3 ms·
By "out of sandbox" you refer to the fact that shaders are statically transpiled into safe code, rather than getting executed in a dynamically memory-safe and s
by zurn 12y ago
By "out of sandbox" you refer to the fact that shaders are statically transpiled into safe code, rather than getting executed in a dynamically memory-safe and sandboxed environment?
I agree the approach raises some doubts, as it gives untrusted web content a degree of indirect control over what kind of "safe" shader code gets passed to the GPU shader compilers. But the first-order issues are addressed by the specced security model (https://www.khronos.org/webgl/security/ https://www.khronos.org/webgl/security/).
- chatmasta 12y agoYes that's what I was referring to. I've only read the linked SO discussion, but it seems like security on that compilation step is a focus point for the companies implementing WebGL. Still, any time you're manually bound checking at compilation, there's a chance for error. (A SO comment mentioned something about open acceptance tests for this.) Microsoft says the security is too bad to develop for, but that could be a play for DirectX (whatever it's called now) more than a real security worry. Point is, it seems like a lot of the WebGL security is based on "don't worry, we tested everything!"