Microsoft refuses to endorse WebGL, labels it ‘harmful’ • Hacker News Board

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#111

Post by mixmastamyk » Fri, Jun 17, 2011, 6:15 PM UTC

MatthewPhillips wrote: post #105

mixmastamyk wrote: post #14

I'm not a fan of most MS products, and I get a bit of NIH syndrome vibe from the article. However, the security argument is spot on. Perhaps browser developers have come up with strong countermeasures, but experience shows the state of OS and app development today is still ineffective in the area. I don't allow Java, most Javascript, and most Flash to run on my system either, so its nothing personal. With direct acce…

Why is deferring execute to a button any better? A user that visits a site is implicitly trusting it; it doesn't take additional trust to click a link (or hover over a link, for that matter). Sandboxing js to only user explicit events will take us back to the browser stone ages.

It is much better security/performance-wise to only run programs you intend to.

There are sites you visit every day like HN, and there are those sites you rarely if ever visit. Perhaps a link from a link to one of the stories here.

Not allowing those sites to autoexecute code is very powerful. Hell, not allowing tracking code to run at trusted sites is just as powerful.

With Flashblock et all, I can go to strange urls and not have to worry about dangerous, performance sapping shit getting loaded. There is a whitelist for sites/scripts I choose to enable.

If you've never used NoScript/Ghostery give them a try. Your eyes will be opened to the sheer amount garbage loaded even on "trustworthy" sites.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#112

Post by pmjordan » Fri, Jun 17, 2011, 9:34 PM UTC

pflats wrote: post #109

pmjordan wrote: post #94

Earlier quoted context omitted.

What about Apple? They're clearly working on WebGL support for Safari. They have at least equal insight into the whole stack, considering the ship the GPU drivers with the OS. Then there's XNA in Silverlight. If they believe in the security of that, why not build WebGL on top of it? Probably because they're in direct competition with one another, and Microsoft wants Silverlight to win.

I would think that security in this regard is far easier for Apple than it is for Microsoft. By virtue of their closed hardware, Apple has a very limited set of graphics cards for OS X to support. I'd imagine that this makes graphics drivers a lot easier to police and keep secure.

Let's face it, AMD, nVidia and Intel have >99% of the PC GPU market, and 100% of the Mac market. The drivers only change from one chip generation to the next, and the Mac has had chips from all recent generations from all 3 manufacturers. The total number of drivers is therefore identical. I really don't think there's much in it. See also: Silverlight's XNA.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#113

Post by dantheta » Sat, Jun 18, 2011, 9:58 AM UTC

"Microsoft believes that WebGL will become an “ongoing source of hard-to-fix vulnerabilities” in its current form. "

If only they'd had the same insight with ActiveX, and all of the other attempts to turn Internet Explorer into a zero-install native application execution environment.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#114

Post by johnzabroski » Mon, Jun 20, 2011, 11:32 PM UTC

SigmundA wrote: post #87

johnzabroski wrote: post #63

Earlier quoted context omitted.

It is a completely separate house / separate bed issue. You do not have permission to call Direct3D directly. You can't even do cool hacks like you can in WPF, stealing the Direct3D video feed and writing it to a movie file. Everything is abstracted away by (underpowered) APIs. All Secunia advisories on .NET Framework / Silverlight are presently patched, and the total number is relatively small compared to other tech…

Silverlight 5 is a better comparison, this blog has the details: http://muizelaar.blogspot.com/

That blog is trolling. The blog author copied and pasted the material from the blog we are currently discussing, and replaced WebGL with Silverlight.

Silverlight is more secure than WPF, too, by the way, and has to be. For example, in WPF there is a very insecure static method that allows you to steal a bitmap of the entire screen! This was one of the first things taken out of Silverlight.

If you want to know more about Silverlight security, ask Nick Kramer who maintains the Silverlight security best practices document for Microsoft.