Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IE11 to support WebGL

microsoft-news.com

Post reply on HN
Print view View original

121–130 of 136 posts

Re: IE11 to support WebGL

#121

Post by fulafel »

pvnick wrote: post #61
idupree wrote: post #50

What engineering did they do to reduce the security risk? As much as I like WebGL as a dev, Microsoft's arguments against feeding arbitrary machine code to buggy graphics cards that have kernel-level memory access privileges... seemed a bit convincing.

Just want to reply to say I also would like to hear an answer to this question. Something I've wanted to do for a while is write a fuzzer [1] that puts together arbitrary garbage shader script code and runs it with weird webgl operations looking for exploitable crashes. I would expect there to be a ton of bugs found, but then again the monetary barrier to entry might be high considering differences between hardware.…

This is happening and Google & Mozilla have both been dealing out bug bounties for vulnerabilities found this way.

You can search for them in eg chrome bug db: https://encrypted.google.com/search?hl=en&q=site%3Acode.goog...

(this shows just the subset they've remembered to make public, some time after fixes were shipping in stable)

Re: IE11 to support WebGL

#122

Post by anon1385 »

nailer wrote: post #106
jimmaswell wrote: post #77

Earlier quoted context omitted.

"Any browser that doesn't implement WebGL will soon be considered crippled" Really? I don't think WebGL is that important. What's it really good for besides laggy browser games? What's with the hype on browser games anyway? They're always going to perform much slower than native code. I don't see WebGL becoming such a critical aspect of browsing that the average user would consider IE "crippled" for not supporting it…

ASM is only 2x slower than native (it was 10x prior to) and will be 1.5 soon. With a way better distribution model. Have you seen UE3 or UE4 demos?

>ASM is only 2x slower than native

Only in wilfully misleading benchmarks. Allow use of SIMD and multithreading and asm.js can be as much as 50 times slower:

http://cdn.arstechnica.net/wp-content/uploads/2013/05/native...

http://cdn.arstechnica.net/wp-content/uploads/2013/05/classi...

Re: IE11 to support WebGL

#124

Post by freehunter »

CJefferson wrote: post #107
mtgx wrote: post #102

Will Microsoft support the full OpenGL on Windows, too, now? Or will they just run WebGL through Google's ANGLE project? At least Google had the "excuse" to use it because they couldn't put OpenGL on Windows themselves, so they had to translate DirectX to OpenGL to make WebGL work. What's Microsoft's excuse? They should support OpenGL and allow Google and Mozilla to use the OpenGL API's directly, too. Then we'll all…

OpenGL on Windows is a driver issue. Some hardware manufacturers make opengl drivers, of varying quality. I'm not clear what you want Microsoft to do?

Microsoft should control Windows like Apple controls OSX except when I don't want them to! If something is wrong with Windows, it's Microsoft's fault for not controlling third party vendors! When Microsoft controls third party vendors, they're being anti-competitive!

Re: IE11 to support WebGL

#125

Post by josteink »

cmccabe wrote: post #83
idupree wrote: post #50

What engineering did they do to reduce the security risk? As much as I like WebGL as a dev, Microsoft's arguments against feeding arbitrary machine code to buggy graphics cards that have kernel-level memory access privileges... seemed a bit convincing.

The security claims were bullshit. For details see: http://games.greggman.com/game/webgl-security-and-microsoft-... tl;dr: While it was talking up the security risk of WebGL, Microsoft was allowing Silverlight to permit untrusted code to access graphics APIs in exactly the same way. Chrome validates everything before calling the actual driver APIs, so the opportunities for fuzzing are limited.

> Chrome validates everything before calling the actual driver APIs, so the opportunities for fuzzing are limited.

Well I guess that's the end of the story then. Google says it's secure so there can't possibly be any bugs or risks or anything worth caring about.

Everyone: put down your work. It's OK now. Google says so.

Re: IE11 to support WebGL

#126

Post by snprbob86 »

nitrogen wrote: post #89
snprbob86 wrote: post #87

Earlier quoted context omitted.

I dunno... Allowing the language to be selected like a video codec or image file format seems like a reasonable request. There are three issues: 1) Language pluggable? 2) Spec-ed shader languages 3) Mandatory languages The proposal was: 1) No 2 & 3) GL SL ES Microsoft proposed: 1) Yes 2) GL SL ES 3) None The perfectly reasonable compromise would have been: 1) Yes 2 & 3) GL SL ES

It may sound reasonable, but ultimately is against the universal spirit of the web, and thus should not be standardized. Your #1 should be No, because if it were Yes, we'd have a mess of mutually incompatible, vendor-specific, proprietary languages fragmenting 3D content on the web.

Mutually incompatible, vendor-specific, proprietary anything is an inevitability. #1 isn't about that. That's what #2 and #3 are about.

#1 is about planning for extensibility. Just look at the hackery with JS where lonely, otherwise ignored, strings are used for things like "use strict" and "use asm". Or where Microsoft added "conditional comments", which quite frankly, was essential to the development of Outlook Web Access, which basically gave us Ajax. Or all the absurd vendor prefixes on CSS tag names. Or one of 100 other little hacks that browser vendors have invented to try to innovate past the standard. Pushing pass the standard, by the way, is the only way forward. We've learned that lesson by now, so we should plan for extensibility.

Re: IE11 to support WebGL

#127

Post by nawitus »

jimmaswell wrote: post #77
judah wrote: post #4

Credit to Microsoft for reversing their previous stance on WebGL. Credit to Mozilla for pushing 3d on the web and forcing the issue. Any browser that doesn't implement WebGL will soon be considered crippled; Microsoft desperately wants to avoid that title again, so in a way, Mozilla forced their hand. Competition at work.

"Any browser that doesn't implement WebGL will soon be considered crippled" Really? I don't think WebGL is that important. What's it really good for besides laggy browser games? What's with the hype on browser games anyway? They're always going to perform much slower than native code. I don't see WebGL becoming such a critical aspect of browsing that the average user would consider IE "crippled" for not supporting it…

It will soon be used for numerous business apps as companies are porting their native applications to work on browsers.

Re: IE11 to support WebGL

#128

Post by jimmaswell »

nawitus wrote: post #127
jimmaswell wrote: post #77

Earlier quoted context omitted.

"Any browser that doesn't implement WebGL will soon be considered crippled" Really? I don't think WebGL is that important. What's it really good for besides laggy browser games? What's with the hype on browser games anyway? They're always going to perform much slower than native code. I don't see WebGL becoming such a critical aspect of browsing that the average user would consider IE "crippled" for not supporting it…

It will soon be used for numerous business apps as companies are porting their native applications to work on browsers.

I just hope the desktop versions don't go away.

Re: IE11 to support WebGL

#129

Post by nitrogen »

snprbob86 wrote: post #126
nitrogen wrote: post #89

Earlier quoted context omitted.

It may sound reasonable, but ultimately is against the universal spirit of the web, and thus should not be standardized. Your #1 should be No, because if it were Yes, we'd have a mess of mutually incompatible, vendor-specific, proprietary languages fragmenting 3D content on the web.

Mutually incompatible, vendor-specific, proprietary anything is an inevitability. #1 isn't about that. That's what #2 and #3 are about. #1 is about planning for extensibility. Just look at the hackery with JS where lonely, otherwise ignored, strings are used for things like "use strict" and "use asm". Or where Microsoft added "conditional comments", which quite frankly, was essential to the development of Outlook Web…

OpenGL already has a mechanism for extensibility, and proprietary junk is only an inevitability if we allow it to be enshrined in open standards. There is no reason to accept proprietary DRM plugins in CDM, and there is no reason to accept proprietary shader languages.

The reasons are manifold, but here are a few:

- Standardizing non-standardness gives proprietary implementations an unwarranted air of legitimacy and blesses incompatibility.

- Proprietary plugins and extensions are more likely to have untested security vulnerabilities and widen the browser attack surface.

- Proprietary extensions violate the essential web principles of cross-platform compatibility, graceful degradation, progressive enhancement, and accessibility.

Re: IE11 to support WebGL

#130

Post by tmzt »

pests wrote: post #101
tmzt wrote: post #65

Earlier quoted context omitted.

why wouldn't it be a hash of the download URL only?

Perhaps they are worried about the same url being used to serve multiple files. Eg: example.php/download/invoice.pdf might be customer / order specific.

Right, I can see why the hash of the file would be important, but I can't see why they would include the plain text URL instead of a hash.

It would be interesting to have a hash of a file that could identify embedded data but exclude private data. For instance, for a Microsoft Office file it would include hashes of embedded binary assets but exclude the text of the document.

Post reply on HN