AngularJS’s latest release candidate is the first framework I’ve seen that cleanly supports a content security policy that restricts usage of eval(), new Function(), and the like. I’m thrilled to see this happening, and it’s a testament to the priority that the Angular developers place on security. CSP is quite simply one the best XSS-protection mechanisms available to developers these days in modern browsers. The more frameworks that hop on board, the faster sites can start adopting CSP, and the safer we’ll all be on the net.

All that said, the implementation isn’t as complete as it could be. Angular requires that the developer manually opt into CSP-friendly mode via the ng-csp directive. This is error-prone at best, and introduces complexity that would be better hidden away inside the framework. The Angular developers recognize this shortfall, and are explicitly requesting some sort of feature detection API that would allow frameworks to query the currently active policy to determine its boundaries, and fork their implementation accordingly.

This does seem like a great addition to the spec; I’d suggest the following implementation:

Add document.[prefix]contentSecurityPolicy as an object that exists in browsers that support CSP. This would enable trivial feature detection of CSP as a whole, which would enable frameworks to make intelligent decisions about how to proceed through the following use cases:

So there you go. We have real problems, for both the browser vendors and the users.

If it isn’t already clear, I’m not a fan of this solution, and we’ve finally arrived at the crux of why: It is a short-sighted solution, primarily for the benefit of browser vendors, which contradicts an existing standard.

My recommendation: learn the language, and use it to your liking; and don’t rely or blindly accept what any “wise elders” tell you. Try to do something new and crazy every day. You might not end up using the crazy, but it’s the best way to master JavaScript. Develop your own style that you are comfortable with. Experiment.

Among the best practices recommended, the RFC stipulates that all new “IP implementations” must support IPv6

The Internet Engineering Task Force (IETF), which for all intents and purposes is the standards body of the Internet Protocol, has declared that “IPv6 is no longer considered optional.” In RFC 6540 officially published the other week as an Internet Best Current Practice, the IETF cites the impending depletion of IPv4 address space with the continued growth of the Internet as drivers for widespread IPv6 deployment. While the RFC defines requirements for all developers of IP nodes, the main target seems to be consumer device vendors, many of whom have delayed implementation of IPv6. With consumers just implementing these IPv4-only devices today, they are likely to remain installed for many years, extending the IPv4 support lifecycle. Of course IPv4 will be around for quite some time, but the more of these devices that are IPv4 + IPv6 instead of IPv4-only, the easier co-existence will be to manage.

Among the best practices recommended, the RFC stipulates that all new “IP implementations” must support IPv6, and IPv6 support must be equivalent to or better than corresponding IPv4 feature support and quality, that dual-stack support is required though IPv4 must not be required for operation, and existing hardware and software implementations should be considered for upgrade to IPv6 support.

Another interesting statement from the RFC is that “the term “IP” can now be interpreted to mean IPv4 + IPv6, IPv6-only, or IPv4-only.” While separate standards exist for IPv4 and IPv6, the term “IP” now officially encompasses both protocols. Requirements for features specific to a given version should be so indicated, while general “IP” features will be assumed to apply to both.

In general, n ends a statement unless:

The statement has an unclosed paren, array literal, or object literal or ends in some other way that is not a valid way to end a statement. (For instance, ending with . or , .)
The line is -- or (in which case it will decrement/increment the next token.)
It is a for() , while() , do , if() , or else , and there is no {
The next line starts with [ , ( , , * , / , - , , , . , or some other binary operator that can only be found between two tokens in a single expression.
The first is pretty obvious. Even JSLint is ok with n chars in JSON and parenthesized constructs, and with var statements that span multiple lines ending in , .

The second is super weird. I’ve never seen a case (outside of these sorts of conversations) where you’d want to do write in nj , but, point of fact, that’s parsed as i; j , not i ; j .

The third is well understood, if generally despised. if (x)ny() is equivalent to if (x) { y() } . The construct doesn’t end until it reaches either a block, or a statement.

; is a valid JavaScript statement, so if(x); is equivalent to if(x){} or, “If x, do nothing.” This is more commonly applied to loops where the loop check also is the update function. Unusual, but not unheard of.

The fourth is generally the fud-inducing “oh noes, you need semicolons!” case. But, as it turns out, it’s quite easy to prefix those lines with semicolons if you don’t mean them to be continuations of the previous line.

Similar hazards arise with [ , / , and unary and - . Remember, if there wasn’t an error, ASI does not apply.

This problem may seem minor, but JS file concatenation ups the ante. For this reason some style guides (Dojo, IIRC) advocate starting your reusable JS file with ; , but people don’t know and it’s easy to forget.

I wish I had made newlines more significant in JS back in those ten days in May, 1995. Then instead of ASI, we would be cursing the need to use infix operators at the ends of continued lines, or perhaps or brute-force parentheses, to force continuation onto a successive line. But that ship sailed almost 17 years ago.

The way systematic newline significance could come to JS is via an evolution of paren-free that makes it to Harmony status. I intend to work on this in the strawman , but not for ES6.

Some of the github issue comments are naive or idealistic to the point of being silly. Since when does any programming language not have syntax arguments? All living, practical languages that I know of, even those with indentation-based block structure and similar restrictions, have degrees of freedom of expression that allow abusage as well as good usage. Language designers can try to reduce degrees of freedom , but not eliminate them completely.

My two cents: be careful not to use ASI as if it gave JS significant newlines. And please don’t abuse && and || where the mighty if statement serves better.

I’ll also say that if it were up to me, in view of JS’s subtle and long history, I’d fix JSMin. But I would still log a grumpy comment or two first!

Repeat after me: “There’s nothing to fix!” If you have a problem with email, fork a client or build your own! Nobody’s stopping you from “fixing” email. Many people have made a lot of cash by “fixing” email.

We don’t have to sit in fluorescent-lit, university buildings deliberating for hours on end about how to change the spec to fit everyone’s new needs. We don’t need 100 stupid startups “disrupting” the “broken” email system with their new protocols, that will inevitably end up being a proprietary, non-distributed, “ad hoc, informally-specified, bug-ridden, slow implementation of half of” the current email system.

Please don’t try to fix email, you’re just going to fuck it up!! Trust me, you can’t do any better. Instead, let’s build all of our awesome new features on top of an already beautifully-working system by making smarter clients.

As many of you have noticed, I’m effectively proposing that the W3C become a foundation instead of a consortium, albeit a foundation whose primary mission is to act as a consortium would. I’ve avoided using terms like “non-profit” and “not-for-profit” because they might imply specific things which I don’t fully intend in terms of tax law, or whatever, but I do think of it as a generically non-profit institution; that is, one that does not strive to create a profit, except as can be invested into the endowment.

I’ve tried to explain why I believe this is a good idea, but in the end, I think the most fundamental reason is that one I can’t explain: it just feels like the right thing to do. It’s like I can perceive a shape without grasping all its details, but the overall shape looks right, looks better.

I fully expect that some will recoil from this idea, convinced that a foundation is a poor substitute for a consortium. Obviously, I disagree. I think the W3C’s future could be made much more stable with this approach, especially in financial terms. I also believe, as I said before, that it would be no less of a force for the advancement of the web. In fact, I think it would be a much stronger force, and have a greater positive effect, over the long term.

It is not a small undertaking, but it is an important and worthwhile effort, and I hope it is one the W3C considers seriously.

Similarly text based protocols (such as HTTP, IMAP, SMTP, FTP and POP3) make it easy for humans to write, read and debug. One of the things that made POPFile easy to implement was that all the mail protocols are text based (the entire POP3 proxying module is able to use simple string matching and regular expressions to handle POP3). And they are also line oriented (a command is read by reading to the line ending). That makes programs to handle them very easy to implement. Of course, the downside is that text takes up extra space and for low-level protocols (such as IP) it makes sense to use binary. But for almost everything else it’s best to use text. Only use binary protocols where the performance is so sensitive that it’s worth the implementation and debugging downside. The upside is that no special tools are needed. I wonder how much of the success of the Internet can be put down to the decision to use text-based protocols for almost everything that people will need to implement. And how much we owe the early writes of the RFCs in deciding that text was best.

The Free Software Foundation Europe (FSFE) is celebrating open standards today in an annual event called Document Freedom Day. The event, which was first held in 2008, is observed on the last Wednesday of March. The purpose of the celebration is to raise awareness of the critical role unencumbered interoperability and open standards play in protecting data from vendor lock-in.

According to the FSFE, 34 organizations are hosting 48 events in 17 countries to honor the occasion. The FSFE’s list of Document Freedom Day partners includes The Document Foundation, the KDE eV, the Pirate Party of Baden-Württemberg, and many regional Linux user groups.

Document Freedom Day is also endorsed by Google and Oracle, with both credited as sponsors. Many advocates of free culture and open standards issued statements in support of Document Freedom Day, including actor and humorist Stephen Fry.

“Open standards make sense. What makes no sense is that large companies in the field still do not understand this. It is time once and for all to end the pointless nonsense of one document sent on one platform being incomprehensible to the user of another,” Fry said in a statement.

The FSFE has published a list of activities interested parties can get involved with to help the cause, including promoting open formats in public libraries and creating street art raising awareness of open standards.

In addition to the typical advocacy activities, the FSFE has come up with an unusual means of drawing attention to their cause this year. The organization intends to send policymakers informational packets including a pair of handcuffs, a gesture intended to symbolize the restrictiveness of proprietary formats.

Mozilla began an internal discussion last week about whether to implement support for H.264 and other patent-encumbered media formats by relying on hardware decoding and codecs supplied by the underlying operating system. Over the weekend, Mozilla’s Brendan Eich and Mitchell Baker wrote blog entries explaining why they support the plan.

The initial proposal on the mailing list focused on Mozilla’s Boot2Gecko (B2G) mobile platform and the Android port of the Firefox Web browser. As the debate evolved, a path for enabling the same capability in Firefox on the desktop was also discussed. The issue is controversial because royalty-bearing technologies are antithetical to Mozilla’s vision of an inclusive, open Web.

Mozilla has historically argued against the use of H.264 and had previously decided not to support it on principle. The organization argued in favor of Ogg and then backed the VP8 codec when Google made it available under open, royalty-free terms after acquiring On2. Google said that it would encourage adoption of its own VP8-based WebM format by removing H.264 support from the Chrome browser.

One year later, Google still hasn’t followed through with that commitment. Mozilla says that it can no longer afford to wait for Google to do what it has promised. In his blog post, Eich explained that H.264 has become too deeply entrenched in the mobile space to be easily displaced and that browsers that don’t support it are jeopardizing their own future relevance.

“H.264 is absolutely required right now to compete on mobile. I do not believe that we can reject H.264 content in Firefox on Android or in B2G and survive the shift to mobile,” he wrote. “Losing a battle is a bitter experience. I won’t sugar-coat this pill. But we must swallow it if we are to succeed in our mobile initiatives.”

He thinks that Google is in a position where it has to continue supporting H.264 in order to remain competitive itself, which means that the search giant can’t be counted on to champion WebM to the extent that some had hoped. A graph in Eich’s blog post shows that approximately 80 percent of video content on the Web that is available through the HTML5 video element is encoded with H.264.

“Apple sells a lot of H.264-supporting hardware. That hardware in general, and specifically in video playback quality, is the gold standard. Google is in my opinion not going to ship mobile browsers this year or next that fail to play H.264 content that Apple plays perfectly,” he wrote. “Whatever happens in the very long run, Mozilla can’t wait for such an event. Don’t ask Google why they bought On2 but failed to push WebM to the exclusion of H.264 on Android. The question answers itself.”

Although Mozilla is going to have to capitulate on patent-encumbered video in order to stay relevant today, there may be opportunities down the road to address the issue. Patents will eventually expire, Eich pointed out, and can also be invalidated. In the meantime, a pragmatic compromise on H.264 will end the impasse that is currently blocking widespread adoption of standards-based Web video.

It’s getting late, so I’ll wrap this up with a few thoughts:
Fast is good. I’m excited to see that sub-100ms page loads are possible, and it’s a shame to not be able to take full advantage of modern networks because of protocol limitations (http being the limiting protocol, btw).
Being non-standards-compliant in a way that privileges their flows relative to others seems more than a little hypocritical from a company that’s making such a fuss about network neutrality.
I’m not really qualified to render judgment on whether IW10 is a net positive, but after reading the discussion (and considering that the internet hasn’t actually melted down), I’m inclined to think that it is.
I’m pretty confident that turning off slow-start entirely, as Microsoft seems to be doing in my trace, is a very bad thing (maybe even a bug).
So, this leaves the question, what should I do in my app (and what should you do in yours)? Join the arms race or sit on the sidelines and let Google have all the page-load glory? I’ll let you know what I decide (and if I do it, I’ll be sure to let you know how it works out).

Cisco has appealed to the European Union’s General Court, asking for the European Commission’s approval of Microsoft’s takeover of Skype to be made conditional. The network infrastructure company wants the EC to ensure “standards-based interoperability in the video calling space.”

Regulatory bodies gave Microsoft’s takeover of Skype the go-ahead last year, with the deal finalized in October . Cisco says that it does not want to block the merger entirely, just restrict it and require Microsoft to make Skype play nicely with other voice and video calling systems.

Skype’s video and voice chat protocol is entirely proprietary and undocumented. Skype also uses a range of different codecs (including the proprietary, Google-owned VP8 and the open H.264). This makes Skype’s network of users almost completely isolated, and unable to communicate directly with any other VoIP or video system.

Apple is attempting to stop the used of “standards essential” patents on 3G technology as legal bludgeons against smartphone competitors . To make its case, the company has gone directly to the standards body behind 3G wireless networking, the European Telecommunications Standards Institute (ETSI). In a letter to ETSI dated last November (but only recently uncovered by the Wall Street Journal ) Apple suggested that patents offered as part of wireless networking standards should be governed by standardized royalty rates and barred from being used as the basis for legal injunctions.

As the war over smartphone supremacy has spilled over into the courtroom , some players—including Samsung and Motorola—have taken to leveraging patents essential to 3G wireless networking standards in lawsuits largely aimed at Apple. Those patents were offered up to the ETSI to help create 3G standards on the condition that they be licensed on fair, reasonable, and non-discriminatory (FRAND) terms.

In the letter to the ETSI, however, Apple’s chief IP counsel Bruce Watrous asserted, “it is apparent that our industry suffers from a lack of consistence adherence to FRAND principles in the cellular standards arena.”

In particular, Samsung has asked for a 2.4 percent royalty on the full retail price of every iPhone or iPad sold to cover its 3G-related patents, while Motorola has asked for 2.25 percent. Apple has apparently rejected these offers as unfair and unreasonable, leading both Samsung and Motorola to sue Apple for infringement.

So far, courts in the European Union haven’t taken too kindly to using FRAND-encumbered patents to block competitors with injunctions. Samsung lost injunction requests based on 3G patents in France, Germany, Italy, and the Netherlands. Motorola won an injunction in Germany, but was later overturned on appeal.

The European Commission also objects to using FRAND-encumbered patents against competitors. It began a formal investigation in late January “to assess whether Samsung Electronics has abusively, and in contravention of a commitment it gave to the European Telecommunications Standards Institute, used certain of its standard essential patent rights to distort competition in European mobile device markets, in breach of EU antitrust rules.”

The translate attribute is an enumerated attribute that is used to specify whether an element's attribute values and the values of its Text node children are to be translated when the page is localized, or whether to leave them unchanged.

The attribute's keywords are the empty string, yes, and no. The empty string and the yes keyword map to the yes state. The no keyword maps to the no state. In addition, there is a third state, the inherit state, which is the missing value default (and the invalid value default).

CSS is a language for describing the rendering of structured documents (such as HTML and XML) on screen, on paper, in speech, etc. This module contains the features of CSS level 3 relating to the hierarchical nesting of style rules. It includes and extends the functionality of CSS level 2 [CSS21], which builds on CSS level 1 [CSS1]. The main extension compared to level 2 is the ability to nest a style rule within another rule, allowing greater modularisation and readibility of CSS documents.

I was developing a small single purpose microsite and decided to build it using CASSIS not just for application logic, but for the server-side runtime execution and flow as well. I figured the needs of a simple real world site would work well to drive the design of a simple runtime.

No need to invent anything new, just re-use Apache/CGI environment variables (e.g. as used in PHP, like SERVER_NAME). But they look like old C constants, and CASSIS coders will be more familiar with Javascript.

Window.location's properties seem reasonable, until you get to "search" for the "?" query part of a URL. What about the source, the specs for URL and HTTP? And that's when I started to see the problem.

With a little more research I found a half-dozen different ways to slice and dice URLs. Kevin Marks asked me, what about Python? And that made seven. I published my research publicly on the microformats wiki, which is a good place to document existing formats for something (a key step in the microformats process).

Among all the differences (and overloading of the same terms to mean different things) it did seem that there were some patterns. So I made a diagram of a sample URL, chopped into pieces and named according to seven different conventions over the years, in the hopes that doing so might reveal such patterns.

WebAPI is an effort by Mozilla to bridge together the gap, and have consistent APIs that will work in all web browsers, no matter the operating system. Specification drafts and implementation prototypes will be available, and it will be submitted to W3C for standardization. Security is a very important factor here, and it will be a mix of existing security measurements (e.g. asking the user for permission, like Geolocation) or coming up with new alternatives to ensure this.

That, or Microsoft is ignoring an accepted standard in favor of its own technology - and setting the groundwork for the "bad old days" of Web fragmentation all over again. I wrote earlier about the mixed messages Microsoft is sending - on the one hand saying that developers should be able to write markup once and run it anywhere, and on other saying developers should create alternate versions of their sites for non-IE9+ browsers.

It's a shame. IE9 and 10 look to be great browsers. But the harder I look at what Microsoft is doing, the harder it is to believe that its browser strategy developer friendly.

Combine this with Chrome's Native Client and the ongoing war over a video codec standard and think we'll see a return to the bad old days soon.

Adobe previewed some new streaming video capabilities of its Flash Media Server at the 2011 National Association of Broadcasters (NAB) trade show, including new compatibility with iOS devices like the iPad. Instead of getting Steve Jobs to relent on his "thoughts on Flash," however, Adobe is instead adding HTTP Live Streaming support to Flash Media Server.

HTTP Live Streaming is a protocol that Apple developed to stream live and recorded video using standard HTTP connections instead of the more difficult to optimize RTSP. It uses H.264-encoded video and AAC or MP3 audio packaged into discrete chunks of an MPEG-2 transport stream, along with a .m3u playlist to catalog the files that make up the individual chunks of the stream. QuckTime on both Mac OS X and iOS can play back this format, and it is the only streaming format compatible with the iPhone, iPad, and iPod touch.

Apple submitted HTTP Live Streaming to the IETF in 2009 as a proposed standard, though it doesn't appear that the standard ever moved beyond the draft stage. However, Microsoft quickly added support to its IIS Media Services server, which is used to deliver "smooth streaming" video to Silverlight-based clients. When IIS Media Services detects an iOS device, it instead packages and delivers the content using HTTP Live Streaming.

Adobe added its own HTTP-based streaming feature to Flash Media Server last year. Similar to Apple's solution, it breaks up H.264 video into chunks saved as separate files and sends those files to a client over HTTP. The difference is that its HTTP Dynamic Streaming uses an XML-based manifest file (instead of a plain-text playlist file) and the MPEG-4 fragment container format (.f4f). Also, it's only compatible with Flash or AIR.

However, Adobe is "committed to developing technologies that simplify broadcast workflows to make it simpler to reach a fragmented lineup of devices," according to senior product manager for Flash Media Server Kevin Towes. Towes noted in a blog post that Adobe is adding HTTP Live Streaming support to Flash Media Server and Flash Media Live Encoder. "By adding support for HLS within the Flash Media Server, Adobe is reducing the publishing complexity for broadcasters who need to reach browsers supporting HLS through HTML5 (such as Safari) or devices where Adobe Flash is not installed."

In other words, instead of trying in vain to persuade Apple to build Flash into iOS, or losing potential Flash Media Server customers to some other iOS-compatible solution, Adobe seems to be implicitly acknowledging that content publishers need Flash-free video streaming.

It's also worth noting that Flash Media Server will also be served to compatible clients on non-iOS platforms, including Safari on Mac OS X. Apple recently began selling its portable computers without Flash pre-installed, and we discovered that running Safari without Flash seemed to increase battery life of the latest MacBook Air as much as 33 percent. While Adobe has claimed to be working on a MacBook Air-optimized version of Flash, perhaps the company decided it was prudent to cover all bases and serve up content to Mac users who are choosing to not install Flash on their systems (yours truly included).

"The World Wide Web Consortium has published a draft of an interface that browsers can use to manipulate files better, one of a series of steps aimed at gradually improving the sophistication and polish of Web site interfaces. The draft File API (application programming interface) defines a number of ways that browsers and Web sites can handle files better. One big part of it: being able to select multiple files for upload, such as on photo-sharing sites or Web-based e-mail, a task that often relies on Adobe Systems' Flash today."

"To watch this video from Microsoft regarding the upcoming IE 9’s support for standards and interoperability, you are prompted to install Silverlight. (Via Mark Pilgrim.)" So much for open standards.

"One of the points I've made repeatedly about Web 2.0 is that it is the design of systems that get better the more people use them, and that over time, such systems have a natural tendency towards monopoly. And so we've grown used to a world with one dominant search engine, one dominant online encyclopedia, one dominant online retailer, one dominant auction site, one dominant online classified site, and we've been readying ourselves for one dominant social network. But what happens when a company with one of these natural monopolies uses it to gain dominance in other, adjacent areas? I've been watching with a mixture of admiration and alarm as Google has taken their dominance in search and used it to take control of other, adjacent data-driven applications. I noted this first with speech recognition, but it's had the biggest business impact so far in location-based services."

"With PDC going on, we get a glimpse at the early stage of IE 9. There is some promise, albeit with omissions!"