om2

20 ms·

181.
by om2 7y ago
Is there a test suite?
182.
by om2 7y ago
The actual functionality exposed is close enough that cross-compiling is a solvable problem. But fair point. (On the flip side, having two syntactically very similar but actually different things can be dangerous, as it may lead devs to thi
183.
by om2 7y ago
Sorry, I meant WebGL, simply mistyped. As far as posting blog posts, we think this is just as fair as the Chrome team's communication about their own WebGPU implementation, which included a public demo and sessions at Google I/O w
184.
by om2 7y ago
The only thing that already exists that is provably web-safe is the WebGL dialect of GLSL (which no one seems to like). WebSPIR-V would be based on SPIR-V but in many ways has to be a new thing as well. Edit: I originally said "WebGPU
185.
by om2 7y ago
You may not like it but it's pretty clear that WSL is at least a starter. It has a spec, a test suite, and an implementation (which fully implements safety). And the implementation is pretty fast, and should at least dispel WSL vs SPIR
186.
by om2 7y ago
I was there for one of the times that Phil (from Apple) explained dominator analysis and why it's an added complexity of a binary language. Phil is the architect of our JS VM and one of the main designers of WSL so I think he knows! Yo
187.
by om2 7y ago
The proposal from SPIR-V advocates is to not ship any high level language compiler with the browser. That could change, but currently no one is excited about accepting both a binary language and a text-based language.
188.
by om2 7y ago
Others have explained why it's relevant (this is the recommended solution for online shader generation from SPIR-V advocates.) But there's also a direct comparison of WSL vs SPIR-V wire size in he same graph, for cases where SPIR-
189.
by om2 7y ago
Many of the techniques used in modern JS VMs like v8 or JavaScriptCore could totally be applied to a Python interpreter, and it wouldn't take 50 people. Someone just needs to invest the effort. The core techniques are a fast-start inte
190.
by om2 7y ago
It says “identity”, not cookies. Maybe it means cookies are partitioned. Maybe it means some new form of identity token is created (Googles have proposed them at various times) and is partitioned, but cookies are blocked. Maybe it means new
191.
by om2 7y ago
Google’s proposal sounds simple because it is vague, does not address all the ways websites can track you, and does not address all the possible compatibility problems with partitioning. WebKit’s policy (and more importantly our code) are w
192.
by om2 7y ago
Fortunately, they have an issue tracker and a documented update process: https://github.com/publicsuffix/list/wiki/Guidelines
193.
by om2 7y ago
Safari with ITP enabled blocks cookies on those font-related resources. But because of other browsers, it's not very nice to send cookies on those resources in the first place.
194.
by om2 7y ago
Sounds like we need to expand WebKit's implementation of Storage Access API to cover LocalStorage.
195.
by om2 7y ago
It could, but access through these various CNAMEs would not give it stateful cross-site tracking ability, since each would be a different Origin. It would be providing a hosted first-party analytics/ads/whatever service within the
196.
by om2 7y ago
The linked page is primarily based on tech in the WebKit open source tree. However, some protections depend on support in underlying layers. WebKit's strategy is to use the platform-native versions of things like the network stack and
197.
by om2 7y ago
It is still possible to make changes that are mostly reusable for both, but it takes some effort, and some parts (JS engine, multiprocess architecture) are so different that you just have to write it twice.
198.
by om2 7y ago
If you logged into Medium with that account, then Medium would know, and could tell the I frame. But if you didn’t, then the iframe shouldn’t know your user ID unless you click and allow access, at least in Safari.
199.
by om2 7y ago
Sign In With Apple has the same level of access as any other OAuth-based federated login scheme. The popular login services from Facebook and Google work fine in Safari. As others have mentioned, the way they are built does not require cros
200.
by om2 7y ago
This is roughly how the Google safe browsing list for anti-phishing/malware is distributed (except with chunks and multiple levels of hashing).
201.
by om2 7y ago
We have mixed feelings about this. Most people could probably figure out that google.com and google.co.uk are owned by the same entity. And probably many people are aware that youtube.com and google.com are related. But some entities own hu
202.
by om2 7y ago
We have a partial mitigation and it does not involve stripping query params. We'll be doing more stuff in standards first / in parallel now that more browsers are actively engaged in reducing tracking. A lot of the more extreme th
203.
by om2 7y ago
It offers 6 bits of campaign ID with the intention that campaigns need to be bucketed. Maybe it could be a bit more, but if it was, like, 32 bits, it could be used as a user ID.
204.
by om2 7y ago
It's actually pretty hard to do this. You still need some way to consistently identify the same user across different sites. Stateful tracking, fingerprinting, and link decoration are the only ways we know of to do this and we have our
205.
by om2 7y ago
OK, that's good feedback if we ever need targeted mitigations in the future.
206.
by om2 7y ago
We are not presently manually curating a specifically targeted mitigations list. Just saying we might in the future. We did do a one shot rollback of HSTS super cookie abuse in the past, but that’s it.
207.
by om2 7y ago
They maintain a Windows port of WebKit as a reference implementation.
208.
by om2 7y ago
That tweet is misinterpreting the “Unintended Consequences” section. Those are things we want to keep working, and if we break them, we will create alternate solutions (like Storage Access API for social embeds, and Private Click Measuremen
209.
by om2 7y ago
Our goal is not to break single-site analytics, and if it gets affected as an unintended consequence, we will try to come up with alternate solutions.
210.
by om2 7y ago
Depends on whether these drop-in solutions track cross-site, and whether they strictly limit data collection to the context of the first party site.

More ›