21–30 of 40 posts
What are the security guarantees about this?
Exactly this. Vrchat had chromium for a while, but exploits got it removed. Itd be great if it was just a static browser engine, no Js, with a strong sandbox. So at most all that can be done is messing with the browsers runtime memory itself, not the system it's on.
Earlier quoted context omitted.
Exactly this. Vrchat had chromium for a while, but exploits got it removed. Itd be great if it was just a static browser engine, no Js, with a strong sandbox. So at most all that can be done is messing with the browsers runtime memory itself, not the system it's on.
What kind of exploits? Was the browser not isolated at all or was it (say) sandbox-escaping via the JS?
What are the security guarantees about this?
Exactly this. Vrchat had chromium for a while, but exploits got it removed. Itd be great if it was just a static browser engine, no Js, with a strong sandbox. So at most all that can be done is messing with the browsers runtime memory itself, not the system it's on.
Earlier quoted context omitted.
Exactly this. Vrchat had chromium for a while, but exploits got it removed. Itd be great if it was just a static browser engine, no Js, with a strong sandbox. So at most all that can be done is messing with the browsers runtime memory itself, not the system it's on.
What kind of exploits? Was the browser not isolated at all or was it (say) sandbox-escaping via the JS?
https://medium.com/@vrchat/security-update-web-panels-4699fa...
It was severe enough that I ripped them out, though we were unable to find any evidence of the vulnerability in use.
The current title here on HN of “Firefox in Unity” is incorrect. This is based on Servo, not Firefox. From what I understand as a very casual observer that hasn’t been keeping up with things, Servo’s architecture is rather more conducive to this application both in embedding convenience and rendering, being able to render pages in a way that will make them perfect quality regardless of your 3D perspective, whereas I…
Ok, we've changed the title to what the article says. " Please use the original title, unless it is misleading or linkbait; don't editorialize. " https://news.ycombinator.com/newsguidelines.html
Post titles need more context than the original article title because posting to HN strips out most of that original context.
I remember when this sort of functionality arrived in Second Life. It enabled a lot of easy 'shared experiences'. eg: Watching a live video stream of an event with people, or group presentations etc.
This is something I've wanted for years, for numerous uses like collaboration, Method of loci, and documentation. Overlaying our built-in spatial awareness with focused data is an area of information architecture with a lot of untapped potential. there is also this which allows multiple windows within unity (there's a demo you can try): https://zenfulcrum.com/browser
+1 for this; couldn't agree more
Sounds like Unity has changed enough under the hood that the technique I used (calling gl_bind() behind Unity's back, using the texture ID you pass in, to basically write to the texture Unity is using for your mesh) no longer works.
Earlier quoted context omitted.
What kind of exploits? Was the browser not isolated at all or was it (say) sandbox-escaping via the JS?
We posted this: https://medium.com/@vrchat/security-update-web-panels-4699fa... It was severe enough that I ripped them out, though we were unable to find any evidence of the vulnerability in use.