Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft refuses to endorse WebGL, labels it ‘harmful’

winrumors.com

Post reply on HN
Print view View original

71–80 of 114 posts

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#71

Post by rbanffy »

daeken wrote: post #37
rbanffy wrote: post #20

Earlier quoted context omitted.

> Microsoft has spent more time and resources than any technology company in the world focusing on web related security. Mostly because they had to. If others spent less it could be because they had a smaller vulnerable surface to begin with, or simpler codebases.

You evidently haven't seen the massive codebases from the Mozilla or Webkit camps, or the huge number of vulnerabilities therein in recent years. IE is a huge piece of shit, but MS has done a lot for web security. Mind you, I think Google's efforts have been more fruitful, but writing off MS's effort is silly.

The way IE is reliant on Windows and vice-versa, you can't really draw a clear line separating Windows and IE (at least not security-wise). It's very different with Mozilla and Webkit codebases, where the clean separation exists (as they are both multi-platform). I believe IE's base also carries lots of cruft from previous versions, something that complicates matters even more.

Microsoft did a lot, quite possibly because they had a whole lot to do. No other company has an OS that large (Windows is huge) so tightly coupled to a browser.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#72

Post by code_duck »

Locke1689 wrote: post #54
msy wrote: post #50

Earlier quoted context omitted.

Well either Google and Mozilla are knowingly shipping insecure code or Microsoft is, to some degree, wrong. Given the history of the organisations in question I'm going to assume Microsoft wrong or not telling the whole story until we hear a response from Moz or Google.

This is an argument from ignorance and, knowing engineers at both Google and Microsoft, I have no reason to believe that the Google engineers are any more competent than Microsoft. I do know that the Google security team is smaller than Microsoft's.

Hence the 'not telling the whole story' part. Would Microsoft play politics with something like this? Not saying that's the case, only that one would have to be silly to think they wouldn't.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#73

Post by rbanffy »

msy wrote: post #50
Locke1689 wrote: post #13

Wow, this thread is turning into another security-clueless developer freakout. Microsoft very clearly laid out reasons why they believe that WebGL presents possible security vulnerabilities. While GPU security isn't my area of expertise, the driver issues seem very plausible. If someone wants to actually address Microsoft's points in this thread then that would be great.

Well either Google and Mozilla are knowingly shipping insecure code or Microsoft is, to some degree, wrong. Given the history of the organisations in question I'm going to assume Microsoft wrong or not telling the whole story until we hear a response from Moz or Google.

I believe Google and Mozilla (doesn't Safari support WebGL?) are shipping code that interfaces with insecure GPU drivers.

We cannot, however, discount the incentive Microsoft has in preventing the formation of another standard it can't control. I would consider any info coming from Redmond on this issue to be somewhat exaggerated.

And Windows-specific.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#74

Post by daeken »

rbanffy wrote: post #71
daeken wrote: post #37

Earlier quoted context omitted.

You evidently haven't seen the massive codebases from the Mozilla or Webkit camps, or the huge number of vulnerabilities therein in recent years. IE is a huge piece of shit, but MS has done a lot for web security. Mind you, I think Google's efforts have been more fruitful, but writing off MS's effort is silly.

The way IE is reliant on Windows and vice-versa, you can't really draw a clear line separating Windows and IE (at least not security-wise). It's very different with Mozilla and Webkit codebases, where the clean separation exists (as they are both multi-platform). I believe IE's base also carries lots of cruft from previous versions, something that complicates matters even more. Microsoft did a lot, quite possibly bec…

That's pretty much complete BS. IE is no more dependent on Windows than Chrome is, but yes, various bits of the Windows UI are dependent on the Trident engine in IE. Either way, IE is no more inherently insecure than any other browser, despite its many vulnerabilities in the past. In addition, security improvements in the OS itself affect not only IE, but any browser running on top of it, making your claims even more silly.

I know you like to hate on MS (how many times have we been over this in the past few months?), but really, your claims here are completely unfounded. IE has a completely shit track record, but they have done a whole, whole lot in recent years to improve its security. Look at the many, many vulnerabilities in other browsers/layout engines compared to IE in recent years -- it's pretty startling. There are many reasons to hate on IE, but the effort put into securing it -- and the way they've gone about securing it -- is definitely not on of them.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#75

Post by daeken »

rbanffy wrote: post #73
msy wrote: post #50

Earlier quoted context omitted.

Well either Google and Mozilla are knowingly shipping insecure code or Microsoft is, to some degree, wrong. Given the history of the organisations in question I'm going to assume Microsoft wrong or not telling the whole story until we hear a response from Moz or Google.

I believe Google and Mozilla (doesn't Safari support WebGL?) are shipping code that interfaces with insecure GPU drivers. We cannot, however, discount the incentive Microsoft has in preventing the formation of another standard it can't control. I would consider any info coming from Redmond on this issue to be somewhat exaggerated. And Windows-specific.

Speaking as someone doing security research on WebGL but no real dog in this fight (aside from developing on WebGL on the side, making me potentially biased in its favor), nothing MS has said is Windows-specific or remotely exaggerated. In fact, they explicitly didn't talk about many potential attack vectors against WebGL, which makes me think they really don't care much about this either way.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#76

Post by msy »

msy wrote: post #50
Locke1689 wrote: post #13

Wow, this thread is turning into another security-clueless developer freakout. Microsoft very clearly laid out reasons why they believe that WebGL presents possible security vulnerabilities. While GPU security isn't my area of expertise, the driver issues seem very plausible. If someone wants to actually address Microsoft's points in this thread then that would be great.

Well either Google and Mozilla are knowingly shipping insecure code or Microsoft is, to some degree, wrong. Given the history of the organisations in question I'm going to assume Microsoft wrong or not telling the whole story until we hear a response from Moz or Google.

I asked Paul Irish, Chome Developer relations: @paul_irish re http://bit.ly/kOZ7Lp - MSFT wrong? Security risk in Chrome/FF with WebGL?

http://twitter.com/#!/paul_irish/status/81492337108328448 @AlexGraul i think chrome's record in pwn2own is a good indicator of our commitment to security while delivering great features. :)

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#77

Post by AshleysBrain »

Locke1689 wrote: post #13

Wow, this thread is turning into another security-clueless developer freakout. Microsoft very clearly laid out reasons why they believe that WebGL presents possible security vulnerabilities. While GPU security isn't my area of expertise, the driver issues seem very plausible. If someone wants to actually address Microsoft's points in this thread then that would be great.

Has JOGL in Java web applets always had these same vulnerabilities? Is JebGL (http://code.google.com/p/jebgl/) also vulnerable to the same points?

Should Microsoft stop supporting Java applets for the same reason?

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#78

Post by snprbob86 »

cma wrote: post #43
Locke1689 wrote: post #13

Wow, this thread is turning into another security-clueless developer freakout. Microsoft very clearly laid out reasons why they believe that WebGL presents possible security vulnerabilities. While GPU security isn't my area of expertise, the driver issues seem very plausible. If someone wants to actually address Microsoft's points in this thread then that would be great.

I don't have a response, but Microsoft supposedly thinks it is securable enough for Silverlight: "With the release of Silverlight 3 Beta 1 GPU (Graphics Processing Unit) acceleration (or hardware acceleration) is now available." I'd like to hear what could make that secure that couldn't be used with WebGL.

It's the same thing as Safari, IE, and Chrome using the GPU to composite pages: Silverlight is hardware accelerated, but does not expose the hardware acceleration primitives. GL or Direct3D expose more-or-less direct hardware access, which is very different.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#79

Post by tzs »

msy wrote: post #76
msy wrote: post #50

Earlier quoted context omitted.

Well either Google and Mozilla are knowingly shipping insecure code or Microsoft is, to some degree, wrong. Given the history of the organisations in question I'm going to assume Microsoft wrong or not telling the whole story until we hear a response from Moz or Google.

I asked Paul Irish, Chome Developer relations: @paul_irish re http://bit.ly/kOZ7Lp - MSFT wrong? Security risk in Chrome/FF with WebGL? http://twitter.com/#!/paul_irish/status/81492337108328448 @AlexGraul i think chrome's record in pwn2own is a good indicator of our commitment to security while delivering great features. :)

Note he didn't actually answer the question.

Re: Microsoft refuses to endorse WebGL, labels it ‘harmful’

#80

Post by snprbob86 »

Locke1689 wrote: post #13

Wow, this thread is turning into another security-clueless developer freakout. Microsoft very clearly laid out reasons why they believe that WebGL presents possible security vulnerabilities. While GPU security isn't my area of expertise, the driver issues seem very plausible. If someone wants to actually address Microsoft's points in this thread then that would be great.

Shaders are the big vulnerability I know of.

Any game developer will tell you: It's pretty easy to accidentally craft a shader that will totally stall particular GPUs, taking down the entire windowing environment, if not the entire system. With malicious intent, shaders are a giant gaping DoS attack waiting to happen.

Beyond that, the shader compiler backends are supplied by third parties because they generate hardware specific opcodes and optimizations. Considering how poor nVidia and ATI's drivers have been historically, do you really trust them to create secure compilers?

In theory, Microsoft could implement a subset of WebGL without shaders, but I'd rather it not exist than be crippled and unusable. There are probably several other potential vulnerabilities I don't have firsthand experience with too.

All that said, I think that Java applets & JOGL already expose this attack vector.

Post reply on HN