Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IE11 to support WebGL

microsoft-news.com

Post reply on HN
Print view View original

71–80 of 136 posts

Re: IE11 to support WebGL

#71

Post by simpsond »

sampk wrote: post #70
idupree wrote: post #50

What engineering did they do to reduce the security risk? As much as I like WebGL as a dev, Microsoft's arguments against feeding arbitrary machine code to buggy graphics cards that have kernel-level memory access privileges... seemed a bit convincing.

Who cares. Typical way: Download game -> Confirm execution -> Play WebGL way: Confirm execution -> Play

As of right now, with WebGL enabled, there is no confirmation of execution... it just happens. One time confirmation of execution per domain per code load might be a good option.

Re: IE11 to support WebGL

#72

Post by moneyrich »

The other day an application I run launched IE, I was pretty confused as to why IE opened in the first place, and as it was loading I began to swear, a lot... I started to spam ALT and F4 while clicking on the red X icon in the top-right corner. It took about 5 seconds, to load IE onto and then off the heap, but finally it went away. I haven't used it since that fucking day.

Re: IE11 to support WebGL

#73

Post by camus »

adrr wrote: post #43
Zikes wrote: post #2

And IE11 will support Windows 7, right?

They need to support these newer browsers on older operating systems. If the OS is still being actively patched, new browsers should be made backwards compatible to work on it otherwise we'll have exact same problem with IE8 on XP and IE9 on Vista. And soon to be IE10 on Windows 7.

Their business model is to sell os , MSFT never did anything for free.

Re: IE11 to support WebGL

#74

Post by mayanksinghal »

scott_karana wrote: post #64
mayanksinghal wrote: post #59

Earlier quoted context omitted.

> only sends in a small part of the URL's hash for matching ... Isn't it incredibly easy to bypass that check by using a randomly generated url segment? [Edit: Formatting + isn't]

Right, so next time we download something private from a different party, we'll ask them to change their file structure to suit our privacy needs. :)

I am not questioning that sending entire URLs is undesirable, I am asking if the hash solution works (at all).

Re: IE11 to support WebGL

#75

Post by azakai »

idupree wrote: post #50

What engineering did they do to reduce the security risk? As much as I like WebGL as a dev, Microsoft's arguments against feeding arbitrary machine code to buggy graphics cards that have kernel-level memory access privileges... seemed a bit convincing.

I don't know anything about what Microsoft has done in particular. But I can tell you what other WebGL implementations do, for example: rewrite shaders to ensure their memory accesses are safe, not accept as valid shaders code that is dangerous (but would be valid GLSL in general), validate input to the graphics card (e.g., buffers are bound, avoids depending on the GL driver to check that), do fuzz testing, maintain blacklists of known buggy drivers, etc. etc.

I would guess Microsoft is doing much the same, but it does have the extra advantage of only caring about one OS and also owning that OS.

Re: IE11 to support WebGL

#76

Post by nivla »

mayanksinghal wrote: post #59
nivla wrote: post #29

Earlier quoted context omitted.

I know but that also turns off the malware links protection. I don't mind the malware site/link protection since it only sends in a small part of the URL's hash for matching (similar to how we have in Firefox). Comparatively, the file scanner requires the whole hash of the file, the clear text of the download URL and the IP address which I find far more intrusive to privacy. I am hoping for a future update where they…

> only sends in a small part of the URL's hash for matching ... Isn't it incredibly easy to bypass that check by using a randomly generated url segment? [Edit: Formatting + isn't]

I have used the Safe Browsing API for one of my projects and if I remember correctly, you are supposed to sent hash of the root domain along with the hash of the URL. Assuming it works similarly for browsers, once the root domain is blacklisted randomly generated URLs won't be able to get through.

Re: IE11 to support WebGL

#77

Post by jimmaswell »

judah wrote: post #4

Credit to Microsoft for reversing their previous stance on WebGL. Credit to Mozilla for pushing 3d on the web and forcing the issue. Any browser that doesn't implement WebGL will soon be considered crippled; Microsoft desperately wants to avoid that title again, so in a way, Mozilla forced their hand. Competition at work.

"Any browser that doesn't implement WebGL will soon be considered crippled"

Really? I don't think WebGL is that important. What's it really good for besides laggy browser games? What's with the hype on browser games anyway? They're always going to perform much slower than native code. I don't see WebGL becoming such a critical aspect of browsing that the average user would consider IE "crippled" for not supporting it.

Re: IE11 to support WebGL

#78

Post by copperred »

pvnick wrote: post #61
idupree wrote: post #50

What engineering did they do to reduce the security risk? As much as I like WebGL as a dev, Microsoft's arguments against feeding arbitrary machine code to buggy graphics cards that have kernel-level memory access privileges... seemed a bit convincing.

Just want to reply to say I also would like to hear an answer to this question. Something I've wanted to do for a while is write a fuzzer [1] that puts together arbitrary garbage shader script code and runs it with weird webgl operations looking for exploitable crashes. I would expect there to be a ton of bugs found, but then again the monetary barrier to entry might be high considering differences between hardware.…

It would be an interesting project. You should go ahead and test the current implementations! Actually, would you even need webgl to hunt for GLSL exploits?

Re: IE11 to support WebGL

#79

Post by opinali »

drivebyacct2 wrote: post #58
opinali wrote: post #55

Shaming link 1: http://arstechnica.com/information-technology/2011/06/micros... Shaming link 2: http://www.extremetech.com/computing/87696-webgl-is-fundamen...

What are we supposed to take away from those links? The latter isn't even written from the perspective of Microsoft, it's just another generic {Open/Web}GL rant (if anything, you've granted MS legitimacy here by acknowledging other legitimate complaints about the spec). Yes, I was annoyed when they boldly claimed they wouldn't be supporting it at all. I'm also gracious enough to say "Thanks" when handed a gift. The I…

My takeaway is simple, just exposing the BS from Microsoft's original stance wrt OpenGL. One thing is saying "WebGL is right now hard to secure because current OpenGL drivers are buggy, or IE's sandboxing tech is not good enough, whatever". A different thing is, "WebGL is fundamentally flawed, will never work, IE will not and should not support it ever".

Of course the same people are already changing the discourse and claiming that _now_ WebGL is safe, and IE11's WebGL will have the upper hand in security because MS controls the whole stack, etc.

This doesn't mean I don't appreciate the change, I'm really happy that IE11 is apparently going to be an awesome improvement (over IE10 which is already pretty good, even if dated).

Re: IE11 to support WebGL

#80

Post by troymc »

jimmaswell wrote: post #77
judah wrote: post #4

Credit to Microsoft for reversing their previous stance on WebGL. Credit to Mozilla for pushing 3d on the web and forcing the issue. Any browser that doesn't implement WebGL will soon be considered crippled; Microsoft desperately wants to avoid that title again, so in a way, Mozilla forced their hand. Competition at work.

"Any browser that doesn't implement WebGL will soon be considered crippled" Really? I don't think WebGL is that important. What's it really good for besides laggy browser games? What's with the hype on browser games anyway? They're always going to perform much slower than native code. I don't see WebGL becoming such a critical aspect of browsing that the average user would consider IE "crippled" for not supporting it…

Your challenge, should you choose to accept it, is to dream up an amazing and popular application of WebGL, now that a majority of web browsers will be supporting it. It might not be a game. Warning: imagination required.
Post reply on HN