Live data from Hacker News

Attacking the Windows Nvidia Driver

googleprojectzero.blogspot.com

11–20 of 77 posts

Re: Attacking the Windows Nvidia Driver

#11
A lot of people hated the decision, but back when Microsoft refused to support WebGL, one of the reasons were that the GPU drivers were awful and exposing them to the internet was dangerous.

The proper solution, of course, i for GPU drivers not to suck but it was still a legitimate point and this article seems to validate that.

Re: Attacking the Windows Nvidia Driver

#12
post #9
post #6

Earlier quoted context omitted.

Yeah - that sounds like fun - recreating a driver install issue after you finally have it working on your system. Heck, even if you set up a system -just- to recreate this problem, it would still be one of those "nightmare inducing" trials of will. I'm not saying it shouldn't be done, I just can't imagine doing it (especially on my personal workstation).

Plus you paid for the computer, graphic card and OS. Why in hell would you spend hours of work on your free time for this ? Do people try to find defects in their car then send a report to Ferrari ?

> Do people try to find defects in their car then send a report to Ferrari ?

Yes.

-- Ferruccio Lamborghini.

Re: Attacking the Windows Nvidia Driver

#13
post #11

A lot of people hated the decision, but back when Microsoft refused to support WebGL, one of the reasons were that the GPU drivers were awful and exposing them to the internet was dangerous. The proper solution, of course, i for GPU drivers not to suck but it was still a legitimate point and this article seems to validate that.

The post specifically mentions that these things are not vulnerable to attack from WebGL, because you can't reach the APIs in question just by drawing.

Re: Attacking the Windows Nvidia Driver

#14
post #11

A lot of people hated the decision, but back when Microsoft refused to support WebGL, one of the reasons were that the GPU drivers were awful and exposing them to the internet was dangerous. The proper solution, of course, i for GPU drivers not to suck but it was still a legitimate point and this article seems to validate that.

Microsoft changed their minds and this article validates that the fears were mostly unfounded. Browsers can do enough validation of their own to mitigate most driver issues.

Re: Attacking the Windows Nvidia Driver

#15
post #8

Earlier quoted context omitted.

Oh trust me, they do tons of QA. If you can replicate what problem you have demonstrably with steps that QA can follow and you submit to the Nvforums or whatever, someone in the QA team will eventually try it out.

I dunno, I have had to live with this bug ( https://forums.geforce.com/default/topic/953432/geforce-mobi... , https://answers.microsoft.com/en-us/windows/forum/windows_10... ) for over half a year now.

I had to revert the Windows 10 Anniversary Update to work around that.

Re: Attacking the Windows Nvidia Driver

#16
post #3

I wonder if AMD drivers have the same attack surfaces as the nvidia drivers Edit: a quick google search turns up CVEs for the old catalyst driver, but none for the newer crimson drivers.

Too bad my laptop can't use those crimson drivers, as AMD no longer support the APU part of the setup that make things like external displays work (and will you please stop trying to be helpful and silently "upgrading" my drivers, Microsoft!).

Re: Attacking the Windows Nvidia Driver

#17
Getting these issues fixed in the drivers is great, no doubt. But it's moot if nobody actually updates to those fixed versions. How hard are nVidia/Microsoft trying to actually push these out over Windows Update so that end users will actually benefit from all of this work?

Re: Attacking the Windows Nvidia Driver

#18
post #11

A lot of people hated the decision, but back when Microsoft refused to support WebGL, one of the reasons were that the GPU drivers were awful and exposing them to the internet was dangerous. The proper solution, of course, i for GPU drivers not to suck but it was still a legitimate point and this article seems to validate that.

The post specifically mentions that these things are not vulnerable to attack from WebGL, because you can't reach the APIs in question just by drawing.

The parts now exposed to WebGL are pretty well fuzzed at this point; much of the low-hanging fruit has now been picked.

Re: Attacking the Windows Nvidia Driver

#19

I cant prove this but my computer blue screened after a Nvidia driver update. It took my several hours to get everything working again because it wouldnt even launch in safe mode. Very frustrating. I wish they had a little more quality control on their drivers.

Oh trust me, they do tons of QA. If you can replicate what problem you have demonstrably with steps that QA can follow and you submit to the Nvforums or whatever, someone in the QA team will eventually try it out.

I once interviewed for a Software Engineering role with an Nvidia QA team in Austin 5 or 6 years ago(would have been working on maintaining the test software that validated new drivers on huge banks of test hardware, if memory serves).

Wasn't too terribly impressed with the team (and a couple of them were definitely giving off that "I hate my job/life" vibe, one disgruntled fellow was even trying to drop little thinly-veiled "run away!" hints at me). I figure either the cream of the crop at Nvidia doesn't work in QA, or they don't get proper support from upper management.

P.S. Didn't get an offer anyway, probably for the best - I was desperate for work at the time and would have taken it :)

Re: Attacking the Windows Nvidia Driver

#20
post #11

A lot of people hated the decision, but back when Microsoft refused to support WebGL, one of the reasons were that the GPU drivers were awful and exposing them to the internet was dangerous. The proper solution, of course, i for GPU drivers not to suck but it was still a legitimate point and this article seems to validate that.

They were right that it was dangerous, but it became pretty clear that IE was using them to provide cover for not implementing a feature when they changed their mind later.

Whereas Chrome implemented a WebGL compiler that reduced the amount of attack surface WebGL could reach and audited a bunch of popular drivers to fix the exposed bits.

I think the fact that this blog shows that these vulnerabilities are not reachable from WebGL is a validation of Chrome's approach there, though it clearly shows the issues these drivers present for escaping Chrome's sandbox.

Post reply on HN