But JavaScript modules can have more than just exports. They can have arbitrary statements: function calls, variable assignments, etc. These can have side effects on the execution environment
Rollup has a moduleSideEffects: false option to control assumptions around this, but has to be conservative by default.
make devdata
This repository is only available to Hypothesis staff. External developers can ignore this step.
A floating point number giving the time of the point in seconds, relative to the duration of the target resource
The duration value cannot be both expressed in seconds and relative to the duration of the target resource. If this meant to say, "since the start time of the resource", that would make more sense.
Support for quantized models is incomplete (they run, but very slowly).
This has changed as of v0.16. Quantized models now run efficiently on both Arm and x86-64.
Performance on eg. one of the small Llama models is respectable, but llama.cpp is still somewhat faster.
A from-scratch release build takes about 30 seconds on my 2020 Intel MacBook Pro.
Or about 16 seconds on my newer M3 Pro.
Loop blocking for linear algebra codes often have three levels: register blocking, L2 cache blocking, and L3 cache (or TLB) blocking.
Some notes on blocking for different purposes in GEMM operations.
Social media threads - https://bsky.app/profile/mitsuhiko.at/post/3lbv32bbxxc2h
Ordered list outside a block quote, with numbering that starts from 2:
Ordered list inside a block quote with numbering that starts from 2:
- Foo
- Bar
In the Hypothesis client, the start numbering of ordered lists is preserved. In the HTML output in the API and shown at https://hypothes.is/search, it is not.
Additionally in activity pages, there is a problem that the list bullets for ordered lists are not rendered, although the <ol> tags are present in the HTML.
Compare the rendering of this annotation in the client vs activity pages - https://hypothes.is/users/robertknight?q=url%3Ahttps%3A%2F%2Fhypothes.is%2Fdocs%2Fhelp%3Felife_test%3D1.
See https://blog.mozilla.org/data/2022/01/31/this-week-in-glean-building-and-deploying-a-rust-library-on-ios/ for an updated version of this article.
Blog post on XNNPack / Tensorflow Lite's recently added FP16 support.
When the compatible model is delegated to XNNPack on a hardware with native support for FP16 computations, XNNPack will transparently replace FP32 operators with their FP16 equivalents
Interesting, so it looks like it is possible to get away with automatically reducing precision of weights for FP32 ops at runtime.
Computes the absolute values of packed 8-bit integers in a.
Pre-AVX512 256-bit instructions start here. All the _mm256* items at the top of the page are AVX512.
Useful post on Profile Guided Optimization and BOLT (post-link optimization) in Rust.
electrons and proton
Test
as Raymond Chen has aptly noted in his blog
https://devblogs.microsoft.com/oldnewthing/20040106-00/?p=41193
When someone needs something more lightweight, I generally point them to lexopt due to the simpleness of the design.
lexopt looks useful for minimalist CLI parsing. See https://github.com/blyxxyz/lexopt.
Module I: Leading and Managing Purposefully with a Community Approach
Quick test
hardware 3d acceleration
Yet another comment
improve this was to break the polygon
And another comment
360 000
And another comment
32-bit processor
Another comment
ridge racer or tekken 2
A test annotation.
Blog post comparing ASG (Auto Segmentation Criterion - yes, the last letter doesn't match) to CTC (Connectionist Temporal Classification) for aligning speech recognition model outputs with a transcript.
Charlie
Quick test
The actual OCR service uses OpenCV and TensorFlow, both written in C++ and with complicated library dependencies; so security exploits are a real concern.
Aha - something I could address with Rust.
We ended up using a classic computer vision approach named Maximally Stable Extremal Regions (MSERs), using OpenCV’s implementation.
Interesting that they decided not to go with eg. pixel classification.
An overview of the OCR system that powers Dropbox's document scanner.
These days if you want to simulate something in the physical world you use a computer.
Test
Critiques
Quick test
Very long essay about dependency management and version bounds.
see the TOSA specification
Spec link is broken. See https://www.mlplatform.org/tosa/tosa_spec.html.
or Twitter.
You can also find me on Mastodon: https://sigmoid.social/@robertknight
If you're reviewing a
Quick test
COCO-Text: Dataset for Text Detection and Recognition
See also the COCO-Text V2 site.
OSD
Orientation and Script Detection
Chapter 11. Nightgown.
Quick test
SOCKPUPPET
According to Wikipedia: A sock puppet is an alternative online identity or user account used for purposes of deception.
Putin’s been accused of using his pet Labrador to frighten Angela Merkel
More on that here: https://www.businessinsider.com/putin-merkel-meeting-dog-2017-7?r=US&IR=T
Prince Henry the Navigator
Utilities for improving accessibility with screen readers.
To understand the CSS properties used by the sr-only class, see blog posts from WebAIM and Cloud Four.
Yet another way of categorizing arguments is to consider their status or stasis—that is, the specific kinds of issues they address.
This works
Testing YouTube embeds. See https://github.com/hypothesis/product-backlog/issues/1297.
Given a function of mapping a nnn-dimensional input vector xx\mathbf{x} to a mmm-dimensional output vector, f:ℝn↦ℝmf:Rn↦Rm\mathbf{f}: \mathbb{R}^n \mapsto \mathbb{R}^m, the matrix of all first-order partial derivatives of this function is called the Jacobian matrix, JJ\mathbf{J} where one entry on the i-th row and j-th column is Jij=∂fi∂xjJij=∂fi∂xj\mathbf{J}_{ij} = \frac{\partial f_i}{\partial x_j}
Quick test
Change; captains, admirals, the dark “interlopers”5 of the Eastern trade, and the commissioned “generals” of East India fleets
This works
had good hold, made his way aft and sat down amongst us. We exchanged a few words lazily. Afterwards there was silence on board the yacht. For some reason or other we did not begin that game of dominoes. We felt meditative and fit for nothing but placid staring. The day was ending in a serenity of still and exquisite brilliance. The water shone pacifically; the sky, without a speck, was a benign immen- sity of unstained light; the
Quick test
The budget constraint clearly shows the tradeoff Alphonso faces in choosing between burgers and bus tickets. Suppose he is currently at point D
Quick test
The Copenhagen meeting in September of 1979 and the iridium papers of 1980 triggered a storm over the Cretaceous-Tertiary mass extinction that raged through the entire decade of the 1980s
Quick test
The German philosopher Immanuel Kant (1724–1804) delved into the critical limits of knowledge in his revolutionary text, The Critique of Pure Reason (1781).
Suggested Further Reading
Quick test
Or what about this
about an 80% in energy density
Should say "80% increase in energy density"?
Now you have the extension up and running. It's time to start annotating some documents.
Quick test
REQUIEM FOR A LOST WORLD
Hello ebooks 📚
figure 3
Should say Figure 13
As long as expressions typed into the Web Console are side-effect free
Does anyone know how "side-effect free" is determined?
TPG is an accessibility solutions provider offering full-service accessibility consulting and a leading provider of accessibility monitoring and management software solutions.
This is a test annotation.
How likely are you to pop open the browser developer tools to look for an overzealous aria-label on a <div>-as-button-via-role-sans-keyboard-handler monstrosity to explain that the button you thought said “Submit” is the one the user hears as “Activate this button to submit this form,” all thanks to a well-meaning developer who thought it was necessary?
Example of a problem caused by mismatched labels for different users.
Safari Settings: Advanced > Accessibility > Press Tab to highlight each item on a webpage
In Safari 13.0.5 on macOS 10.15:
System Settings: Keyboard > Shortcuts > Full Keyboard Access > All controls
I think this may be out of date. On macOS 10.15 (Catalina) I see no such option. However there is an option to enable keyboard navigation with a different label ("Use keyboard navigation...").
What language is this?
איזו שפה זו?
Should only be "Strict" or "Lax".
What about setting the value to None for a cookie where it is specifically desired for the cookie to be available in a third-party context?
Third-party cookies are eventually going away so perhaps that is not a viable option long term.
This
Domain
Annotation two
Example
Annotation one
Manual for my espresso maker.
ommittee is a subset
Test.
RRID:WB-STRAIN
Annotation on the second "RRID:WB-STRAIN" text
RRID:WB-STRAIN
Annotation on the first "RRID:WB-STRAIN" text.
Hypothesis
This is a demo of an H5P-enabled Hypothesis client. It also shows how OAuth can be used to create customized clients which talk to the Hypothesis backend.
Go to the Page Notes for more details.
<iframe src="https://h5p.org/h5p/embed/6725" width="1090" height="387" frameborder="0" allowfullscreen="allowfullscreen"></iframe><script src="https://h5p.org/sites/all/modules/h5p/library/js/h5p-resizer.js" charset="UTF-8"></script>
The online teacher creates, selects, and organizes appropriate assignments and assessments to align curricular content with associated standards-based learning goals
This is a test to investigate a Hypothesis bug report. See https://github.com/hypothesis/lms/issues/875
Try it out!
Hi Tom!
Thanks for sharing your feedback on Hypothesis UX at iAnnotate this year.
If you use the Hypothesis client with the “clean” theme I recommend using the data-hypothesis-trigger attribute to create a button or other affordance to open the sidebar. See https://h-client.readthedocs.io/en/latest/publishers/host-page-integration/ for details. This allows users to see comments without having to find a highlight.
A caveat here is that the rewriting may add quite a lot of code to your bundle,
See this GitLab issue for a real-world example of where this became a problem.
AngularJS
Since a few candidates have asked this, we're not wedded to Angular as a framework, but it was perceived as a sensible choice back in the early days of the project in 2013-2015. In more recent times we've had higher-priority technical issues to address.
Setting the future technical direction and helping to implement it is part of the role.
im2col utilities could be found in the second assigment files of CS231n.
Broken link. I found a copy at https://github.com/yunjey/cs231n/blob/master/assignment2/cs231n/im2col.py
produced with cPickle
Corrected link for Python 3: https://docs.python.org/3/library/pickle.html
The simplest way to generate a private key and self-signed certificate for localhost is with this openssl command:
Keys generated using this command are trusted by browsers (I've tested with Safari, Chrome, Firefox).
I found that they were not trusted by SSL client libraries (eg. Python's ssl package or requests) which use openssl because the keyUsage setting is missing the keyCertSign flag.
Changing the keyUsage= section to keyUsage=digitalSignature,keyCertSign resolved the problem.
Code is at: this https URL
Broken link, should be: https://github.com/facebookresearch/Detectron
disable DoH
Should this say enable DoH under all circumstances? Presumably the current default, mode 0, is always off anyway.
and agree to them before you start annotating
We added a link to the privacy policy, terms of service and community guidelines on the sign up page. We added a checkbox that you have to tick before you can sign up.
For the Hypothesis website, we’ve taken new steps to anonymize the information we collect
In practical terms this means that we turned on Google Analytics' IP anonymization feature which zeroes that last octet of your IP address.
probably UTF-8
Almost certainly UTF-8 on macOS and Linux. I'm not sure about Windows.
What encoding are literal byte strings in?
It wasn't clear to me after reading this, but -*- coding: utf-8 -*- comments are redundant in Python 3 because the default encoding of files is UTF-8.
Before adding a new collaborator, they will need to generate a GPG key. GitHub has good instructions for doing this
Steps for new developers to create public keys.
Hypothesis admins can manage the members for a group in the admin dashboard at https://hypothes.is/admin/groups/
it has been reported in 2008 but not yet being worked on by anyone.
This issue has now been fixed.
For security reasons, after you navigate off the page, you will not be able to see the token again.
So if you forget your token, you'll need to generate a new one :)
A high-level technical explanation of how Dropbox's PDF annotation interface is implemented.
Quite interesting for Hypothesis.
This is a test client which shows: 1) how to use OAuth to create customized Hypothesis clients and 2) is a prototype of support for H5P, a system for creating embed-able interactive content such as quizzes etc.
To add a new annotation with H5P content:
Next, try creating your own interactive content on H5P.org and pasting embed links here.
🤠 - H5P content is sandboxed to prevent malicious abuse. Some functionality may not be available. Let me know if you find issues.
Contact me at robertknight@hypothes.is
Welcome to the BioPub website 🔬.
This is a demo site designed to show various aspects of how Hypothesis can be integrated by publishers into their articles.
To learn more, have a look at the project's README on GitHub.
The ULEZ standards are:
See the table at https://www.rac.co.uk/drive/advice/emissions/euro-emissions-standards/ for a rough guide to what standard a vehicle meets based upon its date of registration.
Tutorial: OAuth
This page is about OAuth v1. Most web services, including Google APIs, now use OAuth v2 which is simpler in various respects. The documentation for that is https://developer.chrome.com/apps/app_identity
Unfortunately not every database supports savepoints and SQLite is precisely one of those that doesn’t
I'm not sure if this is still true, SQLite does have a SAVEPOINT command now. Whether SQLAlchemy supports it and whether there are any limitations with it I don't know.
Transaction objects manage resources for an individual activity.
For a more detailed introduction to the transaction package, see https://zodb.readthedocs.io/en/latest/transactions.html
Lyft partners
Testing a possible change for Hypothesis involving <link rel="shortlink">.
synchronously with the request
We are trying to clarify in https://github.com/hypothesis/h/pull/4700#discussion_r153477745 whether search requests made after an index operation with refresh=true are guaranteed to see the change. My understanding from these docs is that this is true in ES 6.
Anyone know about earlier versions?
Running these queries on a field with many unique terms can be resource intensive indeed. Avoid using a pattern that starts with a wildcard (for example, *foo or, as a regexp, .*foo).
Interesting article on gzip compression. It explains how to apply knowledge about how gzip (and specifically DEFLATE) compression works in order to generate source text that compresses better.
A shame that the gzthermal tool is not open source at present.
Hypothesis requires your browser to accept 3rd-party cookies.
This is no longer the case. See https://web.hypothes.is/blog/leaving-cookies-for-oauth-authentication/
The Lot System is one such idea which has emerged from the movement
See http://www.carolhanisch.org/CHwritings/Leadership.html for an explanation of how the "lot system" worked.
rushed
Coming from the UK where sororities / fraternities are not really a thing as far as I know, I had to look this up: https://en.wikipedia.org/wiki/Sorority_recruitment
New Left
A political movement from the 1960s and 1970s campaigning for social change and reform.
as too threatening to have as close friends
Why "threatening"?
rap group
A "consciousness raising group". See this article.
The aforementioned Yelp reviews is already testing these boundaries with its Monocle feature
The Wired article on the Monocle feature dates back to 2009. In 2017, it is still apparently a hidden feature in the Yelp app.
A new batch of apps that allow users to create hidden graffiti using AR raises an important question about who is legally allowed to “tag” a place.
So basically all the discussions we have had within Hypothesis about rights to write over web pages will be had, but this time applied to the real world.
This article argues for the benefits of favoring integration ("feature") tests over unit tests. An opposing argument ("integration tests are a scam") is that reliance on integration tests is a bad idea because of the difficulty of covering all possible code paths with integration tests as opposed to unit tests.
A half-way point between the two views is the concept of a testing pyramid which advocates having end-to-end, integration and unit tests, but with a larger number of the latter and a smaller number of the former.
I actually just figured this out and it seems to be working. I found this article:
This might be useful for resolving an issue we have with Google Groups where replies made via Zendesk to support requests originating from emails to a Google Groups forum only go to the original user and do not appear on the Google Groups mailing list.
It is also possible to filter all events for the entire application, by installing an event filter on the QApplication or QCoreApplication object.
You can use this to observe all user interactions in an application for example.
A list of some simple suggested exercises to do with a foam roller. One notable point was a recommendation that exercises should be done before workouts.
In New York, however, where some 2016 numbers are available, it seems that every journey only covers 41% of the costs involved in making it.
Does anyone know a) whether this claim is accurate and b) what more up to date numbers look like?
These general forms allow markup grammars, like HTML5, to be created without element counts in the thousands to address every possible need. A generalized element retains the form of greatest applicability
Another EPUB annotation.
This operation that
Should be "This operation ensures that"?
stay
Quick foo
There
An annotation created using IE 11 when logged in using OAuth
The URL that was given to you by Canvas should have had a verifier parameter on it. If so, do not include your Authorization header like you do with all the other API calls that you make.
So this means that the verifier parameter replaces the Authorization header?
This guide takes a slightly different approach to accessibility because of the feature-rich nature of EPUB 3
This is a quick test of an annotation made on an EPUB document.
Sometimes the submodule references get slightly out of sync so to ensure you are at the latest develop branch in all submodules you can run this
I initially tried without running this command but that failed - the plugin configuration had Hypothesis disabled. Presumably that means that the submodule references in the root project don't currently reference the HEAD of the develop branch in some of the submodules?
new annotation
Here is an example of an annotation with an embedded video, taken from a page about Hurricane Harvey
<iframe frameborder="0" height="234" src="//fave.api.cnn.io/v1/fav/?video=us/2017/08/25/hurricane-harvey-space-station-sje-lon-orig.cnn&customer=cnn&edition=international&env=prod" width="416"></iframe>
This video below was created by copying the embed code from http://edition.cnn.com/videos/politics/2017/05/31/fake-news-donald-trump-anonymous-sources-keeping-them-honest-ac.cnn and pasting it into the text field in the annotation editor:
<iframe frameborder="0" height="234" src="//fave.api.cnn.io/v1/fav/?video=politics/2017/05/31/fake-news-donald-trump-anonymous-sources-keeping-them-honest-ac.cnn&customer=cnn&edition=international&env=prod" width="416"></iframe>
Some
An annotation. Link to self: https://hyp.is/66QHAnwLEeeDsA8VMdeQ7g/localhost:1337/dl-test.html
Link to via http://localhost:1337/dl-test.html#annotations:66QHAnwLEeeDsA8VMdeQ7g
Link to page http://localhost:1337/dl-test.html
Link to anything: http://example.org
This fundamental change in J-protein biology during the prokaryote-to-eukaryote transition allows for increased fine-tuning and broadening of Hsp70 function in eukaryotes
Another test annotation created as part of a project with eLife.
Hsp70 participates in a broad spectrum of protein folding processes extending from nascent chain folding to protein disaggregation
Test annotation created as part of a project with eLife.
Create the revision script by running alembic revision, for example:
This appears to be out of date. It looks like alembic commands should be run via the ./bin/hypothesis wrapper script. See https://github.com/hypothesis/h/issues/3863
./bin/hypothesis migrate revision -m "Add the foo table"
It’s a fundamental decision about where the annotation goes which can’t be changed later.
The "can't be changed later" part is something we could, and probably will want to at some point, address.
In a groups-first API I imagine that this might be a specific API call though, since there are a number of error conditions that are specific to this operation.
Letraset sheets
What is a Letraset sheet?
or the browser was holding the storage mutex for a longer time, or for different reasons.
According to this GitHub issue the storage mutex was never implemented in browsers.
See the comment from Ian Hickson at the bottom.
That issue also has some useful details on what modern browsers actually do in a multi-process world.
Example 1. A Dublin Core Description of a Journal Article
Example of usage of the isPartOf relation.
A very accessible explanation of the bias-variance trade-off in ML.
BYOB
"Bring Your Own Buffer"
Think in a chapter of a book, for example: the chapter isPartOf book.
Should we perhaps use this instead of DC.Source for describing a chapter which is part of a book?
said he most commonly used the app
Saqib is blind.
As well as recognizing people it’s seen before and guessing strangers’ age and emotion
I wonder how they try to avoid causing offence if the guess is wrong?
2mins 34secs clear of Kenya's Mathew Kimeli.
This should say 2.34 seconds. Kimeli was ~10 metres behind when Farah crossed the line.
potentially annoying
It's not just "potentially annoying". I think our users would use somewhat stronger language to describe this hassle!
since it could just re-use the still valid access and refresh token that it got last time.
It is possible that the user's identity on the website changed since the last time they visited the page, in which case we do need a new access/refresh token.
I would be inclined not to try and solve this problem until we're sure it is a problem to avoid introducing fun new caching issues that cause confusion for us and users.
One of the important lessons when designing for VR is that you should move your idea or concept as fast as possible to prototyping.
Presumably this would be true for any novel interaction environment.
Dr. Vannevar Bush
Blah
The authorization server MAY revoke the old refresh token after issuing a new refresh token to the client
I assumed that revoking the old token would be mandatory, but on the other hand, not revoking it allows clients to retry a refresh if they fail to receive the response the first time due to a transient network error.
Examples of other similar JavaScript DI frameworks:
A useful list of dependency injection frameworks for JS. From what I've seen of the packages listed here:
BottleJS looks like the simplest and least demanding in terms of JS engine features.
InversifyJS is heavily orientated towards TypeScript and assumes use of decorators, reflect-metadata etc.
Inverted is unmaintained and the link 404s.
I haven't yet looked at WireJS or Mocktail.
When you click on the icon you don't know whether the new things went into the annotations, page notes or orphans tab. (I believe the count numbers on the tabs change, but this is easy to miss.)
A caveat here is that we cannot tell whether annotations are annotations or orphans until after we try anchoring them, so if we go with this approach we'll either have to change how annotations in the "received but not yet presented to the user" state are handled, or optimistically assume that the annotations do anchor.
Tabs (where the number of tabs can change dynamically, tabs opening and closing in response to events or user actions, like in a desktop web browser) are normally left aligned
That definitely depends on what environments you are familiar with. In Windows (traditionally) and modern MS apps tabs are left-aligned.
It uses HTML <a> elements with href="#", which I don't believe is correct for these controllers, which are really buttons not links
Strictly speaking yes, although ARIA actually has dedicated roles for tabs. If you use those, I don't think it really matters.
These buttons also look different than other buttons (and links) in the sidebar itself.
They are tabs rather than buttons. I don't think they should necessarily need to look the same as buttons, as long as it is clear you can hit them.
subresource under number of unique domains, sub frame under number of unique domains, and number of unique domains redirected to.
I'm not clear on exactly what these three things mean and why they might be strong signals for a tracking domain. Can anyone clarify?
Whitelists are a good idea - not only are they a simple way to protect against parent documents setting config settings that we don't want them to
In the case of the sidebar, this is true. Do understand though that code in src/annotator fundamentally runs in an untrusted context and a sufficiently determined page could manipulate what that code does in pretty much any way it wanted.
Faster Approximate String Matching Baeza-Yates and G. Navarro, R. Algorithmica (1999) 23: 127. doi:10.1007/PL00009253
Doesn't manage VPCs, subnets, or other infrastructure that Skyliner manages for us.
How much of a problem is this for us on the spectrum of major blocker to minor inconvenience?
Landmarks
Feature for navigating through landmarks in a page specifically.
Narrator views
This appears to be the closest available functionality in Windows 10 Narrator to the Web item rotor
Specifically, we pad the inputbyk1elements on both the left and right side by zerovectors, and then removekelements from the end of theconvolution output.
Reproduction of the bug described at https://github.com/hypothesis/client/issues/381
WAI-ARIA provides Web authors with the following:
This is a summary of the main types of additional information which may need to be added to a page to make it accessible, which can be done by adding ARIA attributes to elements.
For example, with WAI-ARIA, developers can identify regions of pages and enable keyboard users to easily move among regions, rather than having to press Tab many times.
For example, if the content of a Web page changes in response to user actions or time- or event-based updates, that new content may not be available to some people, such as people who are blind or people with cognitive disabilities who use a screen reader.
The text MUST be selected and normalized in the same way as for the Text Quote Selector before counting the number of characters to determine the start and end positions.
Given the comment above about normalization:
The selection of the text must be in terms of unicode code points (the "character number"), not in terms of code units (that number expressed using a selected data type).
My understanding is that the start/end positions need to be expressed in code points, which is a little inconvenient in the browser since the natural way to retrieve the text content for a node and its descendents in the DOM is using the textContent property, which returns a JS string that represents the text in UTF-16 chars.
One of the projects I'm working on is an annotation bot called "contextbot"
Very cool! For anyone else reading, you can find contextbot's annotations here.
Where do you get the feed of articles that it processes from?
With tens of thousands of events occurring every day at a rate of approximately one per second,
Where does this figure come from?
Overview of dependency injection libraries and patterns in JS circa early 2016.
Coupling your data and code adds the additional problem that if you want to use a function at a certain point, you have to find a way get its object to that point.
Jeff Bezos' annual letter to Amazon shareholders from 2017. I encountered it via a tweet.
2.3 The Jacobian of the Pyramidal Transformation in 3D
$$x * 2$$
Well-known quadrature rules exist in 2D for triangles and a few 3D regions, such astetrahedra, prisms and hexahedra
Hello, this is a comment on an article I found via canaryhaz.
Stylesheets are also scoped to the shadow tree:
Providing a malicious onLogin callback, for example popup a window into which the user may type their username and password
This is something I do think we should have a plan for. I have a couple of suggestions:
null as one approach.Providing a malicious asset root URL from which the sidebar app will load its assets
I don't think this is true - and it would be a major issue if it was as it would circumvent the same-origin protection that the iframe code assumes. The sidebar app does not allow the host page to set the assetRoot setting, but only reads the setting embedded in the app.html page.
This would also make it slightly more difficult for malicious sites to configure the client.
I think your earlier question about whether the Chrome extension should ignore js-hypothesis-config tags on the page entirely was a better avenue to explore.
Alternatively you can set data-services to the id of a <datalist> element in the page.
Eww
Instead of <script class="js-hypothes-config" type="application/json"> just use HTML attributes on the embed.js script itself
I'm not in favor of this because a) I think JSON is a simple and widely understood format and b) There is one clear obvious way of expressing booleans, arrays and nested data structures in JSON, whereas in HTML you have to invent your own way of doing it.
One additional complication is that although there is a method document.currentScript which code can use to get a reference the <script> tag which caused it to be run, this property is not supported in IE so we'd need a workaround.
Have only one means of inter-frame communication: the bridge.
I think this may be nice in principle, but see the caveats above I mentioned about the sidebar app assuming it can synchronously access settings when it starts up. This might turn out to be more complex.
Consider renaming sidebar/app.js to sidebar/main.js, to match annotator/main.js
👍 - except that in CommonJS the standard name for the main file in a directory is index.js. There is actually support for this built into the require function. require('./some-dir') is actually equivalent to require('./some-dir/index').
actually export config objects directly rather than exporting functions?
The reason these modules export functions rather than objects is because that is easier to write tests for. A simple solution here would be to rename the function to say, readConfig.
This function returns an object named options, it should be named config.
👍
src/shared/settings.js should be renamed to src/shared/config.js to match with other things that are named config.
👍
Or else just add a boolean variable to window.
A difference between DOM elements and expando properties in the context of extensions is that DOM element properties and attributes are visible to code that runs in the context of the page and code that runs as a content script. Expando properties set in one context on the other hand are not visible in the other.
What this means in practice is that an extension might not be able to read a boolean property set on the window object by code in the host page and vice versa.
Is there any reason why the Chrome extension should ever read settings from the parent page?
I can't think of a use case we have for this currently.
The general term for the stuff outside of an iframe seems to be parent page/window/document/frame, so I suggest we use parent instead of host.
Hmm ... "parent" is an overloaded word already within the sidebar app. You have parent elements in the DOM tree, parent components in the Angular component tree, parent scopes.
The whole inheritance thing around PdfSidebar, Sidebar, Host, Guest and Annotator.
Yes, completely agree.
It would be nice to have only one means of inter-frame comms (bridge). Get rid of this ?config param on the iframe src.
The reason for using this mechanism originally is that query string params are available immediately as soon as the sidebar app starts which is convenient for the sidebar app's boot code.
As far as I am aware this is not possible with postMessage (the API underyling the bridge service). The sidebar app could make an RPC call back to the host page, but this may add some latency to app startup which would need to be measured. It's also unlikely to be as simple as parsing out a query string param.
Use just one name, not settings, options, config, app_config, etc.
I'm in favor of this. We probably do want to use a different term for static configuration of the client vs. user preferences.
And that tag needs to contain valid JSON (which is all too easy to get wrong)
I'm really not convinced that this is a problem. JSON is ubiquitous, especially in the field of web development. Additionally, we present a helpful error message if the config fails to parse.
From the point of view of someone wanting to embed Hypothesis in their site this API seems more difficult to use than it needs to be
I'm not convinced that any of the potential difficulties listed here are actually problems. I'll also note that the fact that the config data is JSON is more convenient than alternatives such as data attributes because most languages have builtins for serializing objects to JSON. We make use of this in both the Python code and JavaScript modules that render app.html in the extension for example.
For example you change the value of a setting in a js-hypothesis-config object, but it doesn't work because (unknown to you) it's being overridden by another js-hypothesis-config object further down the page.
I honestly think this is unlikely to be a problem for publishers.
This provides an easy, high fidelity way to replace the sidebar with a malicious copy
As I noted above, replacing the Chrome extension's app.html with a different page is really easy to do even without this mechanism.
I think this is a real potential vector for phishing attacks but it is really important to understand that the DOM in the host page is fundamentally a shared resource for all code that runs in that context with no access controls.
handled somehow.
Handled or prevented. We currently do the latter as it was the simplest thing to implement.
Browserify-requireable JavaScript function
The usual term for a JS module that imports other modules via require() and exports variables/functions etc. via module.exports is a "CommonJS module". Browserify is a tool that packages up a graph of CommonJS modules for use in the browser - there are other tools such as Webpack and rollup which do the same thing.
to thwart attacks based on sites embedding their own malicious copies of the client
As I noted in Slack, it is trivial for a page to redirect iframes created by the extension to a different URL.
But it seems like there may be a race condition here between the Chrome extension and embedded instance of Hypothesis?
I believe there is. If you activate the Chrome extension while the page is still loading and before the embedded Hypothesis client has loaded, it is possible the extension will win.
I believe this is intended to have the Chrome extension abort on launch, if there is already an embedded instance of Hypothesis in the page?
This is correct. If you try to activate the Chrome extension on a page which embeds Hypothesis, whichever loads first, which will almost always be the embed, will win.
evil
Foo
page
Blah
This is a version of the paper with an ugly presentation. There is a LaTeX version available but several PDF readers (Mac Preview, PDF.js) have problems with text selection in that version.
If anyone knows of a LaTeX version without that problem, please reply.
It is not feasable for the client to first load the annotations and then compile a list of URIs and hopefully match up flag status with the annotations currently displayed on these pages.
I don't think it would be that difficult to do, but it also isn't that important either. As you note - both those pages are deprecated.
It seems not unlikely to me that we'll want to expose flag/moderation status on activity pages (showing annotations from many URLs) in future - so from the backend side it will probably be useful if this didn't require a redesign to support.