2 ms·

Except for the CORS issue have you seen an exploit related to WebGL? As detailed in my post it's unlikely there are any. In fact it's far more likely there are

Except for the CORS issue have you seen an exploit related to WebGL? As detailed in my post it's unlikely there are any. In fact it's far more likely there are bugs in JavaScript implementations or JPEG decoders or video decoders or font renderers than WebGL. As for the CORS issue, MS shipped CSS first and CSS had the same issue. Namely that you could change the :visited property to something heavy and then through timing divine a user's web history. Once that was discovered it was fixed. I suspect it was similar to WebGL where someone was like "hey, you know, it might be possible to use timing to figure out some stuff" "yea, but that seems pretty unlikely" a few months later someone shows a working timing attack. "oh shit, let's fix that" As for DOSing, as detailed in my post, we (or I) didn't see that as the same level of important because there's no incentive to do it. Sure we worked on fixing it (and that's why WebGL is now enabled by default on several Android devices who's drivers can deal with the issue). But even on devices that can't deal with the issue there's no incentive to DOS someone's machine because they aren't going to visit your website a 2nd or 3rd time if you do that and you weren't able to do accomplish anything else except to get them stop visiting your website. Awesome. I'm going to go make a site right now that people actively avoid visiting. Yea! You also realize that Mozilla started the WebGL spec, not Google and that Mozilla also released WebGL long before v1. Opera was also involved and MS was welcome to join but never bothered. WebGL is not proprietary. Never has been. So claiming Google is copying Microsoft by pushing proprietary standards is pretty disingenuous. Want some MS evil evidence? Just Bing it http://www.bing.com/search?q=microsoft+fud+2013 http://www.bing.com/search?q=microsoft+fud+2013

throwawaykf05 13y ago
> Except for the CORS issue have you seen an exploit related to WebGL? And as far as I can tell, that was the issue MS needed fixed before going ahead with WebGL, but then again I haven't been following their actions in this area. On the other hand, another Microsoft employee seemed to agree with Mozilla and Google: http://www.theregister.co.uk/2011/06/20/webgl_/ http://www.theregister.co.uk/2011/06/20/webgl_/ "And, frankly, if Microsoft has taken a formal position against WebGL, no one I know got the memo.” So maybe it was only the MS Security team being paranoid, as they are supposed to be? >As for the CORS issue, MS shipped CSS first and CSS had the same issue. Wouldn't that indicate that they have more reason to be wary of things like this? >You also realize that Mozilla started the WebGL spec, not Google and that Mozilla also released WebGL long before v1. Opera was also involved and MS was welcome to join but never bothered. WebGL is not proprietary. Never has been. So claiming Google is copying Microsoft by pushing proprietary standards is pretty disingenuous. Mozilla doesn't have clean hands in this either. It may not be proprietary, but releasing an implementation with known vulnerabilities? Enabling something widely used connected to the Internet without sufficient hardening is exactly what MS did with Win95/WinXP/ActiveX, and it created a decade of malware-infested Internet. They also got widely excoriated for that. I wouldn't blame them for being cautious going forward. > Want some MS evil evidence? Just Bing it So negative advertising is "evil"? I knew F/OSS folks thought MS's publicity against their religion was "evil", because, well it offends their personal beliefs... but so is negative advertising against your employer? Sorry, but Google engages in a lot of that itself, it's just that people in this echo chamber uncritically accept it as fact because it confirms their biases.
- greggman 13y ago
  A company that has objections to a spec discusses those objections with others. A company that is trying to spread FUD hires a 3rd party company to dig up dirt. Microsoft did the latter. I'm sorry you can't see it but Microsoft was clearly not showing concern for WebGL's security. As pointed out before, if they had they would have also have brought up Silverlight and Flash 11, which both provide the same features as WebGL.

throwawaykf05 13y ago

> Except for the CORS issue have you seen an exploit related to WebGL? And as far as I can tell, that was the issue MS needed fixed before going ahead with WebGL, but then again I haven't been following their actions in this area. On the other hand, another Microsoft employee seemed to agree with Mozilla and Google: http://www.theregister.co.uk/2011/06/20/webgl_/ http://www.theregister.co.uk/2011/06/20/webgl_/ "And, frankly, if Microsoft has taken a formal position against WebGL, no one I know got the memo.” So maybe it was only the MS Security team being paranoid, as they are supposed to be? >As for the CORS issue, MS shipped CSS first and CSS had the same issue. Wouldn't that indicate that they have more reason to be wary of things like this? >You also realize that Mozilla started the WebGL spec, not Google and that Mozilla also released WebGL long before v1. Opera was also involved and MS was welcome to join but never bothered. WebGL is not proprietary. Never has been. So claiming Google is copying Microsoft by pushing proprietary standards is pretty disingenuous. Mozilla doesn't have clean hands in this either. It may not be proprietary, but releasing an implementation with known vulnerabilities? Enabling something widely used connected to the Internet without sufficient hardening is exactly what MS did with Win95/WinXP/ActiveX, and it created a decade of malware-infested Internet. They also got widely excoriated for that. I wouldn't blame them for being cautious going forward. > Want some MS evil evidence? Just Bing it So negative advertising is "evil"? I knew F/OSS folks thought MS's publicity against their religion was "evil", because, well it offends their personal beliefs... but so is negative advertising against your employer? Sorry, but Google engages in a lot of that itself, it's just that people in this echo chamber uncritically accept it as fact because it confirms their biases.

greggman 13y ago
A company that has objections to a spec discusses those objections with others. A company that is trying to spread FUD hires a 3rd party company to dig up dirt. Microsoft did the latter. I'm sorry you can't see it but Microsoft was clearly not showing concern for WebGL's security. As pointed out before, if they had they would have also have brought up Silverlight and Flash 11, which both provide the same features as WebGL.