Surfin' Safari (WebKit) — Last week in WebKit: Tab sizing and strings for IndexedDB
A total of 650 commits landed in WebKit’s repositories last week, ending with revision 116915.
Web Inspector’s search box supports CSS selectors again, JavaScriptCore timers will now show up on the timeline and a context menu has been added for tabs.
Text decorations, such as underlines, will now be rendered for text in :first-line selectors. Implementation of the :first-letter selector was aligned with the specification. Eric landed stylesheet inheritance support for seamless iframes, as well as the ability to inherit styles from their parent iframe. The RadioNodeList interface is now supported, background-size is now part of the “background” shorthand and, albeit disabled, the <intent> element has landed.
IndexedDB now uses strings instead of numeric constants. Violation reports generated by Content Security Policy now also include the referer, original policy and the URL which got blocked. The File System API is now able to deal with cross-file system operations, widths and heights are now exposed for <input type=image> images, and the offsetLeft property was broken when used together with CSS Columns.
WebKit has also gained support for the tab-size CSS property. This property, which is also supported by Firefox and Opera, allows you to define the number of spaces a tab should be equal to.
Included among other minor updates on the WebKit website, the conditions under which the WebKit trademark can be used are now available on the Mac OS Forge website.
Other changes which occurred last week:
- Half a megabyte of memory was saved by Andreas when viewing the full HTML5 specification.
- The IETC CSS Values and Units tests have been added to WebKit’s test suite.
- A first step towards implementing the HTML Media Capture API has been made.
- Pages served with an XHTML-MP doctype will now automatically use a suitable viewport.
Surfin' Safari (WebKit) — Last weeks in WebKit: sub-pixel layout and seamless iframes
Since there wasn’t an update last week, this one briefly covers changes between revisions 114867 and 116271.
Web Inspector now offers the ability to disable all JavaScript execution on a page, and also allows Web Socket frames to be inspected. The shortcut overlay has received some UI polish and the Timeline Frame Mode has been taken out of experimental.
Fixed placeholders have been implemented for date input types, a form field’s entries supplied through a <datalist> are now barred from validation. The Apple Mac port removed support for BlobBuilder and the Selector APIs have been aligned with the specification when pseudo-element selectors are used.
Retrieving a canvas’ image data will now return a Uint8ClampedArray instead of a CanvasPixelArray object. In preparation of supporting getUserMedia on Chromium, the Peer Connection API implementation has been separated with a compile time flag. Tables now support the createTBody() method and the IndexedDB implementation can now open cursors based on an IDBKey, and advance cursors as well.
Eric landed the first parts of support for seamless iframes in WebKit, namely some tests, sandbox and styling and navigation. A vendor-prefixed version of the Performance Timeline API landed, the getUserMedia() method now takes an object instead of a string and the noteOn and noteOff methods of the Web Audio API’s oscillator got implemented.
Antti made it possible to share stylesheet data structures between documents, decreasing memory usage by several megabytes (take note, kling) depending on the port’s implementation. Furthermore, parsed stylesheets may now be cached, increasing performance of subsequent page loads.
Per commit 116009, Levi and Emil were able to close the meta bug for supporting sub-pixel layout in WebKit. While this has not yet been enabled for any port, this is a significant milestone for the project. This article provides some insight in the importance.
Other changes which occurred last week:
- Code supporting positioned floats has been removed from WebKit, pending proper implementation.
- The EFL port has enabled support for the <track> element, the Web Timing API and the Web Audio API!
- The BlackBerry port enabled support for the download attribute on anchors.
- Abhishek Arya (inferno) is now a WebKit Reviewer, congratulations!
- Alexis Menard is now a WebKit Reviewer as well, congratulations!
- Chromium is working towards enabling getUserMedia by default.
- Multiple input channels are now supported for the JavaScriptAudioNode.
Surfin' Safari (WebKit) — Alexis Menard is a WebKit Reviewer!
Alexis (aka darktears on IRC) has been an unstoppable WebKit coder in the last couple of years working at INdT/Nokia Brazil.
Among his contributions would be the Qt multimedia backends with GStreamer/QTKit, improvements to getComputedStyle, and countless other contributions in various parts of WebKit.
We’re happy to finally remove the word “unofficial” from his reviews. Welcome Alexis!
Surfin' Safari (WebKit) — Last week in WebKit: The Contributors Meeting and datalists
A total of 652 changes landed last week in various branches of WebKit’s repository. This update covers changes up to revision 114894.
Last Thursday and Friday, Apple kindly hosted the 2012 WebKit Contributors Meeting in Cupertino. With contributors from many different vendors around, a large number of subjects were covered in presentations and discussions. Transcripts of most of these are available on WebKit’s Trac, including a group photo of all attendees.
An experimental Style Panel has been introduced to Web Inspector which mimics the interface of the Script Panel, which also features an open stylesheet-dialog. Cross-frame security error spam when typing in the console is gone, calling document.open() will now reset the Elements Panel and the Inspector is now shimming the startsWith() and endsWith() methods on the String prototype, anticipating implementation of Microsoft’s proposal.
Parsing rules of the :nth-*() pseudo-classes has been aligned with the specification. Clipping issues with the CSS drop-shadow filter have been resolved and the “-webkit-filter” CSS property will now show up when enumerating over an element’s computed style.
Support for the HTML5 <datalist> element has been enabled for Chromium. It provides similar functionality to suggestions by the browser based on what you previously entered in a text field, with the difference that these suggestions are provided by the website.
Other changes which occurred last week:
- The WebKitGTK port has enabled the Web Timing implementation.
- Performance of several String-returning DOM attribute and property getters has been improved for v8.
- The localStorage.setItem() method cannot override methods on the Storage prototype anymore.
- The footprint of an element’s attributes has been reduced to a minimum for common usage.
- The IndexedDB implementation can now retrieve values or keys by IDBKeyRanges.
Surfin' Safari (WebKit) — Abhishek Arya is now a WebKit reviewer!
Abhishek, better known to the community as inferno, joined the WebKit community in March 2010, and he has been fixing security bugs in CSS, DOM, editing, rendering, and various other components in WebKit. Abhishek has contributed more than 260 patches, many of which are fixes to severe security bugs.
Please join me in welcoming Abhishek Arya as a new WebKit reviewer.
Surfin' Safari (WebKit) — Last week in WebKit: CSS’ -khtml- and -apple-, and ancestorOrigins
667 commits made it into WebKit’s repository last week.
Work on Device Emulation in Web Inspector is continuing and now also supports dimension wrapping to mimic orientation changes, and a “fit to width” option which will inherit the browser window’s dimensions as the device’s resolution. Lines having a breakpoint will now show line numbers and the vertical timeline overview now shows the wall time.
Support for -khtml- and -apple- properties has been removed for some WebKit ports, including Chromium, after previous attempts failed due to compatibility issues. Background sizes are now correct if the page is zoomed out, the default box-shadow color now defaults to the element’s “color” property, the viewport-relative CSS units now work for Replaced objects (such as images) and the -webkit-image-set CSS property was enabled for the Chromium port.
The ancestorOrigins() method was added to the window.location object, Chromium now exposes the Battery Status API and a Mutation Observer’s attributeFilter is now able to deal with namespaced attributes as well. The contentNodes property for NamedFlows was added, JavaScriptAudioNodes now respect the number of output channels and timestamps used in WebVTT had their limits relaxed.
Other changes which occurred last week:
- The backingStorePixelRatio property has been added to 2D Canvas contexts.
- Microsoft’s Grid Layout tests have now been integrated in WebKit as well.
- WebKit’s Microdata’s property collection implementation now features caching.
- Implementation of the Encrypted Media Extensions API started in WebKit.
- The new UI for date input types has been enabled for Chromium.
- Jocelyn Turcotte now is a WebKit Reviewer, congratulations!
Surfin' Safari (WebKit) — Jocelyn Turcotte is a WebKit reviewer!
Jocelyn has been a key contributor to the Qt port for many years now and has
lately been exploring the accelerated land of the texture mapper on the
WebKit2 planet.
Please join me in congratulating Jocelyn on his new role as a WebKit reviewer!
Surfin' Safari (WebKit) — Last week in WebKit: Flexbox updates and iframe’s srcdoc attribute
A total of 732 commits landed in WebKit’s repository last week.
The animatedPathSegList property for SVG path elements has been implemented, completing support for the animVal properties. Minor type updates were done aligning WebKit’s typed array implementation with the specification, the Web Audio API’s Oscillator and WaveTable interfaces have been implemented and plumbing for the new JavaScript Speech API continues.
Support for the CSS flex() function has been removed in favor of the flex property, which Tony Chang implemented and made animatable. Empty @media and @charset declarations are now being ignored, image-set updates dynamically when the device scale factor changes and syntax was updated for two CSS Exclusion functions.
Now that a user interface for color input types is available, next in line is an interface for the date and time input types. Kent Tamura has been working on implementing this, an early example of which can be seen here. Meanwhile, work has started on cleaning up and implementing support for <datalist>. The <iframe srcdoc> attribute is now also supported, allowing untrusted HTML code to leverage an iframe’s sandbox constraints.
Other changes which occurred last week:
- Both the backend and frontend for device metrics emulation in Web Inspector have been implemented.
- The BlackBerry port has added client implementations for the Battery Status and Vibration APIs.
- WebKit’s Web Intents implementation has been prefixed with the a vendor prefix.
- The “let” keyword has been unreserved in JavaScriptCore as reserving it caused compatibility problems.
- Microsoft’s backgrounds and border tests from the IE Test-center are now included in WebKit.
- The scroll position won’t be lost anymore after hiding and re-showing an element.
Surfin' Safari (WebKit) — Announcing Remote Debugging Protocol v1.0
It has been almost a year since we announced the support for WebKit remote debugging. It is now officially supported by BlackBerry PlayBook and in Chrome for Android. Latest version of Chrome introduces new extensions API that exposes it to the in-browser clients as well.
Today we are happy to announce the v1.0 of the remote debugging protocol. We commit to supporting it and maintain its backward compatibility from now on. Since we receive a lot of questions on the remote debugging from the port owners, protocol clients and WebKit contributors, I’d like to provide a brief remote debugging 101 here. It will provide answers to the questions such as:
- What is the structure of the remote debugging message?
- Is there a documentation of the protocol messages?
- Is remote debugging protocol versioned? How is backward compatibility defined?
- What do I need to do in order to support remote debugging with standard Web Inspector front-end in my WebKit port?
Protocol definition
Protocol schema
WebKit is using JSON-RPC 2.0 protocol for the remote debugging. Clients send commands to the backend and receive responses in return. Backend can generate notifications upon particular events on its own. Commands, responses and notifications are all JSON-serialized objects.
The remote debugging protocol schema is defined by the Inspector.json. Protocol documentation, along with parts of the inspector source code, is generated from that file. We group commands and events of a particular nature into domains such as DOM, Debugger, Network for the user’s convenience.
Commands and notifications
Here is a sample command that is setting a breakpoint:
{
"id": 10, // <-- command sequence number generated by the caller
"method": "Debugger.setBreakpointByUrl", // <-- protocol method
"params": { // <-- named parameters map
"lineNumber": 23,
"url": "http://www.webkit.org/index.html"
}
}
Backend responds to all the commands either with a result or with an error message. For the above command, the backend will generate the following response:
{
"id": 10, // <-- same id as in the command
"result": { // <-- command result
"breakpointId": "http://www.webkit.org/index.html:23",
"locations": [
{
"lineNumber": 23,
"columnNumber": 10
}
]
}
}
Notifications don’t have identifiers. For example, when JavaScript source is evaluated in the virtual machine, following notification is sent to the client:
{
"method": "Debugger.scriptParsed", // <-- notification method
"params": { // <--notification parameters
"scriptId": "15",
"url": "http://www.webkit.org/index.html",
"startLine": 22,
"startColumn": 12,
"endLine": 33,
"endColumn": 4
}
}
Complete list of the protocol methods for the v1.0 of the protocol can be found here.
Hidden entities
If you look at the Inspector.json file that defines the protocol schema, you will notice that some of the protocol entities (domains, commands and parameters) are marked as “hidden”. We don’t generate documentation for such entities. Although one can technically use them, we are not yet ready to commit to maintaining their backward compatibility. As the protocol matures, we will be polishing these entities and making them public.
Protocol versioning and backward compatibility
With the revision r106352, we updated the protocol version to v1.0. All subsequent v1.* versions of the protocol are going to be backward compatible with v1.0. Protocol backward compatibility is defined as follows:
- No commands or notifications are removed from the protocol.
- No required parameters are added to the commands.
- No required parameters are removed from command responses or notifications.
We do not anticipate any breaking changes to the protocol any time soon (years), but we leave this possibility to ourselves. We will flip the major version component when such change comes. You can find documentation of all of the versions of the protocol including the tip-of-tree version here.
Enabling remote debugging on your WebKit port
By default, remote debugging is using WebSocket transport for the protocol messages. That’s the transport you need to support in your WebKit port if you want Web Inspector front-end to be able to attach to the running pages. In this mode WebSocket frames are carrying the serialized protocol messages. Note that WebSocket connection is dedicated, there can only be one client attached to the WebKit page at a time.
Using Web Inspector front-end as a remote debugging client
Under the hood, Web Inspector front-end is a web app that can function in a stand-alone mode. It supports ws= query parameter that points to the WebSocket wired to the WebKit backend (it also supports host= and page= parameters that are now deprecated). Some browsers (such as Chrome or Safari) bundle Web Inspector front-end with their distributives, others (Chrome for Android) upload it to the web and point to it.
To see how it works, you can run the Chrome Canary with the following command line flag:
chrome --remote-debugging-port=9222
Then open any other WebKit-based browser and navigate to http://localhost:9222. You will see that initiating the remote debugging session loads the front-end files from the browser. This is possible because Chrome implements a small HTTP server for serving bundled front-end files. But since Web Inspector front-end is just a web app, it can be loaded from any location. Try running Chrome Canary as
chrome --remote-debugging-port=9222 --remote-debugging-frontend="http://trac.webkit.org/export/head/trunk/Source/WebCore/inspector/front-end/inspector.html".
It will tell Chrome to use trac.webkit.org as a source for front-end files. See how entire Web Inspector front-end loads from the source code repository when you inspect one of the tabs. You could have manually navigated to the http://trac.webkit.org/export/head/trunk/Source/WebCore/inspector/front-end/inspector.html?ws=localhost:9222/devtools/page/<tab-id> and that would also initiate the debugging session.
Chrome for Android team uses similar approach and uploads a version of Web Inspector front-end to appspot.com with each public build. But now you know, that you can download that site, change the front-end URL to the local one and do remote debugging with no internet connection at all.
Running WebSocket server in your port
In order to use the default Web Inspector front-end for the remote debugging of your WebKit port, you need to implement a small web server supporting the WebSocket specification. We did not make this server code a part of the WebCore because it is up to the embedder to be listening for external connections and discover the inspectable pages. In some cases, socket should operate in a different process than the inspected WebKit instance. For example, in Chrome, the socket is opened by the browser process, and browser dispatches protocol messages to the corresponding WebKit instances running in the renderer processes.
Here is what your WebSocket server needs to do:
- Upon accepting the WebSocket connection, it should start a debugging session via calling the
InspectorController::connectFrontend()method. - Upon connection termination, it should call
InspectorController::disconnectFrontend(). - For each incoming WebSocket frame, it should call
InspectorController::dispatchMessageFromFrontend(message)with the frame content passed asmessage. - It should send WebSocket frame over the connection for each
InspectorClient::sendMessageToFrontend()callback that it receives from the inspector.
See Chrome light http server and devtools handler for reference.
WebKit2 currently also includes a generic WebSocket server for the inspector. To use it with your port you need to:
- Define ENABLE_INSPECTOR_SERVER=1 in Source/WebKit2/config.h and add Source/WebKit2/UIProcess/InspectorServer/* to your build system
- Provide an implementation for WebSocketServer::platform*
- Start the server by calling WebInspectorServer::listen in the UI process
The server could also be modified to be used without WebKit2, but you would have to tear WebInspectorProxy out of WebInspectorServer and connect InspectorController and InspectorClient yourself to WebInspectorServer.
Surfin' Safari (WebKit) — Last week in WebKit: Network Information API and disabled fieldsets
A total of 792 changes landed in WebKit’s repository last week.
Support for IndexedDB in Web Inspector’s Storage Panel is now available by default. Line-endings won’t be reset anymore after editing a file, heap snapshot parsing has been significantly sped up and the shortcut for going to the previous panel has been changed. Development on supporting snippets is ongoing, as is support for device metrics emulation.
After having been rolled out, support for the vw, vh and vmin CSS units has returned to WebKit. Flexbox’ flex-line-pack property has been implemented and two bugs around the flex-pack property have been fixed. Replaced elements now gets pixellated when stretched ” href=”http://trac.webkit.org/changeset/112229″>assume an intrinsic size, the calc() function can now mix percentages and absolute values for box-reflect and vertical-align and more progress landed for the new Multiple Column implementation. Finally, CSS Exclusions’ shape-inside and shape-outside had their “wrap-” prefix removed, and now occur in the list of computed style properties.
Support for the Network Information API landed in WebKit, currently only enabled for the EFL port. The “preview” state of the Page Visibility API has been implemented and toggling the “disabled” attribute on a fieldset element will now also effect all form associated elements it contains. Verification for the Sec-WebSocket-Protocol header has been made significantly stricter, cross-origin behavior for XMLHttpRequests seeing redirects has been aligned with the specification, and images will now have their error event fired when the CORS check fails.
Other changes which occurred last week:
- Running “git status” in a WebKit checkout will be roughly 1.6 times faster due to splitting up the top-level .gitignore and .gitattribute files.
- Chromium’s compositor layer sorting system has been rewritten, fixing a lot of outstanding issues on several websites.
- WebKit’s build systems are being prepared for upstreaming iOS changes to the public repository.
- Performance of creating nodes through JavaScript has been sped up by ~15% for v8.
- Support for several new types has been added to SVG’s animVal property.
- Color selection dialogs through <input type=color> have been enabled for Chromium.
Surfin' Safari (WebKit) — Last week in WebKit: the move of WTF and responsive CSS images
With 901 commits to the various branches on WebKit’s repository, last week brought highlights including the move of WTF and a new CSS property to aid usage of responsive images: image-set().
Following much discussion and preparation, including e-mail threads going back more than a year, Eric Seidel moved the WTF (Web Template Framework) code out of JavaScriptCore. It initially settled there in 2005 as the kxmlcore directory, after which it got renamed to WTF in 2006 as many more useful classes had been included there.
JavaScript files and stylesheets will now be editable by default in Web Inspector’s Resources Panel. Highlighting of SVG root elements with a custom viewbox has been fixed and Source Maps may now be defined inline.
An initial implementation of the image-set() CSS function landed in WebKit, as was proposed for the CSS Images Level 4 module last month. Mixed percentage and absolute combinations for calc() may now be used for masks, background positioning and image sizing, Hyatt is working on the new Multiple Column implementation and fieldsets won’t stretch to minimum intrinsic width anymore if an explicit width has been specified. Besides various other Flexible Box Layout changes, the flexing algorithm got updated.
The crossorigin attribute may now be specified on script elements, causing WebKit to apply the Cross-Origin Resource Sharing policy on script elements as well. Three DOM-mutating JavaScript errors have been updated to align with the DOM4 specification and WebSocket’s Sec-WebSocket-Accept may not occur multiple times anymore.
Other changes which occurred last week:
- The default WebSocket version to use for WebKit ports has been changed to RFC 6455.
- While still completely disabled by default, CSS Shaders can now be compiled for Chromium.
- The style sharing optimization can now be applied to elements with style attributes as well.
- Support for “magic” iframes within WebKit has been removed.
Surfin' Safari (WebKit) — Last week in WebKit: Battery Status API and form updates
Last week, 751 changes landed in the WebKit repository. Highlights include landing of the Battery Status API and support for the W3C version of the Fullscreen API.
All signed and float Typed Arrays will now show up as normal arrays in Web Inspector. Taking heap snapshots should now be 12% faster and work is being done in preparation of supporting snippets in the Script Panel. A meta bug covering that work is available on WebKit’s Bugzilla.
CSS parsing now follows the specification when it unexpectedly runs into the end of a file and widths set on a column group won’t affect a column’s width anymore for fixed-layout tables. Three issues with the Flexible Box Layout implementation have been fixed, the “em” unit will be used correctly even when a :first-line pseudo-element changes the size and calc() can now mix percentages and absolute values for gradients and fonts.
The HTML5 meter and progress elements aren’t form-associated anymore, out-of-document radio buttons are now grouped when associated with a form and the form-attribute for labels had its behavior updated. The outer element is now labelable, while hidden input fields have lost that capability.
Samsung has landed an implementation for the Battery Status API, to be enabled on the EFL port. As for Speech Recognition, stubs for WebCore’s controller and the client landed, as well as the SpeechRecognitionEvent part of the API. The MediaStream’s PeerConnection implementation has been deprecated as it’s moving towards a JSEP API. Meanwhile, Nikolas Zimmermann has been busy implementing proper animVal support for SVG.
Besides support for Mozilla’s FullScreen API, WebKit now also supports the very similar W3C Fullscreen API. The primary differences lie in capital usage for the methods and behavior while exiting fullscreen.
Other changes which occurred last week:
- The HTML5 summary and detail elements have been enabled for the EFL port of WebKit.
- The Page Visibility API and Web Timing API have been enabled for the BlackBerry port.
- Dave Hyatt has started moving the Multiple Column implementation to one based on CSS Regions.
- Apple added implementation stubs for IndexedDB on JavaScriptCore, fixing the build.
- WebKit’s Commit Queue will now fast-track patches which already passed on testing EWS bots.
- Performance of the blur CSS Filter has been sped up by 2-2.5 times on Chromium.
- Andreas improved memory usage by another 800 kB when viewing the HTML5 specification.
- Performance improvements were made for innerText, outerText, innerHTML and outerHTML.
- Visual word movement can now be backed by ICU, providing a simpler implementation.
- Three accessibility improvements landed, one fixing the HTML5 footer element.
Surfin' Safari (WebKit) — Last week in WebKit: improved calc() support and FlexBox wrapping
715 changes landed in WebKit’s repository last week, bringing highlights such as improved calc() support and wrapping behavior for the new Flexible Box Layout implementation.
As for Web Inspector, not all percentage signs will attempt to be substituted anymore, the Network Panel will show application/json data again and inactive properties will be checked for vendor prefixes. The button allowing you to toggle the Timeline Panel’s overview mode has been moved and the Inspector has gotten more efficient at inspecting arrays containing large (~a million) elements.
WebKit’s implementation of the CSS calc() function is now able to mix absolute values and percentages for lengths. The Flexible Box Module’s flex-wrap property has been taught about the “wrap” and ”reverse-wrap” values, and margins won’t be double counted anymore when baseline alignment is used. Finally, multiple values are now accepted for the unicode-bidi CSS property, as an union with bidi-override and isolate is now valid.
Three changes to the JavaScript Speech API have landed, namely the SpeechRecognition(Alternative, Error, Result, ResultList) and the SpeechGrammar(List) interfaces. Support for SVG’s transform-origin attribute has been implemented, getComputedStyle’s result for the height property no longer takes intrinsic paddings into account and rendering of the <shadow> element is now implemented, defining the insertion point for older shadow sub-trees.
Other changes which occurred last week:
- Initial code paths have been added in preparation for rendering subtitle cues of the <track> element.
- CSS Property getters have been sped up by 35% for JavaScriptCore, and setters by about 8%.
- Fierce performance improvements (up to 10.9 times!) for several properties in v8 bindings.
- All of JavaScriptCore’s forwarding headers have been removed in favor of accessing WTF directly.
- The compositor will now also be enabled following animated CSS Filters.
- A WebGL extension enabling anisotropic filters has been added to WebKit.
- Support for vw/vh/vmin has been rolled out again due to performance issues.
- Jessie Berlin now is a WebKit Reviewer, congratulations!
Yngve Nysæter Pettersen (Opera) — New versions of Public Suffix, TLS Multiple Stapling drafts
- The Public Suffix definition draft, introduced in this article. This version is substantially rewritten compared to earlier versions. Document link.
- TLS Multiple OCSP Stapling, introduced in this article. This version has some updates, drawing on implementation experience. Document link.
- Cache Context: how to organize resources in groups so that when you log out of a site the old pages cannot be displayed. Introduced here. Document link.
Archive links:
draft-pettersen-cache-context-06.txt
draft-pettersen-subtld-structure-09.txt
draft-pettersen-tls-ext-multiple-ocsp-03.txt
Surfin' Safari (WebKit) — Jessie Berlin is a WebKit Reviewer!
Jessie Berlin has been writing awesome WebKit code and masterfully wrangling WebKit bots for several years now, so I am thrilled to announce that she is now a WebKit reviewer. Maybe you can be lucky enough to have her wrangle your code if you submit a patch!
Congratulations, Jessie!
Surfin' Safari (WebKit) — Last week in WebKit: viewport-relative CSS units and JavaScript Speech
755 commits landed in WebKit last week, containing highlights such as support for three new viewport-relative CSS units and work on a JavaScript Speech API.
Style declarations within Web Inspector can now be added anywhere in the declaration rather than just at the end. The DOM counter graphs aren’t experimental anymore, color pickers will be closed when either escape or enter gets pressed and timeline records will be opened when you click on a DOM counter graph. Furthermore, the Profiles panel has been enabled for Web Workers and suggestions will now be given for Watch Expressions.
WebKit now supports an intra-line character grid for Japanese text layouts. The initial value for the -webkit-flow-into CSS property has been changed to “none”, the display type for inline flexboxen is now supported and David Barton is continuing his work on improving MathML support, this time by fixing <msubsup> formatting. The :empty pseudo-selector won’t apply anymore when scripted additions occur, clipping behavior for a fieldset’s <legend> element has been fixed and the :scope pseudo-class is now supported as well.
The Shadow DOM’s ShadowRoot has been taught about the innerHTML property, and the <content> element will now behave like an unknown HTML element when it’s used outside of a Shadow DOM sub-tree. Microdata’s property collections gained the namedItem method and CSS Region’s NamedFlow object now supports the getRegionsByContentNode method. SVG’s <use> element has been integrated with the Shadow Root implementation and work is being done to stop SVG from mutating CSS styles directly.
Joe Thomas landed support for three new CSS units: vw, vh and vmin. These units allow you to define sizes based on the viewport’s width, height or smallest of the two. Following an announcement on webkit-dev, Hans landed an initial patch towards implementing the JavaScript Speech API.
Other changes which occurred last week:
- Trailing new-lines will be removed again when pasting text in a single-line text box.
- IPP optimizations have been enabled for the Web Audio API’s Biquad filter.
- Adrienne Walker is now a WebKit reviewer, congratulations!
- Cloning and transferring ArrayBuffers has been implemented for JSC per Khronos’ typed array specification.
- Lines containing right-to-left text on Facebook can be selected again.
- Very early basics of the new KURLWTFURL URL parser were landed by Benjamin.
- The XMLHttpRequest Blob response test on html5test.com will now recognize Chromium.
- Layers required for elements which potentially have to hide overflow will now be created lazily.
- Plenty of BlackBerry upstreaming has been done again last week.
- Working towards date and time input pickers, a HTML-capable popup API has been added.
- Smooth Scrolling support has been added for the WebKit GTK port.
- The WebKit2 API now features the possibility to suspend and resume timers and animations.
Yngve Nysæter Pettersen (Opera) — How secure is online shopping, really?
Online shopping is increasingly representing a large portion of the economy. In Norway, the size of this trade was estimated to be NOK 48 billion (USD 8.4 billion) in 2011 by DIBS (a Scandinavian payment processor) according to an article in Digi.no/NTB. That amount is, however, just under half of Amazon's USD 17 billion sales revenue in the 4th quarter of 2011.
When so much money is changing hands, it is important for consumers to have confidence in the security of online shopping sites.
Security in online shopping sites
The security we need to be confident about consists of several components, primarily:
- How secure is the shopping experience itself?
- How securely is the personal data handled?
- How securely is the payment handled?
These components depend in part on what customers do, such as how they select passwords, then by how the shopping site is organized, e.g., its use of encryption, and, finally how the internal systems are secured.
Securing the customer's local information is the customer's own responsibility. Even though technical aids like security software and pin-code calculators can help, it is mainly education and the user's own vigilance that really help in this area.
Similarly, the shopping site is responsible for securing internal systems and the storage of private information. For an outsider, it is difficult, if not impossible, to know if the shopping site has properly secured its systems, and as a customer you have to assume they have done so. If, contrary to expectations, the shopping site has not secured their systems properly, the first indication of a problem will usually be large articles in the news about a break-in at the site. It may, however, be possible to get assistance in evaluating the security at a shopping site, if the site has been audited by an independent third party, such as the Norwegian organization Trygg E-handel ("Safe e-shopping").
There is only one security area where a customer can determine, with relative ease, how good the shopping site's security is: how the shopping site is designed and how it works while you are shopping.
Use of encryption
When you are shopping in an online store you go through several activities:
- Explore the shop and its selection of goods.
- Select the goods you want to buy.
- Check what is in your shopping cart.
- Register if you are a new customer. (Or, if you are already a customer, proceed to activity #5)
- Log in if you are already a customer.
- Go to the checkout area with your shopping cart.
- Enter shipping details.
- Pay for the goods.
My personal opinion is that all of these activities should be done over an encrypted (secure HTTPS) connection, but almost no online shopping sites have implemented this. However, it is very important that activities number 4 through 8 are always performed over an encrypted connection to prevent leaks of sensitive information.
After my December 2011 discovery of an online shop that broke several fundamental rules for good security in encrypted webpages, I have looked more closely at several groups of online shopping sites with respect to the first 6 activities above, and, in January I performed a simple survey of 34 Norwegian and 12 British online shopping sites. During this survey, I did not look into what happened when shipping and payment details are entered (activities 7 and 8), as these activities require that you are registered as a customer and complete the entire shopping process, which I was not
interested in doing as part of this survey.
The selection of shopping sites mostly included big brands in various Norwegian or British markets, most of which have brick-and-mortar stores, as well.
Each shopping site was checked for each activity point and evaluated based on whether the page a customer landed on, and all other resources (images, scripts, etc.) that were loaded as part of the page, were encrypted. If any resource, even an image, was loaded without encryption, the entire page was deemed "unencrypted". The reason for this requirement is that it requires a non-trivial effort by a user to determine why a page is marked as unencrypted by the browser. This was also done for pages where the encrypted page was "hidden" inside a frame in an unencrypted page.
The results of this survey are, to put it mildly, disappointing:
- Just two of the Norwegian shops, Boots (which might be considered international) and Kitch'n, encrypted all activities, while none of the British shops did.
- More than half (52%) of the Norwegian shopping sites did not use encryption at all (or not well enough) for the activities that were tested. The corresponding number for the British sites was 16%.
- 26% of the Norwegian sites encrypted the activity for registration, login, and "go to checkout", while 67% of the British sites did the same. If we include secure display of the shopping cart, the numbers became 12% and 8%, respectively.
- 35% had secure customer registration, compared to 75% of the British sites.
- 26% had secure login, compared to 75% of the British sites.
- 46% had secure start on "go to checkout", compared to 75% of the British sites. For "go to checkout", this usually means that you have to log in.
- At one of the Norwegian and one of the British sites, these three main activities were admittedly encrypted, but they included unencrypted resources that would enable a malicious person to gain complete control of the encrypted site. Another two Norwegian sites included less dangerous unencrypted content.
- At several of the shopping sites where encryption was not used for an activity, it was sometimes possible to activate encryption by changing the URL, but, in many of these cases, the resulting pages included unencrypted content, and, in several cases, this created vulnerabilities in the encrypted document.
Why should encryption be used?
Why should activities like customer registration, login, and "go to checkout" always be encrypted?
The answer is that these activities, at the very least, require use of your username and password, and may also ask for other private details such as address and phone number, or provide access to them, and sometimes information about your social security number may be involved, too. In many cases, the shopping site will also store information about your credit card in your profile, meaning that you don't have to type it every time you're shopping. In such cases, should malicious persons get hold of your password, they can go shopping with your credit card.
When something is sent unencrypted, anyone who is in control of a network router between you and the shopping site, such as in a wireless network, would not only be able to listen in on what is being transmitted, but would also be able to easily change the content being transmitted, which could include adding code that sends a copy of whatever is entered on the page to the attacker.
One possible way such an attack can be carried out is that somebody places a "Free Wi-Fi" network in travel hub (e.g., a railway station, bus station, or airport) where many people will sit down to use their mobile phones or PCs. With the right software installed in the network, it is very easy to listen in, or even modify, the unencrypted traffic crossing the network.
On three of the Norwegian sites, and two of the British ones, the usernames and passwords that were entered on unencrypted login-pages were admittedly sent encrypted, but this only provides an illusion of security, since an attacker can easily change the content of the unencrypted page so that a copy of the information is sent to a different destination in addition to the real login to the shopping site. It is worth noting that Eric Lawrence of Microsoft called this "Critical Mistake #1" in an IEBlog article back in 2005. It is rather incredible that we are still, in 2012, seeing this kind of login page being used.
For another of the shopping sites, several activities were encrypted, but this was hidden away inside a frame that was hosted on an unencrypted site. Also, the allegedly-secure page inside the frame, where you might be asked for your social security number, turned out to be violating most rules about how secure pages should be constructed and opened multiple security vulnerabilities. Effectively, the activity was done over an unencrypted connection, as it is not trivial to discover that encryption was used in the frame or that it suffered from several vulnerabilities, and an attacker can easily change what is actually loaded in the frame, since the instructions are sent unencrypted. Such replacements cannot be discovered easily. This is another example of web design that should simply not be used by a serious shopping site in 2012.
It is, however, not just use of encryption that determines if the connection to the shopping site is secure. As part of this survey, I also checked the patch status for a less visible vulnerability that I have discussed many times before, mostly on the Security Group home page: the "Renego" issue, which was discovered and patched over two years ago. I discovered that only 29% of the Norwegian shopping sites had upgraded their servers to patch this problem, while 67% of the British sites had done so (the general patch rate is now 65%). In all, 53% of the unpatched Norwegian sites were also configured in such a fashion so that they were vulnerable to a full "Renego" attack, allowing an attacker to inject commands to the website and have them executed with the user's credentials.
What can be done to improve the situation? First, the shopping sites must fix their sites, but, in the long run, we need good control routines, such as by certification services, as well as customers learning to keep an eye on their own security.
Certification services
As mentioned above, it is usually difficult for outsiders to determine how good the security of a shopping site really is. This is due to the fact that, to be able to do that, we need access to information that companies for business reasons seldom make available. It is, however, possible that an independent and trusted third party might be allowed to audit the company and its compliance with specific requirements, issuing a certificate or seal if the requirements are met.
In my opinion, such requirements should include a requirement about using encryption for all functionality that handles sensitive information.
In Norway, the organization Trygg E-handel is such a certification service. Among its requirements for online shopping sites, it states that "Personal information must be protected against external access" (my translation), which, in my opinion, requires that all handling of such information must be encrypted, as you cannot protect a system against "external access" if the unencrypted password is easily available on the net. Still, two of the four shopping sites in my survey that were certified by Trygg E-handel did not use encryption for login and registration.
What can the customer do to ensure that a shopping site uses good encryption?
Primarily, customers must make themselves familiar with how their browsers indicate that a webpage is encrypted. This indication appears with slightly different designs and locations across the various browsers, and the indication can also change, depending on which kind of SSL certificate the server presents to the browser. It is, however, frequently associated with an image of a padlock, such as in Opera and Internet Explorer, but not always; Firefox is currently using a slightly different presentation. In addition, most browsers show a different, green variant of the padlock when the secure site is using an Extended Validation (EV) certificate for which the information has been extensively checked. Such certificates are frequently used by online banks and should be used by any site that charges payment for goods and services.
The following picture shows examples of how an unencrypted site, an encrypted site, and a site using an Extended Validation certificate are presented in various browsers:

When customers visit an online shopping site, they must check the padlock before starting to enter usernames, passwords, and other personal information, such as during registration or before starting the payment process. If the padlock (for either normal encryption or Extended Validation) is not displayed, you should not continue the transaction, but instead leave the site, as the information is not handled securely enough. You should also inform the shopping site about what you observed.
Summary
Based on the above, I would say that the lack of encryption, and lack of timely server upgrades to fix well known security problems, clearly indicate that Norwegian shopping sites are not secure enough.
The question is what these findings indicate about the security of shopping sites in other countries? Given the numbers for the British sites mentioned above, as well as the findings in my e-bookstore survey in December of about 50% of surveyed shops using good encryption, (which may be too few datapoints to be really significant), there is at least a good indication that there is still a lot of room for security improvements in the online shopping industry.
At the very least, based on the single certification service I reviewed, I would say that these services still have room for some improvement in the security area.
Not using encryption for sensitive information sends a signal to customers that a business has not given sufficient attention to the security of its shopping site. This signal is, I would hope, mistaken, but I am afraid that it can create a justified doubt about how well the shopping site's internal security is handled. Or, to put it another way: It is a very good practice to lock the back door to your house, but that won't help you if the front door is wide open.
I urge online shopping sites to take security and the use of encryption seriously. If a shopping site is not using encryption for sensitive information, this should be fixed as quickly as possible, and, if repairs cannot be completed within a short time, then the site should, strictly speaking, be taken offline until the problem has been fixed.
It is a sad thing to say, but, unfortunately, I doubt that there will be any significant improvement until somebody completes an attack (as happened to the social websites with the Firesheep utility), or until customers become more observant and vote by moving their mouse clicks to online shopping sites that guard their customers' security better.
Surfin' Safari (WebKit) — Adrienne “Enne” Walker is a WebKit reviewer!
Adrienne is one of the principal developers of the compositing infrastructure in the Chromium port, and has added major features such as tiling and texture memory management. Enne has also made significant contributions to WebKit’s cross-platform accelerated compositing code, including some tricky bug fixes affecting large web applications.
Please join me in congratulating Adrienne on becoming a WebKit reviewer!
Surfin' Safari (WebKit) — Last week in WebKit: Vibration API and compressed WebSockets
Another 754 commits managed to find their way in WebKit’s repository last week, bringing many updates including support for the Vibration API, WebSocket’s DEFLATE extension and parsing for two CSS Grid Layout properties.
Web Inspector’s Audit Panel gained the ability to warn developers about CSS properties which should be unprefixed. The Ctrl/Cmd {+,-,0} key combinations may now be used to control zooming of the inspector, attributes containing links can now be properly selected in the Elements Panel and, while it’s not enabled by default yet, managing IndexedDB is making visual progress now. Showing re-paint rectangles is now an Inspector option and three patches landed preparing changes in the Timeline Panel, such as the ability to align events by their start time.
Following inflator and deflator classes, WebKit’s WebSocket implementation now supports per-frame compression through the DEFLATE extension. Samsung’s Kihong Kwon landed initial support for the Vibration API. The zero-width joiner (0x200D) and non-joiner (0x200C) characters are now recognized by the JSC and v8 lexers, the PopStateEvent’s state property now equals history’s state property’s value and spin buttons now fire two events.
Initial parsing support for the grid-column and grid-row CSS properties has been added as part of support for the CSS Grid Layout module. <rt> elements won’t inherit the text-decoration property anymore, file upload controls can now stretch to make sure the text fits in the label and the click event for transformed SVG elements now is more reliable.
Apple’s JavaScriptCore is now a triple-tier virtual machine, adding a new low level interpreter which is 2 to 2.5 times as fast as the old one. While performance of the triple-tiering engine is neutral on performance tests, reducing the amount of JIT’ed code delivers strong performance improvements on actual websites.
Other changes which occurred last week:
- Style and link elements will now emit load and error events based on whether the stylesheet was successfully loaded.
- An empty skeleton of KURL based on WTFURL, a new URL parsing library, has been added.
- The requestAnimationFrame mechanism has been enabled for the BlackBerry port.
- The drop-shadow() CSS filter can now be applied to composited layers on Chromium.
- An IDL attribute checker has been added to the generator, and is now enabled for all ports.
- The HTTP Referrer header will now be set when requesting media downloads.
- The FractionalLayoutRect type has been added in preparation for sub-pixel layout support.
Surfin' Safari (WebKit) — Last week in WebKit: calculated CSS values and the translate attribute
684 commits landed in WebKit’s repository over the course of last week, bringing several new features and improvements such as a color picker for Web Inspector, two new CSS properties and the “translate” attribute for all HTML elements.
Brian Grinstead’s color picker is now enabled by default in WebKit nightlies, following some slight polishing. To aid the undo and redo system, an event has been added to monitor CSS modifications, percentage calculation for empty heap snapshots has been fixed and the first UI for managing IndexedDB databases is available. The free-flow DOM editing experiment has ended, concluding that it wasn’t an optimal solution for highly dynamic pages. Single-click CSS editing got enabled by default, and the Elements Panel will now show previews for images.
Per Mike’s commit, basic usage of CSS’ calc() function have started to work in WebKit. Two new CSS properties have been added, -webkit-line-grid to support the alignment of lines in the inline direction to the line grid and -webkit-overflow-scrolling, indicating that an element with overflow scrolling should follow the platform’s behavior. Nested horizontal flexboxes for the new implementation have been fixed, the nowrap value for the flex-wrap property has been renamed to “none” and the computed style for auto flex-item-align now resolves to its parent’s flex-align.
All HTML elements now support the translate attribute. Support for the DOM Level 3 FocusEvent class has been added and the “types” attribute for HTML5′s drag and drop Clipboard object now returns a DOMStringList. As for CSS Regions, it’s now possible to check whether a named flow overflows and update the regionOverflow property for all elements. Finally, a repaint issue and a text selection issue related to Regions have been fixed as well.
Other changes which occurred last week:
- CSS Animations can now be driven through requestAnimationFrame, evading the 40Hz rendering limit.
- Following the actual implementation, an API is now available to invert colors on WebKit’s Windows port.
- <mark> elements now expose their highlighted state and the <summary>element has been made keyboard accessible.
- Certain XMLHttpRequest resources can now be re-used from the memory cache.
- Apple’s WebKit ports have switched to using the RFC6455 protocol for WebSockets.
- Fat Fingers is now responsible for touch accuracy in BlackBerry’s WebKit port.
- Support for CSS Regions is now run-time toggleable, and may be disabled for Chromium.
- Scoped selector matching has been implemented in the CSS slow path.
This is the first article in a weekly series highlighting the WebKit changes which occur during during a given week. Of course there are many other changes landing as well, which the Trac Timeline provides a great overview of!
Surfin' Safari (WebKit) — Alejandro García is a WebKit reviewer!
In the last couple of years Alex, as we call him, helped with the WebKitGTK+ port maintenance from bugfixing to testing or releasing. He also contributed some improvements to the shadow rendering performance and lately he started the integration of WebKit2 GTK+ port, helping also with the integration of the accelerated compositing in the GTK+ port.
Please join me in congratulating Alejandro on his new role as a WebKit reviewer!
Yngve Nysæter Pettersen (Opera) — Hvor sikker er egentlig norsk netthandel?
Handel på nett utgjør en stadig større del av norsk handel, og ble ifjor estimert til 48 milliarder kroner av DIBS, ifølge en artikkel på Digi.no/NTB.
Når så mye penger er i omløp er det en nødvendighet at man har tillit til sikkerheten i nettbutikkene.
Sikkerhet i nettbutikker
Sikkerheten som man må ha tillit til består av flere deler, hovedsaklig:
- Hvor sikker oppleves selve handelen?
- Hvor sikkert håndteres dine personlige data?
- Hvor sikkert håndteres betalingen?
Disse delene avhenger delvis av hva kunden selv gjør, for eksempel ved valg av passord, deretter av hvordan nettbutikkens funksjonalitet mot kunden er lagt opp, for eksempel bruk av kryptering, og til sist av hvordan de interne systemene er sikret.
Kundens lokale sikring av egen informasjon er kundens eget ansvar. Selv om tekniske hjelpemidler som sikkerhetsprogramvare og passordkalkulator kan hjelpe, er det i hovedsak bare opplæring og brukerens generelle årvåkenhet som nytter på dette området.
Tilsvarende, nettbutikken er ansvarlig for sikring av interne systemer og den lagrede informasjonen. For utenforstående er det vanskelig, om ikke umulig, å vite om nettbutikken faktisk har sikret systemene sine skikkelig, og man må som kunde ta det for gitt at de er sikret godt nok. Dersom nettbutikken mot formodning ikke har sikret systemene skikkelig er vanligvis den første indikasjonen man som kunde får om at det har vært noe galt at det publiseres store artikler i avisene om datainnbrudd hos nettbutikken. Man kan imidlertid få hjelp til å vurdere hvor gode systemer nettbutikken har dersom nettbutikken har blitt sertifisert av en uavhengig tredjepart, f.eks. organisasjonen Trygg E-handel.
Det eneste området av sikkerheten hvor man som kunde rimelig enkelt kan avgjøre om sikkerheten i nettbutikken er god nok gjelder hvordan nettbutikken er bygget opp og fungerer når du handler der.
Bruk av kryptering i nettbutikker
Når man handler i en nettbutikk går man gjennom flere steg:
- Undersøke vareutvalget
- Velge varene man vil kjøpe
- Sjekke hva som er i handlevognen
- Registrere seg som kunde, eller
- Logge inn dersom man allerede er kunde
- Gå til kassen med handlevognen
- Oppgi hvordan varene skal leveres
- Betale for varene
Min personlige oppfatning er at alle disse aktivitetene bør gjøres over en kryptert (sikker HTTPS) forbindelse, men det er nesten ingen nettbutikker som har implementert dette. Derimot er det ganske viktig at aktivitet nummer 4 til og med nummer 8 alltid gjøres over en kryptert forbindelse for å hindre at sensitiv informasjon kommer på avveie.
Etter at jeg i desember 2011 kom over en nettbutikk som brøt flere fundamentale regler for god sikkerhet i krypterte nettsider har jeg sett nærmere på hvor sikre flere grupper av nettbutikker er når det gjelder de første 6 aktivitetene nevnt ovenfor, og i løpet januar har jeg gjort en slik enkel undersøkelse av 34 norske, og 12 britiske nettbutikker. I denne undersøkelsen har jeg ikke sett på hva som skjer når man oppgir hvordan varen skal leveres og hvordan man skal betale (aktivitet 7 og 8), siden dette krever at man er registrert som kunde, og at man gjennomfører hele kjøpsprosessen, noe jeg ikke var interessert i å gjøre som del av denne undersøkelsen.
Utvalget av nettbutikker var stort sett kjente merkenavn i flere forskjellige markeder, og de fleste har også vanlige utsalgssteder.
Hver butikk ble sjekket for hvert aktivitetspunkt, og hvorvidt den nettsiden man kom til, og alle ressurser lastet i denne siden var kryptert. Hvis enkelte ressurser, selv bilder, ble lastet uten kryptering ble hele siden kategorisert som "ukryptert", siden det kreves omstendelige undersøkelser fra brukerens side for å finne ut hvorfor siden er markert som usikker. Dette gjaldt også sider hvor den krypterte siden var "gjemt" inne i en ramme på en ukryptert side.
Resultatet av denne undersøkelsen er mildt sagt skuffende:
- Bare to norske butikker, Boots og Kitchn, krypterte alle aktiviteter, mens ingen av de britiske gjorde dette.
- Over halvparten (52%) av de norske nettbutikkene benyttet *ikke* kryptering i det hele tatt (eller ikke godt nok) for de aktivitetene som ble testet, tilsvarende for de britiske butikkene var 16%.
- 26% av de norske butikkene krypterte aktiviteten for registrering, innlogging, og gå til kassen, men 67% av britiske butikkene gjorde dette. Inkluderer man også sikker visning av handlevognen ble tallene henholdsvis 12% og 8%.
- 35% hadde sikker registrering som kunde, sammenlignet med 75% blant britiske butikker
- 26% hadde sikker innlogging, sammenlignet med 75% blant britiske butikker
- 35% hadde sikker start på å gå til kassen, sammenlignet med 75% blant britiske butikker. Gå til kassen innebærer som oftest at man må logge inn.
- I en av de norske, og en av de britiske butikkene var disse tre aktivitetene riktignok kryptert, men inkluderte ukrypterte ressurser som åpnet for at en ondsinnet person kan ta full kontroll av den krypterte siden. Ytterligere to norske butikker blandet inn mindre farlig ukryptert innhold.
- I flere av de nettbutikkene som ikke benyttet kryptering for en aktivitet, men hvor det var mulig å aktivisere kryptering, viste det seg at disse variantene lastet ukryptert innhold, og i noen tilfeller åpnet
dette sårbarheter i den krypterte siden.
Hvorfor bruke kryptering?
Hvorfor skal aktiviteter som registrering som kunde, innlogging, og gå til kasse alltid foregå over en kryptert forbindelse?
Svaret er at disse aktivitetene i det minste omfatter bruk av brukernavnet og passordet ditt, og kan også omfatte andre private detaljer som adresse og telefonnummer, eller adgang til disse, og noen ganger kan nok informasjon om personnummer være involvert. I mange tilfeller lagrer også nettbutikken informasjon om kredittkortet ditt i profilen din, slik at du slipper å taste det inn hver gang du handler, og i så fall kan en ondsinnet person som får tak i passordet være i stand til å endre profilen din, og gjennomføre handler med ditt kredittkort.
Når noe sendes ukryptert vil hvem som helst som er i kontroll av en ruter mellom deg og nettstedet, for eksempel i et trådløst nettverk, være i stand til å avlytte det som sendes, men kan også enkelt endre innholdet i det som sendes, og for eksempel legge inn kode som sender kopi av det som tastes inn til angriperen.
En mulig måte et slikt angrep kan gjennomføres på, er at noen plasserer et "gratis WiFi" nettverk ved et trafikk-knutepunkt hvor mange setter seg ned med mobilen eller PCen sin. Med den rette programvaren installert i nettverket kan man enkelt avlytte eller modifisere all ukryptert trafikk gjennom nettet.
I tre av de norske butikkene og to av de britiske ble brukernavn og passord som ble oppgitt på ukrypterte innloggings-sider riktignok sendt kryptert, men dette gir bare et bedragersk skinn av "sikkerhet", siden en ondsinnet person bare trenger å endre innholdet i den ukrypterte siden slik at den sender en kopi av brukernavn og passord til ham selv, i tillegg til den faktiske innloggingen til butikken. Det er egentlig ganske utrolig at man i 2012 fremdeles kan se slike innloggingssider i bruk.
I en av de undersøkte butikkene ble riktignok kryptering benyttet for flere aktiviteter, men dette var gjemt inne i en ramme (frame) som var laget av en ukryptert side, og den såkalt sikre siden inne rammen, hvor man kan bli bedt om personnummeret når man har valgt enkelte betalingsalternativ, brøt også de fleste reglene for hvordan sikre sider skal lages og åpnet for enda flere sikkerhetsproblemer. Effektivt vil det si at aktiviteten foregikk over en ukryptert forbindelse siden det ikke er enkelt å finne ut at rammen bruker kryptering (eller har flere andre sårbarheter), og en ondsinnet person kan veldig enkelt endre hva som skal vises i rammen, siden informasjonen om det blir sendt ukryptert og kan endres uten at det kan oppdages på noen enkel måte. Dette er også et annet eksempel på noe som ikke burde bli brukt av en seriøs nettbutikk i 2012.
Det er imidlertid ikke bare bruken av kryptering som avgjør om forbindelsen til en nettbutikk er sikker. Som en del av undersøkelsen sjekket jeg også status for en velkjent, men mindre synlig sårbarhet i de sikre tjenerne for de nettbutikkene som benyttet slike. Jeg fant da ut at bare 29% av nettstedene deres har oppgradert slik at de er beskyttet mot det såkalte "Renego" angrepet , som ble oppdaget, og fikset for 2 år siden, til sammenligning har 67% av de britiske nettbutikkene fikset problemet; og generelt har ca. 65% av alle sikre nettsteder fikset dette problemet. 53% av de norske butikkene som ikke er oppgradert er dessverre også slik konfigurert at de er sårbare mot det fulle "Renego" angrepet, hvor angriperen kan lure nettstedet til å utføre oppgaver med kundens ID. Forøvrig, norske nettbanker har det samme problemet, kun en av de 6 jeg har sjekket, Skandiabanken, har fikset problemet, og de fleste andre er i tillegg sårbare for angrepet (En stor bank har delvis fikset problemet i løpet av de siste ukene, men ikke fullført dette ennå).
Hva kan gjøres for å forbedre situasjonen? Først og fremst må nettbutikkene fikse nettstedene sine, men for å få god sikkerhet i det lange løp må man få på plass gode kontrollrutiner, for eksempel i form av sertifiseringsordninger, og ved at kundene holder et øye med sin egen sikkerhet.
Sertifiseringsordninger
Som nevnt ovenfor er det normalt vanskelig for utenforstående å kontrollere hvor godt en nettbutikk ivaretar sikkerheten. Dette skyldes at man må ha adgang til informasjon som de færreste bedrifter offentliggjør, av forretningshensyn. Det er imidlertid mulig at en uavhengig tredjepart undersøker bedriften og dens oppfyllelse av nødvendige krav, og dersom disse er oppfylt utsteder et sertifikat om dette.
Etter min oppfatning må disse kravene inkludere et krav om at kryptering brukes for all funksjonalitet som håndterer sensitiv informasjon må være kryptert.
Organisasjonen Trygg E-handel, som er en norsk sertifiseringsordning, har blant sine krav til nettbutikker at "Personopplysningene skal beskyttes mot ekstern inntrenging", noe som etter min oppfatning betinger at all håndtering av slik informasjon må foregå kryptert, siden man ikke kan beskytte et system mot "ekstern inntrengning" dersom passordet er enkelt tilgjengelig i ukryptert form på nettet. Likevel, to av de fire nettbutikkene i min test som var sertifisert av Trygg E-handel benyttet ikke kryptering for innlogging og registrering.
Hva kan kundene gjøre for å sikre seg at nettbutikken bruker god kryptering?
Først og fremst må kundene gjøre seg kjent med hvordan nettleseren deres indikerer at en side er kryptert. Denne indikasjonen har varierende utseende og plassering i de forskjellige nettleserne, og utseendet kan også variere med hvilken type sertifikat (identifikasjonskort) nettstedet presenterer til nettleseren, men er vanligvis assosiert med en "hengelås", slik som i Opera og Internet Explorer, men ikke alltid, siden Firefox benytter et litt annet utseende. I tillegg vises en spesiell, grønn variant av "hengelåsen" når nettstedet bruker et såkalt EV (Extended Validation) sertifikat, hvor informasjonen om nettstedet har blitt kontrollert spesielt grundig; slike sertifikater brukes blant annet av nettbankene, og bør brukes av alle nettsteder som krever betaling for varer og tjenester.
Bildet under viser eksempler på hvordan et ukryptert nettsted, et kryptert, og et nettsted med et Extended Validation sertifikat blir vist i forskjellige nettlesere.

Når en kunden går til en nettbutikk må han eller hun sjekke "hengelåsen" før de starter inntasting av brukernavn og passord, eller annen personlig informasjon, for eksempel under registrering, og før man starter betalingsprosessen. Dersom "hengelåsen" ikke vises skal man avbryte det man holder på med siden informasjonen ikke blir håndtert sikkert nok. Man bør også informere nettbutikken om hva man har observert.
Oppsummering
Basert på det som er vist ovenfor, vil jeg påstå at både den manglende bruken av kryptering, og den manglede oppgraderingen av nettstedene for å fikse kjente sikkerhetsproblemer, gir en klar indikasjon på at norske nettbutikker dessverre ikke er sikre nok.
Det kan også stilles spørsmåltegn ved om sertifiseringsordningene passer godt nok på dette området.
Manglende bruk av kryptering for sensitiv informasjon sender et signal til kundene om at man ikke har tenkt godt nok igjennom sikkerheten for nettstedet. Dette signalet er forhåpentligvis feil, men etter min mening kan det skape berettiget tvil om hvor godt sikkerheten er ivaretatt internt i butikken. Eller for å si det på en annen måte: Det er bra å låse bakdøren, men det nytter lite dersom hovedinngangen er vidåpen.
Jeg vil på det sterkeste oppfordre norske nettbutikker om å ta sikkerhet og bruk av kryptering på alvor. Dersom nettstedet ikke bruker kryptering for sensitiv informasjon bør det fikses raskest mulig, og dersom det ikke kan gjøres umiddelbart bør strengt tatt nettstedet tas av luften inntil problemet er fikset.
Det er synd å si det, men dessverre tror jeg at det ikke blir noen stor bedring før noen gjennomfører et angrep, eller kundene blir mer observante, og stemmer ved å flytte sine museklikk til nettbutikker som passer bedre på kundenes sikkerhet.
Surfin' Safari (WebKit) — Chris Rogers is a WebKit Reviewer!
Chris Rogers is the author of the Web Audio API specification and the primary implementor of it in WebKit. Chris has also contributed to the XHR2 specification (the .responseType and .response attributes), and implemented these attributes in WebKit.
Please join me in congratulating Chris on his new role as a WebKit reviewer!
Surfin' Safari (WebKit) — Vsevolod Vlasov is a WebKit Reviewer!
Vsevolod Vlasov has been a major contributor to the recent improvements to the Web Inspector. Please join me in congratulating Vsevolod on his new role as a WebKit reviewer!
Yngve Nysæter Pettersen (Opera) — Secure e-book shopping for the holidays? Maybe, Maybe not
Despite this I actually do have a collection of e-books on my PCs, since Baen Publishing, a Science Fiction and Fantasy publisher, has been kind enough to include CDs with several of the hardcover books I've bought from them. The CDs contain the books in several formats, including HTML, all unencumbered by DRM, even with a permission for non-commercial sharing. Baen do this because they think they will sell more physical books, and as far as I can tell it works like a charm: I bought a bunch of paperbacks from the first CD, and I know one of the authors published by Baen, Eric Flint, did some research, finding that he sold more books than he normally would have, after he had made his available for free (see this article collection, search for "There Ain’t No Such Thing as a Free Lunch" and "I can demonstrate this concretely").
Until a month ago I had not been looking into Baen's WebScription service, their e-book store (they also have a free library), since, as I mentioned above, I prefer physical books. A month ago, however, I became aware that Baen had, as they frequently do, made an early version (an ARC, Advanced Reader Copy, before proofreading) of a book I was waiting for (it will be published in March, already pre-ordered), so I decided I did not want to wait that long :), "walked" over to Webscription, registered and bought the early version (without encountering any problems with the security of the website).
Then, a couple of weeks ago, as I was winding up the backlog of books in a series (in case anyone is interested: the Lee&Miller Liaden Universe Saga - finally decided it was time to get started on that one, while flying across the Atlantic) that I've been reading the past few months, I found that there were a few collections of shorter stories available, particularly as HTML e-books (without DRM). Most of them were available via WebScription, but not all of them.
The remaining books were available through another e-book service, Smashwords, and that's when I hit the first security warning. I had followed links from Lee&Miller's home page to the Smashwords pages for the books, and clicked "Buy". Up came the the "You are about to submit an unsecure query from a secure page"-warning. What's going on? The link from Lee&Miller was (unusually enough) for a HTTPS page, most shopping sites use unencrypted pages for the presentation, so I had not noticed, and the "buy"-button was submitting a form to an unsecure server.
This, of course, triggered some more investigation, and I quickly discovered that the HTTPS page I was on was not just posting to an unsecure server, it also included an unsecure external JavaScript, in a page that also had a login form at the top (most pages had that login form, also the unencrypted ones). As I have mentioned before, this means that if anyone logs in through this page, an attacker could replace the original script, steal the account information, and assume control of the account (including the accounts of authors publishing at the site).
I also discovered that the "buy" action that submits to the unsecure server (which triggered the initial warning dialog), bounces back to a "secure" page that says you have to be logged in to see the shopping cart. This "secure" page includes both an unsecure CSS file, and an unsecure external JavaScript file, which again means that a attacker can take complete control of the user experience, and steal account data and, very likely, credit card information.
I informed Smashwords about the problems on or around December 2nd, and again December 15th after I had received no response from them, and the problems still remained. As of December 20, still nothing has happened.
After this I decided to check out a few more e-book shopping sites, and did a quick test of 14 more sites found via a wiki page, which along with Smashwords, totaled 15 sites. In this quick test I tested their support for secure presentation, sign up, log in, how securely the shopping cart was presented, and the checkout up to having to log in before being able to continue. In none of these cases did I create an account or attempt to log in, so the investigation did not test how secure the payment systems are.
- One (1) site did not seem to provide any encryption at all. This one seemed to mostly offer free content.
- 5 sites provided a secure variant of their front page. All five of them had mixed secure and unsecure content, 4 of the 5 included unsecure JavaScript.
- 3 sites provided a secure variant of the book presentation. All three of them included unsecure JavaScripts.
- 6 of the sites provided a secure variant of the shopping cart, only one had that as the default, 3 others included unsecure JavaScript, another unsecure images.
- 3 more required log in on a secure page before displaying the shopping cart, one mixing unsecure images, one unsecure JavaScript.
- 14 of the sites provided default secure sign up and login pages, but 3 included unsecure external Javscript, another two used mixed security content.
- In two cases it was not possible to get to checkout, due to login requirements for even adding items to the cart.
- In another three the checkout was login protected.
- in the remaining 9 cases, 3 were including external JavaScript, and one mixed security content.
In total, ignoring the pre-checkout navigation, for the sign up, log in, and checkout parts of my test:
- 8 of the 15 used full encryption, without mixed security.
- 4 included unsecure JavaScript, with some also including unsecure CSS style sheets. Some of these scripts were these scripts were Facebook related or analytics-scripts. Three of these were informed yesterday, Smashwords was, as mentioned, informed a few weeks ago.
- 2 others included mixed security content.
- (and one did not provide any security, at all).
In other words, only half of the tested e-book sites followed the minimum best practices for e-commerce (secure sign up, sign in and checkout, no mixing of secure and unsecure content), and a full two thirds of the rest leave their sites wide open to a JavaScript-based Man in the Middle hijacking of accounts, and in at least some cases this appears to include the author's accounts too.
So, my advice is that you should be vigilant when you are online shopping for e-books, and probably in other online shops, as well. Frequently, when the "secure" indication for a "secure" page is gone, only a detailed investigation will indicate if the problem is a true security problem, so it is better to assume that it indicates that there is a security problem. If there is no "padlock" when you are about to use your password or credit card, then I would recommend that you should do your shopping somewhere else.
Some quick advice to site administrators:
- Avoid using absolute URLs on the form https://www.example.com/foo . Only use this kind of URL when you are intentionally changing to HTTPS or HTTP from a page that was loaded using the other protocol, or if you want to use that specific protocol.
- Instead, use relative URLs:
- Use "/foo" if the content is on the same server, or just "foo" if it has the same folder path as the current document.
- Use "//www.otherexample.com/bar" (note the two leading "/"s) if you are referencing content on a different server. All modern web browsers recognize this form of URL, and will automatically prepend "http:" is the document has a http-URL, and "https:" if the document has a https-URL. Example using "//tools.ietf.org/html/rfc3986#section-4.2"
This will ensure that you do not accidentally change from HTTPS to HTTP for some content, in particular when parts of the template for the webpage are also used on a HTTP page.
Surfin' Safari (WebKit) — Filip Pizlo is a WebKit Reviewer!
Filip Pizlo has been a major contributor to the recent improvements to the JavaScriptCore JIT and Garbage Collector. Please join me in congratulating Filip on his new role as a WebKit reviewer!
Surfin' Safari (WebKit) — Julien Chaffraix is a WebKit Reviewer!
Julien Chaffraix has been a very long time contributor to the WebKit project. He started by improving XMLHttpRequest. After that, he switched to different areas over the years (DOM, network stack, …). Lately he has been doing some rendering work aimed at improving <table> performance & memory footprint. Please join me in congratulating Julien!
Nicklas Larsson (Opera) — Programming language syntax
The best syntax I have yet seen is that of CoffeeScript. It gets so many things right. Even if it borrows heavily from Ruby, it has improved a lot on the syntax. Here are some nice things with CoffeeScript syntax:
Functions as ->: A function is defined by ->, very compact to write and easy to read. Full form is (params) -> body
Indentation, not curly braces or end: Use of indentation is really nice in CoffeeScript, like in Python, but much better executed.
Keywords like is, and: Use is instead of ==, and instead of &&, etc. Better readability.
Easy to define lists and objects: key: value automatically creates an object, indentation creates an object, use indentation instead of "," to create easier to read and write lists and objects.
if at the end of line: a = 3 if b > 4 sets a to 3 if b is larger than 4. Makes one-statement bodies of if, while etc more compact.
Optionally skip parens in function calls: alert 'foo'. When nesting function calls, you still has to use parens. If a function call does not get any parameters, parens are required.
if returns a value: a = if a > 3 then 3 else a. a will be 3 if higher than 3, otherwise unchanged.
Don't declare variables: Just assign a variable a value, no need to declare them first. a = 4.
Use constructor instead of class name for constructors: Change the name if the class, without having to change the name of the constructors.
a, b = b, a: When you want to swap two variables, it's that simple. Can also be used to return multiple values from a funnction.
this is @: Why write this, when you can write @?
Replacement of C-like for and C-like switch: We will not do for int i = 0; i < 5; i++, but use ranges instead, and other forms of for. switch/case, is replaced by switch/when without the need for break.
The syntax in CoffeeScript is fantastic. Maybe it is because CoffeeScript mostly is just a nicer syntax for JavaScript, and it focused on the syntax, not all the other things in a language. I would maybe change a few things, I would probably add foo! for calling foo without parameters instead of having to use foo(). Declaring variables could also be useful in another type of language.
If Google started with the CoffeeScript syntax when designing Dart, I think we would get a nicer language in the end. (of course, CoffeeScript is more dynamic in nature, doesn't do type declarations, so it is not certain that CoffeeScript would make a better end result, but I think it would) Can't we just let the too C-like syntax die?
Nicklas Larsson (Opera) — Dart as a language, and Dart in the browser
For a person like me, that mostly have been doing C++ development, it is a good thing that the language is boring, since it is more similar to what I have been doing. Of course, there are interesting things with the language, like optional type system and isolates. If you compare it to JavaScript (I think we should, since Google is trying to integrate it to the browser) it is less dynamic, but more robust. That code can import other code is great for structure, and I also think that the main function brings structure, instead of just adding code in the body of the script to do initialization. (however, main removes the nice things from most scripting languages)
A warning, it is hard to learn Dart, you can use try.dartlang.org, and you also need to read the language specification. (I have not done that yet, so I don't have a full understanding of the language)
If it was just a language choice, it existed two languages in the world, Dart and JavaScript, and both worked equally well in the browser, which one would I pick? Because of my background, I would probably go for Dart. If Dart were a little better at being dynamic, it would be an easier choice.
What is the chance that we can add another successful language to the browser? I will list a few things that must come true.
Size of the binary: how much bigger will the binary be if we add another language? This is something that a few years ago were very important for running on mobile devices. But, if you are going to be able to run a web browser well, you need a lot of heap storage. No new smartphone has less than 256 MB I think, so this argument is probably not valid anymore. However, if we start talking about adding n languages, it will of course be a problem.
Burden on browser vendors: creating a good JavaScript engine is a lot of work, creating an engine for Dart will double that effort. Of course, everyone can use the same Dart engine if they want to. Google's dart implementation will be written to integrate well with Chrome, and its API will work best with Chrome.
Standardization: I like JavaScript because it is standardized, and therefore can have multiple compatible implementations. Dart needs to be standardized too.
Work everywhere: JavaScript is available everywhere, how is Dart supposed to get there? First, all browser vendors must like it, and find a way to motivate themselves to add it. Google will add it to Chrome since they are creating the language. They would probably also try to write some of their biggest web applications in Dart. Mozilla would like it if the design process is open, and if more applications will be written for the web as a result. Opera would add it if the others add it. Google can easily do all the integration for Apple, that is a good way to convince someone. Microsoft, I don't know what it would take. They try to be compatible with what is already out there, and they might want to push for another solution if we are going to allow any other language to the web.
So, what do I think? I dislike the effort of trying to add a lot of functionality to JavaScript, morphing it to a different language, I thought the EcmaScript 4 suggestion was horrible, and was very happy that it didn't happen. JavaScript is a compatible language, and it should stay compatible. At the same time, more and more code is written for the web, and we should have better tools for building what we want to build. I find CoffeeScript to be a very nice addition, but as long as you can't debug in a good way, it will not be a great solution. We have to think about the future, and we should not settle for something that is not good enough, or else the walled gardens will win. I want applications that run on all platforms, on all devices. Dart is at least one possible way to get there. And, it widens the discussion how we should solve the web as a platform.
Nicklas Larsson (Opera) — How many programming languages do we need?
A lot of programming languages exist, and now Google has created two programming languages, only two years apart, Go and Dart. My question is, how many programming languages do we need?
Of course we can discuss the value of choice, but I am not interested in that right now. Let's say you were to create a new computer (Amiga 10000), all the software in the world had disappeared, and you needed to replace all software needed to make the user productive.
First of all, you would need a programming language that is good at accessing the low-level parts of the system. Just to make it simpler, let's add the possibility to create performance critical code in this language. (operating system, parts of a web browser, encoding/decoding) Of course, you have to be able to generate machine code from this language, and if we need another language (which I will argue that we do), it should be possible to write a VM for another language in this language.
Then, I think that a programming language that is focused on low-level stuff and performance, would get too complex if it also supported everything else. So, my suggestion is that you add another programming language, that is focused on creating applications, where low-level stuff is not needed, and where performance will not stand in the way of programming convenience. (but of course performance is still important)
Of course, there will always be some overlap, some applications that does not require performance or low-level access might be written in the first language anyway.
Just because Google's languages are new, I will see if Go and Dart could be those two languages, starting with Go to see if it fulfills the requirements for the first language. (Go tries to be more than just a programming language with high performance, but it is not a complex language, so at least that part is promising for Go to be a good fit for the first language)
Nicklas Larsson (Opera) — Dart and its type system
Now I know that the type system is very different from what I anticipated. Yes it has both untyped and typed variables. But they did something that I have never seen in a language that I have studied before, the types were for debugging and documentation, not a rigid type system that will keep you in the type jail.
When you run your code in production, the VM does not care about the types. When you debug it, the tools will check if the types are honored. Suddenly, you have a language who's variables are completely dynamic, but that helps you write more robust code anyway.
So, what are the advantages of using variable type declaration?
1. Documentation, easier to document an API, since the types are given in the declaration.
2. Type checking during compilation and/or run-time.
3. Faster code.
In Dart, you get the documentation, you also get most of the type checking. However, the faster code part is not there, since all static type declarations is gone when you run the code in production. I think that is a good thing, I think that a VM that supports type checking might be slower when it also allows untyped variables, so it is better to treat all variables as untyped. But, of course static type checking during compilation will usually have a speed advantage to untyped variables.
I have not completely dived into Dart yet. It feels like a pragmatic, but not very exciting language. The type system is interesting, and I think I like it.
Ben Smedberg (Mozilla) — Wall-Mount Computing
For the past year or so, my wife and I have successfully kept all of our calendars (home, work, and kids) in Google calendar. We purchased matching phone computers, and calendering is one of the primary uses we have for the phones apart from actual calling. At work I keep an app tab open in Firefox with my calendar and it all works out pretty well.
I would like to extend our calendar system out to the kids. I want a touchscreen computer which I can mount for the older kids to see upcoming events and also see school information such as library/gym day, packing lunch which we keep in their calendar. I’d also like to be able to write a little app for them to check off their chores in the afternoon, or even leave virtual post-it notes for the family.
I have not yet found a suitable computing device which meets my needs and budget. It seems like somebody could make this kind of device pretty inexpensively because it is always plugged in: you don’t need the expensive battery setup of tablet computers. I can’t seem to find a tablet with a wall mount system, and I fear how quickly they could break something which wasn’t securely mounted.
My first choice would probably be an Android system, but any system that runs webapps and a decent browser would meet my needs. I guess I’m looking for something in the 7-12″ screen size range, and less than $500.
Do my readers have any suggestions?
Nicklas Larsson (Opera) — Following Dart
I have no idea of what to expect from Dart, if it will be a good language, and where I will be able to use it, but I find it interesting to learn new things, and try to early understand if this is a language of the future, or something that will fail.
Vladimir Vukicevic (Mozilla) — Looking at Java NIO Buffer performance
While starting to convert much of our IO to using nio byte buffers, with an eventual goal in pushing that further up into the application, I decided to investigate in some more detail performance. I’d seen some blog posts that claimed that performance wasn’t great, in particular a very old blog post from 2004. That post included a simple benchmark, which I grabbed, converted to use Int buffers, dropped the count to 10,000,000 int values, and ran it. The source is available as niotest.java. The results weren’t encouraging:
Java Version 1.6 1.7 array[] put 26 ms 31 ms absolute put 129 ms 130 ms relative put 130 ms 132 ms array[] get 20 ms 19 ms absolute get 116 ms 119 ms relative get 130 ms 137 ms
Not only was there no really visible perf changes between Java 1.6 and 1.7, using the nio buffers was 4x-6x slower than regular java arrays! I wrote a quick equivalent benchmark in JavaScript, using Typed Arrays, and originally saw numbers in the 11ms range. (Note: the original benchmark numbers aboe were inthe 300ms range for nio arrays, before a laptop suspend/unsuspend — I incredulously tweeted the 30x difference, and then went about cleaning up the benchmarks. I can’t reproduce either result now; the Java version got faster, and the JavaScript version got slower.) The JS benchmark (source code buftest.html) gives about 65ms for writing and 40ms for reading. That still seemed faster, and I set about writing this blog post.
As part of that, I decided to clean up the benchmark code and put everything together in a nice package. The source for the new benchmark is ArrayBenchmark.java. Like the original, it works on arrays/buffers of 10,000,000 integers, first writing each element (with just its index) and then reading each element in the get operation. The additional “copy into” benchmarks time how long it takes to copy all the ints into an existing int[] array. Here are the results:
Java 1.6 Java 1.7
===== native java int[] array
put: 27.971961 ms 42.464894 ms
get: 32.949032 ms 14.826696 ms
copy into: 20.069191 ms 15.853778 ms
===== nio heap buffers
put: 839.730766 ms 57.876372 ms
put (relative): 844.618171 ms 80.951102 ms
get: 742.287840 ms 80.578592 ms
get (relative): 759.317101 ms 79.563458 ms
copy into: 769.494235 ms 91.685437 ms
===== nio direct buffers
put: 161.480338 ms 31.951206 ms
put (relative): 170.194344 ms 47.541457 ms
get: 179.621322 ms 18.913808 ms
get (relative): 164.425689 ms 29.387186 ms
copy into: 21.940450 ms 16.936357 ms
===== custom buffers
put: 151.095845 ms 48.125012 ms
put unchecked: 148.538301 ms 51.241096 ms
get: 146.243837 ms 36.636723 ms
get unchecked: 138.765277 ms 31.641897 ms
copy into: 41.643050 ms 20.206091 ms
copy into (copyMemory): N/A 16.845686 ms
These numbers show a significant improvement in Java 1.7! Direct buffers are roughly about as fast as regular arrays, which is what I had hoped to see originally. The “custom buffers” section is a hand-rolled integer buffer class that uses Unsafe.getInt/putInt without much of the additional nio buffer machinery or abstractions, to see how much that was contributing to overhead. It’s noticable in Java 1.6, but in Java 1.7 the original nio buffers win handily, even against “unchecked” versions of get/put that don’t do any bounds checking. I also added heap (non-direct) buffers, to see if there was any truth to a claim I read regarding mixing direct and non-direct buffers causing an overall slowdown, because then there would be two implementations of the abstract parent class, and the VM couldn’t optimize the virtual calls. That doesn’t seem to be the case any more — the JIT doesn’t care.
But, I am now very confused why the original benchmark code and the new code give such different results. The normal int[] ut is down to 42ms, slower than the 31ms in in the original benchmark, and slower still than the 27ms that the same benchmark gets in Java 1.6. The other numbers are all much better though — compare, for example, direct buffer absolute “get” performance — 119ms in the first benchmark, 19ms in the second. This is a 6x speed difference. The same compiler and JVM are used for both. I even added a ‘mixed’ set to the new benchmark, that does the operations in the exact same order as the first one (interlaving operations on arrays and int buffers), and it didn’t matter.
The new benchmark numbers are really encouraging, and mean that we’re going to probably push the nio buffers into many places, simplifying our interaction both with IO, OpenGL, algorithms implemented in JNI, etc. as well as letting us move the bulk of our large data out of the Java heap. However, I’d like to understand why the two benchmarks give such vastly different performance results. I’ve stared at the source for a while, and I’m virtually certain that they’re doing the same operations, on identically-sized arrays. Can someone explain the overall slowness of the first benchmark? Why didn’t the numbers change hardly at all between Java 1.6 and 1.7? Why are the 1.6 numbers in the second benchmark slower than the 1.6 numbers in the first?
Nicklas Larsson (Opera) — Amazon Silk
You can do "cloud browsing" in a number of ways. You can just do a proxy to the Internet, and do all the requests via a server, with a quick link to the browser. This doesn't reduce the size of the content downloaded, but you can have one connection to the server open, and can shuffle the data quicker than individual requests. Then you can do one step further, compress the content, like Opera Turbo. You may reduce the image quality, but you use a normal web rendering engine on the client, so everything will work the same way as you are used to. Then you can do what Opera Mini does, invent a new format for rendering on the client, so you don't need a real web rendering engine on the client, but something simpler and much more compact data. The last variant is to send bitmaps representing the content on the screen, and as soon as the content changes/you scroll, the browser will get new bitmaps. It is like a glorified VNC server, that is only used for the browser.
All these types of "cloud browsing" solutions have their pros and cons. It depends on the device and the network which one you want to use. And only the first two solutions can provide SSL all the way, so you might lose more customers if you go for the last two options due to security concerns.
One thing that makes me believe that Silk is using Opera Mini-like technology is that they say that they send compressed images to the client. But, watching the video, I am not really sure.
A VNC-like solution is much simpler than a solution based on markup in its design. Its drawback is usually bandwidth usage. But, for a WiFi-only device for the US market, I don't think that extremely low bandwidth usage is as important to the user. (and Amazon will be shuffling much more data into their "cloud" than out from it, so cost shouldn't be that big of a deal either for each solution) And, they create a new "cloud browser", is it really possible that they have gone through all the problems that is related to a solution not based on bitmaps, if it is not necessary for their target audience?
I personally use Opera Mobile on my Android device, since I think it is fast enough and I have unlimited data on my 3G subscription.
Then, there is a remark in the blog post, that sounds like something unique from the Silk browser: "Each time you load a web page, Silk makes a dynamic decision about which of these subsystems will run locally and which will execute remotely."
What does that mean? I don't know. But having a really flexible solution will create a lot of complexity. Should JavaScript run locally on some pages, and not on others? And if JavaScript runs locally, the rest will have to run locally to. To me, it does not make sense. We will have to wait and see.
Zack Rusin (WebKit) — ApiTrace 2.0
We have implemented so many new features since 1.0 that we have decided to bump the version number to 2.0.
Some of the new features include:
- About 10x faster tracing and 2x faster retracing
- Mac OS X support
- OpenGL 4.2 support
- Support for multi-gigabyte traces in the GUI
- Ability to display all of the uniforms
- Showing number of calls per frame, marking large frames and ability to indent shaders
- Support for `GL_GREMEDY_string_marker` and `GL_GREMEDY_frame_terminator` extensions, so you can mark frames and important pieces of code in your applications.
- Incredible amount of bug fixes, making sure that everything we throw at it just works
The huge improvements in the performance of tracing came from both flushing/syncing the trace files only if there's an uncaught signal/exception and switching to Snappy compression from zlib.
We also did some magic to seek and load on demand from a compressed file on the disk which means that we don't load all of the data at once. That allows us to load huge files in the GUI while using very little memory. For example loading a 1GB file takes only ~20MB of RAM.
All of those improvements mean that it's possible to trace and debug huge applications with little to no costs. It's quite amazing. In fact working with graphics and not using ApiTrace starting now is going to be classified as abuse.
Read the instructions and start living the life of a computer graphics superstar, which differs from the life of an average computer graphics hacker by about 10 keyboard headbutts and half a bucket of tears a week! And that's a change we can all believe in!
Nicklas Larsson (Opera) — C# day 3 - partial
Nicklas Larsson (Opera) — C# day 2 - a better C++?
What I noticed when reading this time, was that C# is really a better C++, or at least aims to be. (depending on your own preferences) You can actually see the differences from Java (at least early Java that I am used to), that C# tries to add more of the functionality from C++ but in a different and cleaner way, where Java tried to be a simpler language than C++. What I really liked was the use of use and ref keywords for references. You have to declare out or ref to the argument, when you call a function that has a parameter list with an out or ref parameter. In C++, you add an &, and then the argument becomes a reference, without you even know that it might be changed in the function that you call. (that is, if you only look at the current function, not the function that gets called, you will not see that it is passed by reference)
This is just one example of C# providing C++ functionality in a cleaner way. I am still a little bit sceptic about using C#, I want to move away from C++, and if I end up in a language too similar, what will I learn? And, I have started to believe in dynamic languages, so why a structured language? C# tries to be the perfect structured language. And, the structured language needs a lot of features I think. It can't really just be as elegant as a dynamic language, the whole idea inherited from structured languages demands that you add features, since otherwise you will feel limited, as all of you know that used the first version of Java. If you don't have generics, you will spend all your time casting, so you need that feature. In a dynamic language, you don't need generics, you just call the functions that you want, and it will fail if it doesn't exist. So, with C# I will get a feeling of how good a structured language can be, and compare it to the best dynamic language, to see who actually wins. :-)
In general, what makes a dynamic language better than a structured language, and vice versa? A dynamic language can be much simpler, fewer constructs, and at the same time deliver the same power as a structured language. Code from a dynamic language will use fewer lines of code. Code testing is better in a dynamic language, since you will be able to truly write the tests first, you can call functions that does not exist, and say that the test fails. (instead of having to write a stub for that function) Documentation is better in a structured language, you get a lot of help from type checking and access modifiers. Tools usually work better with structured languages, even if I am not sure that it will always be like that, or if it is not that we have figured out yet how to write great tools for dynamic languages. Because of the above, structured languages work better with external libraries.
Which leads to a good reason for me to learn C#. Working with external libraries. I am not used to that at all. I haven't even used STL in C++. The problem is to grasp a big set of external functionality, and to make use of them. It will be very useful for a coder that thinks that it is more fun to write a hash table implementation, than to use one.
Nicklas Larsson (Opera) — C# day 1 - everything is an object?
So from day 1, I found out that value types are objects, that is derived from System.Object. I didn't expect this, as my view on C# had been, well it is just Java with extra syntax added. I read a book a long time ago about C# 1.0, when it felt that they were really close. I also remember how unnecessary I found the struct to be (allocate objects on the stack), but in the light that int becomes part of the type hierarchy, then I see the reason for adding struct to the language. (you have to keep the simple value objects on the stack)
Zack Rusin (WebKit) — NV path rendering
I've heard about it before but lately I've been too busy with other stuff to look at, well, anything.
I've decided to spend a few seconds looking at the videos NVIDIA posted on their site. They were comparing the NV_path_rendering, Skia, Cairo and Qt. Pretty neat. Some of the demos were using huge paths, clipped by another weird path and using perspective transforms. Qt was very slow. It was time for me to abandon my dream of teaching my imaginary hamster how to drive a stick shift and once again look at path rendering.
You see, I wrote the path rendering code so many times that one of my favorite pastimes was creating ridicules paths that no one would ever think about rendering and seeing how fast I could render them. Qt's OpenGL code was always unbelievably good at rendering paths no one would ever render. Clearly these people were trying to outcrazy me.
Fortunately there's an SDK posted on the NVIDIA site and it's really well done. It even compiles and works on GNU/Linux. Probably the best demo code for a new extension that I've ever seen. The extension itself is very well done as well. It's very robust, ultimately though it's the implementation that I care about. I have just one workstation with an NVIDIA card in it, a measly Quadro 600, running on a dual processor xeon e5405, but it was enough to play with it.
The parts using Qt were using the raster engine though. I've looked at the code and decided to write something that would render the same thing but using just Qt. The results were a little surprising. Qt OpenGL could render tiger.svg scaling and rotating it at about 270fps, while the NV_path_rendering was running at about 72fps. Here's both of them running side by side:
(numbers lower for both on account of them running at the same time of course). As you can see Qt is almost 4x faster. I've figured it might be related to the different SVG implementations and rendering techniques used, so I quickly hacked the demo NVIDIA posted to open a brand new window (you need to click on it to start rendering) and render to QGLPixelBuffer but using the same SVG and rendering code as their NV_path_rendering demo code. The results were basically the same.
I posted the code for the Qt demo and the patch to nvpr_svg on github: https://github.com/zackr/qt_svg
The patch is larger than it should be because it also changed the file encoding on the saved files from DOS to Unix but you shouldn't have any issues applying it.
So from a quick glance it doesn't seem like there are any performance benefits to using NV_path_rendering, in fact Qt would likely be quite a bit slower with it. Having said that NVIDIA's implementation looks very robust and a lot more numerically stable. I've spent a little bit of time looking at the individual pixels and came away very impressed.
In general the extension is in a little bit of a weird situation. On one hand, unlike OpenVG which creates a whole new API, it's the proper way of introducing GPU path rendering, on the other hand pretty much every vector graphics toolkit out there already implements GPU based path rendering. Obviously the implementations differ and some might profit from the extension but for Qt the question is whether that quality matters more than the performance. Specifically whether the quality improves enough to justify the performance hit.
I think the extension's success will largely depend on whether it's promoted to, at least an EXT or, ideally an ARB, meaning all the drivers support it. Using it would make the implementations of path rendering in toolkits/vector graphics libs a lot simpler and give driver developer a central place to optimize a pretty crucial part of the modern graphics stack. Unfortunately if you still need to maintain the non NV_path_rendering paths then it doesn't make a whole lot of sense. Mesa3D implementation would be trivial simply because I've already implemented path rendering for OpenVG using the Gallium3D interface, so it'd be a matter of moving that code but I'm just not sure if anyone will be actually using this extension. All in all, it's a very well done extension but it might be a little too late.
Ben Smedberg (Mozilla) — Complementing Firefox Rapid Release
After Firefox 4, the Mozilla community decided that we needed to be more agile and ship Firefox faster. This “rapid release” process has been absolutely fanstastic for the Mozilla engineering/development community: we have been able to develop more quickly, and the process has made Firefox development a lot less stressful because there will always be another release in 6 weeks. But rapid release has its downsides, and I think we, as a community, should consider whether we are serving the needs of our users.
Much has been said about how the rapid release process is problematic for “enterprise” users, or other situations which use managed deployments and have unusual testing requirements. I know that we are discussing a plan to work with enterprises to provide a longer-term support system for these users.
But even for ordinary “consumer” users, there is still a significant pain point in the rapid release process. Not all extensions are keeping up with rapid release. Traditional Firefox addons are given almost infinite power to modify the application, but with this power comes a price: any change we make has the possibility of breaking an addon.
We are working on many projects to mitigate this problem. The Add-on SDK (Jetpack) gives addon authors a way to write addons against a stable API that we promise will be maintained across versions. And most of the time, even though an extension is actually compatible with a new version, we aren’t sure about this compatibility. We are planning on asking our Aurora/Beta testing audience to help us test addons to mark them compatible by default.
But even with all these mitigation strategies, there are still going to be users who have incompatible addons on each 6-week cycle, either because they are using unusual or custom addons, or because an addon which is critical to that user needs major update work which cannot be completed in a particular release cycle. Users are then given the unfortunate choice of updating Firefox and having important extensions broken, or not updating Firefox and potentially being exposed to security flaws.
We should continue the existing rapid release process: it makes our development practices better, and for a majority of users it gets them the newest and best web features and Firefox performance improvements as quickly as possible. But for users who have a long tail of addons which are updated less frequently, we should complement the rapid release vehicle with a stable release which will contain security fixes but won’t break extensions for a longer period of time. This could be a release vehicle which has updates only on a 6-12 month cadence.
This is definitely not an easy decision; maintaining a stable version will cause pain for our community. The development community will have to do security/stability backports against older code. Our testing community will somehow have to deal with an additional train of releases beyond the existing nightly, aurora, and beta release trains. We will have to deal with pressure to rush a feature into an stable release, or delay the schedule in order to pick up an important feature. Finally, a stable release will be a pain for extension authors themselves, because extensions must provide and maintain versions which are compatible with both the rapid and stable releases.
I fear that we are frustrating our users with extensions, which ought to be one of Firefox’s greatest strengths.
Surfin' Safari (WebKit) — Andy Estes is a WebKit Reviewer!
I am delighted to announce that Andy Estes is now a WebKit reviewer. Andy works primarily on web site compatibility, which means that he has become familiar with many aspects of WebCore. You can thank Andy for keeping your favorite sites working in WebKit, and now you can ask him to review your patches too!
Congratulations, Andy!
Nicklas Larsson (Opera) — Windows 8 - installed
Finally, I decided to try to install Windows 8 on the second drive, a 2 TB drive with stone age technology, instead of the 120 GB SSD that I have been using for Windows 7. Then, it suddenly worked. Of course, I had installed the version without developer tools when it started working, so another install with the developer tools and I was done.
I have also written my first 'application'. (actually, what I did was writing "Hello world" in the HTML body, but it is still an application, that is, it started when I used Visual Studio to tell it to start. Now I am at least there when I can start coding.
So, what about Windows 8? Well, I will not spend that much time on that, I will jump to coding immediately. After all, it is probably just a year or so until the applications have to be ready. :-)
Nicklas Larsson (Opera) — Windows 8 - before testing
However, the stores are closed in Sweden for another 6 hours or so, and I don't have any media that can fit 4.8GB at home (or at least I don't know where it is, if I have one). I just burned the version without developer tools to a DVD, but I will not install it, since it is the developer tools that I care about the most.
I downloaded the two files in parallell, and it worked very well, less than 15 minutes to complete the downloads.
I think it will be really fun to develop Metro applications. This is the first environment that I really believe to be super-fun to develop for. This is not the web, I know that, but it is at least web technology.
Nicklas Larsson (Opera) — Microsoft's Build conference
I am not going to guess what they will talk about. I am just going to share what I currently think of Microsoft, and that also includes what probably will happen at Build. I am going to watch the live stream of the keynote, since I think this event is one of the most important events ever in the industry.
If you listen to the debate, it sounds like Microsoft is a has-been. I see a new and strong Microsoft, a Microsoft that is easier to like. The starting point of Microsoft's new life is Windows 7. It is not that I am one of those who think that Vista was worse than XP, I preferred Vista over XP. The reason that Windows 7 is so important is that the good developers won. Only promise to deliver what you can deliver, only show what is almost complete, and that you can deliver. Deliver on time. A company that does not even control their own development process, will not be able to deliver good stuff, or shape the future. With Windows 7, Microsoft fixed that.
With a fixed development process, Microsoft was able to start doing real innovation again. You can't do innovation, if you are not sure if there will be a version of Windows to add your innovation to. We don't know that much about Windows 8 yet, but what we can see, it sure looks innovative.
A company that can deliver, and can innovate, does not have to be scared. Microsoft can now shape their own future. A company that is scared, will fight to keep their position, instead of using their skills to stay ahead of the competition. When you try to keep your position, you will do whatever you can to slow the competition down, since the competition is better than you at innovation.
Lock-in is not a viable long-term strategy. It can work well for a few years, but since technology moves on, the innovation dept for a company that tries to use lock-in as a strategy will eventually be too big. Microsoft knows that, and the new Microsoft has innovation as its strategy, not lock-in. A lot of companies (including Opera Software where I used to work) have tried to stop Microsoft from using the lock-in strategy. It has had some effect, but the biggest reason for Microsoft's change in strategy is there because Microsoft needed it, and that they were finally able to change when their development process and innovation started working.
But isn't Microsoft still evil? Well, probably, but it is hard to tell. When it comes to standards, they are accused of not implementing the new standards fast enough, and for building test cases where IE passes. The IE team has improved so much that I am happy with their development speed. As for test cases, I think that they are doing the right thing. Of course you should build test cases, and make sure that your product passes all of them before you release them. You need to prove that your tests work first. Of course, there has been some marketing coupled with the release of the test cases, but the reason for releasing the test cases have been to improve the web, no doubt about that. I think it is sad that some people can't see the difference between the work the team is doing to improve the web, and what the marketing department is doing. By releasing the test cases, Microsoft helps other browser makers to find their bugs. (and in a few cases that I know of, find bugs in their test cases, and actually help Microsoft back by fixing the bugs in the test cases, that finds bugs in IE)
Then we have the big and ugly patent fight between the biggest companies. Or may I say the marketing fight? Because especially the fight between Microsoft and Google seems to be marketing. Both cries wolf. Good thing that both companies have a lot of money to spend on both patents and marketing. Microsoft has the history of being evil, Google has the potential of being evil.
Microsoft is the only company of the big ones that has focus on the developer. This is Microsoft's strength. They get developers. They get how important it is to have partners. Microsoft is not arrogant, but they are able to listen to the developers, and deliver something that works for them. Of course, in the last years, they have tried to invent their own stuff, but Microsoft is changing. And now, with Windows 8, the only thing we know about developing for the platform, is that you are going to be able to build applications with web technology. This is from a company that tried to make sure that the web stagnated, since they were afraid that the web platform could compete with their platform. Today, Microsoft has realized that their platform is not limited to the client, and they are delivering the complete stack, with hosting in Windows Azure, and the focus is the developer's needs.
Developers, developers, developers. Do you want to go Apple, and develop in Objective C, a language that I can for no reason call a good language. Or do you want to go Google, and use their clunky Eclipse based tools for Android development? I am not fond of C#, I am really tired of the statically typed languages, and all the code that you usually need to write in them just for the simplest thing. But you still have the best development tools that the market has to offer. And now, with Windows Azure maturing, you get all you need to develop and deploy applications from one big company.
Developers is the true, legal, and moral lock-in. Build stuff that the developers like, and they will build great applications on your platform. Don't just get them there because the platform is the biggest, that does not work for Windows Phone, because of its market share, and apply the developer love everywhere. I think this is exactly where Microsoft is heading.
I am trying to adjust to living in the Microsoft world and finding a way to like it. To be able to use web technology in Windows 8 is important to me, it helps me being a believer. I have for a long time worried about two things, the hardware, and the special versions of Windows that you get when you buy a laptop. I hope this will be solved, and Intel's UltraBook concept is something that is very interesting. Today, I would buy a MacBook Air if I just looked at the hardware, but soon I think I will have a choice.
I am really looking forward to the keynote that is only 160 minutes into the future.
Nicklas Larsson (Opera) — How to accept magic?
I have decided to try to go Microsoft, running Windows, using Visual Studio, coding C#, and using Microsofts web developer tools and MVC. I am going through the tutorial of MVC, and thinks it is more magical than rails. I will promise myself not to give up until I can accept the magic.
Surfin' Safari (WebKit) — Luiz Agostini is now a WebKit reviewer!
Luiz is a long-time WebKit contributor. He has been working on maintaining and fixing bugs in the Qt port, on the implementation of the details and summary elements, on media query listeners for which he also helped writing the spec, as well as many other things. He has been an extraordinary help for the Qt port, and I am today pleased to announce that Luiz is our newest WebKit reviewer. Please join me in congratulating Luiz!
Ben Smedberg (Mozilla) — Help improve Firefox power usage!

As Mozilla increasingly focused on being the best browser for mobile devices, we will need to focus on battery usage. This is already an issue on laptops, where some browser activities like playing movies can chew through battery very quickly, but it is even more an issue on smaller phone and tablet devices where batteries are smaller and users expect at least a full day of battery life.
The first part of this project will be accurately measuring our power usage under various conditions. As with any software engineering project, you are what you measure! To that end, Mozilla is looking for both volunteers and potential paid employees who are experienced at measuring and tuning power usage on small devices. If you have experience with software or hardware tools for measuring power usage (both is even better), please contact me at benjamin@smedbergs.us, or go ahead and apply for the job.
Mozilla is a great place to work, whether you are working out of one of our offices (Mountain View, San Francisco, Toronto, Paris, London, or Auckland) or working remotely. Especially with a new project such as this one there will be plenty of opportunities to chart your own course, and improve software which is shipped to millions of users.
Surfin' Safari (WebKit) — Apple style span is gone
This week, I committed WebKit changes r92823 and r93001. They’re perhaps the most important changesets I’ve ever committed to the WebKit codebase because these changesets made WebKit no longer produce wrapping style spans on copy and paste and class="Apple-style-span" anymore. In fact, these are two changes I’ve always wanted to make ever since I started working on the WebKit’s editing component in the summer of 2009.
Introduction to Apple style spans
Apple-style-span is a HTML span element with the class “Apple-style-span”. It is created whenever WebKit applies style on text by CSS. For example, document.execCommand('HiliteColor', false, 'blue'); may produce:
<span style="background-color: #0000ff;">hello world</span>
if “hello world” was selected. The initial intent of this was so that WebKit can avoid removing or modifying elements created by the authors and meant to stay by differentiating spans added by WebKit itself and those created by the authors.
We also use an Apple-style-span to wrap the copied contents to preserve the style of the copied content. If you copy “hello world” on this page, for example, WebKit puts the following markup into the pasteboard on Mac:
<span style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Times; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><span style="color: rgb(51, 51, 51); font-family: 'Lucida Grande', Verdana, Arial; font-size: 12px; line-height: 18px; ">hello world</span></span>
Problems with Apple style spans
However, avoiding the modification of spans not created by WebKit turned out to be ineffective at best because the editing component had to add and remove so many other elements and WebKit also had to work with elements generated by other browsers and CMS editors. Also, avoiding the removal of spans without class="Apple-style-span" caused the markup to get progressively verbose over time because sometimes we had to cancel the style added by those elements e.g. (<b><span style="font-weight: normal;">unbolded text</span></b>). This was particularly apparent on mail clients that used WebKit as the editor such as Apple’s Mail or Gmail (if the user happens to use a WebKit-based browser). In some case, an e-email consisting of 3 lines of text consumed 3MB in HTML because of nested spans created by WebKit and other mail clients.
An Apple-style-span that wraps the copied contents can get far worse if the copied contents include block nodes. Consider the following markup which annotates “This is title” to be a level-1 header:
<h1>This is title</h1>
When “This is title” is copied, WebKit puts the following markup in the pasteboard:
<span style="color: #000000; font-family: Times; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><h1>This is title</h1></span>
Notice that the h1 is wrapped in a span! In addition, WebKit used to wrap contents in two spans to retain the document’s style separately prior to r86983. Here, font-family: sans-serif was set on the body element and therefore stored in a separate span below:
<span style="border-collapse: separate; color: #000000; font-family: Times; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; ">l;<span style="font-family: sans-serif; "><h1>This is title</h1></span></span>
If we paste the above example into right where the br element is in the following markup:
<h1><br></h1>
WebKit produces this:
<h1><span style="font-weight: normal; font-size: medium; "><h1>This is title</h1></span></h1>
Here, the span between two nested h1 is canceling the style of the outer h1 because the span is preserving the style of the container from which contents were copied; i.e. immediately outside of <h1>This is title</h1>. This is horrible because neither the spans nor the h1 add any semantic or visual information to the page, and it is invalid under any one of HTML4.01, XHTML1.0, and HTML5.
A Two-Year Project to Remove Apple style spans
When I started working as an intern at Google in the summer of 2009, this problem caught my attention and I decided to investigate the ways to fix it. However, ApplyStyleCommand which implements inline style application commands such as execCommand('bold') and execCommand('italitc'), and markup.cpp and ReplaceSelectionCommand which are responsible for copy and paste respectively all heavily relied on the classname “Apple-style-span“. In particular, ReplaceSelectionCommand detected and treated the wrapping spans generated by markup.cpp on copy very differently from other elements. I soon realized that removing Apple style spans require the following 3 steps:
- Improve ApplyStyleCommand not to depend on Apple style spans
- Improve copy and paste code not to use Apple style spans
- Remove Apple style spans
Since I was an intern at the time and I had only a couple of weeks left, I decided to focus on the step 1. So I fixed various bugs in ApplyStyleCommand and refactored the code.
When I came back to Google as a full-time employee, a year later, I continued to fix and refactor this class. As a result, I have devised a style application algorithm which is now partially adopted by Aryeh’s editing spec. It’s a three-phase algorithm described as below:
- Remove conflicting styles (e.g. if we’re italicizing text, then remove all instances of font-style properties with values other than italic).
- For each inline runs, remove all styles that match the style being applied (e.g. if we’re italicizing text, then we remove all font-style properties, em, and i).
- Wrap each inline runs with appropriate element or a span with style appropriate attribute; or add appropriate properties to an existing element that wraps each run.
I’m quite proud of this algorithm myself since it produces very clean markup at the end (current WebKit implementation has a bug in pushing down styles).
After I had made some progress in refactoring ApplyStyleCommand, I started cleaning up DOM serialization code in markup.cpp as well which is responsible for generating two wrapping spans. But there were a couple of obstacles I had to deal with:
- There are two conflicting createMarkup functions one used for copy and another one used for innerHTML, and they shared code by means of calling functions instead of a class hierarchy. This made it hard to modify the interface of each function and do the necessary refactoring to avoid adding wrapping style spans.
- createMarkup used for copy was a 250-line long function that serialized range, determined the highest ancestor to serialize, and added wrapping spans. It made it extremely hard to see which variable or condition depends on what.
- Various functions in markup.cpp manipulated CSSMutableStyleDeclaration but the intentions of them and implications on paste code were not obvious.
To address points 1 and 2, I decided to do a massive refactoring of markup.cpp. Since darin had already introduced MarkupAccumulator (Darin always has the best idea for refactoring!) for the innerHTML version of createMarkup, I decided to introduce StylizedMarkupAccumulator that inherits from MarkupAccumulator for the copy version of createMarkup. After the refactoring, markup.cpp started looking really clean and nice (Note that abarth extracted MarkupAccumulator.cpp shortly before I finished all the refactoring). In fact, StylizedMarkupAccumulator provided a perfect abstraction for getting rid of wrapping spans, and various refactoring made clear that this is feasible.
Now I had to address point 3. For me to get rid of “Apple-style-span”, I had to fully understand how WebKit preserves styles and how various parts of the editing component manipulate and interpret the style information. Meanwhile, I had realized the fact that various parts of editing component directly manipulate CSSMutableStyleDeclaration is problematic because of tricky properties like background-color and text-decoration from my prior experience with ApplyStyleCommand. Even seemingly simple font-weight is hard to deal with because it can take numeric values such as 700 and 400 or keywords such as bold and normal. So I introduced a new layer of abstraction, so called EditingStyle, between the editing component and the CSS component to centralizes all style manipulation code in one place. I’ve been extremely happy about this on-going refactoring effort as it has been reducing the code duplication and caught many hidden bugs.
Now, it was about time. I had addressed all 3 points that blocked me from getting rid of wrapping style spans on copy. So I started my epic attempt to get rid of wrapping style spans in May, 2011. This was not an easy job because we use copy and paste code as a part of some other editing commands, and in fact, I spent almost an entire week just to create a prototype. Since I normally submit 5 or more patches a week, spending an entire week on one patch that can’t even be submitted for a review was very unusual. But it paid off at the end. I was able to come up with a patch that gets rid of wrapping spans and does not regress a single test. Now, recall my list of things to do in order to remove Apple style spans:
Improve ApplyStyleCommand not to depend on Apple style spansImprove copy and paste code not to use Apple style spans- Remove Apple style spans
Yes, I was only left with step 3 when I landed the patch for 34564 this Wednesday. So I went ahead and finished off step 3 of this two-year project:
- Bug 66091 – Share code between isStyleSpanOrSpanWithOnlyStyleAttribute, isUnstyledStyleSpan, isSpanWithoutAttributesOrUnstyleStyleSpan and replaceWithSpanOrRemoveIfWithoutAttributes
- Bug 12248 – Apple-style-span class seems unnecessary
And there you go. WebKit revision 93001 that no longer produces Apple style spans. My (and perhaps your) dream has come true.
Acknowledgements
Of course, all of this could not happen without support from the following people and the entire WebKit community, whom I sincerely thank:
- Darin Adler
- Enrica Casucci
- Eric Seidel
- Julie Parent
- Justin Garcia
- Levi Weintraub
- Ojan Vafai
- Tony Chang
Surfin' Safari (WebKit) — Dean Jackson is a WebKit Reviewer
It is my great pleasure to announce that Dean Jackson is now a WebKit reviewer. Dean has great knowledge of transforms, transitions and animations, and is active both in the code, and in developing the relevant standards. Congratulations, Dean!
Nicklas Larsson (Opera) — Unite (or something else)
There are alternative solutions, like Pogoplug, but I don't really see that as the answer to the goals.
And a solution that I sketched on a few years ago, closer to Pogoplug, but with applications on the server written in JavaScript, had a lot of problems too. As soon as you have a local server, even the simplest to administer, you get network problems and problems that the average user needs to install it. (privacy and power should be for everyone, why should you create a solution for the people who already know how to install a server?)
Finally, this week, I saw the light. (actually, I saw a light, and it is probably a solution that has problems just like all the other solutions, but all the pieces fit very well together, so well that I can't stop thinking that this might be the problem-free solution) One of the ingredients is hosted private clouds, as an alternative to people being able to have a private cloud that they host themselves. How hard do you want it to be to keep your data private, vs how private do you want your data to be.
I am going to experiment with this for a while (it is much more to it than just hosted private clouds, but the details are not that interesting until I have a proof of concept), and see how it works. One interesting thing is that I started to think about this problem again since I wanted to create another product, and it needed some of the things that a private cloud or hosted private cloud can provide. Distractions, you never know if the distraction is more important than the product.
Nicklas Larsson (Opera) — The creativity mission
I am almost done with my 2nd pop album, well, within 2 months or so. This is an example of creativity. I write songs, that is how I prefer to be creative. When you write a song, at least if you don't have a massive amount of skills, all you can do is to sing the song, and maybe play the guitar at the same time. So, to actually be able to express my creativity, I need help. A producer and a number of musicians is all it takes to make a rough demo into a track of CD quality. Also, you need time and money to do it.
I think that this is common for all creativity, to be able to do something with your creativity, you need people, time, and money.
I wish that more people decided to spend more time being creative, instead of some of the time they spend on passive entertainment. I wish it so much, that I would like to have as my mission to help people being creative. You will always need people, time and money, but I want to reduce the actual need for it. It is for example harder to write a song without an instrument. (it will take more time, but you saved some money) Some people only have one hour of week that they can spend on creativity, and it is important that it is possible to use that hour for creativity, and not waste parts of that hour on things that does not support the creative process.
So, my mission, dream, or whatever, is to create tools that will help people to be creative. So, time to start working on the first tool!
Ian McKellar (Flock) — LXC on Ubuntu 11.04 Server
For a while I’ve been interested in Linux Containers (LXC), new way of providing Linux virtual machines on Linux hosts. Unlike machine virtualization systems like Xen, VMWare, KVM and VirtualBox, LXC is an OS-level virtualization system. Instead of booting a complete disk image Linux Containers share the same kernel as the host and typically use a filesystem that is a sub-tree of the host’s. I’d previously tried to get this running on a machine that was connected by WiFi, but basically that doesn’t work. Bridged network interfaces don’t play nicely with wireless network interfaces. I just set up a machine on wired ethernet, found a great introductory article, and I’m up and running.
Stéphane Graber‘s article is great, but it hides a bunch of the details away in a script he wrote. Here I’m going to explain how I got LXC up and running on my Ubuntu 10.04 system as simply as possible.
Install the required packages
Everything you need to set up and run LXC is part of Ubuntu these days, but it’s not all installed by default. Specifically you need the LXC tools, debootstrap (which can create new Ubuntu / Debian instances) and the Linux bridge utilities.
apt-get install lxc debootstrap bridge-utils
Set up the network
To put the containers on the network we use a bridge. This is a virtual ethernet network in the kernel that passes ethernet frames back and forth between the containers and the physical network. Once we’ve set this up our current primary network interface (eth0) becomes just a conduit for the bridge (br0) so the bridge should be used as the new primary interface.
Add the bridge in /etc/networking/interfaces:
# LXC bridge
auto br0
iface br0 inet dhcp
bridge_ports eth0
bridge_stp off
bridge_fd 0
bridge_maxwait 0
And change eth0 to be manually configured, ie: it doesn’t DHCP:
auto eth0 iface eth0 inet manual
Now bring up the interface:
ifup br0
Set up Control Groups
Control Groups are a fairly new Linux mechanism for isolating groups of processes as well as managing the resources allocated to them. The feature is exposed to userland via a filesystem that must be mounted, so put this in your /etc/fstab:
cgroup /cgroup cgroup
Create the mount point, and mount it:
mkdir /cgroup mount /cgroup
Now we’re ready to create containers
An LXC container is a directory under /var/lib/lxc. That directory contains a configuration file named config, a filesystem table called fstab and a root filesystem called rootfs. The easiest way to do that is to use the lxc-create script. First we create a configuration file that describes the networking configuration, let’s call it network.conf:
lxc.network.type = veth lxc.network.flags = up lxc.network.link = br0
and then run lxc-create to build the container:
lxc-create -n mycontainer -t natty -f network.conf
Note, -n let’s you specify the container name (ie: the directory under /var/lib/lxc), -f lets you specify a base configuration file and -t lets you indicate which template to use.
Container templates are implemented as scripts under /usr/lib/lxc/templates. Given a destination path they will install a base Linux system customized to run in LXC. There are template scripts to install Fedora, Debian and recent Ubuntus as well as minimal containers with just busybox or an sshd. Template scripts cache completed root filesystems under /var/cache/lxc. I’ve found the container template scripts to be interesting and quite readable.
Starting a container
Starting the container is as simple as:
lxc-start --name mycontainer --daemon
If you leave off the --daemon then you’ll be presented with the container’s console. Getting a console is as simple as:
lxc-console --name mycontainer
Keeping containers straight
Each time a container is started it will be allocated a random MAC (ethernet) address. This means that it’ll be seen by your network as a different machine each time it’s started and it’ll be DHCPed a new address each time. That’s probably not what you want. When it requests an address from the DHCP server your container will pass along its hostname (eg: mycontainer). If your DHCP server can be configured to allocate addresses based on hostname then you can use that. Mine doesn’t so I assign static ethernet addresses to my containers. There’s a class of ethernet addresses that are “locally administered addresses”. These have a most-significant byte of xxxxxxxx10, ie: x2, x6, xA
or xE. These addresses will never be programmed into a network card. I chose an arbitrary MAC address block and started allocating addresses to containers. They’re allocated by adding the following line after the network configuration in the /var/lib/lxc/mycontainer/config file:
lxc.network.hwaddr = 66:5c:a1:ab:1e:01
Managing your containers
There are a few handy tools for container management, beyond the lxc-start and lxc-console mentioned before.
lxc-stop --name mycontainer does what you’d probably expect.
lxc-ls lists available containers on one line and running containers on the next. It’s a shell script so you can read it and work out how to find which containers are running in your own scripts.
lxc-ps --lxc lists all process across all containers.
There are more like lxc-checkpoint, lxc-freeze and lxc-unfreeze that look pretty exciting but I haven’t had a chance to play with them. There are also a set of tools for restricting a container’s access to resources so that you can prioritize some above others. That’s a story for another day.
Ian McKellar (Flock) — We already have information, why do we need more data?

I love gadgets and metrics and pretty graphs. I’ve been using Endomondo to track my cycling, primarily my commute. I know it’s about 6.5km an I ride it in between 22 and 26 minutes. I can even share or embed my workout here. I love that shit. When I get to work in 21 minutes I feel awesome. What it doesn’t tell me is that riding to work is good for my health. I don’t need a fancy app on my $500 mobile phone to tell me that.
Fancy pedometers like the Fitbit or Jawbone’s newly announced Up are neat gadgets, but are they really going to help anyone become healthier? More importantly are they going to help stem the slide of some countries into unhealthy patterns like obesity?
The target market for these devices is affluent and health conscious. They already know that they should be eating less fat, more fiber and exercising more. They can afford a good bicycle, a personal trainer or fancy running shoes. Anyone who is forking over a hundred dollars for a pedometer already knows more about the impact of their lifestyle on their health than these gadgets will give them.
These gadgets aren’t doing anything to educate less health literate Americans about living healthier lifestyles. They aren’t doing anything to address childhood nutrition here or around the world. They’re a distraction from the real problems we face.
I still kind of want one.
Ian McKellar (Flock) — The full Bradley Manning / Adrian Lamo logs
(06:08:53 PM) info@adrianlamo.com: What’s your greatest fear?
(06:09:24 PM) bradass87: dying without ever truly living
via Manning-Lamo Chat Logs Revealed | Threat Level | Wired.com.
Everyone should read (apparently) this full chat log. In it Manning, a 22 year old depressed man, questioning his gender reached out to Lamo for someone to talk to. While Manning poured out his story of growing up with abusive, alcoholic parents Lamo repeatedly assured him that he was safe to talk to. Manning denied having a “doctrine”, but he did have a clear sense of morality:
(1:11:54 PM) bradass87: and… its important that it gets out… i feel, for some bizarre reason
(1:12:02 PM) bradass87: it might actually change something
(1:13:10 PM) bradass87: i just… dont wish to be a part of it… at least not now… im not ready… i wouldn’t mind going to prison for the rest of my life, or being executed so much, if it wasn’t for the possibility of having pictures of me… plastered all over the world press… as a boy…
via Manning-Lamo Chat Logs Revealed | Threat Level | Wired.com.
When Lamo was chatting to him, Manning had been demoted and had lost his access to classified networks. Any good or ill he had done by leaking to WikiLeaks was over. He was going to be discharged. He’d started to set up his identity as a woman. He was just 22, trying to serve his country, serve humanity and work out who he was.
Surfin' Safari (WebKit) — 4 new WebKit reviewers!
I’m happy to announce that we’ve added 4 new reviewers to the roster: Chang Shu, No’am Rosenthal, Zoltan Herczeg and Philippe Normand. They are all long-time WebKit contributors, each with their own areas of expertise.
Chang (Boston, US) is well versed in the HTML editing code and spatial navigation.
No’am (Sunnyvale, US) is a QtWebKit wizard, responsible for accelerated compositing, the QObject/JavaScript bridge, and countless other things.
Zoltan (Szeged, Hungary) is working on improving the performance of JavaScript and SVG filters.
Philippe (Barcelona, Spain) is one of the most active WebKitGTK+ developers, and the go-to guy for GStreamer multimedia in WebKit.
Please join me in welcoming them!


