mysteryDate

4 lata temudiscuss

TypedOM CSSColor is coming soon!

4 lata temudiscuss

The spec defines the web

https://html.spec.whatwg.org/multipage/canvas.html#the-canva...

The "we" in the statement is the maintainers of the spec, which includes engineers from Chromium, Firefox, Safari, Edge, Opera and many other stakeholders.

mysteryDate

4 lata temudiscuss

This number is a little bit of a guess. It is the number of calls to `<canvas>` divided by the total number of page loads. Obviously some pages are using more than one canvas, hence the large range.

As for fingerprinting, most canvases are 1. not their default size, 2. not 1x1 (like fingerprintjs uses) 3. never call `getImageData`. All these things together point to the idea that these are legitimate uses. Yes, fingerprinting on the web platform is a problem. It's also a problem with canvas. I think it's disingenuous to say "canvas is mostly used for fingerprinting" without ways to support that statement.

mysteryDate

4 lata temudiscuss

Oh yeah! Safari is definitely doing great for colorspaces and we have some work to do to catch up. Very good point.

mysteryDate

4 lata temudiscuss

Oh, this is just yet another mistake we didn't catch. It's totally x before y. facepalm

mysteryDate

4 lata temudiscuss

There was a ton of work across browser vendors to make this a part of spec:

https://html.spec.whatwg.org/multipage/canvas.html#the-canva...

It's all there. It's all official. That github page was just one part of reaching consensus. There's also TAG review:

https://github.com/w3ctag/design-reviews/issues/627

FWIW Mozilla and Safari signed off on all of these changes at some point in time somewhere, hence why it's allowed to be part of spec. There were some changes that were not allowed to be part of the new API because one of those two said no (like perspective transforms, conic curves).

For jdashg's concerns on that thread, 4x4 matrices were cancelled, and you can follow up with much more debate from all parties on roundRect and filters:

http://github.com/whatwg/html/pull/6763 https://github.com/whatwg/html/pull/6765

This is certainly not decided by fiat. Working to find consensus across browser implementers is just a ton of work.

mysteryDate

4 lata temudiscuss

True. Any data the user leaks is data the user leaks and we should work to prevent this. However I don't think people realize just how easy it is to reliably fingerprint users who are blocking javascript and canvas and other web features.

mysteryDate

4 lata temudiscuss

Look the proposal's still here!

https://github.com/fserb/canvas2D/blob/master/spec/perspecti...

If you raise an army of angry webdevs to yell at other browser implementers, I would be so very happy.

mysteryDate

4 lata temudiscuss

So, these functions are are now currently part of the whatwg spec, so other browsers have stated their intention to implement them and this is underway.

mysteryDate

4 lata temudiscuss

These are all part of the official spec: https://html.spec.whatwg.org/multipage/canvas.html#the-canva...

Getting the features into the spec is the vast majority of the work. Though some features are not yet implemented in Firefox or Safari, they have both indicated their intention to do so.

mysteryDate

4 lata temudiscuss

These are all available as of Chrome M99! Thanks for reminding me to update caniuse!

mysteryDate

4 lata temudiscuss

Yup, we're aware and we're all ashamed

mysteryDate

4 lata temudiscuss

This is all great feedback!

  I'm sure most users know this by now, but generally for performance the fewer calls you make to the canvas and the context, the beter.

This is almost entirely due to the javascript engine. We're working on ways to improve it.

  roundRect is great. Though you don't need 4 arcTo in order to make a rounded rect, you can use bezier instead (we do).

Yeah, the example was a little bit humorous, I kinda brute forced it.

  Their example is also 1% amusing because they set the `fillStyle` but then call `stroke` (and not `fill`).

You caught what 100 rounds of edits did not.

mysteryDate

4 lata temudiscuss

Well, there's this and the fact that browser implementers all need to come to consensus over what features to add and that's an extremely difficult process to move forward. There also is one big browser implementer who doesn't really want the "playful web" to exist and would prefer that everyone live inside of apps.

Edit: To be clear, we all work together and mostly get along. It's a long and arduous process to reach consensus and not everyone's incentives are aligned and this can be frustrating.

mysteryDate

4 lata temudiscuss

Yup. It's awful. We are aware and ashamed

mysteryDate

4 lata temudiscuss

AHHHHHH! We wanted to add this so badly! Wrote the code and the spec and everything!

Unfortunately Safari said it would be too much effort on their end to change the 2x3 matrices on the backend to 4x4 matrices to support this.

mysteryDate

4 lata temudiscuss

A legitimate point! Unfortunately from our end it's also impossible to tell what canvases are being used for. Somewhat reassuringly, the vast majority canvases that are being created are much larger than would be necessary for fingerprinting, so we have some reason to believe that most uses are legitimate. There's also the fact that the vast majority of canvases never perform `getImageData`, which is an essential part of every fingerprinting technique I've ever seen.

At this point it's possible to fingerprint with CSS alone, no javascript: https://css-tricks.com/css-based-fingerprinting/

So to say that canvas is an element "for fingerprinting" I think is an outdated notion that's the result of some bad PR the element got like 10 years ago.

So, yes, fingerprinting is an issue and we all wish it would go away. Unfortunately there is a ton of work to do. A lot of very smart people are working on this and I wish them the best of luck.

mysteryDate

4 lata temudiscuss

CanvasFilter is coming to MDN documentation, it's been a struggle... I promise it's part of the spec: https://html.spec.whatwg.org/multipage/canvas.html#filters

comments