The point of semantics

There are essentially three purposes for language semantics. Overall, as a smell test to guide language design: if you can't define a feature, it's probably bad. Second, to help other implementers of our language and programmers for the language -- unfortunately, I'd claim we generally fail on this point. Third, to help structure proofs about our language.

As part of the preparation for a paper submission, I'm finishing up my formalization of a subset of CSS 2.1 (blocks, inlines, inline-blocks, and floats) from last year. My first two, direct formalization approaches failed the smell test so Ras and I created a more orthogonal kernel language. It's small, and as the CSS spec is a scattered hodge-podge of prose and visual examples riddled with ambiguities, we phrase it as a total and deterministic attribute grammar that is easy to evaluate in parallel. Finally, to prove that it can be implemented efficiently (e.g., linear in the number of elements on a page, meaning no reflows), the grammar without floats leads to a syntactic proof, and the version with floats then only has to explain away some edge cases (using a single-assignment invariant, which can probably also be made syntactic).

All of this should have happened 10 years ago. However, the academic language design community, as per the norm, seems to have been late to the party. Instead, we have huge, slow interpreters that don't give the same answers and a generation of abused and confused artists and designers.

An evil test case

Opera, WebKit, and Firefox are supposed to conform to CSS 2.1 standards, at least, right?

A fun test:

<div style="width: 30px; height: 30px; background-color: blue; padding: 1px">
  <div style="display: block; background-color: red; padding: 1px">
  <div style="opacity: .1; float: left; width: 100px; height: 40px; background-color: green">a</div>
  <div style="opacity: .2; float: left; width: 100px; height: 40px; background-color: green">b</div>
  <div style="opacity: .3; float: left; width: 100px; height: 40px; background-color: green">c</div>
  <div style="width: 50px; height: 10px; background-color: green">d</div>
  </div>
</div>

Do three versions of it: set the red box to be display block, inline-block, and inline. A little subtle to why this breaks is that, while these browsers might conform to the CSS specification for these (I'm still not sure about this), it exercises ambiguously defined parts of the spec.

For the few folks actually implementing this stuff, it exercises ambiguity in the definition of preferred widths, preferred minimum widths, and shrink-to-fit in the presence of floats.

Formalizing one fully-defined interpretation of the spec is... interesting. Thought I was done, but realized I wasn't =/

First weekend in Seattle

Still looking for a place, but Capitol Hill successfully captured my heart:

1. Lunch: jamon serrano crepe @ joe bar cafe
2. Snack: picked up a copy of Pride and Prejudice and Zombies and headed off to another cafe
3. Discovered Dilletante, a chocolate cafe and chocolate martini bar -- opens at 4pm, so on my TODO list

I also somehow came across two free passes to the Seattle International Film Festival that is ending this weekend. Viable candidates (will see one each on both remaining days; haven't found anyone else who is interested yet):

• Saturday:

1. In Your Absence
   
2. Breathless (it was great!)
3. Fifty Dead Men
4. Flame & Citron
5. Forever Enthralled

• Sunday:

1. Marcello Marcello
2. The Shaft (done well)
3. Involuntary
4. OSS 117: Lost in Rio (+ closing gala)
5. The Overbrook Brothers
6. A Pain in the Ass

300+ movies over one month... that's an intense festival. Despite the lack of an apartment and a slowdown on my research, summer is going well (and I apparently had a subletter for my place in Berkeley without realizing it!)

RazorFish

I think the most significant demonstration was somewhere between 5:00 and 5:30. Would have loved to have hacked on this in high school :)

Security as a Disease

Lovely post by Rob Meijer on the capability list about how to write a useful Wikipedia article (in particular, for cleaning up the entry on ambient authority):

A good way for me personally to think about the audience for infosec related subjects, is to think about myself on medical related subjects.

...

In this case, the main things you would want to know would be:

* How do I know if I have ambientitus?

If I know I don't have ambientitus, I'm out, off to find other possible sources of my symptom. If it is likely that I have ambientitus, I would want to know:

* How bad is it? Is it fatal?

...

That totally made my morning. Worth reading.

updateable secure views

Was looking at what the bidirectional programming folks at UPenn were up to, and got excited: the paper we had rejected last year about secure browser programming through views was, in another form, accepted for these guys: Updateable Security Views. Our take on it (a tentative title was "membranes, views, and browsers") was of capabilities and flexibility; this clearly has different principles (static checking, information flow, etc.). The important thing is that the idea is gaining traction!

Assembly Language of the Web

What should be the assembly language of the web? JavaScript has risen as the pragmatic choice, with the Flash VM trailing far behind. Some elements of Google think x86 is the way to go.

With Flapjax, JS was a fine choice: we were interested in rewiring existing AJAX-style apps and could do it. Sometimes, with both Flapjax and the membrane work, it wasn't enough (weak references, reflection / interpositioning woes, no good separability). Other notions, like parallelism and DB transactions, are just missing entirely (e.g., workers were not enough when I did some Firefox extension work).

Given a void, what's the way forward? CLR? DLR? JS? x86? VMs? Folks like Erik Meijer and Gilad Bracha seem comfortable with JS is the new assembly, but I'm not. At best, it would then need an overhaul that it isn't getting, and, at worst, we're slowing the web down by maybe 5-10 years.