Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft refuses to endorse WebGL, labels it ‘harmful’

winrumors.com

Post reply on HN
Print view View original

61–70 of 114 posts

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#61

Post by simcop2387 »

Locke1689 wrote: post #56
wmf wrote: post #46

Earlier quoted context omitted.

AFAIK both Windows (WDDM) and Linux (DRI) use userspace drivers. http://en.wikipedia.org/wiki/Windows_Display_Driver_Model

You're definitely correct about Windows (it was something I was excited about in Vista), but I'm not sure about Linux. Looking at the Nvidia GLX drivers for my Linux machine, it still seems like quite a hefty kernel module. I can't really examine it, though, because it's not open source.

Actually the part of it that runs in kernel mode does have it's source visible. It's part of the standard packaging provided by NVIDIA so that it can work on many different kernel versions. For the most part their driver is also userspace and the kernel driver exposes a communications pathway to the userspace. That's not to say I know how robust that pathway is, but they have separated things somewhat.

The open source drivers also follow this kind of model where the kernel modules handle hardware access and memory management but not a whole lot more. Mesa (and Gallium 3D) all work in userspace to handle compiling things to the native formats of the cards.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#62

Post by mixmastamyk »

georgemcbay wrote: post #48
mixmastamyk wrote: post #14

I'm not a fan of most MS products, and I get a bit of NIH syndrome vibe from the article. However, the security argument is spot on. Perhaps browser developers have come up with strong countermeasures, but experience shows the state of OS and app development today is still ineffective in the area. I don't allow Java, most Javascript, and most Flash to run on my system either, so its nothing personal. With direct acce…

"Remember Windows has graphics drivers in the kernel" Post-XP, very little of the graphics driver is in the kernel (just the KMD bits). It is mostly all in user space.

Ok, although "when there's a will, there's a way." ;)

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#63

Post by johnzabroski »

cma wrote: post #43
Locke1689 wrote: post #13

Wow, this thread is turning into another security-clueless developer freakout. Microsoft very clearly laid out reasons why they believe that WebGL presents possible security vulnerabilities. While GPU security isn't my area of expertise, the driver issues seem very plausible. If someone wants to actually address Microsoft's points in this thread then that would be great.

I don't have a response, but Microsoft supposedly thinks it is securable enough for Silverlight: "With the release of Silverlight 3 Beta 1 GPU (Graphics Processing Unit) acceleration (or hardware acceleration) is now available." I'd like to hear what could make that secure that couldn't be used with WebGL.

It is a completely separate house / separate bed issue.

You do not have permission to call Direct3D directly. You can't even do cool hacks like you can in WPF, stealing the Direct3D video feed and writing it to a movie file. Everything is abstracted away by (underpowered) APIs.

All Secunia advisories on .NET Framework / Silverlight are presently patched, and the total number is relatively small compared to other technologies like web browsers and Flash. I don't really know enough about WebGL to compare, though.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#64

Post by johnzabroski »

kenjackson wrote: post #21
giberson wrote: post #6

This is why I'm absolutely terrible at security considerations. When I look at webGL, I think what's the problem? So what if you have direct access to the GPU? My naive view of the graphic card is: shader instructions -> VIDEO CARD -> PIXEL DATA Shader instructions are a limited to a specified function set directed at transforming and calculating numbers. What possible risk can a calculator represent? Video Card is a…

Read these papers: http://www.contextis.com/resources/blog/webgl/ http://www.contextis.com/resources/blog/webgl2/ To learn more about WebGl and security. Goes into more depth than that article.

That is extremely informative. How did you find it?

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#65

Post by DenisM »

nkassis wrote: post #11
giberson wrote: post #6

This is why I'm absolutely terrible at security considerations. When I look at webGL, I think what's the problem? So what if you have direct access to the GPU? My naive view of the graphic card is: shader instructions -> VIDEO CARD -> PIXEL DATA Shader instructions are a limited to a specified function set directed at transforming and calculating numbers. What possible risk can a calculator represent? Video Card is a…

But before the code gets to the GPU it has to be compiled and that's the job of the GPU drivers which are know to crash often. Video card drivers are the problem. If you can manage to make them crash in a predictable way then you have a way to crash the machine and I guess reboot the box on windows. Who would have thought that a small program to do graphics manipulation could be used to reboot a box? I mean something…

>it's about time Nvidia/ATI/Intel/others pull their own weight and fix the damn issues with their drivers

It's been about time for 15 years, and they still haven't. Video card drivers are #1 reason for windows crashes. Microsoft put a lot of pressure on these companies (and Microsoft knows pressure) and it still didn't help.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#66

Post by Impossible »

daeken wrote: post #45
cma wrote: post #43

Earlier quoted context omitted.

I don't have a response, but Microsoft supposedly thinks it is securable enough for Silverlight: "With the release of Silverlight 3 Beta 1 GPU (Graphics Processing Unit) acceleration (or hardware acceleration) is now available." I'd like to hear what could make that secure that couldn't be used with WebGL.

I don't know anything about how they're doing this, but I wonder if it has something to do with the bytecode abstraction used in D3D. In D3D, you compile HLSL to bytecode which then gets passed down to the kernel, but in the OGL world you pass source straight down to the kernel. Definitely still risks there, but significantly diminished, and some simple verification in userland would make it next to impossible to get…

MS could (and probably would) write an Angle style abstraction layer that runs WebGL on top of D3D9 or D3D11 anyway, so I think source going to the kernel isn't a big deal.

It's possible that because MS has more knowledge of the graphics drivers work in Windows they know about some dangerous security holes that Mozilla, Google, or even Nvidia or AMD aren't aware of, but its equally possible that they just don't want to support WebGL for political reasons and this is a semi-technical excuse.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#67

Post by kenjackson »

johnzabroski wrote: post #64
kenjackson wrote: post #21

Earlier quoted context omitted.

Read these papers: http://www.contextis.com/resources/blog/webgl/ http://www.contextis.com/resources/blog/webgl2/ To learn more about WebGl and security. Goes into more depth than that article.

That is extremely informative. How did you find it?

I saw that this story link was really just a recap of an original source (which appears to be down for maintainance now). The original source linked to these two papers, which upon a quick read had some content that I wasn't familiar with, so thought it might be news to others too.

In general, when I see blog recaps I almost always go to the source. This blog entry, like most good ones, will link to their sources.

I wish I could say it was because I'm an expert on OpenGl and security. I'm really just a rabid link follower.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#68

Post by jessedhillon »

msy wrote: post #50
Locke1689 wrote: post #13

Wow, this thread is turning into another security-clueless developer freakout. Microsoft very clearly laid out reasons why they believe that WebGL presents possible security vulnerabilities. While GPU security isn't my area of expertise, the driver issues seem very plausible. If someone wants to actually address Microsoft's points in this thread then that would be great.

Well either Google and Mozilla are knowingly shipping insecure code or Microsoft is, to some degree, wrong. Given the history of the organisations in question I'm going to assume Microsoft wrong or not telling the whole story until we hear a response from Moz or Google.

This is a false dichotomy. Mozilla and Google could both be unknowingly introducing the possibility of bugs and errors. The depth of their testing could be inadequate -- bugs could occur only on certain combinations of hardware and driver (and even, versions of drivers).

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#69

Post by jimbobimbo »

joelthelion wrote: post #41

They have a point, but coming from the company that invented ActiveX, I find it rather funny :)

Actually, thanks to the backlash they got in Windows XP pre-SP2 times, they are very security-conscious now. Blessing in disguise.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#70

Post by jimbobimbo »

jimbobimbo wrote: post #12
vbrenny wrote: post #2

Yeah, sure. Silverlight is the future!

Actually, that's an interesting point. Silverlight allows pixel shader usage, which they view unsafe in WebGL. That'd be interesting to read SDL team's views on this.

Looks, like this is the answer: http://news.ycombinator.com/item?id=2663497
Post reply on HN