Slashdot Mirror
WebGL Poses New Security Problems
Julie188 writes "Researchers are warning that the WebGL standard undermines existing operating system security protections and offers up new attack surfaces. To enable rendering of demanding 3D animations, WebGL allows web sites to execute shader code directly on a system's graphics card. This can allow an attacker to exploit security vulnerabilities in the graphics card driver and even inject malicious code onto the system."
Now that we finally have sandboxing in browsers they want to let any website run directly code on your hardware. Insane! Just forget the WebGL stuff. Silverlight has direct support for XNA which handles it everything better and safer anyway. Are we also supposed to write WebGL games with notepad? At least XNA games can be written with a solid IDE like Visual Studio. Not only that but the games also work on Xbox360 and mobile phones without such a major porting. What a developers dream...
Leave my hardware alone and secure!
Do any FOSS drivers even support shaders?
There's no -1 for "I don't get it."
Can anyone remind me why we're putting EVERYTHING in a web browser anyway?
So they're saying that enabling shader code execution allows web sites to exploit hypothetical vulnerabilities in the graphics driver?
They're not particularly hypothetical. Graphics driver code is such that games programmers carefully work around bugs in order to not crash anything. Imagine if every program running on the main CPU had to carefully avoid certain instruction sequences in order to not crash the system -- would you run a multi-user system on that?
Then again, that was how it was in the 80's on many time sharing systems...
Finally! A year of moderation! Ready for 2019?