Re: Intent to ship: WebCrypto API

2014-09-05 Thread Henri Sivonen
On Thu, Sep 4, 2014 at 6:29 PM, Ehsan Akhgari ehsan.akhg...@gmail.com wrote: On 2014-09-04, 4:42 AM, Anne van Kesteren wrote: On Wed, Sep 3, 2014 at 7:36 PM, Tim Taubert ttaub...@mozilla.com wrote: Chromium has had the WebCrypto API enabled by default since Crome 37, which was released in

Re: Intent to implement and ship: ImageCapture

2014-09-05 Thread Henri Sivonen
On Wed, Sep 3, 2014 at 12:15 PM, Alfredo Yang ay...@mozilla.com wrote: Summary: Allow web authors to take photo via gUM video track. Does this have the same privacy protections as current gUM? Is current gUM restricted to authenticated origins? If it isn't, is it realistic to restrict it to

Re: Intent to implement and ship: ImageCapture

2014-09-05 Thread Robert O'Callahan
On Fri, Sep 5, 2014 at 10:19 PM, Henri Sivonen hsivo...@hsivonen.fi wrote: Does this have the same privacy protections as current gUM? Yes. You can only use this on a stream you've already acquired (e.g. via current gUM, but other APIs also produce streams). You can already shunt a MediaStream

Restricting gUM to authenticated origins only (was: Re: Intent to implement and ship: ImageCapture)

2014-09-05 Thread Henri Sivonen
On Fri, Sep 5, 2014 at 1:25 PM, Robert O'Callahan rob...@ocallahan.org wrote: On Fri, Sep 5, 2014 at 10:19 PM, Henri Sivonen hsivo...@hsivonen.fi wrote: Is current gUM restricted to authenticated origins? If it isn't, is it realistic to restrict it to authenticated origins? That's a good idea

Re: Restricting gUM to authenticated origins only (was: Re: Intent to implement and ship: ImageCapture)

2014-09-05 Thread Robert O'Callahan
On Fri, Sep 5, 2014 at 10:34 PM, Henri Sivonen hsivo...@hsivonen.fi wrote: On Fri, Sep 5, 2014 at 1:25 PM, Robert O'Callahan rob...@ocallahan.org wrote: On Fri, Sep 5, 2014 at 10:19 PM, Henri Sivonen hsivo...@hsivonen.fi wrote: Is current gUM restricted to authenticated origins? If it

Re: Restricting gUM to authenticated origins only (was: Re: Intent to implement and ship: ImageCapture)

2014-09-05 Thread Eric Rescorla
On Fri, Sep 5, 2014 at 3:34 AM, Henri Sivonen hsivo...@hsivonen.fi wrote: On Fri, Sep 5, 2014 at 1:25 PM, Robert O'Callahan rob...@ocallahan.org wrote: On Fri, Sep 5, 2014 at 10:19 PM, Henri Sivonen hsivo...@hsivonen.fi wrote: Is current gUM restricted to authenticated origins? If it

Re: Review Board Preview

2014-09-05 Thread Ehsan Akhgari
This is fantastic! Thanks for all of the team effort here. Everyone, please take a few minutes to check this out. Seriously. :) On 2014-09-04, 8:57 PM, Mark Côté wrote: I know lots of people are very interested in the on-going project to replace Splinter with a modern code-review tool.

Re: Deferred display of XUL panel containing embedded iframe

2014-09-05 Thread Yonggang Luo
I was also insert a iframe into panel, but the problem that i faced is the autohide doesn't works, the panel act like this: it's weirdly calling the hidden and show event, that's should not be happen. ___ dev-platform mailing list

web-platform-tests now running in automation

2014-09-05 Thread James Graham
The web-platform-tests testsuite has just landed on Mozilla-Central. It is an import of a testsuite collated by the W3C [1], which we intend to keep up-to-date with upstream. The tests are located in /testing/web-platform/tests/ and are now running in automation. Initially the testsuite,

Re: web-platform-tests now running in automation

2014-09-05 Thread Kyle Huey
On Fri, Sep 5, 2014 at 8:55 AM, James Graham ja...@hoppipolla.co.uk wrote: The web-platform-tests testsuite has just landed on Mozilla-Central. It is an import of a testsuite collated by the W3C [1], which we intend to keep up-to-date with upstream. The tests are located in

Re: web-platform-tests now running in automation

2014-09-05 Thread Boris Zbarsky
On 9/5/14, 11:55 AM, James Graham wrote: The web-platform-tests testsuite has just landed on Mozilla-Central. This is fantastic. Thank you! Does this obsolete our existing imptests tests, or is this a set of tests disjoint from those? -Boris ___

Re: web-platform-tests now running in automation

2014-09-05 Thread James Graham
On 05/09/14 18:00, Boris Zbarsky wrote: On 9/5/14, 11:55 AM, James Graham wrote: The web-platform-tests testsuite has just landed on Mozilla-Central. This is fantastic. Thank you! Does this obsolete our existing imptests tests, or is this a set of tests disjoint from those? I think

Re: Restricting gUM to authenticated origins only

2014-09-05 Thread Chris Peterson
On 9/5/14 4:39 AM, Henri Sivonen wrote: * Geolocation In principle, I think geolocation should be restricted to authenticated origins. Unfortunately, it might be too late compatibility-wise to do that at this point. Also, since the geolocation responses are easily proxied over postMessage, I

Re: Restricting gUM to authenticated origins only

2014-09-05 Thread Ehsan Akhgari
On 2014-09-05, 4:37 PM, Chris Peterson wrote: On 9/5/14 4:39 AM, Henri Sivonen wrote: * Geolocation In principle, I think geolocation should be restricted to authenticated origins. Unfortunately, it might be too late compatibility-wise to do that at this point. Also, since the geolocation

Re: Restricting gUM to authenticated origins only

2014-09-05 Thread Chris Peterson
On 9/5/14 2:38 PM, Ehsan Akhgari wrote: Google Maps and Yahoo Maps use HTTPS, but MapQuest and Bing Maps use HTTP. Before we could restrict geolocation to authenticated origins, we would need to convince Microsoft and MapQuest to use HTTPS (or whitelist their sites). Those are not the only

Re: Restricting gUM to authenticated origins only

2014-09-05 Thread Ehsan Akhgari
On 2014-09-05, 5:46 PM, Chris Peterson wrote: On 9/5/14 2:38 PM, Ehsan Akhgari wrote: Google Maps and Yahoo Maps use HTTPS, but MapQuest and Bing Maps use HTTP. Before we could restrict geolocation to authenticated origins, we would need to convince Microsoft and MapQuest to use HTTPS (or

Re: web-platform-tests now running in automation

2014-09-05 Thread Boris Zbarsky
On 9/5/14, 11:55 AM, James Graham wrote: Instructions for performing the updates are in the README file [2]. There is tooling available to help in the update process. Is there a way to document the spec or test suite bugs in the expectations file? e.g. if I want to add an expected: FAIL and

Re: Restricting gUM to authenticated origins only

2014-09-05 Thread Martin Thomson
One idea that has been floated (https://bugzilla.mozilla.org/show_bug.cgi?id=1002676) is to restrict persistent permissions to secure origins. The reasoning there being that a persistent grant can be trivially intercepted if you work in the clear. That's a real security concern. One that