4 ms·

Also with things like WebGL security is only going to become a bigger problem. Yes, they fix and push fixes out faster, but that doesn't inherently mean your b

by luriel 14y ago

Also with things like WebGL security is only going to become a bigger problem. Yes, they fix and push fixes out faster, but that doesn't inherently mean your browser is more secure, only that there are less people out there with browsers that are publicly known to be exploitable, but is safe to assume that all browsers are exploitable, and that there are people that knows the holes but doesn't make them public because their value (either to governments or criminals) is way too great to even compete in the same league as the rewards offered by browser makers.

azakai 14y ago
> Also with things like WebGL security is only going to become a bigger problem. Please don't repeat FUD.
- luriel 14y ago
  Is Carmack also spreading FUD? It seems the web people have deluded themselves into thinking they really understand the implications of letting webpages interact with video drivers, and some of the graphics industry were just to happy to help along. This doesn't change the fact that WebGL exposes graphics drivers in ways that they were never meant to, and that there is no real way for third parties to verify how safe it is to turn on WebGL for a given driver. The whitelists and blacklists of drivers currently used do little more than to fragment the web and frustrate users. I'm a big fan of how Google introduced much needed decent sandboxing to web browsers, but what they are doing with WebGL is both scary from a security point of view and depressing from the point of view of fragmenting the web, now to access certain websites not only you need the right browser, you also need the right video card and video drivers, is worse than the "best viewed with" nightmare of the 90's.
  - throwMeaway1111 14y ago
    > not only you need the right browser, you also need the right video card and video drivers, is worse than the "best viewed with" nightmare of the 90's. First, Chrome will fall back to a software emulation that actually works very well. So even if your video driver is blacklisted, you can still see the content. Second, I'm not sure Carmack has made an effort to really look at the differences between WebGL and OpenGL. Features are limited and the browsers are required to parse and verify input, so that only correct code is sent to the graphics drivers. (edit:) Let me add some more information here: Array bounds are checked; Array indexes must be constant expressions ; and, most importantly, while-loops are forbidden. If you've taken a course in theoretical CS, you may recall the difference between for and while loops and why applications using only the former can be verified (if there is not recursion - OpenGL shaders also don't support that anyway). Third, access to WebGL could be easily limited in the future: For example allow access by default for browser extensions and require user confirmation for the rest of the web. Should be fine for games.
    - azakai 14y ago
      > First, Chrome will fall back to a software emulation that actually works very well. So even if your video driver is blacklisted, you can still see the content. 1. Only on Windows, not anywhere else 2. It will be very slow. For this reason, I think this might be almost pointless, and worse than showing nothing in some cases.
  - azakai 14y ago
    > It seems the web people have deluded themselves into thinking they really understand the implications of letting webpages interact with video drivers By "the web people" you mean Google, Microsoft (yes, Microsoft, because it is ok with letting webpages interact with video drivers through Silverlight), Apple, Mozilla, Opera, and Adobe (yes, Adobe, because it is ok with letting webpages interact with video drivers through Stage3D in Flash)? So basically the entire industry is deluded?

by luriel 14y ago

azakai 14y ago

> Also with things like WebGL security is only going to become a bigger problem. Please don't repeat FUD.

luriel 14y ago
Is Carmack also spreading FUD? It seems the web people have deluded themselves into thinking they really understand the implications of letting webpages interact with video drivers, and some of the graphics industry were just to happy to help along. This doesn't change the fact that WebGL exposes graphics drivers in ways that they were never meant to, and that there is no real way for third parties to verify how safe it is to turn on WebGL for a given driver. The whitelists and blacklists of drivers currently used do little more than to fragment the web and frustrate users. I'm a big fan of how Google introduced much needed decent sandboxing to web browsers, but what they are doing with WebGL is both scary from a security point of view and depressing from the point of view of fragmenting the web, now to access certain websites not only you need the right browser, you also need the right video card and video drivers, is worse than the "best viewed with" nightmare of the 90's.
- throwMeaway1111 14y ago
  > not only you need the right browser, you also need the right video card and video drivers, is worse than the "best viewed with" nightmare of the 90's. First, Chrome will fall back to a software emulation that actually works very well. So even if your video driver is blacklisted, you can still see the content. Second, I'm not sure Carmack has made an effort to really look at the differences between WebGL and OpenGL. Features are limited and the browsers are required to parse and verify input, so that only correct code is sent to the graphics drivers. (edit:) Let me add some more information here: Array bounds are checked; Array indexes must be constant expressions ; and, most importantly, while-loops are forbidden. If you've taken a course in theoretical CS, you may recall the difference between for and while loops and why applications using only the former can be verified (if there is not recursion - OpenGL shaders also don't support that anyway). Third, access to WebGL could be easily limited in the future: For example allow access by default for browser extensions and require user confirmation for the rest of the web. Should be fine for games.
  - azakai 14y ago
    > First, Chrome will fall back to a software emulation that actually works very well. So even if your video driver is blacklisted, you can still see the content. 1. Only on Windows, not anywhere else 2. It will be very slow. For this reason, I think this might be almost pointless, and worse than showing nothing in some cases.
- azakai 14y ago
  > It seems the web people have deluded themselves into thinking they really understand the implications of letting webpages interact with video drivers By "the web people" you mean Google, Microsoft (yes, Microsoft, because it is ok with letting webpages interact with video drivers through Silverlight), Apple, Mozilla, Opera, and Adobe (yes, Adobe, because it is ok with letting webpages interact with video drivers through Stage3D in Flash)? So basically the entire industry is deluded?