2021-01-01 [05:47:57.0000] hi there [06:01:10.0000] hi there [06:01:39.0000] a [06:08:42.0000] l 2021-01-02 [01:38:22.0000] Hello. I have collected some supporting data wouldd like to comment on whatwg/url §4.8.1. I'm curious if there's already discussion, or, shall I open an seperate issue? [03:25:17.0000] outloudvi: if you cannot find one, feel free to file one [05:26:15.0000] annevk: Okay, thanks :-) 2021-01-03 [04:55:45.0000] http://www.tizag.com/javascriptT/javascript-innerHTML.php [04:55:55.0000] i am trying to execute this code [04:56:05.0000]

Welcome to the site dude

[04:56:08.0000] it is not working, any idea? 2021-01-04 [23:43:25.0000] MikeSmith: hey so looking at https://dom.spec.whatwg.org/review-drafts/ I wonder if we should order by filename desc instead [23:43:43.0000] /me looks [23:43:50.0000] MikeSmith: in particular to avoid W3C-marked snapshots from ending up higher [23:44:16.0000] ah [23:44:23.0000] yeah [23:44:51.0000] shall we change it to that then? [23:45:00.0000] for just review-drafts, right? [23:45:05.0000] MikeSmith: yeah [23:45:06.0000] not commit-snapshots [23:45:08.0000] OK [23:45:12.0000] will raise a PR for it [23:45:57.0000] will be a couple hours from now [23:46:25.0000] MikeSmith: cool thanks 2021-01-05 [23:33:43.0000] MikeSmith: seems to work great now [11:08:11.0000] MikeSmith: when you have a chance, could you regenerate https://github.com/w3c/mdn-spec-links ? 2021-01-06 [20:26:53.0000] Domenic: yes, sorry for not having gotten to it yet [20:27:53.0000] since December 14 launch of mdn/content, have not had much free cycles [20:29:23.0000] to regenerate mdn-spec-links, I still need to rewrite my MDN-consuming code to consume the different (better) JSON format that’s now exposed [20:31:15.0000] in the mean time, been working today on https://github.com/mdn/content/pull/893 [20:31:35.0000] updating https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/getTimezoneOffset [20:32:14.0000] and, at the risk of embarrassing myself, I have to admit I don’t think I understand date.getTimezoneOffset() [20:35:07.0000] I *thought* I did — I thought it was simple: regardless of what Date instance the getTimezoneOffset() method is called from, the result isn’t calculated based on the value of the particular Date instance, but is instead always just the difference between UTC time and local time [20:36:04.0000] but https://github.com/mdn/content/pull/893/files#r551959459 suggests that ain’t so [20:37:59.0000] however, from reading https://tc39.es/ecma262/#sec-date.prototype.gettimezoneoffset I find no indication how the behavior could be anything other than one what I described — that is, it’s not calculated by looking at he instance [20:39:57.0000] but I had anyway already been wondering, if that’s so, why then is getTimezoneOffset() an instance method rather than being a static method of Date? [21:41:49.0000] MikeSmith: LocalTime(t), and in particular LocalTZA(t), is a function of t, I guess? And t = the time value of the particular instance [21:42:24.0000] https://tc39.es/ecma262/#sec-local-time-zone-adjustment seems to have an example [21:42:51.0000] Domenic: yeah, I have since read through the spec to get to some of that [21:42:52.0000] https://tc39.es/ecma262/#sec-local-time-zone-adjustment [21:43:10.0000] > When tlocal represents local time repeating multiple times at a negative time zone transition (e.g. when the daylight saving time ends or the time zone offset is decreased due to a time zone rule change) or skipped local time at a positive time zone transitions (e.g. when the daylight saving time starts or the time zone offset is increased due to a time zone rule change), tlocal must be interpreted [21:43:16.0000] using the time zone offset before the transition. [21:43:23.0000] this “time zone transition” stuff [21:43:40.0000] https://tc39.es/ecma262/#sec-time-values-and-time-range [21:43:50.0000] > A time value that is a multiple of 24 × 60 × 60 × 1000 = 86,400,000 (i.e., is equal to 86,400,000 × d for some integer d) represents the instant at the start of the UTC day that follows the epoch by d whole UTC days (preceding the epoch for negative d). Every other finite time value t is defined relative to the greatest preceding time value s that is such a multiple, and represents the instant [21:43:56.0000] that occurs within the same UTC day as s but follows it by t − s milliseconds. [21:43:59.0000] ... [21:46:56.0000] so I think that means, if a Date instance’s value is a multiple of 86,400,000, then calling getTimezoneOffset() from that instance will give the time zone offset prior to DST transition [21:47:00.0000] Right? [21:48:00.0000] That much, I cannot answer at 1am, sorry :) [21:48:09.0000] I can try to help out tomorrow! [21:48:54.0000] hai :) [22:50:01.0000] Domenic: (when you’re back) found https://esdiscuss.org/topic/override-localtza [22:50:04.0000] > I understand that an implementation of ECMAScript is expected to determine the local time zone adjustment [1]. [22:50:07.0000] > This is really convenient -- most of the time. However, it would be great to override this for a given Date object. [23:00:53.0000] OK from testing I’ve managed to glean that it depends on whether the date of the instance is/was during DST [23:01:18.0000] basically [23:04:09.0000] only “basically” because I guess there is probably some more complicated checking of the https://www.iana.org/time-zones tzdb [23:09:03.0000] (end monologue; apologies to channel; /me heads off to try to document this in MDN) 2021-01-07 [13:58:24.0000] can we have a Strict-Content-Type that replaces nosniff? [13:58:43.0000] "replaces" [13:58:59.0000] anyway the idea is that it'd actually be strict [13:59:02.0000] and apply to images and whatnot 2021-01-08 [21:50:14.0000] Soni: what’s the upside? [01:57:23.0000] annevk: catch broken servers [01:58:13.0000] Soni: I'm not sure how it would as the server would have to set the header [01:58:50.0000] well somehow servers were sending the wrong content type with nosniff on 2021-01-11 [08:24:53.0000] annevk: I sent out an internal call for someone on the implementation side to take point and coordinate on cleaning up embed/object/plugins. We already have a thread on general Flash cleanup so I hope someone is interested in carrying it further and actually making changes to embed/object to achieve interop. [08:25:25.0000] Domenic: sounds good, happy to work with whoever volunteers; I have some ideas 🙂 [08:27:04.0000] I wish it was part of disabling Flash as getting people to take initiative now is undoubtedly harder, but alas [08:40:48.0000] I want to update https://developer.mozilla.org/en-US/docs/Web/API/Window/isSecureContext to point to HTML but the edit button has disappeared on MDN I guess [08:47:04.0000] Domenic: the "Found a problem with this page? [08:47:16.0000] Domenic: " section links to the source on GitHub? [08:47:42.0000] Oh, I see, I was able to find that after Ctrl+Fing... but it was not in my line of sight [08:49:07.0000] I mean I'd argue that's a sensible thing to file a bug for :) [08:49:42.0000] Filed https://github.com/mdn/content/issues/1192 instead of doing a PR... seems easier. [10:42:15.0000] annevk: https://bugs.chromium.org/p/chromium/issues/detail?id=1163588 for PDF + click events... you may want to subscribe, or maybe we should open a spec-side issue. I guess it's a UI events issue technically? [10:47:01.0000] Domenic: yeah I guess, though HTML should prolly define PDF documents [10:47:26.0000] Yeah [10:48:10.0000] I think we need to accept that PDF is a thing that’ll stick around and define the observable aspects. Prolly don’t wanna go into the format though [10:58:03.0000] I wonder how much we will gain from making it PDF-specific vs. defining some much smaller version of "plugins" with more rules. (E.g.: content type must match, does nothing, clearly-defined interaction with sandbox, etc.) [10:58:20.0000] PDF-specific seems like the right place to start though [11:02:04.0000] is there any difference, though, between a PDF in an object and, say, a network error in an iframe? [11:02:15.0000] both are presumably resources "without a Document" [11:03:05.0000] Well, object and iframe are needlessly different in lots of ways [11:03:44.0000] But indeed in terms of what comes out of the navigation algorithm I think they're very similar [11:04:20.0000] Some discussion of observability at https://github.com/web-platform-tests/wpt/pull/27129 [11:04:28.0000] Also I don't remember what the latest is on error events on network errors [11:04:57.0000] Oh right fallback content, as Anne mentioned in that thread, is probably the biggest answer to your question, andreubotella [11:05:31.0000] I'll take a look [11:06:50.0000] annevk: on another note, how big of a faux pas would it be to open a new PR to tackle the same issue as https://github.com/whatwg/html/pull/3276? [11:07:12.0000] since the OP seems to be AWOL for years and the PR needs updating other than the merge conflicts [11:49:55.0000] andreubotella: totally fine [11:50:29.0000] ok [11:51:02.0000] I figured it'd be better to raise one single Firefox issue for both that PR and https://github.com/whatwg/html/issues/6247 [12:31:14.0000] Is there a spec term for the about:blank which is created synchronously? [12:34:17.0000] "initial about:blank" [12:45:31.0000] aha, thanks 2021-01-12 [23:33:41.0000] annevk: If you could take a look at https://github.com/whatwg/html/pull/6249 that would be great! [23:35:38.0000] domfarolino: will do [23:37:34.0000] domfarolino: I just realized that the first paragraph that's added is between two paragraphs about the document's URL [23:37:53.0000] domfarolino: so you either want to put it after the warning or a paragraph earlier [23:38:29.0000] annevk: hah, whoops. I'll take a look now [23:39:53.0000] annevk: Done [23:41:25.0000] domfarolino: thanks, I guess we can prefix this with Editorial, right? [23:41:38.0000] I'll merge it once the build bot gets back to us [23:42:13.0000] annevk: yeah I think that's right [23:42:37.0000] done [23:44:59.0000] Oh, no need to change the title in the future [23:45:17.0000] I thought you meant the bot was done, but it seems even GitHub Actions isn't that fast [23:47:12.0000] Well' it's all done now, it was pretty fast [23:47:19.0000] Ah, haha. Indeed, thanks! [23:47:35.0000] I'm glad that's properly defined now [23:52:29.0000] Yeah, it's great improvement that adds a lot of clarity [23:53:24.0000] It's so surprising that old API specs hand-waved all private state and you had to infer it somehow [00:03:26.0000] Ugh, I know :/ [00:46:58.0000] lol Domenic that PR from you against Secure Contexts was the majority of the open issues [07:38:56.0000] Nice [07:39:06.0000] Hmm https://github.com/whatwg/html/pull/6282 ended up much shorter than I expected given all the surrounding discussion [07:42:20.0000] Domenic: that PR deals with escapes and it's intended to replace https://github.com/whatwg/html/pull/3276 [07:43:07.0000] I'm still waiting for feedback from some of the folks at whatwg/forms before I open the one dealing with newline normalization [07:43:20.0000] Ah I see [07:43:20.0000] https://github.com/whatwg/html/issues/6247 [07:44:44.0000] I think in the end we should define the full format, but I'm all for small incremental steps as that makes reviewing a lot easier [07:45:24.0000] indeed [07:46:18.0000] in the WPT tests I've written and modified, all browsers act the same other than the few bugs related to escapes or newlines [07:46:35.0000] but I'll take a look at hixie's test suite after I'm done with this [07:47:46.0000] the test suite at https://github.com/masinter/multipart-form-data/tree/master/test-cases, rather [08:39:23.0000] Domenic: what do you think about creating historical tests for and filing a bug against Chrome and Safari each? The spec never supported it and it seems like it should matter even less today [09:57:27.0000] annevk: in the absence of anyone on the Chrome side stepping up to take ownership of this stuff (I sent out a message yesterday but no responses), that seems reasonable. Maybe eventually when the bug gets triaged there will be some pushback and desire to add it to the spec, I dunno. [10:05:09.0000] Domenic: yeah, I mean, that's also fine, it's not like something we couldn't add to Fx, I just rather not [10:06:36.0000] Yeah, I'd definitely prefer it in the abstract if we could just make totally do nothing, I just am not personally willing to sign up for the work of adding use counters/doing outreach to any pages we find/potentially dealing with angry enterprise customers when the change makes it to stable. I hope someone is though :) [10:12:40.0000] Domenic: did you see https://github.com/whatwg/html/pull/6281 btw? [10:13:20.0000] annevk: yep, it generally looks good, I wanted to do a pass to make sure there wasn't more to delete. I'll do that now. [10:13:41.0000] no rush, I'll be out until tomorrow most likely [10:13:54.0000] was just wondering since you checked the more recent PR 2021-01-13 [02:02:18.0000] TIL: Chrome/Safari block style sheets without an ok status... [02:55:33.0000] annevk: non-2xx status you mean? [02:55:51.0000] they won’t follow 3xx’s? [02:56:29.0000] MikeSmith: at the point where the relevant algorithm gets a response, redirects have been handled [05:51:00.0000] When rendering an element I would need to set the Authorization header to be used for fetching its data. Is this possible to do "directly"? [05:52:21.0000] I'm not sure I understand the question, but I'm pretty sure the answer is no [05:54:07.0000] What is not clear in the question? annevk [05:54:50.0000] I have [05:55:17.0000] This will make a request for the object (a pdf) to this url. But the url won't allow unauthorized requests. [05:55:35.0000] So in the request additional headers should be specified. [05:56:21.0000] The is a similar example that I saw people are struggling with. [05:56:49.0000] Is this possible? If it is not possible why not add this capability to the standard? [05:58:28.0000] I think everyone removed that (you could use the username/password fields of a URL) because it would allow for dictionary attacks [06:01:03.0000] annevk: so what does “without an ok status” mean? what other status is there that would not also cause all browsers to not load the stylesheet either? [06:02:39.0000] MikeSmith: Firefox applies a style sheet whose status is 600 [06:02:54.0000] MikeSmith: can I rename the default branch on whatwg/misc-server? [06:10:05.0000] annevk, what do you mean by "everyone removed that", you mean every browser? does this mean some browsers supported something like that? [06:13:42.0000] yes [06:50:32.0000] Why not add to the standard to add some header fields to the img or object elements? [06:50:52.0000] would really come handy in situations like this, and a lot of people are wondering this over the internet [06:55:09.0000] As annevk said, letting some script on some random website manipulate the Authentication header would be a big security risk [06:55:12.0000] annevk: IIRC Opera blocked everything !ok as part of the cross-origin stylesheet snooping fixes, IIRC [06:55:51.0000] gsnedders: well, they didn't standardize it [06:55:54.0000] annevk: hence WebKit/Blink (quite possibly pre-fork) blocking them doesn't seem super surprising? [06:56:33.0000] annevk: none of that cross-origin protection stuff was standardised for a long time after, AFAIK :| [06:58:00.0000] and wasn't there some quirks mode scoping of some of it, at least the text/css check, originally? [06:58:05.0000] The main things about being strict on text/css has been standardized for a long time [06:58:29.0000] (this is CVE-2010-0654 I'm referring to) [06:58:41.0000] So if !ok was part of that I would have expected that to have come up, but it hasn't and Firefox doesn't implement it [07:04:48.0000] andreubotella, annevk how would it be a security risk, and what does it have to do with dictionary attacks? [07:05:16.0000] What does allowing Authentication header have anything to do with a dictionary attack? [07:07:20.0000] croraf: https://gist.github.com/andreubotella/04e617f15af88125597d842c40e2edba [07:08:12.0000] I'm not actually sure that img.decode works that way – this is an example, not a proof of concept [07:13:32.0000] And what possible workaround offers protection by such attacks? [07:13:48.0000] I always confuse atob and btoa [07:14:20.0000] This is silly I think. Why is having Authorization header in the image making site less secure than not having. [07:14:49.0000] croraf: the point is not having the header, it's letting scripts from other sites modify it [07:14:49.0000] An attacker can try dictionary attacks on everything, it can try to access the same resource using fetch and with dictionary attack. [07:15:07.0000] huh, right [07:15:28.0000] with fetch probably not because of cors [07:15:53.0000] but an attacker could use any non-browser http client [07:16:00.0000] This is the usual problem [07:16:15.0000] You cannot use fetch to access internal (e.g. intranet) resources, because of CORS [07:16:18.0000] You can use to do so [07:16:23.0000] I see. [07:16:25.0000] So with arbitrary headers can be used for attacks on intranets [07:17:03.0000] Why is cors not applied to images? [07:17:12.0000] Because it wasn't in Netscape 1.0 :( [07:17:49.0000] "don't break the web" is an important principle, and that means if something used to work, it must keep working unless the risks would be huge [07:18:19.0000] Arguably the risks are pretty bad these days, but we've gone with less strict mitigations than full CORS. E.g. CORB is such a mitigation. [07:18:32.0000] annevk: oh, https://trac.webkit.org/changeset/72743/webkit might be the change that made this happen in WebKit, which makes it look accidental? [07:20:11.0000] gsnedders: isn't that for images? Pretty sure that it's important to ignore status there [07:21:38.0000] annevk: it changes WebCore/loader/cache/CachedResource.h and WebCore/loader/loader.cpp to make < 400 a failure by default, except where things opt-in to it being okay (like images) [07:22:17.0000] Domenic: with "these days" you mean because of Spectre, right? [07:22:18.0000] annevk: basically anywhere that didn't explicitly check "has an error occured" started being strict about this [07:23:14.0000] gsnedders: I guess that means I should check media as well, at least for ORB purposes [07:23:16.0000] andreubotella: indeed [07:23:34.0000] gsnedders: there's a bunch of other things like text tracks that might then also need to be checked, but I care less about those [07:25:04.0000] I still need slight clarification. So scripts on website A loaded from any origin can access the . Or the issue is that scripts from any origin can create the element with some URL and access that data? [07:26:48.0000] croraf: some of the CORS-related restrictions that were put on the element means you can't access the contents of the image from a website in a different origin, because those capabilities were only added after CORS, but you can see if the image loads or not [07:27:23.0000] so if you can change the Authorization header, just create an element in any origin that points to a resource in the intranet, and see if it loads [07:28:16.0000] Domenic: are there server aspects that depend on the default branch name? Or would that all be documented in misc-server in which case I should find it shortly? [07:28:57.0000] annevk: my guess is if you do a full-text search on misc-server for "master" you'll find all such dependencies. [07:29:04.0000] great [07:29:07.0000] (assuming you are only talking about renaming misc-server) [07:29:32.0000] Domenic: I'm talking about renaming all repos, but I'm also grepping all repos [07:29:46.0000] Domenic: so the main question is if we have stuff that's outside repos I suppose [07:29:47.0000] andreubotella, how can you see that it loads? [07:30:23.0000] annevk: OK, I can't think of anything outside repos then. We'll see... [07:30:36.0000] croraf: my example was using the img.decode() method, that I believe returns a promise that rejects if the image doesn't load. but you can also listen for an "error" event [07:30:44.0000] If anything breaks down it should be easy to fix, not planning on switching today though [07:31:12.0000] Maybe Tuesday would be a good day after we get the RDs out [07:32:37.0000] andreubotella, I see [07:33:36.0000] I'm also confused now with this element, it loads a document in my example, but I cannot apply Network latency in Chome devtools to it. [07:35:20.0000] [07:36:30.0000] I'm so confused with this croraf: and used to be elements that allowed you to integrate plugins like flash into a page [07:38:26.0000] So I should use Iframe for pdf's? [07:38:51.0000] yeah [07:39:02.0000] :thumbs-up: [07:39:18.0000] I mean I know there are subtle differences between the three. [07:39:26.0000] see https://github.com/whatwg/html/issues/6003, which will make object and embed more similar to iframe now that flash is deprecated [07:40:22.0000] I'm wondering if the latency will be applied on the iframe [07:40:41.0000] it is not :( [07:41:14.0000] that sounds like a chrome devtools issue, rather than something the spec would require [07:41:21.0000] yes [07:41:37.0000] Can I apply custom headers to Iframe, I guess not :( ? [07:43:00.0000] https://bugs.chromium.org/p/chromium/issues/detail?id=1113722&q=devtools%20latency%20iframe&can=2 I guess that's the bug [07:46:28.0000] Damn, thats from 2012, and still open [07:48:06.0000] But even on FF it is not throttled [07:59:58.0000] annevk: I think I'll file a PR for https://github.com/whatwg/html/issues/6247 and see what the folks from the different browsers think [08:00:56.0000] andreubotella: sounds reasonable, unfortunate that people are not more proactive, but that's pretty common I'm afraid [08:01:01.0000] /me hits that all the time [08:23:47.0000] Domenic: if you're okay with it I think I'm also happy to switch tomorrow [08:24:17.0000] Domenic: it doesn't seem like we have many dependencies on the default branch name so all the PRs have been rather straightforward [08:24:51.0000] Domenic: misc-server doesn't need updating at all; participate.whatwg.org does though [08:25:03.0000] And whatwg.org of course [08:32:54.0000] annevk: sounds good to me [08:34:00.0000] Domenic: cool, I think I'll do it around this time and then watch the fireworks for a one or two hours, assuming you don't find anything problematic [08:50:58.0000] Is there any way to put