Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IE11 to support WebGL

microsoft-news.com

Post reply on HN
Print view View original

61–70 of 136 posts

Re: IE11 to support WebGL

#61

Post by pvnick »

idupree wrote: post #50

What engineering did they do to reduce the security risk? As much as I like WebGL as a dev, Microsoft's arguments against feeding arbitrary machine code to buggy graphics cards that have kernel-level memory access privileges... seemed a bit convincing.

Just want to reply to say I also would like to hear an answer to this question. Something I've wanted to do for a while is write a fuzzer [1] that puts together arbitrary garbage shader script code and runs it with weird webgl operations looking for exploitable crashes. I would expect there to be a ton of bugs found, but then again the monetary barrier to entry might be high considering differences between hardware.

It also looks like the good folks at Mozilla have already been doing this to some degree [2], presumably shrinking the untested threat surface considerably (man I love those guys).

[1] http://en.wikipedia.org/wiki/Fuzz_testing

[2] https://bugzilla.mozilla.org/show_bug.cgi?id=665936

Re: IE11 to support WebGL

#62

Post by rurounijones »

dman wrote: post #23
judah wrote: post #4

Credit to Microsoft for reversing their previous stance on WebGL. Credit to Mozilla for pushing 3d on the web and forcing the issue. Any browser that doesn't implement WebGL will soon be considered crippled; Microsoft desperately wants to avoid that title again, so in a way, Mozilla forced their hand. Competition at work.

I am surprised they didnt try to push a webdx based off directx.

They did, sort of[1], it didn't appear to fly.

[1] http://lists.w3.org/Archives/Public/public-fx/2012JulSep/007...

Re: IE11 to support WebGL

#63

Post by camus »

judah wrote: post #4

Credit to Microsoft for reversing their previous stance on WebGL. Credit to Mozilla for pushing 3d on the web and forcing the issue. Any browser that doesn't implement WebGL will soon be considered crippled; Microsoft desperately wants to avoid that title again, so in a way, Mozilla forced their hand. Competition at work.

> Credit to Microsoft for reversing their previous stance on WebGL.

One cant believe anything MS says. And it's another proof of that.

Remember when WebGL wasnt "secure"? Strange , now it is.

I say bull* , like their bull Venture Capital sh*t.

But I guess they have enough spare change to do community management on HN ( ie propaganda ), looking at all the MS spin here.

Re: IE11 to support WebGL

#64

Post by scott_karana »

mayanksinghal wrote: post #59
nivla wrote: post #29

Earlier quoted context omitted.

I know but that also turns off the malware links protection. I don't mind the malware site/link protection since it only sends in a small part of the URL's hash for matching (similar to how we have in Firefox). Comparatively, the file scanner requires the whole hash of the file, the clear text of the download URL and the IP address which I find far more intrusive to privacy. I am hoping for a future update where they…

> only sends in a small part of the URL's hash for matching ... Isn't it incredibly easy to bypass that check by using a randomly generated url segment? [Edit: Formatting + isn't]

Right, so next time we download something private from a different party, we'll ask them to change their file structure to suit our privacy needs. :)

Re: IE11 to support WebGL

#65

Post by tmzt »

drivebyacct2 wrote: post #54
nivla wrote: post #29

Earlier quoted context omitted.

I know but that also turns off the malware links protection. I don't mind the malware site/link protection since it only sends in a small part of the URL's hash for matching (similar to how we have in Firefox). Comparatively, the file scanner requires the whole hash of the file, the clear text of the download URL and the IP address which I find far more intrusive to privacy. I am hoping for a future update where they…

Usually I groan when people complain about the Malware features in Chrome in relation to privacy but this is definitely one I'd not heard of. The hash of the whole file is bad enough, but even if it were unique, the full URL could easily contain sensitive information or information about the file contents.

why wouldn't it be a hash of the download URL only?

Re: IE11 to support WebGL

#66

Post by DigitalSea »

I, for one, welcome our new WebGL overlords. Seriously though, it's good to see Microsoft reversed their stance on WebGL no doubt their hand was forced by Mozilla and Webkit (probably Mozilla more so). And SPDY support as well? Looks like IE11 might actually be a decent contender in the browser race. The future of web development doesn't look so bad after all.

Re: IE11 to support WebGL

#68

Post by tmzt »

quackerhacker wrote: post #51

I really hope IE11 will integrate WebRTC. I have to give credit to IE10 though...a cool feature that I have only seen in safari (through quicktime), is IE10 allows multi audio track support for html5 mp4...great for multi-language videos, and adapting a single video to play on multiple devices (like some that don't support 5.1 audio).

It would be extremely useful for getting Skype in Outlook.com.

Re: IE11 to support WebGL

#69

Post by yuhong »

bmm6o wrote: post #47
gsnedders wrote: post #28

Earlier quoted context omitted.

Opera didn't disable it due to security concerns per se — rather more just the general bugginess of Opera's hardware acceleration. I wouldn't consider crash bugs in general security issues. Equally, there is software rendered mode, but it's pointlessly slow to enable. Note the prior concerns are still just as true today as they were a few years ago — graphics drivers are still relatively easy to find crash bugs in, l…

> I wouldn't consider crash bugs in general security issues You should, until proven otherwise. If it crashes because it's reading an invalid memory location (for instance), it's a matter of time before someone figures out how to place executable code there. I have no problem with MS's original position. WebGL forces your hardware drivers to run random code downloaded from the internet. I'm frankly surprised that the…

On that matter, it is not difficult for someone who knows how to use WinDbg or similar to see if a crash is exploitable. For example, in user mode, null pointer accesses are generally not exploitable. I personally was able to get an IE6/IE7 bug described in http://www.satzansatz.de/cssd/pseudocss.html#fltadjacent fixed in the May 2013 security update by proving there is an exploitable crash.

Re: IE11 to support WebGL

#70

Post by sampk »

idupree wrote: post #50

What engineering did they do to reduce the security risk? As much as I like WebGL as a dev, Microsoft's arguments against feeding arbitrary machine code to buggy graphics cards that have kernel-level memory access privileges... seemed a bit convincing.

Who cares.

Typical way: Download game -> Confirm execution -> Play

WebGL way: Confirm execution -> Play

Post reply on HN