- Dillo-dev - lists.mailman3.com

want to test some experimental cookies code?

by jcid＠dillo.org

On Tue, Jan 05, 2010 at 09:12:39PM +0000, corvid wrote: > In recent days, I've been making a version of cookies dpi that > follows the current cookies draft of the http state working group. > > I haven't tested it exhaustively yet, but if anyone who uses > cookies wants to try it and watch the msgs and so on, let me know. > > > As for how much validity or meaningfulness this draft has, let's see... > - They've made the decision to describe the way things currently behave, > having learned from the bitter experience of others who made RFC 2109 > and RFC 2965*. > In 2010, no one has any way to be King of Cookies. They write testcases and > try all of the major browsers and decide what they want to write down in > their spec when there are differences. > - On their mailing list, from the user agents, they have an opera guy, the > curl guy, and someone related to firefox, although I didn't take any notice > of whether he has a position of authority in firefox or not. > - Of course there will be changes. Smallish, I think. > > > A cookie set without an explicit domain goes only to that domain. > A cookie with a domain attribute is sent to that domain and any subdomain. > A .domain attr cookie can go to domain. > As for how to decide to reject cookies for, e.g., .co.uk, I don't think they're > ever going to say too much. > > A cookie can be set for any path, regardless of the url path of the page > setting it. > Paths are matched when selecting cookies to return, though. > Path-matching does work by slashes instead of simple prefixes. > > An http page can set a secure cookie (just like currently). > > An example of the little things that may change are that a cookie that is > just VALUE instead of NAME=VALUE is currently allowed, but it's not decided > for good yet. There are corner cases such as this that maybe they could > make illegal without rendering themselves irrelevant. > > > * To be precise, the main author of the RFCs has written that it was at > least initially reasonable to think that what they were putting together > in rfc 2109 would be adopted by user agents. AFAIS, you're our cookies expert now. Please feel free to replace the current dpi when you see net gain. -- Cheers Jorge.-

Jan. 9, 2010

Re: even more cookies SECURITY

by jcid＠dillo.org

Hi, I want to start this 2010 year thanking all the people that have contributed to make Dillo what it is. It's been 10 years and a long way lays behind. Lots of people have shared their time/work/advice/help/money/. After all, what we have now is the addition of all those efforts. Thanks to you all!!! On Mon, Jan 04, 2010 at 11:38:03PM +0000, corvid wrote: > Do we currently have anything that needs to be > fixed/implemented before a release would be sensible? Not that I remember. The only problem I recall was the error message you reported with cookies and later seemed to be working somehow. Besides, AFAIS the repo is stable enough to start rolling the release process. BTW, the cookie story is frustrating. Generally speaking: vested interests strive to kill commodity technologies to introduce their own and henceforward profit monopoly-like. This happens everywhere in the area we deal with e.g. HTTP, HTML, SGML, XML, scripting, flash, java, video streams, audio, cookies, AJAX, etc. Remember that not even the big players were able (nor willing) to implement the SPECS they co-designed. Dillo's game so far had been to support a subset with emphasis on efficiency and privacy. The game is never solved, the point is to decide well where to prune (see bottom line). Speaking of technology: Ten years ago it was images and tables, the FTP, then CGI, then cookies (the stateless HTTP, now with state), then frames (which faded 5 years later), then SGML (which was replaced by XML), then XML (which never succeeded over HTML tag soup). Then CSS (which is necessary these days. Despite IE never gave much for it). Somewhere in the middle there was java (and java beans), but it died. Then Flash, then AJAX, then silverlight, the cloud... IMHO, beyond the hyped technologies "du jour", Dillo is relevant as long as it's able to serve as an efficient information gathering tool, with emphasis on privacy. -- Cheers Jorge.-

Jan. 9, 2010

Doctree changes

by Johannes.Hofmann＠gmx.de

Hi, I just committed a modification of the Doctree class which is used for CSS matching. Before it was just an interface that was implemented by StyleEngine. Now it is a real class that is used by StyleEngine. I hope the new origanization makes things a bit clearer. It also avoids virtual method calls in the performance critical CSS matching path. To me it seems that complex pages render a bit faster now, but I did not make any proper measurements. Cheers, Johannes

Jan. 7, 2010

Query on interfacing IMX27 keyboard with Dillo browser.

by newman.x＠gmail.com

On Thu, Jan 7, 2010 at 4:48 PM, corvid <corvid(a)lavabit.com> wrote: > (Trying firefox now, I see that I can't type tabs into textareas; > it always takes me to the next focusable element. I'm a bit surprised.) It always been this way. I remember Konqueror allowed me to insert Tab the usual way and one was also able to disable this behavior via Preferences or context menu.

Jan. 7, 2010

Query on interfacing IMX27 keyboard with Dillo browser.

by corvid＠lavabit.com

Rajesh wrote: > I am using Dillo as a browser on IMX27 system. (working with > latest CVS LTIB code). I wanted to interface imx27 > Keyboard with the browser so that the UP/DOWN/etc. keys work on the > browser pages. > I have been using this with Touchscreen and I wanted to know if the > Keyboard can be interfaced too. > > Presently, I saw that on any Linux installation with Dillo on it, only mouse > works as mouse can be moved from one link to other link. But keyboard was > not working. I would want to make the Keyboard UP/DOWN arrows take me up and > down the links on a page in the Dillo browser. Is it possible to do this ? Not currently. I've sort of idly considered what it might take to be able to tab between the various links and form controls, but was stopped by "Hmm, how would you know to break out of a <textarea> again?". (Trying firefox now, I see that I can't type tabs into textareas; it always takes me to the next focusable element. I'm a bit surprised.)

Jan. 7, 2010

Query on interfacing IMX27 keyboard with Dillo browser.

by rmarathe11＠gmail.com

Hello, I am using Dillo as a browser on IMX27 system. (working with latest CVS LTIB code). I wanted to interface imx27 Keyboard with the browser so that the UP/DOWN/etc. keys work on the browser pages. I have been using this with Touchscreen and I wanted to know if the Keyboard can be interfaced too. Presently, I saw that on any Linux installation with Dillo on it, only mouse works as mouse can be moved from one link to other link. But keyboard was not working. I would want to make the Keyboard UP/DOWN arrows take me up and down the links on a page in the Dillo browser. Is it possible to do this ? regards, Rajesh Marathe.

Jan. 7, 2010

want to test some experimental cookies code?

by corvid＠lavabit.com

In recent days, I've been making a version of cookies dpi that follows the current cookies draft of the http state working group. I haven't tested it exhaustively yet, but if anyone who uses cookies wants to try it and watch the msgs and so on, let me know. As for how much validity or meaningfulness this draft has, let's see... - They've made the decision to describe the way things currently behave, having learned from the bitter experience of others who made RFC 2109 and RFC 2965*. In 2010, no one has any way to be King of Cookies. They write testcases and try all of the major browsers and decide what they want to write down in their spec when there are differences. - On their mailing list, from the user agents, they have an opera guy, the curl guy, and someone related to firefox, although I didn't take any notice of whether he has a position of authority in firefox or not. - Of course there will be changes. Smallish, I think. A cookie set without an explicit domain goes only to that domain. A cookie with a domain attribute is sent to that domain and any subdomain. A .domain attr cookie can go to domain. As for how to decide to reject cookies for, e.g., .co.uk, I don't think they're ever going to say too much. A cookie can be set for any path, regardless of the url path of the page setting it. Paths are matched when selecting cookies to return, though. Path-matching does work by slashes instead of simple prefixes. An http page can set a secure cookie (just like currently). An example of the little things that may change are that a cookie that is just VALUE instead of NAME=VALUE is currently allowed, but it's not decided for good yet. There are corner cases such as this that maybe they could make illegal without rendering themselves irrelevant. * To be precise, the main author of the RFCs has written that it was at least initially reasonable to think that what they were putting together in rfc 2109 would be adopted by user agents.

Jan. 5, 2010

table/cursor oddity

by Johannes.Hofmann＠gmx.de

On Mon, Jan 04, 2010 at 01:19:37AM +0000, corvid wrote: > A little bug that I just stumbled upon. > > <table border=1> > <tr><td style="cursor:help">one<td style="cursor:wait">two<td>three > <tr><td colspan=3>row > </table> > > The style of the first td seems to be the style of the whole table. > > (I wasn't surprised that the text has the default cursor, since I > know there's that weirdness with wordStyle and regular style. > Speaking of which, is it spelled out anywhere what is going on with > that exactly? I know there have been times when I've been in the area > of the table code and some reason why it's necessary has become clear, > but I don't think I've ever had the whole shape of the matter in my head.) > > Hmm. I just changed the first td to style="cursor:help; color:red", > and it colored the first td correctly, and now the rest of the table > shows the wait cursor. Interesting. Should be fixed now. Turned out to be a stupid bug in style.cc.

Jan. 5, 2010

css :visited and security

by Johannes.Hofmann＠gmx.de

On Tue, Jan 05, 2010 at 03:36:24PM +0000, corvid wrote: > The other day, I saw another of those pages about using :visited and > display in order to allow others to learn whether the user has visited > a page. (I remember Johannes pointing to a page about this last year, too.) > > I wonder whether it would be sensible to have a dillorc option defaulting > to NO for whether to use :visited. Yes, that sounds good. We should distinguish between remote / embedded CSS and user agent and user stylesheet though. For the latter two we don't need any restrictions. We might also do some other restrictions on remote CSS in the future, e.g. possible dillo specific extensions should also be only accessible via the user agent and user stylesheet.

Jan. 5, 2010

css :visited and security

by corvid＠lavabit.com

The other day, I saw another of those pages about using :visited and display in order to allow others to learn whether the user has visited a page. (I remember Johannes pointing to a page about this last year, too.) I wonder whether it would be sensible to have a dillorc option defaulting to NO for whether to use :visited.

Jan. 5, 2010