Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft refuses to endorse WebGL, labels it ‘harmful’

winrumors.com

Post reply on HN
Print view View original

11–20 of 114 posts

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#11

Post by nkassis »

giberson wrote: post #6

This is why I'm absolutely terrible at security considerations. When I look at webGL, I think what's the problem? So what if you have direct access to the GPU? My naive view of the graphic card is: shader instructions -> VIDEO CARD -> PIXEL DATA Shader instructions are a limited to a specified function set directed at transforming and calculating numbers. What possible risk can a calculator represent? Video Card is a…

But before the code gets to the GPU it has to be compiled and that's the job of the GPU drivers which are know to crash often. Video card drivers are the problem. If you can manage to make them crash in a predictable way then you have a way to crash the machine and I guess reboot the box on windows. Who would have thought that a small program to do graphics manipulation could be used to reboot a box? I mean something is wrong here on many levels.

My WebGL app has frozen a few machines in the past with random bugs that I haven't figured out yet. I tell my users to be careful but I know someone out there knows how to do it predictably.

But you know what, it's about time Nvidia/ATI/Intel/others pull their own weight and fix the damn issues with their drivers. If it can be done with WebGL it can be done with native applications. Flash Molehill probably too.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#13

Post by Locke1689 »

Wow, this thread is turning into another security-clueless developer freakout. Microsoft very clearly laid out reasons why they believe that WebGL presents possible security vulnerabilities. While GPU security isn't my area of expertise, the driver issues seem very plausible. If someone wants to actually address Microsoft's points in this thread then that would be great.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#14

Post by mixmastamyk »

I'm not a fan of most MS products, and I get a bit of NIH syndrome vibe from the article. However, the security argument is spot on.

Perhaps browser developers have come up with strong countermeasures, but experience shows the state of OS and app development today is still ineffective in the area.

I don't allow Java, most Javascript, and most Flash to run on my system either, so its nothing personal. With direct access to hardware, flakey video drivers, and no thought to security, the possibilities for disaster are even greater with WebGL. Remember Windows has graphics drivers in the kernel.

Also, as long as browsers continue to execute objects on page load instead of behind a play button security breaches will continue.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#15

Post by ssp »

giberson wrote: post #6

This is why I'm absolutely terrible at security considerations. When I look at webGL, I think what's the problem? So what if you have direct access to the GPU? My naive view of the graphic card is: shader instructions -> VIDEO CARD -> PIXEL DATA Shader instructions are a limited to a specified function set directed at transforming and calculating numbers. What possible risk can a calculator represent? Video Card is a…

Honestly, what could possibly go wrong?

The biggest issue is that GPUs can do DMA to read and write directly in main RAM. This can be exploited to overwrite arbitrary kernel data structures, for example.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#16

Post by Joeri »

seanalltogether wrote: post #10

My biggest question with webgl is who is it targeted at? Certainly it can't be game developers because javascript is still way to slow to manage a game world and vector logic. Pipelining assets is also a big problem in html and I just can't see many devs taking it seriously as a way to deliver 3d games.

You can preload the assets and store them in the html5 app cache. If you've seen the webgl Quake 2 port you know that javascript is fast enough to do games, at least the lighter ones, like the stuff telltale makes.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#17

Post by nkassis »

seanalltogether wrote: post #10

My biggest question with webgl is who is it targeted at? Certainly it can't be game developers because javascript is still way to slow to manage a game world and vector logic. Pipelining assets is also a big problem in html and I just can't see many devs taking it seriously as a way to deliver 3d games.

Check out my application: https://brainbrowser.cbrain.mcgill.ca (sorry if it's a little hard to use, I'm working on documentation but my user base usually knows what all the stuff means.)

It's in use by neuroscientist for a varity of stuff. I have users in almost all continents. (I need people in Australia and African Countries ;p)

There are many games that could be done with WebGL as it is today. Some little RTS games that could be fun. Zynga has proven that you don't need anything fancy to make money from games.

As for other applications, well I think http://ro.me is a great example of something that can be done with WebGL. I bought the CD just because of that video. It was brilliant marketing.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#18

Post by Locke1689 »

nkassis wrote: post #11
giberson wrote: post #6

This is why I'm absolutely terrible at security considerations. When I look at webGL, I think what's the problem? So what if you have direct access to the GPU? My naive view of the graphic card is: shader instructions -> VIDEO CARD -> PIXEL DATA Shader instructions are a limited to a specified function set directed at transforming and calculating numbers. What possible risk can a calculator represent? Video Card is a…

But before the code gets to the GPU it has to be compiled and that's the job of the GPU drivers which are know to crash often. Video card drivers are the problem. If you can manage to make them crash in a predictable way then you have a way to crash the machine and I guess reboot the box on windows. Who would have thought that a small program to do graphics manipulation could be used to reboot a box? I mean something…

I'd be more worried that the drivers run in kernel mode and this could actually allow a new class of root-level arbitrary code execution vulnerabilities.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#20

Post by rbanffy »

keithwarren wrote: post #5

Cue the chorus of people saying this is because Microsoft sucks etc etc. Ignore the fact that Microsoft has spent more time and resources than any technology company in the world focusing on web related security. Mind you that is not an endorsement of their track record, but a statement with respect to the reality on the ground.

> Microsoft has spent more time and resources than any technology company in the world focusing on web related security.

Mostly because they had to. If others spent less it could be because they had a smaller vulnerable surface to begin with, or simpler codebases.

Post reply on HN