Re: [Bug 19297] New: May user agents apply additional restrictions on entering pointer lock?

2012-10-08 Thread Florian Bösch
Cheer up everyone, we've got somebody dedicated to writing fullscreen exploits now :) http://feross.org/html5-fullscreen-api-attack/ Summary: Change blindness may make phishing attacks feasible (displaying a mock browser/page in fullscreen) Cause: Switch to fullscreen before user consent. Fix: Swi

RE: CfC: publish FPWD of Push API; deadline October 12

2012-10-08 Thread EDUARDO FULLEA CARRERA
Hi Jonas, Thanks for your feedback. See comments inline. Regards, Eduardo. On 6 oct 2012 at 00:06:53, Jonas Sicking wrote: > Hi All, > > As usual, this is not the official mozilla position, as there is no such > thing. > > Several of us at at mozilla has been looking at push quite a bit > latel

Re: [XHR]

2012-10-08 Thread Tobie Langel
On 10/8/12 5:45 PM, "Glenn Maynard" wrote: >I can't reproduce this (in Chrome 22). Neither can I (Chrome Version 22.0.1229.79). --tobie

Re: [XHR]

2012-10-08 Thread Glenn Maynard
On Mon, Oct 8, 2012 at 10:32 AM, Jakub Łopuszański wrote: > Inspired by you, I reproduced the bug by simply changing "debugger" to > "alert(1)", but without changing where the url points to, so it still > points to something that returns immediately. > I hope that an example with "alert(1)" will

Re: [XHR]

2012-10-08 Thread Jakub Łopuszański
Now I am puzzled: http://jsfiddle.net/44b3P/5/ in Chrome, alerts seems to be blocking, and thus I get msg box with "1", then 3 times a msg box with "got it". in IE and Firefox though, I get simultanously a msg box with "1", and the one with "got it". I think my current example is more obscure tha

Re: [XHR]

2012-10-08 Thread Hallvord R. M. Steen
Jakub Łopuszański skreiv Mon, 08 Oct 2012 17:32:47 +0200 Replacing the delay with an alert() dialog, and pointing the fetch at a 1MB file, I can't reproduce this. Inspired by you, I reproduced the bug by simply changing "debugger" to "alert(1)", but without changing where the url points to,

Re: [XHR]

2012-10-08 Thread Jakub Łopuszański
2012/10/8 Glenn Maynard > > Replacing the delay with an alert() dialog, and pointing the fetch at a > 1MB file, I can't reproduce this. Each readystatechange has the correct > readyState value at the time: only a single event sees each of OPENED, > HEADERS_RECEIVED and DONE, and (in my particula

Re: [XHR]

2012-10-08 Thread Glenn Maynard
On Mon, Oct 8, 2012 at 4:06 AM, Jakub Łopuszański wrote: > Yes, I mean this race condition. It actually is quite easy to reproduce > -- open http://jsfiddle.net/44b3P/ in Chrome with dev tools opened. I've > added "debugger" statement to force a pause long enough for events to > accumulate in the

Re: [XHR]

2012-10-08 Thread Jakub Łopuszański
2012/10/8 Jungkee Song > > From: Jakub Łopuszański [mailto:qbo...@gmail.com] > > Sent: Monday, October 08, 2012 6:07 PM > > > > 2012/10/8 Hallvord R. M. Steen > >> Jakub Łopuszański skreiv Sat, 06 Oct 2012 18:09:16 > +0200 > >> > >>> Spec at http://www.w3.org/TR/XMLHttpRequest/ says that: > >>>

Re: [XHR]

2012-10-08 Thread Glenn Maynard
On Sat, Oct 6, 2012 at 11:09 AM, Jakub Łopuszański wrote: > Spec at http://www.w3.org/TR/XMLHttpRequest/ says that: "TR" drafts are typically out of date; the version you're reading is ten months old. Please use the editor's draft: http://dvcs.w3.org/hg/xhr/raw-file/tip/Overview.html 1. each

Re: [selectors-api] RfC: LCWD of Selectors API Level 1; deadline July 19

2012-10-08 Thread Lachlan Hunt
On 2012-08-06 13:25, Lachlan Hunt wrote: On 2012-08-06 13:08, Kang-Hao (Kenny) Lu wrote: (12/07/31 20:06), Arthur Barstow wrote: On 7/19/12 11:15 PM, ext Kang-Hao (Kenny) Lu wrote: http://lists.w3.org/Archives/Public/public-webapps/2012JanMar/thread#msg518 I think this is a very minor issue,

RE: [XHR]

2012-10-08 Thread Jungkee Song
> From: Jakub Łopuszański [mailto:qbo...@gmail.com] > Sent: Monday, October 08, 2012 6:07 PM > > 2012/10/8 Hallvord R. M. Steen >> Jakub Łopuszański skreiv Sat, 06 Oct 2012 18:09:16 +0200 >> >>> Spec at http://www.w3.org/TR/XMLHttpRequest/ says that: >>> 1. each change of state must fire an even

Re: [IndexedDB] Implementation Discrepancies on 'prevunique' and 'nextunique' on index cursor

2012-10-08 Thread Odin Hørthe Omdal
On Sat, 06 Oct 2012 00:18:43 +0200, Israel Hilerio wrote: Thanks everyone for the explanations. Jonas, your last example clarified things for me. We'll file a bug on our side. I was going to point to some tests for it as well, to be extra helpful, but I hadn't pushed in a long time. No

Re: [XHR]

2012-10-08 Thread Jakub Łopuszański
2012/10/8 Hallvord R. M. Steen > Jakub Łopuszański skreiv Sat, 06 Oct 2012 18:09:16 > +0200 > > > Spec at > http://www.w3.org/TR/**XMLHttpRequest/says > that: >> 1. each change of state must fire an event >> 2. readyState must always be equal to the curre

Re: [XHR]

2012-10-08 Thread Hallvord R. M. Steen
Jakub Łopuszański skreiv Sat, 06 Oct 2012 18:09:16 +0200 Spec at http://www.w3.org/TR/XMLHttpRequest/ says that: 1. each change of state must fire an event 2. readyState must always be equal to the current state it follows that it is possible for eventhandler to be called more than once with

[XHR]

2012-10-08 Thread Jakub Łopuszański
Spec at http://www.w3.org/TR/XMLHttpRequest/ says that: 1. each change of state must fire an event 2. readyState must always be equal to the current state it follows that it is possible for eventhandler to be called more than once with the same value of readyState, in particular the code example [1