4 ms·

These techniques (and others) can still be used by malicious web pages to hang browsers and possibly even crash computers if the OS reacts badly to a hanging GP

by Kristine1975 11y ago

These techniques (and others) can still be used by malicious web pages to hang browsers and possibly even crash computers if the OS reacts badly to a hanging GPU. I recall people discussing Bitcoin miners implemented in Javascript and executed on the machines of unsuspecting visitors of a web page. Maybe WebGL could be used for something similar? And of course there's the fact that suddendly GPU drivers are exposed to untrusted input from the internet via GLSL shaders.

greggman 11y ago
There's absolutely no incentive to do that though. If you crash my computer you haven't stolen my passwords or got my browser history or installed a virus. All you've done is make sure I don't visit your webpage again. As for GPU drivers being exposed WebGL is designed to cover that. Every input is checked, every bounds checked, shaders are re-written and drivers with bugs either worked around or banned.
- Kristine1975 11y ago
  >There's absolutely no incentive to do that though But there is: Lulz. >Every input is checked, every bounds checked That would require solving the Halting Problem. The WebGL spec even says: https://www.khronos.org/registry/webgl/specs/latest/1.0/#4.4 https://www.khronos.org/registry/webgl/specs/latest/1.0/#4.4 >In the general case it is not possible to impose limits on the structure of incoming shaders to guard against this problem. Experimentation has shown that even very strict structural limits are insufficient to prevent long rendering times, and such limits would prevent shader authors from implementing common algorithms.