Minutes of W3C Developer Gathering, 5 November 2009

See agenda and IRC log.

  1. Introduction
  2. Arun Ranganathan: News in APIs
  3. CSS Strike Force: Cool CSS3 Features
  4. Philippe Le Hégaret: Browser Test Suites
  5. Brendan Eich: ECMA Harmony and the Future of JavaScript
  6. Mark Davis: Controversies around international domain names
  7. Leslie Daigle: Internet Ecosystem Health
  8. Kevin Marks: OpenID, OAuth, OpenSocial
  9. John Schneider: EXI


<scribe> ScribeNick: timeless

<darobin> is this mostly for scribing or can we also make fools of ourselves?

<TabAtkins> darobin: Do we need to choose one?

<darobin> TabAtkins: well, so long as we don't talk about unicorns

<dom> "it's 203" — as in "203 Non-Authoritative Information" ? :)

IanJ: Welcome everyone
... My name is Ian Jacobs
... welcome to the first developer meeting we've ever had
... we have a great lineup
... and i will get out of the way
... your names are up here, so just get up on time
... We have w3c groups and non w3c groups represented
... timeless has accepted to scribe
... the proceedings will all be public

Arun Ranganathan: News in APIs

Arun: My name's Arun for people who haven't met me personally
... I work for Mozilla on Firefox
... on evangelism
... A lot of what we do is reach out to developers
... to see what we should be doing
... How many people are web developers?
... that's the lion's share
... How many people are in the business of developing web applications?
... interesting a smaller number of hands
... Both as part of my work at mozilla and as someone who works on standards
... I'm an author of a spec in W3C ... File API

Arun: I also work on a spec outside W3C WebGL

Arun: We work in Web Apps WG
... You should be able to access databases on a client just as you can on a server
... Today you guys have come to the hallowed precincts of a sausage factory
... you're actively following a list-serve
... a lot of developers out there don't follow
... to them, they may be happy to take an API and run with it
... We'd like to get them more involved in standards
... For examples, two browser vendors released browsers with a SQL API
... but two vendors: Mozilla and Microsoft indicated they don't want to do this
... We got feedback from developers indicating they didn't want a SQL API
... ... In HTML5 and web apps
... How many people recognize this movie?

[Back to the future Movie picture]

["Where we're going, we don't need roads"]

scribe: I wanted to condense how standards work into one day
... In fact, there's a story on CNet referring to a date in 2012
... So I thought about last night how to condense this into a day

[Slide: Morning, Afternoon, Evening]

scribe: Basic rules of thumb on Time
... Morning is the period that already passed
... Morning is a little while ago
... Features that are already available in browsers today
... The afternoon is things you can build on right now, but you may not be able to do that in a cross platform manner
... How many people do things for some platforms and worry about other browsers (esp IE6)
... The evening is stuff that has yet to come
... it holds in it the promise of a good night
... it holds in it the promise of things that are still being fleshed out
... it's a bit more than that, but it's not something that you can rely on in your bag of tricks
... The morning includes things like LocalStorage
... It's supported in IE8, Opera, Safari, Firefox 3.X (?)
... As for XMLHttpRequest
... it's implemented in most browsers (?)
... and XDomainRequest (in IE8)
... and they're implemented with the same security approach (?)
... And you can grab me and we can look at snippets of code where I can show you how you can do this in a cross browser manner
... postMessage is also available in IE8, Firefox, ...
... CSS2.1 support, reasonably good, even in IE8
... you can look to it for better support than before

<krisk> IE8

scribe: That's the morning
... The afternoon gets a little bit more interesting
... it introduces more things about the platform
... things aren't as mature
... supported in Firefox (25% of the market)
... Safari, and Chrome

[Slide: Afternoon]

scribe: HTML5 Canvas
... HTML5 Video
... HTML5 Drag and Drop

<Tobias> Is this slide online somewhere?

scribe: CSS WebFonts (...)
... and geolocation

[ Demo ]

scribe: This demo brings together a lot of pieces of the platform
... it sorta does, but the color isn't so great
... I've got a colleague of mine
... doing a fanning gesture between two iPhones
... if I click here, I've got a video supplanted between the two iPhones

<dom> Hi Developers!

scribe: this only works if video is part of the browser, I can't do this with Flash

<IanJ> demo dynamically injecting content into a canvas (within a video element)

scribe: I can also embed a video inside the animation
... This works when video is a first class citizen of the web
... and this comes from html5

<IanJ> Arun: You get this flexibility when video is a first-class citizen of the web

scribe: here's another demo
... The color isn't great
... [about the demo]
... the pixels of the video are dumped into a canvas
... I'm going to label extracted bits

[names which people might not recognize]

[ fwiw, this usually works better, but for some reason one of the pins on the cable seems to be doing strange things ]

[arun uses the demo to establish facial recognition]

scribe: this demo uses localStorage
... because i switch between two urls

<JonathanJ> http://people.mozilla.com/~prouget/demos/facedetector/new/play.xhtml

scribe: I have a lot of demos, please come visit me later
... this is in the context of "the afternoon"
... I wanted to show you this demo

[IanJ: t-minus 10 minutes]

<dom> [very impressive demo for video]

scribe: I'm going to open font book, a handy dandy application on my mac
... what I'm going to do now
... is show a bunch of technologies working together
... HTML5 Drag and Drop
... CSS Font Face
... HTML localStorage
... contentEditable
... I'm going to drag a font onto the page
... and dropped it onto the page
... and the page restyled itself using the font

[drags a font onto the page]

[arun misses the drop target]

<JonathanJ> http://labs.thecssninja.com/font_dragr/

scribe: I'm going to drop in garamond
... now you can see the page has taken on a different look
... this is directly using localStorage
... to store the stuff that I dragged
... it's using the drag and drop api
... and it's using font-face to set the font
... and it's using contentEditable
... if i got to a page flickr.com/maps
... I can share my location

[ Arun shares our location ]

scribe: this is the GeoLocation API introduced in Firefox 3.5
... and I can drag my mouse over locations and see pictures from there
... this is flikr using pieces of an API that recently became a spec
... and now... "Evening"
... We're looking at pushing the hardware
... we're discussing storage
... and orientation events (angles)
... multitouch

[Arun holds up an n900 proto]

scribe: Firefox Mobile will ship for this device

[Arun demos playing a game by tilting his macbook pro]

scribe: this is a pretty popular go-kart game

[ demos an expanding red panda but tilting his laptop]

scribe: this is stuff we'd like to do in the evening

<scribe> ... pending discussion with other folks

UNKNOWN_SPEAKER: this is stuff in the evening, the promise of a tomorrow, or a tomorrow morning
... and of course there's 3d graphics
... 3d graphics are extensions of the html5 canvas element
... and exposes a new way to do hardware accelerated 3d graphics
... these are the things I'm talking about from the promise of an evening

Van Ryper (Krillion):

scribe: I've heard a lot about the web3d consortium

Arun: the deliverable of web3d (x3d)
... is an interchange format that represents 3d graphics
... it's the ability for javascript to parse such graphics
... and use webGL to expose those graphics

Robin: and someone's done that

Arun: X3D OM
... The promise of today is that javascript's performance have improved so much

IanJ: so... Don Brutzman a chance to speak

DonB: We'll be showing this tomorrow morning at X-oclock

<smfr> 9-oclock

<darobin> X3DOM: http://www.x3dom.org/

Tom Strobers (user):

scribe: Java - JavaScript ?

<krisk> ...in the HTML5 WG Meeting

Arun: that's an interesting question
... and I'll speak in a continuum
... java has historically been used as a technology that can be used anywhere
... and so in fact can javascript
... javascript as it now runs in browsers
... and browsers run on mobile devices

Fantasai: JavaScript and Java has no relation
... JavaScript runs natively in the browser
... whereas java runs separately

Arun: JavaScript is the defacto language of the web

IanJ: I'll see if we can talk about moving things into programming languages and out of declarative languages
... I want to keep things moving
... we have a lot of interesting speakers
... we have 3 bottles of wine
... You can use a business card, or just a piece of paper
... thank you Arun

CSS Strike Force: Cool CSS3 Features

fantasai: I'm an invited expert of the CSS WG
... I've brought along a number of people from the CSS WG with exciting demos
... first speaker is David Baron
... he writes specs, makes interesting comments, ...

[ laughter ]

David's slides

dbaron: ...
... there've been a lot of demos of css stuff floating around lately
... I've wanted to demo a few features that are not the ones that get the most press
... the stuff that people demo are these new visual effects
... shadows, columns, rounded corners, transforms
... one of them is border image
... the ability to take an image and then logically that image gets split up into 9 pieces
... and then you can use those slices to form the border of something else


scribe: and this will now resize as i resize the window
... another feature that's been in specs for almost 10 years
... but that hasn't been implemented until recently
... is font-size-adjust
... it lets you get better font behavior
... one of the problems is that font size is whatever the font designer wants it to mean
... what font-size-adjust lets you do
... is that instead of letting font size do what it does
... font-size-adjust lets you operate on the x height

[ demo of font-size-adjust ]

scribe: another feature that's now pretty widely implemented
... Mozilla, WebKit, and Opera
... are CSS Media Queries
... which let you change the style of the web page
... based on characteristics of the thing that's displaying it to you
... so you can change the page based on, e.g. the width of the window
... e.g. you can specify something that only operates for windows >22em's wide
... the final thing, is a feature that I think is only implemented in Mozilla
... many designers have struggled with css using intrinsic widths in basic ways
... there's the longest word of the line
... and (??)
... so you can say the width is the min-content-width
... or the width is the mac-content-width
... or that it fits the container
... which is the same algorithm used for tables

fantasai: we'll have a couple of questions after each talk

dbaron: questions now...

VanR: ... how pervasive are things

dbaron: most of these that I've demo'd are supported in Firefox, Opera and Safari, but not IE

<IanJ> quirksmode.com suggested

VanR: ... meta question, is there a way to see supported list

Tab Atkins:

scribe: quirksmode ... and ...

Ian: ... status of a test suite?

fantasai: we're working on it
... next speaker is Tab Atkins

TabA: ... i just got brought in based on my work on the gradient spec for CSS3
... I'm going to take this opportunity to go over how spec work is done
... because page designers often wonder how to get things added
... steps:
... look at the problem and figure out what the actual problem is

TabA: and then there's a mailing list
... it's a public list
... I have an example

<Tobias> thanks dbaron

TabA: gradients
... Safari introduced experimental support for css gradients in 2008
... I don't know if these will work in Chrome
... that's ok... I have other things that will work
... We kick things around on the mailing list
... later Mozilla created something similar

<smfr> TabAtkins was showing: http://webkit.org/blog/175/introducing-css-gradients/

TabA: they said that they didn't like the way it was done

<benjick> IE have had CSS gradients for ever!

TabA: each vendor uses its own prefix (-webkit-, -moz-)

<smfr> now showing: https://developer.mozilla.org/en/CSS/-moz-linear-gradient

TabA: not the bad old browser wars
... gradients can be done in CSS, with good performance
... without the network bandwidth
... the problem with gradients, was the syntax
... we kicked it around on the mailing list
... it's all public, you can read it on the mailing list
... what it ended up with was a proposal by me

<Arron> www-style archive : http://lists.w3.org/Archives/Public/www-style/

TabA: i just proposed it on the list
... it grew out of discussions with people

<smfr> Current proposal: http://dev.w3.org/csswg/css3-images/#gradients-

TabA: talking about what people were trying to do

[shows the detailed description of the proposal ?]

scribe: these are based on the firefox implementation
... this is a Minefield build of Firefox
... it's now in the nightlies

dbaron: it will be in Firefox 3.6
... as of a few hours ago

TabA: so 3.6 will have the new syntax
... so you can do things like you want to do

[ demos creating _beautiful_ gradients ]

scribe: this is directly using the syntax

<smfr> TabAtkins is testing with http://www.xanthir.com/etc/gradient.html

scribe: I'm just using javascript to set the background

Robin: ... do you have demos where it's animated?

TabA: it's an open problem
... it shows the evolution of an idea
... from someone identifying a problem
... to implementations
... to implementations(?) on the style list
... to proposals(?)
... so if you have a problem
... you tell us about it
... we kick it around
... or we decide to put it off until later
... browser developers are not always page authors

fantasai: coming to a browser near you
... next up, Simon Fraser
... giving a demo of transforms and transitions
... these are new drafts that are coming up
... Simon works for Apple on WebKit, and used to work for Mozilla

Simon= smfr

smfr: so...

<TabAtkins> darobin, I failed!

smfr: with transitions and transforms
... this is some content that we put together using assets from a band called Wilco (?)
... as I hover over things on the left
... you see transitions

[ shows the basic bits ]

scribe: we've got a standard color
... and the nice red color?
... using completion in textmate
... let's put a transition right here
... over one second
... so now when i go back to the page
... you can see the transition
... transitions take a comma separated list
... another thing that dbaron mentioned was transforms
... so let's put a hover on the transform
... a precanned rotate of say X degrees
... and now let's make this nice and smooth
... so let's say ... .5s
... you can use milliseconds too
... so let's go back to our original page
... but this slideshow
... you can have crossfades
... we can use a translate
... and vertical scales
... that's a keyframe animation
... it's a little bit more complex
... they're not as advanced as transitions
... we can do a spin
... we're also proposing a 3d transform
... we're rotating around the vertical axis with some perspective

IanJ: so are all the images there?

smfr: yes, it's all there, it's just css classes tweaking

Dan (HP):

scribe: we've got all these transforms that we can use on a page
... we've also got canvas
... why should you use one or the other

smfr: with canvas, you draw and then don't know what's there
... with transforms, you aren't making the content more opaque
... you still have links
... we've also got examples of applying 3d to slices of a page
... and revealing things from the page
... and we can hover over here and see hit testing still works
... all done with css transforms
... we've done this inside apple
... this demo was done by charles ying (?)
... outside apple
... it uses flikr to fetch images as a wall
... hold keys down, move backwards and forwards

[ wiring glitch, we dimmed another room ]

scribe: thanks

fantasai: so that's our three speakers
... we also have people from Microsoft here
... we've got a bunch of members from the CSS WG

Bernard Ling (?):

scribe: when does it appear in ie6? [just kidding]

dbaron: Mozilla has 2d transforms in FF3.5
... transitions will be in FF3.7

smfr: 2d transforms should be identical in behavior

dbaron: 3d would be after 3.7

<dbaron> if we did it

IanJ: how to tell css wg your idea's

fantasai: www-style@w3.org

xx-? :

scribe: is there any work being done on opacity across browsers


<dbaron> http://lists.w3.org/Archives/Public/www-style/

ms-1: currently it's available through filters
... it's a proprietary property
... we can sit down and i can try to help you with it
... moving forward in the future
... we can see about looking to expand

fantasai: css3 color is a CR
... there's an opacity property
... I believe WebKit, Gecko and Opera

IanJ: ok...

RRSAgent: make minutes

<fantasai> Thanks everyone, your talks were amazing! :)

<dom> very impressive, indeed

Philippe Le Hégaret: Browser Test Suites

Next Speaker: Philippe Le Hégaret (W3C)

IanJ: Philippe has worked on building a test suite

Philippe: let's talk about something embarrassing
... testing at w3c
... I'm responsible for [long list of wg's]
... one of my plans is how do we test all that
... talking about testing at w3c
... we already have plenty of test suites at w3c
... css1, ... DOM event 2, css2.1, ...
... why do we have those test suites?
... one of those reasons is that in 1999 in the DOM working group
... we came up with this phase called Candidate Recommendation (CR)
... "we think we're done", but now we want to prove that we're actually done
... this came out of the DOM WG
... to come out of the phase
... the WG _should_ come out with two implementations of each feature

<karl> http://www.w3.org/QA/TheMatrix we need to brush up the matrix

Philippe: it's a negotiation with the [TBL role]
... what working groups tend to do
... is just demonstrate that each feature has been implemented
... do they actually do this?
... no, they don't have enough resources
... and no one really wants to write tests
... but do we get interoperability on the web?
... and i would argue no

<dom> karl, I actually updated it (somewhat) a few weeks ago

Philippe: how can we make the web a better place?
... w3c has limited resources
... yes we have microsoft
... but we have limited amount of time
... limited amount of budget, for product teams as well
... so what we really want is the community to help us
... tell us what works
... you run into problems all the time
... tell us about it
... can you please submit a test about it?
... what i'd like to see is the community help us
... let's make it a bit harder

[ slide: svg, mathml, video, ...]

scribe: I can manipulate the DOM tree
... if i want to play a video, i just click a button which is just a thing with css style on it
... and it will work
... but who is going to test all this?
... while we have produced some test suites
... we haven't produced combinations of specs
... css+svg+ ...
... so how do we test that?
... first we need to test the parsers
... we need to guarantee that the document you're writing will generate one single DOM
... how do we test dynamic scripting
... if i want to test a css animation
... how do i test it if it's 3 seconds
... i don't want to test just the first frame and the last frame
... we need to understand that there are limitations
... it's impossible to test everything
... and we have to acknowledge that
... but at the same time
... we need to do something
... the most common thing
... is a test that requires a human
... a "self describing test"
... [ pass with green, fail with red ]
... we can also test plain text output
... we can compare screen shots
... if you have for example in svg
... we know exactly what the output should be
... if you have a rectangle, we know what it should be
... we can take a screen capture
... with fonts, it's different
... what dbaron did
... is that instead of trying to write tests to match a static image
... is how about we write two pages that should have the same rendering
... using different features
... that's called reftests
... the advantage is that it can be cross platform/browser
... with webkit, you can

<fantasai> ScribeNick: fantasai

<timeless> ... do a dump of a dom tree

scribe: and there are probably other ways that I'm not aware of.

<dom> Webkit DumpRenderTree, an example of layout tree comparison

scribe: one of the things I've been trying got push inside the consortium is to have a browser testing framework
... that other groups can use. They can choose a method to test their specification.
... we want to make this as automatic as possible.
... we need to produce a lot of tests.
... e.g. Microsoft submitted 7000 tests that were all self-describing tests
... that is not scalable
... it takes a long time to go through those tests
... because of our limited resources, we need to produce a mechanism to help our working groups
... if they are reviewing tests, they are not writing specs
... they should just be able to focus on controversial tests
... if others can submit a test, then we can look if there's a problem
... we can also see if its a bug in the browser, and they have to change their impl
... We also have to be careful here, because if the tests are wrong we get interop on the wrong behavior!
... We need to have testing for all these technologies, not just one of them, or each separately
... but all of them together
... with HTML5 normatively integrating with SVG and MathML, we need to test them together, not just each on the side.
... We need to be able to test HTML inside SVG

<smfr> and SVG inside HTML inside SVG

scribe: As I said there are multiple ways to test a browser, and we should allow more than one
... The browser implementors are not going to rewrite all their tests for us
... but agree on some common formats so that we can all share tests
... We also need to have a life after the Recommendation stage
... the specs still exist after Rec, and we need to continue testing them
... I don't want W3C to run that test suite. We don't have the resources.
... We can't buy 100 servers and run tests on every possible version of every browser
... So we want to allow others to run the tests. To run screen shots on their own computer
... There are some difficulties. E.g. I don't know how to take a screen shot by script on all the platforms
... What happens then?
... We can make the test results useful to you.
... Show reports of what works, and what doesn't. Let's make the test suites useful for the community as well.
... And we should improve our validators at W3C.
... Maybe make it use test results.
... e.g. it notices You are using this feature, note that it doesn't work on FF3.6!
... We're not alone, there are others who are trying to do the same thing.
... test swarm for example is an effort from jQuery author, because he was running into the same problem
... he cannot run every OS /browser combination himself
... browser scope is interesting too. It allows you to compare screenshots across platforms
... It uses a web server locally to determine when to take the screen shot
... We need to produce these tools incrementally
... and try to get them to work on all browsers
... I think the message that I like you to get out of this is that we need help.
... I can get some help from browser vendors, but ultimately we need help from the community because you are the ones suffering every day.
... and until you tell us what is wrong, we are not able to help you

<caribou> For the record, Help W3C Validators program at http://www.w3.org/QA/Tools/Donate

Ian: Questions for Philippe?

<darobin> interesting article on mobile testing: http://www.quirksmode.org/blog/archives/2009/09/testing_mobile_2.html

Dianna Adair:

<timeless> RRSAgent: make minutes

Dianna Adair: Could there be any hooks in the syntax so that you can pass arguments to the syntax automatically, through some sort of test generation program

Dianna Adair: Are there valid simulators for the major browsers?

Dianna: So that you can push the tests against the simulated suite of browsers

plh: For the first question, yes, because we are starting from scratch
... For the other we can get screenshots of the major browsers
... browsertests.org was done by an engineer in Switzerland
... At the beginning of Sept. a few folks including me and a few Moz developers got together and started writing code to do that

<dom> BrowserTests.org

plh: We made a prototype that works on the 3 major platforms
... He is improving his browser test framework
... At W3C we have a way to do human testing, I showed a demo of the mobile web browser
... It requires a human to click pass fail pass fail

Dianna: One way I've seen that works, is to set up a location and have some sort of "bugfest"
... You have people all over the world trying to test things simultaneously

plh: ...
... My goal is not to point fingers at browsers and tell them they're doing bad stuff
... I want to serve the community

IanJ: Have you set up a mailing list or public place for people to come help out?

plh: Not yet

IanJ: ACTION Phillipe? :)

plh: We need to create a group within W3C itself
... I know for example Mozilla and Microsoft are interested in helping
... We need to organize and provide a venue for the community to come together

Dianna: I propose that Universities are a great source intelligence and creativity and might be able to help

Kris (MSFT): There is a test suite alias in the HTMLWG

plh: Yes, we also want cross-tech testing

Kevin Marks: Do you know the test suite for called doctype at Google

plh: I only mentioned testing framework. There are plenty of efforts out there
... One thing I did in August was to collect some of that
... We are not alone, there are a lot of others trying to solve the same problem

IanJ: Ok, we have 4 more speakers after the break
... I'll hand over to Tim for now

TimBL: Thanks for coming

<karl> there was http://lists.w3.org/Archives/Public/www-html-testsuite/

Tim: It's important that everyone designing specs is in contact with lots and lots of people using their specs

<karl> and now http://lists.w3.org/Archives/Public/public-html-testsuite/

Tim: Good to have feedback, and feedback on how to get feedback.

Brendan Eich: ECMA Harmony and the Future of JavaScript

IanJ: Next speaker, Brendan Eich, representing ECMA
... and ECMA harmony

brendan: I'm here from Mozilla
... I'm here to talk about ECMA Harmony
... which is a ... which we reached last summer
... before that, we had problems
... the figure of XX ...
... identified as gandalf ...
... there were people like Doug and sometimes me
... advocating for JS Hobbits
... small enough and based on principals from Scheme itself
... it had virtues which were only discovered years later on the web
... it was the dumb kid brother to Java
... JavaScript was supposed to be the duct tape language
... you were supposed to write it around the real language .. Java
... I think people will agree that Java is basically dead on the client
... there were problems with Java
... the main issues was that JavaScript was a dynamic language
... is a dynamic language, and will continue to be a dynamic language
... the fear with ECMAScript 4 (?)
... was that it would become a static language
... the fear, as with Visual Basic 7
... was that you take a dynamic language
... and you convert it into a large proof system
... and that's not how languages are built
... if ES4 would have been that, i'd be that guy with Gandalf
... there was a point in 2006 where the committee seemed united
... the MS representative was going to put some old version into JScript.net
... and we were all united

[ Slide: The Fellowship of JS ]

scribe: the fellowship was broken

[ Slide: Conflict (2007) ]

scribe: some of it was based on the real prospect that i was somehow working toward
... of pulling the drive language of flash, actionscript, into the web
... and again, microsoft was working on pulling a version into JScript.net
... based on waldemar horwat
... ECMA requires consensus
... and we didn't have that
... at the time this happened in march
... it was clear to me that this wasn't going to work, someone was going to win, and someone was going to lose
... but this was going to be ok
... because it would involve improvements to the language for the web (?)
... ecma was stagnating
... 4th edition was mothballed in 2003
... netscape was dying - partially because of its own failings, and partly because of microsoft (see antitrust)
... msie was sleeping
... in 200x (?) ... there was a chance of things improving
... in April 2007, there were things like
... Microsoft's Silverlight offering
... a JScript Chess demo was converted into C#
... it was 100s of times faster

[ Slide: The Two Towers ]

* ES4

* Waldemar Horwat's work at Netscape, 1999-2003

* JScript.NET, 2000

* ActionScript 3, 2005-2006


* ES3.1

* Doug's recommendations

* Document JScript deviations

brendan: ...
... there were a lot of bugs in IE's implementation of JavaScript
... and MS was heavily involved in the standard writing for ECMAscript 2/3
... and there were serious bugs in the MS implementation

* "No new syntax"

brendan: ...
... if you never add things, you can't break things
... if you aren't careful, and you add global objects/methods
... you can break the web
... (facebook)
... no new syntax doesn't save you
... time was passing, we were trying to get es4 out

[ Slide: Synthesis (2008) ]

brendan: ....
... Allen proposed meta object API
... on the ES3.1 side
... Lars Hansen on the ES4 side, "Packages must go"
... in April 2008
... Namespaces must go too (June-July)
... unfortunately, we lost Adobe
... because they felt they lost the bits they had derived from the standard
... but that's a risk when working on standards
... when we reached harmony in July in Oslo
... the language again is inspired by Scheme with influences from Self
... one of the foundations of Scheme is lexical scope
... javascript has some broken bits of scope
... Doug's teaching and attitude
... in es4 we're looking toward a strict mode
... we have a hope for "use strict mode" for es5
... similar to perl5
... we're trying to avoid "use stricter" for future versions
... that's my quick recap of how we reached harmony
... ES3.1 was renamed ES5 (March 2009)
... We decided not to trouble ECMA with fractional standard version numbering
... ES4 died
... we're not sure if Harmony will really be 5
... we might need to do some quick versions for standardization reasons
... the committee is not the gatekeeper
... a chokepoint for all innovation

[ Slide: Namespaces ]

brendan: ...
... who here knows about Namespaces in Flash?

[ hands raised ]

scribe: there's ECMAScript For XML (e4x)
... it has a lot of problems as a spec IMO
... it's a spec whose pseudo code was extracted from java code
... so you have bugs from the code, translation, etc.
... it almost broke the object model
... it had integrated query
... it had namespace objects
... you had to use ::'s to qualify stuff
... sometimes people complain about namespaces in XML documents
... es4 was much worse
... it was very powerful
... because you could use lexical scope to change how code behaves

[ Slide: Packages ]

scribe: packages are built on namespaces
... even today in actionscript, there are some funny things about them
... there's a temptation to think that using long chains of dotted things
... there's a temptation to think that the dotted things can win
... but because the language is dynamic
... the winner can be the normal object with similar property paths
... I think this problem still exists in actionscript
... and then there are problems with <script> tags

[Slide: Namespace Problems]

scribe: here's a problem with namespaces
... ambiguities can happen when scripts come along and defined a namespace later
... I'm explaining why Namespaces died in ES4
... Question: Why am I talking about why Namespaces when you already said it's dead
... Answer: it died because it had technical problems
... that we couldn't figure out how to solve
... the alternative was to require whole-program analysis

[ Slide: ES5 Meta-programming ]

scribe: the 3.1 contribution
... Create properties with getters and setters
... we have this in mozilla under a different name
... it's finally standardized
... instead of __defineGetter__/__defineSetter__/__lookupGetter__/__lookupSetter__
... We implemented this about 10 years ago in Mozilla
... but MS/Opera didn't implement it
... when live maps launched
... it treated the DOM as the ie DOM
... and then it looked to see if the host wasn't IE
... it decided it wasn't IE, then it must be Gecko
... so it used __defineSetter__/__defineGetter__
... to support it
... this caused a fire drill in Opera/Safari
... to implement this missing feature (within a week!)
... to support live maps

[ Slide: ES5 Meta-programming ]

scribe: you can define things that don't appear in for-in loops
... because the ajax community learned about how pollution breaks iteration
... with this facility, you can not break those things
... with this, lack of syntactic salt
... you can create objects

[ Slide: Hardening Objects ]

scribe: you can make an object that delegates to another object
... without using a constructor pattern
... you can prevent extensions, and prevent reconfig
... and prevent all writing
... this enabled a lot of what we had in ES4 classes

[ Slide: Harmony Requirements ]

scribe: as we worked on harmony, we realized we should state our requirements
... in some way
... we don't want to do anything that requires innovation in committee
... or abstract jumps
... we want to keep the language pleasant for casual developers
... so you could start small and grow
... javascript is in some ways a virus
... it has grown into an application programming language
... we want to keep these features

[ Slide: Harmony Goals ]

scribe: * Be a better language for writing
... [] complex applications
... [] libraries (possibly including the DOM!)
... [] code generators
... * Switch to a testable specification
... * Improve interoperability, adopt de facto standards
... * Keep versioning as simple and linear as possible
... * A statically verifiable ...

[ Slide: Harmony Means ]

scribe: * Minimize additional semantic state
... * Provide syntactic conveniences for:
... [] good abstraction patterns
... [] hide integrity patterns
... [] define desugaring to kernel semantics
... * Remove (via opt-in versioning or pragmas) confusing or troublesome constructs
... * Build Harmony on ES5 strict mode
... * Support virtualizability for host objects

[ Slide: Harmony Proposals ]

brendan: ...
... prognosis, it should be sorted out in 2-3 years
... things that don't make it go toward es6
... you can self host your way to a stronger language
... ECMA standards group TC39 is still strong

IanJ: thank you brendan
... that was our transition talk
... into Internet Ecosystem

Mark Davis: Controversies around international domain names

Mark's slides

scribe: I'm talking about international domain names (IDNA ?)
... IDNA 2003
... There was a system developed in 2003 that allowed people to have international characters in domain names
... I don't know if people saw the news this week
... What happened this week is that the top level domains can have non ascii characters

[ Slide: IDNA 2003 ]

scribe: you can't do certain things...
... IDNA 2003 is tied to Unicode 2.3 (?)
... If you look at the uppercase characters
... they're mapped to lowercase characters before they reach dns
... O with two dots is converted to a lowercase version before it gets sent out
... it gets converted with an ascii binding with something called punycode

[ Slide: IDNA 2008 ]

scribe: about 3 years ago there was an effort to revise it
... it updates to the latest version of unicode
... and makes the system unicode version independent
... but it invalidates certain urls
... uppercase letters are invalid
... it removes a class of symbols and punctuation characters
... and it makes certain classes of characters not equivalent to other expansions
... IDNA 2008 is not yet approved

[ Slide: ISSUES ]

scribe: this causes problems for browser vendors
... which need to retain compatibility with pages using IDNA2003
... need to match user expectations
... it causes problems for search engine vendors
... need to match old and new browsers
... need to match old and new expectations

[ Slide: UTS46 - Compatibility "Bridge" ]

scribe: It enables everything that was allowed in 2003 with the same behavior
... it allows the new stuff allowed from 2008
... it has different things for lookup/display

display: ß, lookup: ss

[ Slide: Compatibility for Transition ]

scribe: aimed at client SW, not registries
... allows client SW to handle both 2003 and 2008
... consensus from browsers and search
... I'll send the slides to IanJ

IanJ: thank you


IanJ: thank you for your good work at unicode
... you mentioned hot controversies

Mark Davis: ...

scribe: there are controversies
... I'll introduce Eric Vanderpool (?)
... Michel Suignard
... one of the coauthors of the IRI spec
... a key issue is the compat difference between the 2003 and 2008 spec
... we've been trying to walk a delicate line
... while not trying to stomp on the IETF toes
... because it's their spec

Diane: ... ...
... If I own one, name sparkasse-gießen.de
... can you squat on sparkasse-giessen.de

Mark Davis: ...

scribe: you can't reserve 'sparkasse-gießen.de'
... it's like case

Doug: ...
... about the heart case (I❤NY.blogspot.com)

Mark Davis: That will resolve to an all lowercase version

scribe: If you were using a browser that implemented IDNA 2008 strictly
... it will fail

questioner: ...
... so the issue about uppercase
... does that mean that you can't type www.APPLE.com?

Mark Davis: no...

scribe: it's limited to IDN cases

<dom> (http://I♥NY.blogspot.com/ resolves to http://xn--iny-zx5a.blogspot.com/ in my FF3.5)

Doug: what's the goal in not making it work?

Mark Davis: that's part of the controversy

<smfr> Safari goes to http://i♥ny.blogspot.com/

scribe: it was bad to show something that was other than what was being resolved to

Robin: so what's with the heart?

Mark Davis: well symbols and punctuation look to close to other things

scribe: We dropped ~3000 such characters
... We dropped ~4000 characters relating to ÖBB.at
... For a lot of us, this didn't really solve the problem

Doug: so it doesn't limit you to non mix ranged characters?

Mark Davis: ...

scribe: there are a number of guidelines in Unicode 36
... the problem is that there are a number of cases where it's needed and customary
... such as mixing Japanese and Latin
... and distinguishing legitimate from others
... and over time, browsers are solving the problems

Rohit: ...
... regexps that pigeon parses urls ... will that break?

Mark Davis: ... you need to replace the dot with the character class

Rohit: are you familiar with the ipv6 handling in urlbars
... and how long it took before it was implemented?

Mark Davis: most stuff users do should work

scribe: but sure the servers will break and have probably been broken since 2003

Tom: ...
... this is at which level?

Mark Davis: this is all handled at the browser level

scribe: punycode ... was adam costello's pun
... as far as dns is concerned, it's all xn--...
... the routing/dns system doesn't see this
... the browsers basically get to agree with this standard

Richard: ...

<IanJ> [Richard Ishida]

Richard: what if i have a heart
... what you've been describing is something which does a transformation of these strings
... if i understand this correctly
... you will continue to use this
... we've been working with all the browser representatives and search engine companies to handle this

xx-4: from hp
... you've alluded to phishing attacks
... what's the status

Mark Davis: ...

scribe: everyone has some approach for dealing with this
... but it isn't consistent
... I think it's a bad idea to standardize too early
... there are a lot of holes before we come up with a cohesive solution

IanJ: thank you


Leslie Daigle: Internet Ecosystem Health

Leslie's slides (originals)

IanJ: Next Leslie Daigle @ ISOC

Leslie: ... talk/pres/discuss/...

[ Slide: The Internet - Evolution and Opportunity ]

[ Slide: The Internet Society ]

scribe: Founded in 1992
... 100 members, 90 chapters ...
... promoting/sustaining internet as a platform for innovation

[ Slide: Internet Evolution ]

scribe: Incremental changes
... seven layers
... independent building blocks
... flexible + responsive
... impossible to nail up a global deployment plan

[ Slide: An external pressure ... IP addresses ]

scribe: Running out of IPv4 addresses
... last allocation from IANA predicted for Oct 2011

<rohit> apologies for interrupting the scribe, but I wanted to share a link for the dumb-app-guy question I asked earlier:

scribe: last allocation to ISP anywhere, predicted for Feb 2013
... Lots of IPv6 addresses

<rohit> http://drupal.org/node/368472 -- an example of sw currently broken and the very first request from the devs was for a regex :)

scribe: it's not going to be an ipv6 internet before the last ipv4 address is handed out

<rohit> viz "valid_url() marks correct IDN domains as invalid"

scribe: more NATs

[ Slide: Implications above the IP Addressing Layer ]

scribe: IPAffinity breaks!
... a recent roundtable of industry leaders we held included reps from Google, Yahoo, Akamai, Netflix, and Comcast
... discussed impending impact on geolocation, geoproximity, management of distribution of copyrighted materials
... http://www.isoc.org/educpillar/resources/docs/ipv6_200905.pdf
... Multiple open streams breaks!
... sharing addresses => fewer ports => ajax apps have troubles
... poor performance of web pages, e.g. Google maps
... users see google maps tiling in slowly
... users don't blame the network, they blame the server

[ Slide: Responses to the IP addressing situation]

scribe: major ISPs and content providers are including ipv6 in their current deployment plans
... wireless broadband LTE has IPv6 baked in

[ Slide: Opportunities in the IP Addressing Situation ]

scribe: make sure your web servers are ipv6 capable
... don't write ipversion specific apps
... with ipv6 you can imagine a world where everything is uniquely addressable
... example of problems ...
... Opera tries to outsmart OS
... if it finds ipv6 address it will use it
... whereas vista might know to fail over to an ipv4 tunnel
... but it can't because opera didn't let it decide

[ Slide: Another external pressure - Unwanted Traffic ]

[ Slide: Responses to Unwanted Traffic ]


scribe: no final conclusion

[ Slide: Alternatives? ]

scribe: top down imposition of security doesn't fit the Internet
... the internet is a "network of networks"

[ Slide: Security Tools Must Address Total Threat Model ]

[ Slide: Different Security Mechanisms Are Needed for Different Threats ]

[ Slide: Too Much Security Technology Impedes Usage, without Reducing Bad Behavior ]

[ laughter ]

[ Slide: One building block: DNSSEC ]

scribe: secure results from domain name servers
... so you can be sure whatever you get back from dns is what the dns server intended to send you
... tamper proof packaging on dns responses
... this doesn't prevent phishing
... it doesn't encrypt the data in the response

[ Slide: DNSSEC opportunities ]

scribe: with DNSSEC you have a better platform for confidence in dns
... dnssec is deploying rather slowly
... I've referred to these in other contexts as broccoli technologies
... you should eat it, but it's better with a cheese sauce
... but there's no cheese sauce


Phillip (Cisco): ...

scribe: when do you think ISPs will deliver IPv6 connectivity?

Leslie: ...
... some soon in Europe, and a few maybe in the US
... I think it's fair to say of the service providers thinking about it
... they will have it deployed before *they* run out
... this is slightly better than before when it was like "yeah, we have it in our research lab"

Tom: you mentioned an ISP
... what specific one?

Leslie: of the list I have here, Comcast is the access one

Mark: Have you seen a hoarding of ipv4 addresses?

Leslie: I think some have retirement plans by auctioning them off
... In principal the regional providers have fairly strict releases of addresses
... the problem is that we're going to run out

Doug: ...
... I asked about a tutorial
... I still think you need a tutorial
... with a tweetable domain name

Leslie: yeah, that'd be great


scribe: part of the challenge is that everyone's problem is different
... at some point, we'll figure out the commonalities
... we're trying to get some of the ones who have done it in a room with some who haven't
... so they can share knowledge

dbaron: David Baron, Mozilla
... in what would you like to do with DNSSEC
... none of this is speaking for mozilla
... there are certain things i'd like to be able to do with dnssec
... among them is putting public keys in dns

<shepazu> put i18n urls in Acid4 :)

dbaron: to avoid using a CA
... another is putting email autoconfig information into dns
... another is to put a default https flag
... to say "foo.com" should go to "https://foo.com" instead of "http://foo.com"

Leslie: thanks for thinking about the questions
... in terms of where to go with them
... some of them are pursued within IETF
... particularly, some levels of email, e.g. domain keys
... to say "this is the server allowed to send email for this domain"
... so the IETF is the right place to go for a lot of this

Kevin: ...
... what would i like to do if i had lots of addressable points
... i'd like to setup servers on my own machines
... without proxies

Leslie: yes
... it'd be good if people would stand up and say that loudly

Kevin: we've seen this problem with real time flow

Diana: ...
... what would i do if i had lots of addresses
... what if i was a washing machine
... what if i was an animal owner
... and i put a chip in each one
... or a hospital owner
... and i wanted chips in patients
... i think ...
... I think we'll run out of ipv6 within 10 years

Tom: who is the definitive place for ipv6

Leslie: all of them

IanJ: thanks Leslie


Kevin Marks: OpenID, OAuth, OpenSocial

Kevin's slides

<scribe> ScribeNick: IanJ

Speaker: Kevin Marks on OpenID, etc.
... open social web standards

<dom> [note that JessyInk provides similar effects as Prezi in SVG]

KevinMarks: How I got to this point.
... the problem is Babel
... see the "Map of Online communities and related points of interest"

(one example: http://uzar.files.wordpress.com/2007/06/online_communities11.png)

KevinMarks: Histogram your users...people use 12345 and 90210 when they are lying to you :)

<timeless> http://www.academiccommons.org/commons/showcase/map-online-communities

KevinMarks: You have to give people a reason to @@
... Open social builds on existing infrastructure
... Defining an API for your favorite programming language...as long as it's javascript.

Open social v0.8 enabled new client and programming models by adding server to server protocols.

<caribou> [original pic at http://xkcd.com/256/]

KevinMarks: Over 1 billion users of open social stuff.
... developing REST APIs.
... Challenge is to identify "me"...people accustomed to identify selves via HTTP URIs
... WebFinger(email) -> URI
... Next think you want to know is "my friends"
... Portable contacts....vcard + some useful fields used by most of the social networks.

<smfr> vcard

KevinMarks: what we do....(photos, etc.)
... the model underneath that is "feeds" but those were designed for blogs.
... Activity Streams codify "actions" (that were not part of feed design)
... Notion of "flow" ...atom pub (posting; and equivalent JSON APIs)...and newer: pubsubhubbub
... a way to get around the feed polling problem.
... you don't check the feed ever N cycles...you get a post when the feed changes.
... Salmon builds on those ideas....codifies "going back up the stream and down again"
... A big chunk of the challenge is to get delegated login.
... didn't get you that much...
... not much improvement to actual user experience.
... but now we have more to help solve form-filling problem.
... you can make a business case now for using the APIs rather than creating yet-another-UI
... we are starting to see this implemented
... you can delegate your logins to the site...will go to site and get not just user identify, but richer identity as well.
... not quite convergence, but we are trying to pull them together (from different site approaches)
... OAuth is a way of issuing tokens.
... you do an HTTP request; knows who you logged in as and your creds; gives you back things you have right to.
... replaces cookies; state management doing in RESTful fashion
... google and yahoo offer this for all their services; twitter likely to as well
... empirical standards (as we experienced with microformats)
... focused on agreement rather than completeness.
... "t-shirt not a suit"
... "good enough standard"
... example of portable contacts.
... we looked at social networks and what they have in common.
... activity stream stuff...we have enough social network sites...what actions are they taking that is common enough to build a vocabulary

[end of overview of the space]

scribe: ad hoc realm.

IJ: Have you taken some to IETF?

KevinMarks: Yes.
... We've set up foundations...but then created OWF.
... as a foundation factory...to do all the legal stuff that you have to do...so you could use this in other places...model was the Apache foundation...but to do for specs what Apache does for code.
... I've worked in video standards before...didn't seem in these cases to have the same patent thicket.

Dan Appelquist (Vodafone): How would you compare this approach to integrating social networks to one based on XMPP?

KevinMarks: Bits and pieces around that.
... there's some overlap and some you can bridge through.
... a lot of this came from open social experience...and part was moving through their comfort zone.
... there's nothing stopping you from sending this over XMPP (as transport)

DanA: I ask because I have heard a view expressed -- isn't all of this retrofitting onto existing web sites something that could be done with a different approach?

KevinMarks: pubsubhubbub stuff closest to xmpp...
... there's some similarity, but a lot was about web developers writing web stuff....but that is changing...
... I think a lot comes down to tastes.
... You can build bridges...there are also cultural tastes among programmers.
... for some, dynamic programming languages not scary, for others it may be.

DanA: In the social web incubator group meeting we held this week, we spent a lot of time talking about user stories
... I'm a user on one social network; I want to create a friend connection to someone on another social network.
... how would you do that?

KevinMarks: When we defined open social, it was with one site in mind.
... but we are now at the point where it's becoming more important....xfn in microformats.
... that works like crawling foaf works.
... many sites have mixes of public and private...you can't just use a crawler over public data.

<tantek> crawling XFN works like that today, using HTML <a href> today

KevinMarks: you need to be able to provide access control.

<tantek> OAuth provides the access control for private data

KevinMarks: there are still some issues sorting out assertions from multiple parties.
... there may be some bindings I can make that you may not want to become public.
... we've punted on some of the stickiness...we addressed some issues first (such as "no more forms asking for personal data")
... the delegation part becomes important.
... about 2000 twitter apps now.
... because you can delegate into it the list of people you are interested in.
... we are trying to correlate patterns in various apps and get commonality.

timbl: When you want to aggregate cal info there are two ways (1) go to a site or (2) run something on your laptop that goes to fetch info.
... if you run on your laptop you don't have delegated authentication. No site knows everything about you.
... you don't give one site access to stuff, where another site might be confused about access boundaries.
... how do you see competition between cals on desktops and sites going in the future?

KevinMarks: I would hope we could use the same protocols for both.
... I can't get a remote site to call me back on my laptop..I have to open the connection first.
... I have to do those things over a "hanging GET" from the browser.
... rather than opening ports to listen to things
... that militates towards going to the site.

timbl: if you are a native desktop app, you can open a port.

KevinMarks: It's a NAT problem.

(e.g., from a cafe)

KevinMarks: That's driving people to web services that feed info through.
... services can use sms, email, other protocols.
... Once we can put up servers again (with ipv6), that will help.

timbl: I think a lot has been architected differently because of NAT.

KevinMarks: Bittorrent is arguably a layer that tries to game TCP.

rohit: a couple of the big open id scares (some since resolved) hover around this issue.

KevinMarks: A big chunk of this is constraining delegation to what is "should be."
... may not be better, but is better than name/password and associated.


John Schneider: EXI

<marie> timeless++

John: Efficient XML Interchange
... Sometimes you need just the right problem to kick you to the next level of evolution.
... web is always evolving to new places.
... part of what EXI is meant to do is take the Web/XML to new places.

<KevinMarks> my prezi is at http://prezi.com/c2hwhoqdmlfj if you can pardon my Flash

John: XML has been wildly successful: communities, vendors, open source


scribe: we want to make it easier to use xml in environments with bandwidth/space limitations.
... people wanted to be able to tap into communities and tools...30 or so binary xml technologies that popped up.
... diversity is good for evolution but not particularly good for interop.
... created EXI WG
... at first, nobody believed.
... we brought experts together...9 months later and 147 pages of analysis, found one!

[EXI Benchmarks]

scribe: lots of other specs published at w3c...will give interop across a broad set of use cases.
... a lot of the people behind this were the people previously competing...fracturing of marketplace going away.
... we are looking at one good solution.
... source is info theory and formal language theory
... the results are great:

- bandwidth utilization

- faster processor speeds

- greater battery life

scribe: simultaneously optimizes a lot of things

....we wanted to see how compares to compression....lots of test cases...better in every case and faster

...if you compare to packed binary formats, it consistently beats those as well

very efficient way to share data in general.

[demo time]

real world example to send 1M data to an aircraft

With EXI was 1 second.

Without EXI 2:23

...there is some processing time on the other end.

...but it's not compression...you process it faster on the other end, too

Minutes formatted by David Booth's scribe.perl version 1.135 (CVS log)
$Date: 2009/11/16 17:59:55 $