They have a point, but coming from the company that invented ActiveX, I find it rather funny :)
Microsoft refuses to endorse WebGL, labels it ‘harmful’
41–50 of 114 posts
Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’
#42My biggest question with webgl is who is it targeted at? Certainly it can't be game developers because javascript is still way to slow to manage a game world and vector logic. Pipelining assets is also a big problem in html and I just can't see many devs taking it seriously as a way to deliver 3d games.
WebGL can be the alternative to Flash games on the web. The performance can be better and the graphics more advanced.
But gpu accelerated 2D Canvas should provide that alternative, 3D games are another matter entirely.
Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’
#43Wow, this thread is turning into another security-clueless developer freakout. Microsoft very clearly laid out reasons why they believe that WebGL presents possible security vulnerabilities. While GPU security isn't my area of expertise, the driver issues seem very plausible. If someone wants to actually address Microsoft's points in this thread then that would be great.
I don't have a response, but Microsoft supposedly thinks it is securable enough for Silverlight:
"With the release of Silverlight 3 Beta 1 GPU (Graphics Processing Unit) acceleration (or hardware acceleration) is now available."
I'd like to hear what could make that secure that couldn't be used with WebGL.
Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’
#44My biggest question with webgl is who is it targeted at? Certainly it can't be game developers because javascript is still way to slow to manage a game world and vector logic. Pipelining assets is also a big problem in html and I just can't see many devs taking it seriously as a way to deliver 3d games.
Check out my application: https://brainbrowser.cbrain.mcgill.ca (sorry if it's a little hard to use, I'm working on documentation but my user base usually knows what all the stuff means.) It's in use by neuroscientist for a varity of stuff. I have users in almost all continents. (I need people in Australia and African Countries ;p) There are many games that could be done with WebGL as it is today. Some little RTS gam…
Your app is a great example as the requirements are very finite. Web games on the other hand seem better suited for 2D, since the requirements for 3D games are much larger.
Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’
#45Wow, this thread is turning into another security-clueless developer freakout. Microsoft very clearly laid out reasons why they believe that WebGL presents possible security vulnerabilities. While GPU security isn't my area of expertise, the driver issues seem very plausible. If someone wants to actually address Microsoft's points in this thread then that would be great.
I don't have a response, but Microsoft supposedly thinks it is securable enough for Silverlight: "With the release of Silverlight 3 Beta 1 GPU (Graphics Processing Unit) acceleration (or hardware acceleration) is now available." I'd like to hear what could make that secure that couldn't be used with WebGL.
I don't know anything about how they're doing this, but I wonder if it has something to do with the bytecode abstraction used in D3D. In D3D, you compile HLSL to bytecode which then gets passed down to the kernel, but in the OGL world you pass source straight down to the kernel. Definitely still risks there, but significantly diminished, and some simple verification in userland would make it next to impossible to get a lot of nasty code down into the kernel.
Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’
#46Earlier quoted context omitted.
I'd be more worried that the drivers run in kernel mode and this could actually allow a new class of root-level arbitrary code execution vulnerabilities.
That's definitively an issue. Is there a way around graphic drivers in the kernel? Userspace graphics drivers could be interesting if they were possible.
AFAIK both Windows (WDDM) and Linux (DRI) use userspace drivers. http://en.wikipedia.org/wiki/Windows_Display_Driver_Model
Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’
#47This is why I'm absolutely terrible at security considerations. When I look at webGL, I think what's the problem? So what if you have direct access to the GPU? My naive view of the graphic card is: shader instructions -> VIDEO CARD -> PIXEL DATA Shader instructions are a limited to a specified function set directed at transforming and calculating numbers. What possible risk can a calculator represent? Video Card is a…
"Honestly, what could possibly go wrong?"
"it could be used to "read" what was on the screen via some form of OCR?"
That is. They can:
a)Make your computer "impossible" to use(until you plug the computer power off and restart), what they cal Denial of Service
b) They can get access to your super important and super confidential screen information, like your bank account or your plans to dominate the world.
I agree with you,not a big deal to me, I find WebGL to be very useful, like google body(use google Chrome, Firefox is slower): http://bodybrowser.googlelabs.com/body.html
Here common sense applies, if you are going to use financial services just use them. Visit WebGL sites when you are not doing something serious and problem solved. Also while it is technically possible to do, it is really difficult to exploit, I program GPUs.
I understand Microsoft position here too, they don't want people suing them because someone manage to get their financial data and stole their identity and money while watching cool webGL animations, but I think you can trust the big guys (google) on this one, they are not going to steal your financial data, in some cases they already have it :-).
Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’
#48I'm not a fan of most MS products, and I get a bit of NIH syndrome vibe from the article. However, the security argument is spot on. Perhaps browser developers have come up with strong countermeasures, but experience shows the state of OS and app development today is still ineffective in the area. I don't allow Java, most Javascript, and most Flash to run on my system either, so its nothing personal. With direct acce…
"Remember Windows has graphics drivers in the kernel"
Post-XP, very little of the graphics driver is in the kernel (just the KMD bits). It is mostly all in user space.
Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’
#49Looks like O3D would have been a better approach after all.
Did Google back the wrong horse?
Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’
#50Wow, this thread is turning into another security-clueless developer freakout. Microsoft very clearly laid out reasons why they believe that WebGL presents possible security vulnerabilities. While GPU security isn't my area of expertise, the driver issues seem very plausible. If someone wants to actually address Microsoft's points in this thread then that would be great.
Well either Google and Mozilla are knowingly shipping insecure code or Microsoft is, to some degree, wrong. Given the history of the organisations in question I'm going to assume Microsoft wrong or not telling the whole story until we hear a response from Moz or Google.