snek

This has been discussed a few times on IRC, but no one has made a proposal yet afaik.

It wasn't TS's idea, stage 3 exists purely for getting feedback from implementations about implementing and using the feature.

It's already been deployed in the wild for about a year.

Engines hold the entire source anyway, with the exception of XS, which returns "[native function]" for everything.

You only need to target old es if you're deploying a website for a big company. Most people don't need IE6 compat. For example, people writing node apps can choose which version of node they deploy.

The Function.prototype.toString change has been in chrome for maybe a year now btw.

Optional chaining is stage 3, and major engines are actively implementing it.

Yeah they really buried the lead here.

I got an email this morning that my hulu had been logged into... my hulu and my robinhood did in fact share a password. I have no evidence that these are connected, but better safe than sorry. (And I do use 1password now, I just didn't back when I used robinhood and hulu).

I think you actually make the opposite point you're trying to make. Wikipedia doesn't use JS for navigation, just to provide those little popups. If you have no JS, the site works exactly the same.

I installed noscript to test this, and yes, the beta rewrite, whose selling point is react, is faster when react isn't allowed to run.

Did you read the article?

I would assume the skia wasm blob can be integrated with cairo canvas, as it has the same exposed api.

Your response makes it sound like this is intended more for cases where a site uses innerHTML and its too much of a burden to rewrite, so you allow only that innerHTML, but that allowed innerHTML is still susceptible to XSS, so what is the point?

As a side note, having a header to disallow innerHTML and etc is definitely a good step, but the rest of this seems superfluous or even leading to a false sense of security.

We have APIs to put content in DOM elements without it being interpreted as html, and we have APIs to build DOM elements without using strings. Given that trusted types don't actually prevent xss from occuring and only make your data flow more explicit, why not just recommend to developers that they use the other APIs, instead of adding this new one?

You have to sign up to read the report? I guess I'm never reading this report.

it costs money to be private

There is a deep comparison in the video in the post.

Even better, what if I have it on github because github pages is my site host?

haveibeenpwned doesn't accept plain-text passwords for checking, they use a k-anonymity model to protect both your passwords and the passwords in the database. the same goes for email addresses.

https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByR...

> Are there projects out there using web assembly in production?

pspdfkit, unity, google earth, and figma spring to mind. Obviously more stuff is using it, but it isn't like there's a big index of sites using wasm.

> What kind of application needs more performance than Javascript can offer, but doesn't need full native performance?

Wasm and JS can achieve equal performance in modern browser engines (and note that in engines like v8, there are operations that can be reduced such that they compete with output from gcc and clang). The thing that wasm is designed to do is make that performance predictable. Optimizing JS requires a lot of guesswork which can end up incorrect, while wasm doesn't require any guesswork because it is strongly typed and uses a regular bytecode. Right now what is holding wasm back is coming up with all the best ways to reduce it to the machine code of the specific platform, and ways to reduce the performance hits of security checks wasm has. For example, v8 recently sped up wasm memory access by ~30% by getting rid of bounds checks and using mmap + sigsegv to detect out of bounds access.

The thing I'm most excited about right now is WASI. It provides abstractions for system calls like fs, sockets, graphics, etc. But the best part is that the entire API is being designed with security and capabilities in mind. WASM binaries have to explicitly declare resources they want access to, or risk not being allowed to access them. (The application could also choose to further prompt the user, but i think in most cases they will just be denied). Once resources are acquired, we use unforgable handles to refer to them. It is a super cool and declarative way to make sure people know exactly what a wasm bin will try to access before it's even run.

concurrency yes, parallelism no(t yet). each wasm module is single threaded, but you can create multiple modules in separate threads that communicate with each other via shared memory and atomic ops, but of course you have to figure out how to correctly emit modules that take advantage of this. So far emscripten's pthread is the only thing I'm aware of that properly does this.

According to a 2011 study by Google, there are on average more people with just low vision/blindness online than there are Canadians online, and visual impairment is just one kind of disability.

LGTM https://gc.gy/31025051.png

which airbus planes do you avoid?

that feel when isitmax8.com is already taken

I just got an X1 extreme, and although windows 10 pro really underwhelmed me (not very responsive, poor battery life, etc), putting linux on this thing has been an absolute dream. The battery life easily matches my old macbook air, and the performance is fantastic. From what I've seen over the past few weeks while getting moved into my laptop, the carbon series has even better support from the linux ecosystem than the extreme does.

Whatever country I live in, I certainly didn't choose to be born there, and moving to another country is often more expensive than is possible for most people. I don't see how this compares to actively seeking a job at Facebook. I also don't think that the US doing bad things is an excuse for Facebook to do bad things.