Re: Intent to implement and ship: rel="noopener" on links

2016-05-03 Thread Boris Zbarsky
On 4/25/16 10:47 PM, Boris Zbarsky wrote: Ah. Perhaps we should hold off on doing this until https://bugzilla.mozilla.org/show_bug.cgi?id=1257849 is fixed then. And the window.open thing would still not be detectable, so people would probably start assuming the anchor bit implied the window thi

Re: Intent to implement and ship: rel="noopener" on links

2016-04-25 Thread Boris Zbarsky
On 4/25/16 10:31 PM, Domenic Denicola wrote: On Monday, April 25, 2016 at 2:09:07 PM UTC-4, Boris Zbarsky wrote: 1) This is not feature-detectible, as far as I can see. So it's not clear to me that sites will know they can use this, short of relying on browser sniffing. If you implement DOMT

Re: Intent to implement and ship: rel="noopener" on links

2016-04-25 Thread Domenic Denicola
On Monday, April 25, 2016 at 2:09:07 PM UTC-4, Boris Zbarsky wrote: > 1) This is not feature-detectible, as far as I can see. So it's not > clear to me that sites will know they can use this, short of relying on > browser sniffing. If you implement DOMTokenList.prototype.supports, it should be

Re: Intent to implement and ship: rel="noopener" on links

2016-04-25 Thread Boris Zbarsky
On 4/25/16 2:57 PM, Tanvi Vyas wrote: Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1267339 I think you meant to link to bug https://bugzilla.mozilla.org/show_bug.cgi?id=1222516 here. Er... right you are. Too many identical-looking tabs. ;) -Boris __

Re: Intent to implement and ship: rel="noopener" on links

2016-04-25 Thread Tanvi Vyas
Very cool! Thanks for implementing. On 4/25/16 11:09 AM, Boris Zbarsky wrote: Summary: The idea is to be able to write Go there and not have "someone-I-don't-trust" be able to get hold of your window via window.opener. This is already possible with rel="noreferrer", but that also preve

Intent to implement and ship: rel="noopener" on links

2016-04-25 Thread Boris Zbarsky
Summary: The idea is to be able to write Go there and not have "someone-I-don't-trust" be able to get hold of your window via window.opener. This is already possible with rel="noreferrer", but that also prevents sending a referrer, which is undesirable in cases like search engine result