Anne van Kesteren

I included a fix for this in https://github.com/whatwg/fetch/pull/1442 which I think works. The HTML side will need to set it on requests, but that's a very straightforward change. And while...

I forgot that the response itself also carries encoding-related information. https://github.com/whatwg/fetch/pull/1447 tackles the first part of that. Once that lands it should be easy to call from Fetch's ORB PR.

In principle I suppose a server could reply to a range `0-` request with a non-first-byte response and only give more data upon subsequent requests. If we can enforce the...

I see, that does seem tricky to resolve. The safelisted URLs would have to be cached somehow in the ORB layer. And perhaps you can "refcount" the media elements by...

@anforowicz what do you think about the idea? Is that in line with the changes you were thinking of making here?

@anforowicz I'm confused, doesn't this issue suggest we cannot use the first of these options?

Yeah, I think you're right. Thanks!

Can you expand on the risk of safelisting the JavaScript MIME type? Is the worry that JSON is often mislabeled? It seems unfortunate to not be able to offer folks...

Yeah, sniffing the first 1024 bytes is probably fine. Perhaps `Cross-Origin-Resource-Policy: cross-origin` can be a fast path, but that would mainly be relevant for the full parse, not sniffing. To...

So thinking about this more it's not technically equivalent so I think we have to specify this if we want to keep it around in this form. E.g., `while (1);`...