Re: [whatwg] Placeholder option for text input boxes

2008-09-30 Thread Jonas Sicking
Benjamin Hawkes-Lewis wrote: Garrett Smith wrote: |placeholder| sounds a little like |alt|. Alt is a property and an attribute on INPUT. How is placeholder content for a form field alternative text? The alt text is for situations where the input can not be displayed at all. For example an

Re: [whatwg] Dealing with UI redress vulnerabilities inherent to the current web

2008-09-30 Thread Robert O'Callahan
On Tue, Sep 30, 2008 at 10:33 PM, Michal Zalewski [EMAIL PROTECTED] wrote: On Tue, 30 Sep 2008, Robert O'Callahan wrote: If I understand correctly, with Michal's option 3, those sites would also stop working as soon as the user scrolled down in the framed page (so that the top-left of the

Re: [whatwg] Dealing with UI redress vulnerabilities inherent to the current web

2008-09-30 Thread Michal Zalewski
On Wed, 1 Oct 2008, Robert O'Callahan wrote: I don't think that's secure. The outer page can set the IFRAME's URL to contain a #xyz fragment identifier That's really covered in the original proposal. Honest :P In a kludgy manner, of course (permitting fragments, but not permitting onload

Re: [whatwg] workers

2008-09-30 Thread Alexey Proskuryakov
Sep 24, 2008, в 10:38 PM, Aaron Boodman написал(а): interface DedicatedWorker : Worker { I've been trying to understand the difference between SharedWorker and DedicatedWorker interfaces. Besides the ability to pick an existing worker by name, are there any other semantic differences? I

Re: [whatwg] Placeholder option for text input boxes

2008-09-30 Thread Tab Atkins Jr.
On Tue, Sep 30, 2008 at 4:10 AM, Andy Lyttle [EMAIL PROTECTED] wrote: I do not like this idea at all. That is what LABEL is for, and disappearing it's so kewl text is as annoying as BLINK and BGSOUND. Chris The label tag is great for labels that are displayed outside the input box (in

Re: [whatwg] Placeholder option for text input boxes

2008-09-30 Thread Garrett Smith
On Tue, Sep 30, 2008 at 12:37 AM, Benjamin Hawkes-Lewis [EMAIL PROTECTED] wrote: Garrett Smith wrote: |placeholder| sounds a little like |alt|. Alt is a property and an attribute on INPUT. How is placeholder content for a form field alternative text? If and until user enters text, the

Re: [whatwg] Dealing with UI redress vulnerabilities inherent to the current web

2008-09-30 Thread Elliotte Harold
Kristof Zelechovski wrote: If you set up a mirror with the same host name as the content provider has, you will probably get sued for identity theft, cybersquatting, forgery or whatever. No, only the content provider (really the domain name owner) can set up these mirrors. This is nothing

Re: [whatwg] Dealing with UI redress vulnerabilities inherent to the current web

2008-09-30 Thread Kristof Zelechovski
I am afraid we are going in circles here. You suggested that the embedded content should be stored on the server that provides the interface. Now you explain how it can be stored on the media provider's server. That is nothing new - except that it has nothing to do with your original position.

Re: [whatwg] Placeholder option for text input boxes

2008-09-30 Thread Nils Dagsson Moskopp
Am Dienstag, den 30.09.2008, 08:25 -0700 schrieb Garrett Smith: (Nils, did you mean to put this on the list, or is this personal mail?) I meant to put it on the list - didn't it go there ? If and until user enters text, the alternate text is displayed. The confusing part is that

Re: [whatwg] workers

2008-09-30 Thread Alexey Proskuryakov
Sep 30, 2008, в 7:19 PM, Aaron Boodman написал(а): I'm of the opinion that there should be as little difference as possible, to lower the amount of API to learn. Therefore in my preferred proposal, the only difference between SharedWorker and DedicatedWorker is that the latter has a close()

Re: [whatwg] Placeholder option for text input boxes

2008-09-30 Thread Andy Lyttle
On Sep 30, 2008, at 8:33 AM, Nils Dagsson Moskopp wrote: No, I meant to abolish the placeholder attribute alltogether and render the title attribute as greyed-sut inside the search box instead, because * semantically, the title attribute conveys the same information. * it is

Re: [whatwg] Dealing with UI redress vulnerabilities inherent to the current web

2008-09-30 Thread Henri Sivonen
On Sep 29, 2008, at 23:52, Adam Barth wrote: On Mon, Sep 29, 2008 at 1:40 PM, Anne van Kesteren [EMAIL PROTECTED] wrote: I thought the issue with Referer was that it exposed path information, but I guess the problem with Origin is that it reveals the intranet server name? The query

Re: [whatwg] Placeholder option for text input boxes

2008-09-30 Thread Andy Lyttle
On Sep 30, 2008, at 7:57 AM, Garrett Smith wrote: If and until user enters text, the alternate text is displayed. The confusing part is that successfully rendered inputs would be rendered and still use the alt. The good part is that it would be (or should be) accessible for screen readers.

Re: [whatwg] Dealing with UI redress vulnerabilities inherent to the current web

2008-09-30 Thread Smylers
Elliotte Harold writes: Smylers wrote: That's a sometimes convenient feature for site developers, but there's nothing you can do with content loaded from two sites you can't do with content loaded from one. Here's some I can think of: * Many sites are funded by displaying

Re: [whatwg] Dealing with UI redress vulnerabilities inherent to the current web

2008-09-30 Thread Smylers
Elliotte Harold writes: Large content providers already move their content closer to the end user. They do this by physically locating boxes with the same host name and fancy DNS and router tricks. Yup. But those are _large_ content providers. We shouldn't design HTML 5 such that smaller

Re: [whatwg] workers

2008-09-30 Thread Aaron Boodman
2008/9/30 Alexey Proskuryakov [EMAIL PROTECTED]: I'm not sure it's so good in the case of dedicated workers either, as they can be used from other contexts via additional message ports. The close() method could just close the default port. Sure, but in order for that to have happened, whoever

Re: [whatwg] Dealing with UI redress vulnerabilities inherent to the current web

2008-09-30 Thread Adam Barth
On Tue, Sep 30, 2008 at 9:31 AM, Henri Sivonen [EMAIL PROTECTED] wrote: This could be addressed by sending a cryptographic hash of the origin (using an algorithm that is commonly available in libraries used by server-side programmers). Interesting idea. So you're suggesting something like:

Re: [whatwg] workers

2008-09-30 Thread Alexey Proskuryakov
Sep 30, 2008, в 8:46 PM, Aaron Boodman написал(а): close() was added so that you could forcibly kill a worker. For example, if you are searching a large set with many workers, you may want to kill them once one finds a match. ... So I think it is useful to have a conceptual difference

Re: [whatwg] Safari-compatible input type=search

2008-09-30 Thread Andy Lyttle
On Sep 30, 2008, at 7:18 AM, Kristof Zelechovski wrote: How can the Web designer know how many recent search terms the user would like to keep handy at the search box? The same way the web designer knows anything else: taking an educated guess at what would be most appropriate for their

Re: [whatwg] Placeholder option for text input boxes

2008-09-30 Thread Tab Atkins Jr.
On Tue, Sep 30, 2008 at 11:36 AM, Andy Lyttle [EMAIL PROTECTED] wrote: On Sep 30, 2008, at 7:57 AM, Garrett Smith wrote: If and until user enters text, the alternate text is displayed. The confusing part is that successfully rendered inputs would be rendered and still use the alt. The

Re: [whatwg] Dealing with UI redress vulnerabilities inherent to the current web

2008-09-30 Thread Michal Zalewski
On Tue, 30 Sep 2008, Adam Barth wrote: This could be addressed by sending a cryptographic hash of the origin (using an algorithm that is commonly available in libraries used by server-side programmers). Interesting idea. So you're suggesting something like: Origin-SHA1:

Re: [whatwg] workers

2008-09-30 Thread Aaron Boodman
2008/9/30 Alexey Proskuryakov [EMAIL PROTECTED]: Hmm... So this is more about how you use the interface, not what the object behind it is. If one chooses to never call close() on a shared worker (or, say, sets myWorker.close to null right after invoking constructor), it becomes

Re: [whatwg] Safari-compatible input type=search

2008-09-30 Thread Andy Lyttle
On Sep 30, 2008, at 7:40 AM, Nils Dagsson Moskopp wrote: I assume that this should be based on the search elements ID attribute, am I right ? Because common UA behaviour already is to cache entries (based on ID) ... so what unsolved problem is solved there ? If I have a form on my site,

Re: [whatwg] Dealing with UI redress vulnerabilities inherent to the current web

2008-09-30 Thread Edward Z. Yang
Michal Zalewski wrote: More importantly, since the dictionary of possible inputs is rather limited, it would be pretty trivial to build a dictionary of site - hash pairs and crack the values. May protect xyzzy2984.eur.int.example.com, but would still reveal to me you are coming from

Re: [whatwg] Dealing with UI redress vulnerabilities inherent to the current web

2008-09-30 Thread Michal Zalewski
On Tue, 30 Sep 2008, Edward Z. Yang wrote: More importantly, since the dictionary of possible inputs is rather limited, it would be pretty trivial to build a dictionary of site - hash pairs and crack the values. May protect xyzzy2984.eur.int.example.com, but would still reveal to me you are

Re: [whatwg] Safari-compatible input type=search

2008-09-30 Thread Kristof Zelechovski
I am not against INPUT[type=search]; I am against INPUT[results=10] because I cannot see how it can be reasonably preset. Is this control for simple search only or is it designed to be used in an advanced search interface? Should it be unique within a form? Chris -Original Message-

Re: [whatwg] Placeholder option for text input boxes

2008-09-30 Thread Benjamin Hawkes-Lewis
Tab Atkins Jr. wrote: 2) @alt Pro: Presumably accessible to people with screen readers. Presumptions are risky. Is there any evidence (by which I mean a test case and a description of how to reproduce behavior with real user agents) that demonstrates that this would be true for INPUT

Re: [whatwg] workers

2008-09-30 Thread Alexey Proskuryakov
Sep 30, 2008, в 9:11 PM, Aaron Boodman написал(а): Do you have any thoughts on the extra API on dedicated workers proposed by Jonas (DedicatedWorker::sendMessage, DedicatedWorkerGlobalScope::onmessage)? Not really - it seems to me that they could work for shared workers as well, but I

Re: [whatwg] Dealing with UI redress vulnerabilities inherent to the current web

2008-09-30 Thread Edward Z. Yang
Michal Zalewski wrote: Not really? I just need to rebuild my dictionary for that salt, but to check against say a million or ten million of common domains, it wouldn't be very expensive. And it's not very expensive to build such a list of domains, too. In that case, you are certainly correct;

Re: [whatwg] Placeholder option for text input boxes

2008-09-30 Thread Andy Lyttle
On Sep 30, 2008, at 7:00 AM, Tab Atkins Jr. wrote: Hm. I have a problem with your example. Get local weather forecast isn't a semantic label for the field - it doesn't describe what the field is for. It describes what the *form* is for, and so should be a legend or hn. City, State

Re: [whatwg] Placeholder option for text input boxes

2008-09-30 Thread Jonas Sicking
Benjamin Hawkes-Lewis wrote: Garrett Smith wrote: |placeholder| sounds a little like |alt|. Alt is a property and an attribute on INPUT. How is placeholder content for a form field alternative text? The alt text is for situations where the input can not be displayed at all. For example an

[whatwg] Fwd: Placeholder option for text input boxes

2008-09-30 Thread Tab Atkins Jr.
blarg forward to list. -- Forwarded message -- From: Tab Atkins Jr. [EMAIL PROTECTED] Date: Tue, Sep 30, 2008 at 12:39 PM Subject: Re: [whatwg] Placeholder option for text input boxes To: Benjamin Hawkes-Lewis [EMAIL PROTECTED] On Tue, Sep 30, 2008 at 12:25 PM, Benjamin

Re: [whatwg] Dealing with UI redress vulnerabilities inherent to the current web

2008-09-30 Thread Michal Zalewski
On Tue, 30 Sep 2008, Edward Z. Yang wrote: In that case, you are certainly correct; adding a salt only hinders an attacker. But if we're worried about Origin giving away a secret intranet website, I think things should be reasonable. Of course, they can still dictionary brute-force it... I

Re: [whatwg] Placeholder option for text input boxes

2008-09-30 Thread Tab Atkins Jr.
On Tue, Sep 30, 2008 at 12:37 PM, Andy Lyttle [EMAIL PROTECTED] wrote: On Sep 30, 2008, at 7:00 AM, Tab Atkins Jr. wrote: Hm. I have a problem with your example. Get local weather forecast isn't a semantic label for the field - it doesn't describe what the field is for. It describes what

Re: [whatwg] Placeholder option for text input boxes

2008-09-30 Thread Nils Dagsson Moskopp
Am Dienstag, den 30.09.2008, 12:04 -0500 schrieb Tab Atkins Jr.: 4) label (moving label textual content into input as placeholder text; currently with Javascript to mutate the DOM, in the future with CSS to present the desired appearance while keeping the DOM stable) Pro: Most semantic. Can

[whatwg] Placeholder option for text input boxes

2008-09-30 Thread Garrett Smith
-- Forwarded message -- From: Garrett Smith [EMAIL PROTECTED] Date: Tue, Sep 30, 2008 at 11:49 AM Subject: Re: [whatwg] Placeholder option for text input boxes To: Tab Atkins Jr. [EMAIL PROTECTED] On Tue, Sep 30, 2008 at 10:04 AM, Tab Atkins Jr. [EMAIL PROTECTED] wrote: On Tue,

Re: [whatwg] Safari-compatible input type=search

2008-09-30 Thread Andy Lyttle
On Sep 30, 2008, at 10:23 AM, Kristof Zelechovski wrote: I am not against INPUT[type=search]; I am against INPUT[results=10] because I cannot see how it can be reasonably preset. Yeah, that's weird. I think if I designed it myself, I would have made the presence of autosave (instead of

Re: [whatwg] Placeholder option for text input boxes

2008-09-30 Thread Andy Lyttle
Pros/cons for a |placeholder| property and attribute on TEXTAREA? As I understand it, it was sort of an accident that Safari supports placeholder on anything other than search fields, but there's no reason it shouldn't apply to all text input fields including textarea. I've just filed

Re: [whatwg] Placeholder option for text input boxes

2008-09-30 Thread Tab Atkins Jr.
On Tue, Sep 30, 2008 at 1:46 PM, Andy Lyttle [EMAIL PROTECTED] wrote: On Sep 30, 2008, at 10:54 AM, Tab Atkins Jr. wrote: Of course, the aesthetics of splitting the description between the label and the placeholder text can't always be denied. Semantically, though, you're still using your

Re: [whatwg] Placeholder option for text input boxes

2008-09-30 Thread Nils Dagsson Moskopp
Am Dienstag, den 30.09.2008, 11:49 -0700 schrieb Garrett Smith: Are there any arguments against a |placeholder| property on INPUT? Missing semantics ? It is a purely presentational attribute. Cheers, Nils

Re: [whatwg] Placeholder option for text input boxes

2008-09-30 Thread Andy Lyttle
On Sep 30, 2008, at 12:14 PM, Nils Dagsson Moskopp wrote: Am Dienstag, den 30.09.2008, 11:49 -0700 schrieb Garrett Smith: Are there any arguments against a |placeholder| property on INPUT? Missing semantics ? It is a purely presentational attribute. It provides a hint to the user about what

Re: [whatwg] Placeholder option for text input boxes

2008-09-30 Thread Garrett Smith
On Tue, Sep 30, 2008 at 12:14 PM, Nils Dagsson Moskopp [EMAIL PROTECTED] wrote: Am Dienstag, den 30.09.2008, 11:49 -0700 schrieb Garrett Smith: Are there any arguments against a |placeholder| property on INPUT? Missing semantics ? It is a purely presentational attribute. The semantics would

Re: [whatwg] Safari-compatible input type=search

2008-09-30 Thread Kornel Lesinski
On Tue, 30 Sep 2008 12:40:23 +0100, Andy Lyttle [EMAIL PROTECTED] wrote: I would like Apple's input type=search adopted as an official standard, maintaining Safari compatibility. Comments? I like type=search. Special search box style is used throughout Mac OS X and Mac-centric sites

Re: [whatwg] Safari-compatible input type=search

2008-09-30 Thread Christoph Päper
Andy Lyttle: results - if present, shows a little magnifying glass icon, which helps to visually identify the field as a search box The magnifying glass was a particularly poor choice by Apple[1], because icons featuring one usually represent zooming (in). Binoculars are (for some

Re: [whatwg] Placeholder option for text input boxes

2008-09-30 Thread Christoph Päper
Tab Atkins Jr.: 1) @placeholder Con: Duplicates semantics already present in label, (...) That could be circumvented by combining the two: labelFoo input type=text placeholder/label yielded [Foo ] whereas labelFoo input type=text placeholder=Bar/label resulted in [Bar

Re: [whatwg] Safari-compatible input type=search

2008-09-30 Thread Andy Lyttle
On Sep 30, 2008, at 2:55 PM, Christoph Päper wrote: The magnifying glass was a particularly poor choice by Apple[1], because icons featuring one usually represent zooming (in). Binoculars are (for some reason) more common as symbols for searches. Eyes and spectacles OTOH most often

Re: [whatwg] Dealing with UI redress vulnerabilities inherent to the current web

2008-09-30 Thread Maciej Stachowiak
On Sep 30, 2008, at 7:57 AM, Elliotte Harold wrote: Maciej Stachowiak wrote: More generally, I am on Apple's internal incoming security bug list, and I see Java applet security bugs all the time, so I think whatever the strength of the model may be, it does not lead to Java applets