Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IE11 to support WebGL

microsoft-news.com

Post reply on HN
Print view View original

91–100 of 136 posts

Re: IE11 to support WebGL

#91

Post by gavanwoolery »

idupree wrote: post #50

What engineering did they do to reduce the security risk? As much as I like WebGL as a dev, Microsoft's arguments against feeding arbitrary machine code to buggy graphics cards that have kernel-level memory access privileges... seemed a bit convincing.

I agree that the threat is present, but rather than restrict freedom it is better to place decisions in the user's hands sometimes. There are security threats everywhere, even beyond the software or hardware level (i.e. phishing for passwords). I think that rather than not implement WebGL, it would be better to ask permission if the user trusts the domain (just as Chrome does with any plugin).

Re: IE11 to support WebGL

#92

Post by Paradigma11 »

cmccabe wrote: post #83
idupree wrote: post #50

What engineering did they do to reduce the security risk? As much as I like WebGL as a dev, Microsoft's arguments against feeding arbitrary machine code to buggy graphics cards that have kernel-level memory access privileges... seemed a bit convincing.

The security claims were bullshit. For details see: http://games.greggman.com/game/webgl-security-and-microsoft-... tl;dr: While it was talking up the security risk of WebGL, Microsoft was allowing Silverlight to permit untrusted code to access graphics APIs in exactly the same way. Chrome validates everything before calling the actual driver APIs, so the opportunities for fuzzing are limited.

But in SL you had to specifically and manually whitelist the website to allow access to the graphics api.

Re: IE11 to support WebGL

#93

Post by ampersandy »

leeoniya wrote: post #56
judah wrote: post #4

Credit to Microsoft for reversing their previous stance on WebGL. Credit to Mozilla for pushing 3d on the web and forcing the issue. Any browser that doesn't implement WebGL will soon be considered crippled; Microsoft desperately wants to avoid that title again, so in a way, Mozilla forced their hand. Competition at work.

memorable quote from http://john.jubjubs.net/2011/09/15/mike-shaver-thanks/ "And [Mozilla's Mike Shaver] affected my framing of the problem deeply – I remember one day a couple of years back when we were talking about some market share point, thinking about how incredibly, insanely competitive the browser technology landscape was – and he said to me: “Look, this is the world we wanted. And this is the world we made.”…

Thanks for the link.

I've bumped into Mike a few times at Facebook; he's one of the most knowledgeable people I've ever met.

Re: IE11 to support WebGL

#94

Post by fhd2 »

Now that's good news.

I feel this whole "but IE won't ever support it!" argument was seriously holding WebGL back. IE still has very significant market share, and since they arguably got their act together lately, I doubt it's going to get smaller in the short term.

Considering that existing C++/OpenGL code bases can be ported to the web relatively easy with Emscripten, my bet is that we'll see a bunch of games come to the browser over the next ~3 years.

Re: IE11 to support WebGL

#95

Post by mtgx »

idupree wrote: post #50

What engineering did they do to reduce the security risk? As much as I like WebGL as a dev, Microsoft's arguments against feeding arbitrary machine code to buggy graphics cards that have kernel-level memory access privileges... seemed a bit convincing.

It was just an excuse. The real reason is they didn't want to support anything OpenGL-based.

Re: IE11 to support WebGL

#96

Post by randomfool »

idupree wrote: post #50

What engineering did they do to reduce the security risk? As much as I like WebGL as a dev, Microsoft's arguments against feeding arbitrary machine code to buggy graphics cards that have kernel-level memory access privileges... seemed a bit convincing.

Shader validation in ANGLE and black-listed drivers are how this is protected against in Chrome and Firefox. Microsoft was never really clear what the security issues were- really felt like a bunch of FUD.

Re: IE11 to support WebGL

#97

Post by mtgx »

fhd2 wrote: post #94

Now that's good news. I feel this whole "but IE won't ever support it!" argument was seriously holding WebGL back. IE still has very significant market share, and since they arguably got their act together lately, I doubt it's going to get smaller in the short term. Considering that existing C++/OpenGL code bases can be ported to the web relatively easy with Emscripten, my bet is that we'll see a bunch of games come…

IE has a lot of market share with IE7, IE8 and possibly IE9. They don't have a lot of marketshare with IE11 - and possibly never will.

So the argument that "WebGL is not supported by IE so I'll never use it" was pretty bogus anyway, since the people using those versions of IE were probably never in your target market anyway.

Re: IE11 to support WebGL

#98

Post by fhd2 »

mtgx wrote: post #97
fhd2 wrote: post #94

Now that's good news. I feel this whole "but IE won't ever support it!" argument was seriously holding WebGL back. IE still has very significant market share, and since they arguably got their act together lately, I doubt it's going to get smaller in the short term. Considering that existing C++/OpenGL code bases can be ported to the web relatively easy with Emscripten, my bet is that we'll see a bunch of games come…

IE has a lot of market share with IE7, IE8 and possibly IE9. They don't have a lot of marketshare with IE11 - and possibly never will. So the argument that "WebGL is not supported by IE so I'll never use it" was pretty bogus anyway, since the people using those versions of IE were probably never in your target market anyway.

You're right. Last time I checked, IE8 was still the most popular IE version. However, since IE9, it's being updated automatically, so I have some hopes that most IE users will end up using the latest version, just as with Chrome and Firefox.

The main reason for IE8's popularity is probably that it's the last IE version available on Windows XP, which is still popular. I really hope Microsoft gives up on the idea that new browser versions can only come with new OS versions.

But still, even if only 10% of all IE users use IE11, that percentage can only grow. Previously, IE was a dead end for WebGL. Now there's a perspective, and that's probably good enough.

Re: IE11 to support WebGL

#99

Post by agentS »

mayanksinghal wrote: post #59
nivla wrote: post #29

Earlier quoted context omitted.

I know but that also turns off the malware links protection. I don't mind the malware site/link protection since it only sends in a small part of the URL's hash for matching (similar to how we have in Firefox). Comparatively, the file scanner requires the whole hash of the file, the clear text of the download URL and the IP address which I find far more intrusive to privacy. I am hoping for a future update where they…

> only sends in a small part of the URL's hash for matching ... Isn't it incredibly easy to bypass that check by using a randomly generated url segment? [Edit: Formatting + isn't]

No, its more like this. You download a series of truncated hashes; you generate a bunch of permutations of your URL (strip the query params, strip components of the path/domain), you hash those, check them against your local list. If you get any matches, you request an expanded list from Google, giving them the truncated hashes that matched. This gives you a cacheable list of full hashes; you check your matched hashes against those full hashes, and if any match, then its a match.

tl;dr No, its not that easy.

Re: IE11 to support WebGL

#100

Post by _pmf_ »

pvnick wrote: post #61
idupree wrote: post #50

What engineering did they do to reduce the security risk? As much as I like WebGL as a dev, Microsoft's arguments against feeding arbitrary machine code to buggy graphics cards that have kernel-level memory access privileges... seemed a bit convincing.

Just want to reply to say I also would like to hear an answer to this question. Something I've wanted to do for a while is write a fuzzer [1] that puts together arbitrary garbage shader script code and runs it with weird webgl operations looking for exploitable crashes. I would expect there to be a ton of bugs found, but then again the monetary barrier to entry might be high considering differences between hardware.…

> Just want to reply to say I also would like to hear an answer to this question.

The question is that they do what a business is required to do: let the market decide. Shockingly, the market does not want actual security; it wants lip service to make people feel safe and it wants shiny features.

Post reply on HN