yoavweiss

Self-Review Questionnaire: Security and Privacy

This questionnaire has moved.

1. What information does this feature expose, and for what purposes?

No Information is exposed.

2. Do features in your specification expose the minimum amount of information

yoavweiss

noopener-allow-popups Cross-Origin-Opener-Policy value

Some origins can contain different applications with different levels of security requirements. In those cases, it can be beneficial to prevent scripts running in one application from being able to open and script pages of another same-origin application. Such a document need to ensure its opener cannot script it, even if the opener document is a same-origin one.

The noopener-allow-popups Cross-Origin-Opener-Policy value severs the opener relationship between the document loaded with this policy and its opener. At the same time, the opened document can open further documents (as the "allow-popups" in the name suggests) and maintain its opener relationship with them, assuming that their COOP policy allows it.

yoavweiss

#!/bin/bash
hidutil property --set '{"UserKeyMapping":[{"HIDKeyboardModifierMappingSrc":0x700000064,"HIDKeyboardModifierMappingDst":0x700000029}, {"HIDKeyboardModifierMappingSrc":0x700000029,"HIDKeyboardModifierMappingDst":0x700000073}]}'

yoavweiss

var DOMTokenListSupports = function(tokenList, token) {
  if (!tokenList || !tokenList.supports) {
    return;
  }
  try {
    return tokenList.supports(token);
  } catch (e) {
    if (e instanceof TypeError) {
      console.log("The DOMTokenList doesn't have a supported tokens list");
    } else {

yoavweiss

var DOMTokenListSupports = function(tokenList, token) {
  if (!tokenList || !tokenList.supports) {
    return;
  }
  try {
    return tokenList.supports(token);
  } catch (e) {
    if (e instanceof TypeError) {
      console.log("The DOMTokenList doesn't have a supported tokens list");
    } else {

yoavweiss

<picture>
  <source srcset="http://placehold.it/300.png">
  <img src="http://placehold.it/100.png" id=bla>
</picture>
<script>
(function() {
  var img = document.getElementById("bla");
  img.parentNode.removeChild(img);
})();
</script>

yoavweiss

var tokenListSupports = function(tokenList, token) {
  if (!tokenList || !tokenList.supports) {
    return false;
  }
  try {
    return tokenList.supports(token);
  } catch (e) {
    if (e instanceof TypeError) {
      console.log("The DOMTokenList doesn't have a supported tokens list");
    } else {

yoavweiss

/**
 * Media query to detect full screen mode!
 * Y U NO WORK Chrome??
 * Firefox, you’re lovely.
 */

body {
	background: red;
	font: bold 400% Helvetica Neue, sans-serif;
	color: white;

yoavweiss

Official RICG Web sites

• http://responsiveimages.org/ - contains links to the specs, repos, etc
• http://ricg.io/ - contains feature status

Articles explaining the various use-cases and solutions:

• https://dev.opera.com/articles/native-responsive-images/ - An explainer article I wrote.
• https://dev.opera.com/articles/responsive-images/ - A "cookbook" with all the various permutations of use-cases, by Andreas Bovens.
• http://ericportis.com/posts/2014/srcset-sizes/ - An awesomely funny article explaining srcset and sizes.
• http://www.smashingmagazine.com/2014/05/14/responsive-images-done-right-guide-picture-srcset/ - An explainer by Eric Portis.

yoavweiss

    TestCase testCases[] = {
 24         {"screen", 300},
 25         {"(min-width:500px)", 300},
 26         {"(min-width:500px) 200px", 200},
 27         {"(min-width:500px) 200px, 400px", 200},
 28         {"(min-width:5000px) 200px, 400px", 400},
 29         {"(blalbadfsdf) 200px, 400px", 400},
 30         {0, 0} // Do not remove the terminator line.
 31     };