4 ms·

True. But once those plugins go away, something else will become the new low hanging fruit. Personally, I wonder how well WebGL will hold up, given that 3d grap

True. But once those plugins go away, something else will become the new low hanging fruit. Personally, I wonder how well WebGL will hold up, given that 3d graphics drivers are absolutely not written with security mind, and were never really intended to be hooked up to the web...

nikcub 14y ago
That is a good point. A bit like how people would switch to Macs to avoid viruses, but all they were really doing was moving to a place that wasn't being targeted yet. I don't like the monolithic design of modern browsers - it is rendering engine, javascript interpreter, sandbox, audio, video, webgl, user management, local store etc. all in one big heap. We will need features to let users swap parts out, highly customize them, apply advanced ACL's to each component (since the browser becomes the new OS) and disable them (chrome://flags)
- mietek 14y ago
  Can you point out an example of a Mac virus?
  - Genmutant 14y ago
    There are many, but they don't get the publicity other malware gets. One example of Mac-malware would be SabPub: https://www.securelist.com/en/blog/208193467/SabPub_Mac_OS_X_Backdoor_Java_Exploits_Targeted_Attacks_and_Possible_APT_link https://www.securelist.com/en/blog/208193467/SabPub_Mac_OS_X...
  - brownbat 14y ago
    It wasn't self-propagating, but MacDefender scareware still claimed a lot of machines. http://en.wikipedia.org/wiki/Mac_Defender http://en.wikipedia.org/wiki/Mac_Defender Apple also has a poor record at security patching, which allows for more drive by downloads, especially through Java. Further reading: http://voices.washingtonpost.com/securityfix/2009/06/apple_patches_java_flaws_at_la.html http://voices.washingtonpost.com/securityfix/2009/06/apple_p... http://krebsonsecurity.com/tag/mac/ http://krebsonsecurity.com/tag/mac/
svachalek 14y ago
Microsoft is refusing to support WebGL for security reasons. I can't make up my mind about whether to be annoyed or impressed.
- hosay123 14y ago
  As with many (but not all) things Microsoft do, when the thick layers of gelatinous hivemind diatribe are pealed away what's left are sound, conscientious engineering decisions made by an organization with a near pristine history of supporting end users and going to extraordinary lengths to preserve backwards compatibility. As for instances where they have not preserved support and compatibility, Silverlight comes to mind, and they dumped that largely in favour of frameworks targeting HTML+JS. (I'm not a Microsoft employee, just a user who appreciates the APIs I cut my teeth on 20 years ago remain applicable today)
  - pyre 14y ago
    | when the thick layers of gelatinous hivemind diatribe | are pealed away what's left are sound, conscientious | engineering decisions Like waiting years to take security seriously? :P
    - jrockway 14y ago
      That's covered by the "backwards compatability" item.
      - pyre 14y ago
        It took them a while to even take patching security vulnerabilities in a timely manner seriously. I can understand that secure design (e.g. not running everything as admin) could fall under "backwards compatibility."
- Uhhrrr 14y ago
  You can be both! But I am usually more annoyed by rich content than the lack thereof. It grabs your CPU and memory and screams out to anyone in your vicinity, "Look what x is browsing!"
anon1385 14y ago
>I wonder how well WebGL will hold up, given that 3d graphics drivers are absolutely not written with security mind It doesn't seem to be holding up too well against normal use, never mind deliberate attempts to exploit it: it's not uncommon for WebGL demos to crash at least one browser/hardware combo. Example from the last WebGL submission I read a few days ago: http://news.ycombinator.com/item?id=5211211 http://news.ycombinator.com/item?id=5211211

nikcub 14y ago

That is a good point. A bit like how people would switch to Macs to avoid viruses, but all they were really doing was moving to a place that wasn't being targeted yet. I don't like the monolithic design of modern browsers - it is rendering engine, javascript interpreter, sandbox, audio, video, webgl, user management, local store etc. all in one big heap. We will need features to let users swap parts out, highly customize them, apply advanced ACL's to each component (since the browser becomes the new OS) and disable them (chrome://flags)

mietek 14y ago
Can you point out an example of a Mac virus?
- Genmutant 14y ago
  There are many, but they don't get the publicity other malware gets. One example of Mac-malware would be SabPub: https://www.securelist.com/en/blog/208193467/SabPub_Mac_OS_X_Backdoor_Java_Exploits_Targeted_Attacks_and_Possible_APT_link https://www.securelist.com/en/blog/208193467/SabPub_Mac_OS_X...
- brownbat 14y ago
  It wasn't self-propagating, but MacDefender scareware still claimed a lot of machines. http://en.wikipedia.org/wiki/Mac_Defender http://en.wikipedia.org/wiki/Mac_Defender Apple also has a poor record at security patching, which allows for more drive by downloads, especially through Java. Further reading: http://voices.washingtonpost.com/securityfix/2009/06/apple_patches_java_flaws_at_la.html http://voices.washingtonpost.com/securityfix/2009/06/apple_p... http://krebsonsecurity.com/tag/mac/ http://krebsonsecurity.com/tag/mac/

svachalek 14y ago

Microsoft is refusing to support WebGL for security reasons. I can't make up my mind about whether to be annoyed or impressed.

hosay123 14y ago
As with many (but not all) things Microsoft do, when the thick layers of gelatinous hivemind diatribe are pealed away what's left are sound, conscientious engineering decisions made by an organization with a near pristine history of supporting end users and going to extraordinary lengths to preserve backwards compatibility. As for instances where they have not preserved support and compatibility, Silverlight comes to mind, and they dumped that largely in favour of frameworks targeting HTML+JS. (I'm not a Microsoft employee, just a user who appreciates the APIs I cut my teeth on 20 years ago remain applicable today)
- pyre 14y ago
  | when the thick layers of gelatinous hivemind diatribe | are pealed away what's left are sound, conscientious | engineering decisions Like waiting years to take security seriously? :P
  - jrockway 14y ago
    That's covered by the "backwards compatability" item.
    - pyre 14y ago
      It took them a while to even take patching security vulnerabilities in a timely manner seriously. I can understand that secure design (e.g. not running everything as admin) could fall under "backwards compatibility."
Uhhrrr 14y ago
You can be both! But I am usually more annoyed by rich content than the lack thereof. It grabs your CPU and memory and screams out to anyone in your vicinity, "Look what x is browsing!"

anon1385 14y ago

>I wonder how well WebGL will hold up, given that 3d graphics drivers are absolutely not written with security mind It doesn't seem to be holding up too well against normal use, never mind deliberate attempts to exploit it: it's not uncommon for WebGL demos to crash at least one browser/hardware combo. Example from the last WebGL submission I read a few days ago: http://news.ycombinator.com/item?id=5211211 http://news.ycombinator.com/item?id=5211211