.0000] MikeSmith: it might be worth removing the default for requests though that would require going through all downstream invocations [23:16:09.0000] well I think that we should not change [23:16:16.0000] MikeSmith: https://fetch.spec.whatwg.org/#dom-request 5.5 [23:17:06.0000] MikeSmith: folks continue to think (justifiably) that fetch() is fetch [23:17:13.0000] yeah [23:17:48.0000] but I think it is (relatively) clear and good, that when, e.g., the HTML invokes the fetch algorithm for, say,