Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft refuses to endorse WebGL, labels it ‘harmful’

winrumors.com

Post reply on HN
Print view View original

31–40 of 114 posts

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#31

Post by daeken »

seanalltogether wrote: post #10

My biggest question with webgl is who is it targeted at? Certainly it can't be game developers because javascript is still way to slow to manage a game world and vector logic. Pipelining assets is also a big problem in html and I just can't see many devs taking it seriously as a way to deliver 3d games.

I'm using it for a couple things. Initially I was just writing demo code to play around with it and take advantage of the ease of collaboration that the web gives you. Now, however, I'm building a MVP of an idea I've had in mind for a while where you can design a figurine of your kid/friend/partner/whatever and get it 3d printed -- WebGL makes it simple and easy.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#33

Post by bmm6o »

jimbobimbo wrote: post #26
tree_of_item wrote: post #8

Wow. Could they be more transparent? This couldn't have anything to do with Direct X, could it?

It's not about whether it could affect Direct X or not - one game crashing your GPU due to some unintentional bug code (there's no incentive on game publisher's side to make it intentional) is not the same as the Web, where anybody can push something to your browser that exploits hole in some graphics card driver. Microsoft has a point. They do not explain, however, how Silverlight is invincible in the same situation…

Exactly. TFA: "Attacks that may have previously resulted only in local elevation of privilege may now result in remote compromise."

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#34

Post by silentOpen »

alexkcd wrote: post #27

They have a point. OpenGL was not designed with security in mind (same goes for Direct 3D). Prior to WebGL there wasn't really a need for security, since applications making use of OpenGL would typically be considered trusted. Index buffers into vertex arrays, for example, are not bounds checked in OpenGL. This makes perfect sense in terms of efficiency, but can lead to code execution in adversarial settings. I'm sur…

They do bounds checking and shader verification using ANGLE.

http://code.google.com/p/angleproject/

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#35

Post by Hov »

jimbobimbo wrote: post #26
tree_of_item wrote: post #8

Wow. Could they be more transparent? This couldn't have anything to do with Direct X, could it?

It's not about whether it could affect Direct X or not - one game crashing your GPU due to some unintentional bug code (there's no incentive on game publisher's side to make it intentional) is not the same as the Web, where anybody can push something to your browser that exploits hole in some graphics card driver. Microsoft has a point. They do not explain, however, how Silverlight is invincible in the same situation…

I'm almost certain Silverlight's Pixel Shaders don't run on the GPU. I have no proof of this other than that they're pretty slow, hence my conclusion.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#36

Post by daeken »

Locke1689 wrote: post #13

Wow, this thread is turning into another security-clueless developer freakout. Microsoft very clearly laid out reasons why they believe that WebGL presents possible security vulnerabilities. While GPU security isn't my area of expertise, the driver issues seem very plausible. If someone wants to actually address Microsoft's points in this thread then that would be great.

I can also support their claims with some preliminary research I've done. When I have free time, I've been poking at the security of shader compilers -- both the translation that's done in Webkit and the compilers in drivers -- and things are pretty bad. Don't have much to show for it yet (a couple non-exploitable crashes/bugs), but I think future research will prove very fruitful.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#37

Post by daeken »

rbanffy wrote: post #20
keithwarren wrote: post #5

Cue the chorus of people saying this is because Microsoft sucks etc etc. Ignore the fact that Microsoft has spent more time and resources than any technology company in the world focusing on web related security. Mind you that is not an endorsement of their track record, but a statement with respect to the reality on the ground.

> Microsoft has spent more time and resources than any technology company in the world focusing on web related security. Mostly because they had to. If others spent less it could be because they had a smaller vulnerable surface to begin with, or simpler codebases.

You evidently haven't seen the massive codebases from the Mozilla or Webkit camps, or the huge number of vulnerabilities therein in recent years. IE is a huge piece of shit, but MS has done a lot for web security. Mind you, I think Google's efforts have been more fruitful, but writing off MS's effort is silly.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#38

Post by daeken »

silentOpen wrote: post #34
alexkcd wrote: post #27

They have a point. OpenGL was not designed with security in mind (same goes for Direct 3D). Prior to WebGL there wasn't really a need for security, since applications making use of OpenGL would typically be considered trusted. Index buffers into vertex arrays, for example, are not bounds checked in OpenGL. This makes perfect sense in terms of efficiency, but can lead to code execution in adversarial settings. I'm sur…

They do bounds checking and shader verification using ANGLE. http://code.google.com/p/angleproject/

The shader verification isn't perfect (e.g. mishandling unicode), though, and is only syntax deep -- if you find bugs in the compiler based around, say, too many function calls nested together (e.g. foo(bar(baz(...))) ) then it will go through ANGLE with no changes. It's a good effort, but needs a lot of work. I've been fuzzing it off and on for that reason.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#39

Post by nextparadigms »

seanalltogether wrote: post #10

My biggest question with webgl is who is it targeted at? Certainly it can't be game developers because javascript is still way to slow to manage a game world and vector logic. Pipelining assets is also a big problem in html and I just can't see many devs taking it seriously as a way to deliver 3d games.

WebGL can be the alternative to Flash games on the web. The performance can be better and the graphics more advanced.
Post reply on HN