5 ms·
I've posted in the other threads about this but when I read this: "The security of WebGL as a whole depends on lower levels of the system, including OEM drivers
by nkassis 15y ago
I've posted in the other threads about this but when I read this: "The security of WebGL as a whole depends on lower levels of the system, including OEM drivers, upholding security guarantees they never really need to worry about before."
I can't help but wonder. If those drivers are so buggy, why isn't this a high priority to fix? It would probably be easier for hackers to attack other things due to the wide range of drivers but if the security issues claims against WebGL are real then escalation of privileges on any OS is a question of breaking the GPU driver.
I find that to be a big issue even with WebGL not in the picture.
- elehack 15y agoYep, it is a pretty big issue. However, WebGL does make it worse: it trivially exposes local privilege escalations as remotely-exploitable root vulnerabilities. It also does so bypassing a lot of the sandboxing work that browser vendors have done to contain browser vulnerabilities.
- bd 15y ago"I can't help but wonder. If those drivers are so buggy, why isn't this a high priority to fix?" It will come. Raised concerns are not WebGL specific, WebGL is just exposing things about HW-accelerated 3d to more general public that have been here since always and every GPU 3d technology has to face (problems with drivers, fragmentation of market, very wide spread in capabilities). People will need to get used to update their drivers (the same as they already got used to update their OS and browsers). Gamers are already doing this since forever, not because of security concerns but for bugfixes / performance improvements. GPU vendors are actually pretty responsive, I'm aware of driver hotfixes released just to address problems discovered on releases of particular games (in between regular monthly driver updates).