3 ms·

WebGPU! Wohoo. I'm tracking the increase in availability of WebGPU across the web here: https://twitter.com/benhouston3d/status/1653865357080248321 https://tw

WebGPU! Wohoo. I'm tracking the increase in availability of WebGPU across the web here: https://twitter.com/benhouston3d/status/1653865357080248321 https://twitter.com/benhouston3d/status/1653865357080248321

runlevel1 4y ago
That sounds like a fun new fingerprinting attack surface. --- EDIT: That might have been too cynical. Let me take another stab: That opens up some cool new possibilities, but also a seemingly large new attack surface. Does anyone know what's been done to mitigate it?
- sebazzz 4y ago
  Also another GPU driver attack vector.
  - cubefox 4y ago
    I'm also excited about WebGPU!
- runlevel1 4y ago
  To partially answer my own question, some of the risks are identified here: https://www.w3.org/TR/webgpu/#malicious-use https://www.w3.org/TR/webgpu/#malicious-use The mitigations, however, feel rather light given the exposure.
  - cubefox 4y ago
    The alternative would be to ask for explicit permission per website, similar to notifications or webcam access. Sounds like overkill to me.
- lxgr 4y ago
  Malicious/non-informed cryptocurrency mining in a background tab also comes to mind. Would it make sense for GPU access to be a permission that users have to explicitly grant?
  - stefan_ 4y ago
    Surely that's how it's implemented? I want nothing to do with websites fuzzing that mountain of (driver) code that sits behind shaders & co.
    - lxgr 4y ago
      I’ve been able to run some demos without any prompt, and WebGL has always worked like that (and exposes compute shaders too, I think?)
MuffinFlavored 4y ago
Are you aware of any examples/demos of onnxruntime-web using the WebGPU backend that was merged but not yet released for v1.15?
aigoochamna 4y ago
[flagged]
- arrow7000 4y ago
  Back in 2011
capableweb 4y ago
Any updates on adding integrity checking to the script? Makes it a bit worrisome to embed it on sites otherwise.
- bhouston 4y ago
  Check the homepage: https://web3dsurvey.com https://web3dsurvey.com Instead of direct JavaScript includes I now recommend just putting it in an iframe and I share example code on the homepage. This lets me still update the script while also ensuring it can not access cookies or other things in the main page context. What do you think?
  - capableweb 4y ago
    The point of the integrity hash is to be able to include a remote resource after reviewing and verifying it, and then being sure it doesn't change to do other things automagically, that you haven't reviewed before it runs on your users browser. Wrapping the script tag in a iframe does not accomplish this as far as I can tell.
    - bhouston 4y ago
      Right. But the main attack vector of a raw JavaScript include into the main page is that it can access anything you are doing in that page include logins or secrets or cookies or other private data. Moving it into an iframe sandboxes it and reduces the majority of nefarious things it can do. Especially if it is running off of web3dsurvey in the iframe and not the host website origin - thus a bunch of cross origin protections kick in. So the iframe sandbox deals with the security issue is a different fashion. Also the iframe can not block the main pages so it has even less impact on the main page experience. This is as secure now as the majority of ads served on the web.

runlevel1 4y ago

That sounds like a fun new fingerprinting attack surface. --- EDIT: That might have been too cynical. Let me take another stab: That opens up some cool new possibilities, but also a seemingly large new attack surface. Does anyone know what's been done to mitigate it?

sebazzz 4y ago
Also another GPU driver attack vector.
- cubefox 4y ago
  I'm also excited about WebGPU!
runlevel1 4y ago
To partially answer my own question, some of the risks are identified here: https://www.w3.org/TR/webgpu/#malicious-use https://www.w3.org/TR/webgpu/#malicious-use The mitigations, however, feel rather light given the exposure.
- cubefox 4y ago
  The alternative would be to ask for explicit permission per website, similar to notifications or webcam access. Sounds like overkill to me.
lxgr 4y ago
Malicious/non-informed cryptocurrency mining in a background tab also comes to mind. Would it make sense for GPU access to be a permission that users have to explicitly grant?
- stefan_ 4y ago
  Surely that's how it's implemented? I want nothing to do with websites fuzzing that mountain of (driver) code that sits behind shaders & co.
  - lxgr 4y ago
    I’ve been able to run some demos without any prompt, and WebGL has always worked like that (and exposes compute shaders too, I think?)

MuffinFlavored 4y ago

Are you aware of any examples/demos of onnxruntime-web using the WebGPU backend that was merged but not yet released for v1.15?

aigoochamna 4y ago

[flagged]

arrow7000 4y ago
Back in 2011

capableweb 4y ago

Any updates on adding integrity checking to the script? Makes it a bit worrisome to embed it on sites otherwise.

bhouston 4y ago
Check the homepage: https://web3dsurvey.com https://web3dsurvey.com Instead of direct JavaScript includes I now recommend just putting it in an iframe and I share example code on the homepage. This lets me still update the script while also ensuring it can not access cookies or other things in the main page context. What do you think?
- capableweb 4y ago
  The point of the integrity hash is to be able to include a remote resource after reviewing and verifying it, and then being sure it doesn't change to do other things automagically, that you haven't reviewed before it runs on your users browser. Wrapping the script tag in a iframe does not accomplish this as far as I can tell.
  - bhouston 4y ago
    Right. But the main attack vector of a raw JavaScript include into the main page is that it can access anything you are doing in that page include logins or secrets or cookies or other private data. Moving it into an iframe sandboxes it and reduces the majority of nefarious things it can do. Especially if it is running off of web3dsurvey in the iframe and not the host website origin - thus a bunch of cross origin protections kick in. So the iframe sandbox deals with the security issue is a different fashion. Also the iframe can not block the main pages so it has even less impact on the main page experience. This is as secure now as the majority of ads served on the web.