Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hello Opera 12

my.opera.com

Post reply on HN
Print view View original

121–130 of 137 posts

Re: Hello Opera 12

#121

Post by ilaksh »

dnissley wrote: post #84
ilaksh wrote: post #20

Why don't they enable WebGL by default? I don't see why more people don't realize, WebGL is a prime Microsoft threat and the key to moving away from the MS Windows monopoly. That's why Microsoft has done so much work to try to scare people away from WebGL (by sponsoring 'security research' and creating FUD content on Wikipedia (seriously, look at the history of that article, the person who created the whole 'security…

Is it just FUD though? John Carmack seems to agree with microsoft about the security concerns over exposing graphics drivers to the web. https://twitter.com/#!/ID_AA_Carmack/status/8173219094948659...

So what if one person agrees with MS, they are a marketing machine.

How many years does John Carmack have invested in C++ programming for Windows games?

Re: Hello Opera 12

#122

Post by justincormack »

daeken wrote: post #89
ilaksh wrote: post #20

Why don't they enable WebGL by default? I don't see why more people don't realize, WebGL is a prime Microsoft threat and the key to moving away from the MS Windows monopoly. That's why Microsoft has done so much work to try to scare people away from WebGL (by sponsoring 'security research' and creating FUD content on Wikipedia (seriously, look at the history of that article, the person who created the whole 'security…

For background, I write a lot of WebGL demos, I work for Mozilla on gfx optimizations (WebGL and otherwise) for the Boot2Gecko project. I also worked at Matasano Security previously, doing WebGL security research. As such, I tend to think that I'm pretty unbiased in this regard -- or perhaps biased towards WebGL, since I love it and want to see it everywhere. So with all that said, your characterization of MS's secur…

If the kernel "largely trusts the userspace" then the security model is wrong.

Re: Hello Opera 12

#123

Post by kombine »

azakai wrote: post #105
kombine wrote: post #93

Earlier quoted context omitted.

This is just an indicator that we need a proper native development environment. Devs who embrace new web technologies like WebGL, or forget that those are just Javascript bindings to the technologies developed in C/C++. Can we please have native code instead, so developer controls the underlying system without having to rely on the wits of browser makers? Google Native Client is a step in the right direction.

> This is just an indicator that we need a proper native development environment. Devs who embrace new web technologies like WebGL, or forget that those are just Javascript bindings to the technologies developed in C/C++. That is technically true, but what is the point? The bindings can make things better, or they can make things worse. WebGL, for example, covers over a lot of issues with OpenGL (security and conveni…

> That is technically true, but what is the point? The bindings can make things better, or they can make things worse. WebGL, for example, covers over a lot of issues with OpenGL (security and convenience), making the web version very nice to use.

Last time I tried WebGL version of Quake3 on my machine which had the hi-end AMD graphics card at that time, it ran at less than 100FPS. For a game that's 10 years old that is a very poor result. The reason why I said bindings is because I want a language powerful enough to implement any technology I want in that language.

> There is no simple solution here.

Of course it's not simple. It doesn't mean it's not possible. Microsoft's WinRT is another example of coming closer to the native code apps.

Re: Hello Opera 12

#124

Post by ryannielsen »

ilaksh wrote: post #121
dnissley wrote: post #84

Earlier quoted context omitted.

Is it just FUD though? John Carmack seems to agree with microsoft about the security concerns over exposing graphics drivers to the web. https://twitter.com/#!/ID_AA_Carmack/status/8173219094948659...

So what if one person agrees with MS, they are a marketing machine. How many years does John Carmack have invested in C++ programming for Windows games?

"Doom was developed on NeXT workstations, under the NEXTSTEP operating system.[6] The Doom game engine was programmed in C, and the editing tools were written in Objective-C. The engine was first compiled with Intel's C compiler for DOS, but later Watcom's C/C++ compiler was used" [1]

John Carmack is nothing if non-partisan when it comes to tools and platforms. Most everything he wrote was reasonably cross-platform C until id Tech 4, released in 2004.

I'd say Carmack has zero years invested in C++ programming for Windows games. He instead has decades invested in making cross platform game engines written in a variety of C-based languages.

[1] http://en.wikipedia.org/wiki/Making_of_Doom

Re: Hello Opera 12

#125

Post by ryannielsen »

ilaksh wrote: post #120
daeken wrote: post #89

Earlier quoted context omitted.

For background, I write a lot of WebGL demos, I work for Mozilla on gfx optimizations (WebGL and otherwise) for the Boot2Gecko project. I also worked at Matasano Security previously, doing WebGL security research. As such, I tend to think that I'm pretty unbiased in this regard -- or perhaps biased towards WebGL, since I love it and want to see it everywhere. So with all that said, your characterization of MS's secur…

How many examples of this type of "just 3 layers" compromise have we actually ever seen being used as an "attack"? How many is that compared to the number of known attacks against browsers using non WebGL-related technologies? Did you actually see the specific 'security' concerns that that MS shop put out? Part of it was a laughable demo of an 'attack' that actually did not compromise anything, and looked like a mock…

A recent Chromium blog post enumerated a successful 14 step exploit. http://blog.chromium.org/2012/06/tale-of-two-pwnies-part-2.h...

Almost all of the iOS jailbreak vectors involve chaining together bugs and quirks in multiple different subsystems, to ultimately root the system.

These aren't theoretical concerns. Just because WebGL hasn't yet been exploited doesn't mean it'll never be exploited. And given the way WebGL works, a WebGL exploit may be a very serious problem.

Re: Hello Opera 12

#126

Post by daeken »

ilaksh wrote: post #120
daeken wrote: post #89

Earlier quoted context omitted.

For background, I write a lot of WebGL demos, I work for Mozilla on gfx optimizations (WebGL and otherwise) for the Boot2Gecko project. I also worked at Matasano Security previously, doing WebGL security research. As such, I tend to think that I'm pretty unbiased in this regard -- or perhaps biased towards WebGL, since I love it and want to see it everywhere. So with all that said, your characterization of MS's secur…

How many examples of this type of "just 3 layers" compromise have we actually ever seen being used as an "attack"? How many is that compared to the number of known attacks against browsers using non WebGL-related technologies? Did you actually see the specific 'security' concerns that that MS shop put out? Part of it was a laughable demo of an 'attack' that actually did not compromise anything, and looked like a mock…

I haven't seen any real-world attacks using WebGL yet; we probably won't for a couple years, since it's still very new technology and there's a lot to learn to be able to do even basic research there.

And have you seen them? http://blogs.technet.com/b/srd/archive/2011/06/16/webgl-cons... Let's go over the points together:

> Browser support for WebGL directly exposes hardware functionality to the web in a way that we consider to be overly permissive

The WebGL API -- outside of bounds checking and shader validation/translation -- is a direct conversion of the EGL API. This makes getting your data (legitimate or not) into the lower levels very easy. That cuts both ways, as I detailed.

> Browser support for WebGL security servicing responsibility relies too heavily on third parties to secure the web experience

Read: The security of WebGL depends on GPU driver vendors, who write terrible code. This point is well known by anyone who's worked on enough 3D code, or even just tried to fix graphics bugs in games by doing the driver update dance.

> Problematic system DoS scenarios

For the vast majority of GPUs, there's no way to set timeouts on rendering or shader execution, so DoSes are just downright trivial. This will be the first thing to get better, with the various robustness extensions that are coming.

All in all, I have absolutely no issues with what MS released on the subject.

Re: Hello Opera 12

#127

Post by samstokes »

One reason this is a big deal: Opera now supports CORS [1]. Until now, it was the only significant browser that didn't. (Even IE did, albeit - of course - in its own special way.)

[1] http://en.wikipedia.org/wiki/Cross-origin_resource_sharing - secure cross-domain AJAX without hacks like JSONP, so you can do POST requests, set headers, etc.

Re: Hello Opera 12

#128

Post by gcp »

mkup wrote: post #43
gcp wrote: post #16

Earlier quoted context omitted.

Very unlikely. 64-bit is mostly an advantage if you have to use a lot of memory or are doing processing on actual 64-bit integers. For the kind of software like Opera (and Firefox and Chrome), the additional registers in 64-bit mode help a little, but that tends to be offset by most pointers now being 64-bits and the L1/L2 caches hence being less effective.

There are more registers in x64, so there may be some speed gain. Or a loss of speed due to larger pointer size and more frequent cache misses.

Did you just repeat exactly what I said?

Re: Hello Opera 12

#129

Post by azakai »

kombine wrote: post #123
azakai wrote: post #105

Earlier quoted context omitted.

> This is just an indicator that we need a proper native development environment. Devs who embrace new web technologies like WebGL, or forget that those are just Javascript bindings to the technologies developed in C/C++. That is technically true, but what is the point? The bindings can make things better, or they can make things worse. WebGL, for example, covers over a lot of issues with OpenGL (security and conveni…

> That is technically true, but what is the point? The bindings can make things better, or they can make things worse. WebGL, for example, covers over a lot of issues with OpenGL (security and convenience), making the web version very nice to use. Last time I tried WebGL version of Quake3 on my machine which had the hi-end AMD graphics card at that time, it ran at less than 100FPS. For a game that's 10 years old that…

> Last time I tried WebGL version of Quake3 on my machine which had the hi-end AMD graphics card at that time, it ran at less than 100FPS. For a game that's 10 years old that is a very poor result.

The Quake II port was extremely unoptimized in how it was performed. It's not a good benchmark of anything.

> Microsoft's WinRT is another example of coming closer to the native code apps.

What about just actual Android C++ apps, as an example of native code apps..?

Re: Hello Opera 12

#130

Post by ilaksh »

daeken wrote: post #126
ilaksh wrote: post #120

Earlier quoted context omitted.

How many examples of this type of "just 3 layers" compromise have we actually ever seen being used as an "attack"? How many is that compared to the number of known attacks against browsers using non WebGL-related technologies? Did you actually see the specific 'security' concerns that that MS shop put out? Part of it was a laughable demo of an 'attack' that actually did not compromise anything, and looked like a mock…

I haven't seen any real-world attacks using WebGL yet; we probably won't for a couple years, since it's still very new technology and there's a lot to learn to be able to do even basic research there. And have you seen them? http://blogs.technet.com/b/srd/archive/2011/06/16/webgl-cons... Let's go over the points together: > Browser support for WebGL directly exposes hardware functionality to the web in a way that we…

"This makes getting your data (legitimate or not) into the lower levels very easy."

Bullshit. Completely unsubstantiated.

The browsers themselves are what are actually being compromised in reality, Microsoft by far more than others. The WebGL exploits are just theoretical. Every browser vendor is a third party.

Big fucking deal, somebody makes your browser or system freeze up.. like that is a new thing that you can't do with a browser or with Internet Explorer? Freezing the system isn't that easy to do with WebGL and depends on the specific setup of that machine. That's not a security concern, thats just a potential inconvenience.

I don't give a fuck what you dumbasses think, this is obviously Microsoft FUD. But its just another example of the sort of idiotic rationalizations that normally support the status quo.

Post reply on HN