Neil's Place

August 8, 2004

2:09 PM XUL 2.0 Prioritized

I've now taken my XUL 2.0 wishlist and prioritized the items. I haven't explained my reasoning yet, but the order is based on various factors, including the demand for a feature, how difficult it is to workaround, and how difficult it would be to implement. Add a comment if you don't agree with the order I've put things in.

Note that three of the items are already being implemented.

Comments ( 11 )

August 7, 2004

Mozilla Developer Day Notes
Lots of info from the recent developer day

August 1, 2004

11:48 AM Codebase Principals

There's a preference in Mozilla called 'signed.applets.codebase_principal_support'. I've seen numerous XUL application authors and others encourage their users to set this preference to true. I'd imagine a significant number of mozdev developers have this enabled. What does enabling this preference do? It allows all web sites on the Internet to delete files on your hard drive with only one click.

OK, that's a bit misleading. What it really does is allows permissions to be granted based on the hostname and directory of a site rather than its certificate. It effectively disables code signing in a sense, which means that unsigned code can run after the user clicks OK in one dialog box. Also, it allows this for every web site, not just a particular one.

Now, I don't think code signing provides much extra security, since malicious code can also be signed. However, one generally has to pay for certificates ($300-$400 per year), and figuring out how to sign code is such a complex task that no one bothers, and as a result, you won't find a lot of signed code around. Still, there is at least some comfort with signed code, since one can see the name of the organization which signed it, assuming that someone isn't trying to trick you by using a certifcate from 'Amazon Retailers' instead of ''.

The point though, is that enabling the codebase principals preference reduces your security, and no author should ever be asking their users to enable it.

Comments ( 12 )

July 28, 2004

8:11 PM XUL Template Examples

One of the most difficult things to get working in XUL is templates. If you do have problems, perhaps you might find these 30 new template examples useful. Also, you can view them using a simple XUL viewer.

Comments ( 30 )

July 23, 2004

3:52 PM Mozilla document.all

Looks like Mozilla just added support for document.all in order to get more sites working. However, there is a slight difference. If you just use it to detect the presence of the property, as many do for browser detection, the check will return false. For instance the condition 'if (document.all) ...' will be false.

Comments ( 6 )

July 20, 2004

4:18 PM XUL Enhancements for the Future

I've put together a big list of enhancements (90 items altogether) that I think would be useful for XUL in Mozilla 2.0. Please comment there with items you like, or don't like, or any ideas you might have regarding any of the items. Feedback will be reviewed by Mozilla 2.0 developers to better prioritize what needs to be done.

Comments ( 30 )

July 13, 2004

10:40 AM Apple Canvas

In order to compare for the Mozilla canvas tag, I took a look at the Apple Dashboard canvas tag source code to see what it did. I found the canvas code fairly easily since the KHTML code is pretty understandable, compared to, say, Mozilla's code. Here's the API:

HTMLCanvasElement {
  Context getContext()
Context {
  scale(float x, float y)
  rotate(float angle)
  translate(float x, float y)
  setStrokeColor(string color)
  setStrokeColor(string color, int alpha)
  setStrokeColor(int graycolor)
  setStrokeColor(int graycolor, int alpha)
  setStrokeColor(int r, int g, int b, int a)
  setStrokeColor(int c, int m, int y, int k, int a)
  setFillColor(string color)
  setFillColor(string color, int alpha)
  setFillColor(int graycolor)
  setFillColor(int graycolor, int alpha)
  setFillColor(int r, int g, int b, int a)
  setFillColor(int c, int m, int y, int k, int a)
  setLineWidth(float linewidth)
  setLineCap(string type) - type is either "round" or "square"
  setLineJoin(string type) - type is either "round" or "bevel"
  setMiterLimit(float limit)
  moveToPoint(float x, float y)
  addLineToPoint(float x, float y)
  addQuadraticCurveToPoint(float cpx, float cpy, float x, float y)
  addBezierCurveToPoint(float cp1x, float cp1y, float cp2x, float cp2y, float x, float y)
  addArcToPoint(float x1, float y1, float x2, float y2)
  addArc(float x, float y, float r, float startAngle, float endAngle)
  addRect(float x, float y, float w, float h)
  clearRect(float x, float y, float w, float h)
  fillRect(float x, float y, float w, float h)
  strokeRect(float x, float y, float w, float h)
  drawImage(image, int x, int y, int w, int h, string composite)
  drawImageFromRect(image, int sx, int sy, int sw, int sh,
                    int dx, int dy, int dw, int dh, string composite)
  setShadow(float width, float height, float blur, string color)
  setAlpha(float alpha)
  setCompositeOperation(string composite)

It's pretty logical. Could be adapted to other browsers for the most part. One advantage of building an API like this is that Apple can construct it suit their platform. For instance, the Mac has a function CGContextSetMiterLimit, so the canvas has a similar setMiterLimit function. Mozilla doesn't have such a function. Interesting that there are no text drawing in the above set of functions. The Mozilla graphics code has stuff to draw text and get the width of text in certain fonts, which is why these functions would appear in the Mozilla canvas tag. Everyone does code this way, which is why the IE specific features tend to look like things created by Microsoft since developers tend to make things in a similar fashion to the rest of the platform.

If a standardized canvas tag appears, perhaps through the WHAT-WG, I'd imagine it would incorporate the best or worst of everything.

Comments ( 33 )

July 11, 2004

11:14 PM Updated ReoPath Expression Language Release

Since someone brought it up, I thought I'd release a new build of ReoPath, which is a Mozilla component which adds an XPath-like expression language for RDF. ReoPath consists of two parts, an expression language, which you can use to evaluate and retrieve results from RDF, and a template language, which you can use to bind RDF data to XUL or XML nodes, as a databinding system. Here is an simplified example which displays a list of the titles of things.

<listbox id="theList" rp:repeaton="%*[dc:creator='Neil']">
  <listitem rp:assignattr="label" rp:assign="dc:title"/>

This version has a number of new features. It is much more efficient, much less crashy, and it auto updates when the RDF changes. And more interesting, it also supports templates using XML sources and XPath as the expression language. In addition, it's also possible to use custom expression languages.

It's also now available for both Linux and Windows. Mozilla 1.7 or Firefox 0.9 are needed.

Install: Linux | Windows

Once installed, and you've restarted your browser, you can go to the URLs below to try the samples. The first displays a list of actors and you can select one to see a bit of information about them. The second is a very simple RSS 2.0 viewer implemented in less than 1K.


There's some documentation on the project page. If someone is interested, I can write some more.

Comments ( 25 )

July 3, 2004

12:39 PM Ideas with nowhere to go

People have asked recently if any of my ideas have had any kind of influence over Mozilla developers. Probably not, but it's hard to tell.

I've noticed that there tends to be three types of developers in the Mozilla community. At the top you have Mozilla Foundation employees and anyone that used to work at Netscape. In the middle are the people that don't fit that group but are key developers. Finally, you have all the extension and XUL developers. I find that communication between two adjacent tiers is fairly decent, but communication between the upper and lower tiers is poor. This is a big generalization, of course; some people don't fit that model.

The more interesting question is that the various people building XUL applications feel that they don't have any way of expressing their opinions either. They ask me if I have any contact into Mozilla rather than than just asking Mozilla folks directly. Mozilla doesn't have any clear way for these voices to be heard. The best idea Mozilla folks have come up with is Bugzilla voting and mailing lists apparently about screen savers. Are there other options? Probably. Does any one know what they are? Unlikely.

I have all kinds of grand visions for what I'd like to do. I've posted many of them or hints about them over the last year or so. Remote XUL, improved templates, a canvas tag, and so forth. In some cases, I started an implementation only to be blocked by some non-implementation related issue. I actually started implementing something so that chrome URLs could be mapped onto http URLs but I stopped after it seemed unlikely that it would ever make it into Mozilla. I started working on some features for XUL templates, but Axel said that "creating template enhancements [is probably not] the right thing to do at the moment", so I didn't continue. I did get to the point where I posted a patch about the canvas tag, but then other developers seemed to take over and the patch disappeared into the Pit of Forgotten Patches. When Alex Vincent created a serverpost tag, no one seemed to want to accept it so it never got any where.

Anyway, various factors have made it very discouraging to try to improve Mozilla in some way, even though I think I'm able to.

Comments ( 17 )