Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft refuses to endorse WebGL, labels it ‘harmful’

winrumors.com

Post reply on HN
Print view View original

101–110 of 114 posts

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#101

Post by nodata »

m_eiman wrote: post #95
spullara wrote: post #91

Earlier quoted context omitted.

Those, like activex controls, require the user to agree to install something that can do whatever to their system. WebGL would be available to any web site.

That should be easy enough to duplicate, just make the feature one of those "Site X wants to use WebGL. [Allow] [Deny]" things. It would make it useless for ads and such, of course, but it seems that most people want to use it for games. Might be workable.

This is not a solution because a user would not know how to answer that question. We don't want ActiveX all over again.

The solution is to address the problems in the article.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#102

Post by rys »

daeken wrote: post #45
cma wrote: post #43

Earlier quoted context omitted.

I don't have a response, but Microsoft supposedly thinks it is securable enough for Silverlight: "With the release of Silverlight 3 Beta 1 GPU (Graphics Processing Unit) acceleration (or hardware acceleration) is now available." I'd like to hear what could make that secure that couldn't be used with WebGL.

I don't know anything about how they're doing this, but I wonder if it has something to do with the bytecode abstraction used in D3D. In D3D, you compile HLSL to bytecode which then gets passed down to the kernel, but in the OGL world you pass source straight down to the kernel. Definitely still risks there, but significantly diminished, and some simple verification in userland would make it next to impossible to get…

The D3D bytecode IR generated by the HLSL shader compiler in the runtime isn't verified for security concerns before being passed to the driver, so there's no real extra protection there, so ultimately D3D makes it no harder to lock the GPU than OpenGL (ES in the WebGL case) does.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#103

Post by reduxredacted »

I'm actually a big fan of several Microsoft products, and think their stand on WebGL is completely right.

OEM video card drivers have a history of already being unstable. In all likelihood, this represents an attack vector that, up until this point, I hadn't even thought of.

That said, it highlights something that has become somewhat of a trend with Microsoft. They seem to have decision making in almost every area being done by different teams who don't talk to one another. While I agree that OpenGL isn't "safe", what about ActiveX? Isn't allowing a browser to execute arbitrary code directly against the processor (regardless of whether or not its "signed" and the user had to click a few dialogs), a far greater threat? I'd love to see a press release that indicated they were ripping that functionality out of all currently supported browsers. What about Silverlight? I thought that had elements of hardware acceleration (perhaps it's protected enough, who knows?).

Kudos, to them, for taking a well reasoned stand for security in an application type that is routinely used to attack users, but I'd like to see the other 'harmful' features addressed as well. For now, I find Firefox with NoScript and Adblock+ to be the safest bet.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#104

Post by ZeroGravitas »

r00fus wrote: post #90
drivebyacct2 wrote: post #24

Earlier quoted context omitted.

>thanks for ditching the open standard h264 on Chrome I think that someone may have lied to you when they explained the words "open" or "standard". Also, why am I "looking at" MSFT/AAPL/GOOG for in relation to HTML/CSS/JS apps? They fact that many are still native? Google's apps for iOS are web based, and I'm sure iCloud apps for Android will be web based. Microsoft just got done demoing HTML5/CSS3 applications for W…

> I think that someone may have lied to you when they explained the words "open" or "standard". h.264 is not royalty free, but it is open and a standard (from Ars: http://arstechnica.com/web/news/2011/01/googles-dropping-h26... ) "In the traditional sense, H.264 is an open standard. That is to say, it was a standard designed by a range of domain experts from across the industry, working to the remit of a standards or…

That particular author has a chip on his shoulder about H.264 and WebM. I would consider taking anything he says on the matter with a grain of salt. His calling anything "unambiguously open" when the word "open" itself is so ambiguous is very poor rhetoric.

But if you look for precise definitions of the phrase "open standard" you might find that H.264 fails 14/16 of the various definitions offered by governments and standards bodies on the wikipedia page for that term. All failing for the same reason of charging patent fees. One of the other definitions is a historical accident that I doubt the same body would stand by today, or at any point in the last 5 or so years. The final definition, the one that it passes, just so happens to be written by patent attorneys of the people who developed H.264.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#105

Post by MatthewPhillips »

mixmastamyk wrote: post #14

I'm not a fan of most MS products, and I get a bit of NIH syndrome vibe from the article. However, the security argument is spot on. Perhaps browser developers have come up with strong countermeasures, but experience shows the state of OS and app development today is still ineffective in the area. I don't allow Java, most Javascript, and most Flash to run on my system either, so its nothing personal. With direct acce…

Why is deferring execute to a button any better? A user that visits a site is implicitly trusting it; it doesn't take additional trust to click a link (or hover over a link, for that matter). Sandboxing js to only user explicit events will take us back to the browser stone ages.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#109

Post by pflats »

pmjordan wrote: post #94
SoftwareMaven wrote: post #60

Earlier quoted context omitted.

Microsoft has the perspective of the entire OS from top to bottom. Google and Firefox have the perspective of their respective applications. Given the concerns Microsoft is voicing (and they aren't the first to voice them) are well below the application itself, I tend to trust Microsoft more on this one.

What about Apple? They're clearly working on WebGL support for Safari. They have at least equal insight into the whole stack, considering the ship the GPU drivers with the OS. Then there's XNA in Silverlight. If they believe in the security of that, why not build WebGL on top of it? Probably because they're in direct competition with one another, and Microsoft wants Silverlight to win.

I would think that security in this regard is far easier for Apple than it is for Microsoft. By virtue of their closed hardware, Apple has a very limited set of graphics cards for OS X to support. I'd imagine that this makes graphics drivers a lot easier to police and keep secure.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#110

Post by andrewf »

pmjordan wrote: post #94
SoftwareMaven wrote: post #60

Earlier quoted context omitted.

Microsoft has the perspective of the entire OS from top to bottom. Google and Firefox have the perspective of their respective applications. Given the concerns Microsoft is voicing (and they aren't the first to voice them) are well below the application itself, I tend to trust Microsoft more on this one.

What about Apple? They're clearly working on WebGL support for Safari. They have at least equal insight into the whole stack, considering the ship the GPU drivers with the OS. Then there's XNA in Silverlight. If they believe in the security of that, why not build WebGL on top of it? Probably because they're in direct competition with one another, and Microsoft wants Silverlight to win.

Apple has announced that, for now, WebGL on iOS will only be available to WebKit when it's displaying advertisements through iAd (where Apple controls which ads are distributed), and not to web pages generally.

http://www.theregister.co.uk/2011/06/16/webgl_in_ios_5/

Post reply on HN