Slashdot Mirror
Microsoft Brands WebGL a 'Harmful' Technology
An anonymous reader writes "Microsoft has announced that it has no plans to support WebGL — a cross-platform low-level 3D graphics API designed for web use — in its future browsers, citing numerous security concerns over the technology and branding the basic principles as 'harmful.'"
a dangerous web idea when they see one. They created ActiveX.
These comments are my own and do not necessarily reflect the views or opinions of my employer or colleagues...
From a security centric company!
Maybe Computers will never be as intelligent as Humans.
For sure they won't ever become so stupid. [VR-1988]
If they did they would do an apple and ban all plugins from their browser.
End of story.
Yeah, a cross platform solution that is in competition with a Microsoft proprietary solution; being applied to the Web; and Microsoft is against it. Personally I am shocked, just shocked. They've been spending a lot of money trying to optimize IE9 for use with DirectX, and care a whole lot less about security or empowering Web developers, than they do about preventing competition on a level playing field.
Pot, meet kettle.
I am relieved that sliverlight will never support such harmful technology!
"Although mitigatinos such as ARB_robustness [...]"
Nice Microsoft, nice.
Whilst I believe that WebGL _could_ become a vector for attack, I think this is actually "We want to push DX not GL, let's stick to NIH by saying it's dangerous instead"
or because it sounds like opengl which is eeeeviiiiiiiil
Until it can come up with it own proprietary version that IE only.
The security issue is a valid question.
In one of the links in the summary it shows that the video memory can be read and get a snapshot of the user's desktop (in the example a confidential document is viewable) - exceptionally bad. Use an exploit like this with something else means their is potential for a severe security breach.
Then again it's early stages and I'm sure the security issues will be resolved in time.
It's an exciting techology especially with regard to streaming games over the internet.
Who remembers VRML???
If WebGL takes off, they'll have no choice but to support it. If it doesn't, then no-one will care that they don't support it.
Microsoft has no business building browsers. The open architecture of the web will always conflict with IE being closed source and the EEE tactics Microsoft is constantly trying on various web technologies. In the past, Microsoft's hegemony over computer technology gave them enough influence that they might actually have a chance at "de-commoditizing" (as they say) some popular open web technologies, but that's over, they aren't the 800lb gorilla in the room anymore, they're just another dog in a fight with at least 2 other dogs (the Open dog and the Apple dog - and no they're not the same. Look at Safari's special HTML5 rendering. Familiar? Don't forget that an open web also poses a threat to Apple's mobile apps).
By continuing to work on browsers, Microsoft is fighting a war they can't win, but like all wars this one is still harmful to the other combatants and various innocent bystanders.
"When information is power, privacy is freedom" - Jah-Wren Ryel
You really want websites to be able to freeze and possibly crash your graphics subsystem, possibly overheat reboot your machine?
Besides that, it's just sloppy, just like WebSQL is sloppy. It's just "hey lets compile opengl ES into our browser" or "lets compile SQLite into our browser" and neither are even half-hearted attempts at a proper standard. I originally said this as a joke, but it makes more sense to just link in the quake engine and support a "quake" tag, that takes a link to a PAK file as its .src attribute. That'd at least solve the (very real) security problems. Executing arbitrary shader code from random websites isn't a good idea.
Aside: apparently noone else supports WebGL either. The implementations in both FF and Chrome are broken. I've had problems with multiple textures, framebuffers, the list goes on. It's simply not working yet.
Of course, webGL would be trivial to reimplement in IE with a partial trust Silverlight plugin, which could just execute the GL natively, though that would be a much bigger security hole.
If Microsoft hates it, I LIKES IT !! I like everything !! Except Mikey !!
...to their business model. Let's face it: if WebGL really took off and brought about it a myriad web-based games, the Microsoft stranglehold on PC gaming would be in jeopardy.
"They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety."
Microsoft has rejected interoperable technologies based on spurious "security concerns" before, only to release later a competing yet non-interoperable technology with far worse security problems than ever showed up on what they rejected. Remember browser plugins, passed over in favor of the steaming pile of fail that is ActiveX?
Look for WebDirect3D in the next version of IE, likely with every problem MS claims WebGL has and a few new ones.
It is hard to argue with the thesis that allowing a webpage to run OpenGL code on the system GPU is less secure(and places security in more hands) than not doing so. However, that seems to throw us back on the more basic problem:
Allowing the internet to do things to your machine is dangerous. It is also among the top reasons why most people bother to own a computer. Letting pages run Javascript opens you up to vulnerabilities in your JS engine. Support for images in webpages means that a bug in any of your image format renderers(and there have been a few of these) will allow the attacker to own you. Even HTML rendering isn't safe. People from the internet are running code on your CPU, through assorted layers of indirection, virtually continually... We put up with this blatantly dangerous situation because we want the functionality.
Other than the (im)maturity of OpenGL as something that is subject to maliciously crafted input, rather than just error by well-meaning application designers, I'm not seeing a fundamental difference. Everything that happens in your browser happens because filthy, possibly dangerous, 3rd party instructions are executed, through some number of intermediate interpreters and libraries and codecs, right on your hardware.
Now, I can definitely see the case to be made for "You really shouldn't enable WebGL, except for websites that you would also trust enough to download and execute with admin permissions executables from, until the OpenGL ecosystem has had time to finish wetting itself from pure fear and start improving things", it is quite likely the case that the large, complex, more-focused-on-speed-than-security, mass that is GPU firmware, GPU drivers, etc is a mass of potentially serious issues, having historically been sheltered from the more hostile side of things. However, that doesn't seem fundamentally different from the state of the stack sitting on top of the CPU that was inherited from a more innocent time before widespread network malice. Ultimately, we just had to fix that; because the alternative involved not being able to do what we wanted to do.
This is bad news.
Yes, everyone hates IE, blah blah blah. This makes webmasters job significantly more difficult in using WebGL as a platform... Flash fallbacks? Alternative browser plug-in? Canvas3d? Uuuugggghhhh....
I really wish we could have more discussions where MS is mentioned that don't immediately devolve into "MS is teh E V I L !!! Anything they say or do is wrong!"
SJW: Someone who has run out of real oppression, and has to fake it.
Microsoft claims competitor's technology harmful and everyone should use their safe & secure version :)
Tune in at 11 for more news from the No Shit, Sherlock dept
WebGL + fast Javascript gives developers a very powerful duo, games and apps on WebGL could rival normal applications (meaning non-Live-AppStore stuff) and endanger their revenue streams. This is exactly why Apple stopped further develop web editors and that is why IE was such a drag all the time... MS is not going to backup WebGL. You have other venues for more advanced stuff like Windows Marketplace or Apple AppStore, web should remain minimalist. A venue without 40% cut? No deal.
In other news Microsoft is releasing DirectAzureX exclusively for Internet Explorer bringing secure 3D content to the Web. Innovation at work people! Microsoft the true king of standards fragmentation.
Considering that most accelerated 3D drivers for video controllers are utter crap full security flaws, or “optimizations“, as some call them, and that a video controller has full access to the system bus, and therefore to the RAM, drives, etc., I tend to agree that letting anyone on the web transparently send possibly crafted data to the 3D driver is, from a security point of view, a rather dubious idea.
The business world keeps Microsoft in power, not gamers.
I don't doubt you overall, but: for my home computers, the only reason the machine I'm typing this on has Windows 7 installed is because of games. My laptop doesn't have Windows, only my desktop which has the hardware to run the games.
Shh.
n/t
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
The question is what is harmed. In this it looks like it is harmful to Microsoft's market share and profits.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
What they mean by "security" is not what everyone else means. Security is just the biggest argument in the FUD arsenal. They mean control, to secure their bottom line.
For 25 plus years, that's been MS's real goal. They tried to kill off Ogg Vorbis over "insecurity"-- the supposed insecurity of no built in DRM. Security was probably one of the arguments they used to push OOXML over ODF when they were trying to maintain their file format lockdown. Talk about an outdated tactic, but then, MS has been slipping for some time now. They would have tried the old line suggesting no one would maintain the software without a large company backing it, another FUD favorite, but even they must see no one would buy that any more. And yet, they can't see the uselessness of the entire Windows Genuine Advantage program.
What specifically could they be trying to promote in place of webGL? Silverlight?
Intellectual Property is a monopolistic, selfish, and defective concept. It is "tyranny over the mind of man"
Context Information Security has already tested WebGL implementations and demonstrated the sorts of bugs Microsoft warns about. In fact, it looks like maybe they got a tip about it from Redmond, but they do demonstrate it, and Mozilla has acknowledged the bugs for Firefox 4.
An essential factor in security is trust. You cannot trust a website you have never seen before to load code of its choosing to be executed on a driver supplied to you by third-party which may or may not have a stellar security record themselves. Especially when "modern" operating systems like Linux run drivers as part of their monolithic kernel and so probably WILL crash when the website code messes up the driver runtime. Windows is heading in all the right directions moving their graphics driver supporing infrastracture out of the kernel into userspace. At least that way, your entire OS won't crash bringing everything down with it. At worst, smart people will figure out doing their favourite things - injecting their code through good old buffer overflows and what not.
This is what you get when you pair three poorly isolating systems to eachother. Microsoft may have done a lot of their own mess during the years with their products' security, but for once, they are right. Not the least, becaue they probably have gotten so much flak for it they finally decided enough is enough and started going by security checklist documets and automated programs that eliminate all the obvious bugs. I sincerely hope they're getting it, for I for one am tired of hearing everyone bash them. Look into your own backyard when you get 20 million lines of code running wildly on a several hundred million computers around the globe, thanks. Or reduce your SLOC, but that, again, is another discussion.
That's rock solid. No security problems whatsoever.
Given they created ActiveX, windows, direct X, IIS, IE and many other technologies that screw up the web and the internet in general.
Microsoft has been a me-too company since it's last killer product: Windows XP SP2
This FUD against WebGL is just another one of the death throes from a company that hasn't been able to compete since August 25, 2004.
Microsoft has innovated exactly one good product: Kinect ... yet, it took Linux hackers to force them to capitalize on it. ... does Microsoft actually want the money, or do we have to shove it up Microsoft's ass??
It reminds me of the old Toll Booth Willie skit
I feel sorry for Microsoft shareholders, and thank god I don't own any of their stock.
If Microsoft would stop with the me-too "standards" (all stillborn) and put 1/10th of that money and effort into applications for the Kinect, and the other 9/10th into innovating things their customers want, they could be the premier tech company again. Sadly, that's not gonna happen.
the graphics there sums it up nicely: http://www.contextis.com/resources/blog/webgl/ Web > Browser > graphics driver > kernel, and we all know graphics drivers are full of bugs/holes, and that even killing and restarting them is not a solution if the browser keeps bombarding them with spurious request. DOS and intrusion must be very easy that way.
It's also true that MS are picking an argument they like, and that they have, in the past and even now, created plenty of exploit avenues.
I think we need to move from a mindset where performance and features reign supreme, to one where security is a major concern. That's bad news, cause security is much harder to evaluate than MIPS or texels/s (and reviewers/commentators like easy work). And people need to be educated: assuming Intel/ATI/nVdia chose to devote resources to creating a "safer" driver, with 30% lower performance (I pulled that figure out of a dark and smelly place), who would choose that safer one, over the faster one ? In a sense, MS can't be totally blamed: they have been giving us what we wanted: perfs and features.
The Cloud - because you don't care if your apps and data are up in the air.
Don't you just hate it when Microsoft takes the high road on security and raises some valid points. We've been through this scenario a bunch of times where some class of programs that used to only be used by local programs became accessible on the web and suddenly there is a rash of exploits (jpeg and pdf come to mind), I'd rather not go through it again.
That said, I think Microsoft laid out the problems with enough specificity that they could be addressed.
And yet Silverlight will get all those "harmfull" Features.
It's a Microsoft article, which means that a few dozen unfunny chuckleheads will chime in with the easy jokes about "ACTIVEX LOL".
Here's a hint: real life is complicated. OSS is not white and MS is not black.
Slashdot is hopeless.
Ie is the only main browser which never had plans for webgl.
It's unlikely for security reasons, just that directX is still battling opengl, they're not about to give an edge to the alternative product, right?
They just jumped on the first opportunity to pin their decision on the first flaw that came out of webgl.
This is a serious question: how different is run WebGL on GPU than run GPU accelerated Flash content? Are those different issues?
Why don't they just stop fucking with customers' machines and actually join the ARB? Then they can help develop some open-source interoperable standards instead of their broken closed-everything type browsers/plugins/systems. Knowing Microsoft they'd probably do everything they could to shoot the process in the foot and then try to make their own competing technology... ...oh wait...
If the only way you can accept an assertion is by faith, then you are conceding that it can't be taken on its own merits
Games. No joystick and other input handling, no feedback and such. Now if the browsers would have this functionality possible as standard then I would say Microsoft would have a valid concern painting the devil on the wall that they think WebGL is. However without those crucial components its more likely not a valid concern... I argue that their own supposed IE9 3D accelerated rendered pages for 2D panes is already doing something they are now stating is inherently insecure... Microsoft is really now just saying "this shi*t is no way of doing it." In any event it is my honest opinion that Microsoft should not quip anything regarding this nor anyother security whatsoever because it really shows how out of touch they ultimately are.
I am reminded of the day when Microsoft's server OS was changed so that unverified third-party video card drivers were run in ring 0. It didn't used to be that way, and it doesn't make sense in a server OS, but they did it anyway.
It's one of the reasons I consider Windows NT 3.51 to be the last decent server OS to come out of Microsoft.
Just look at all of the security issues that Microsoft Windows has, and all of the security problems that Microsoft Windows has caused globally.
executed on a driver supplied to you by third-party which may or may not have a stellar security record themselves.
That is more of a critique of Microsoft Windows itself than of WebGL.
Isn't that the same company that never considered ActiveX as an harmful technology even that it used most of the times to attack users who left IE ActiveX features turned on?
What a FUD title and summary. I was not able to find any quotes from Microsoft that stated they found WebGL itself 'Harmful.' They did state - and with reason by the way - that WebGL is a potential avenue for attacks given the varied and often buggy vendor supplied OpenGL drivers. This makes the browser the venue for attacks but fixes for the attacks must be implemented in the OpenGL driver code (supplied by either ATI, Nvdia, etc.)
Microsoft is not the only developer to come across this issue. Firefox already has a driver blacklist to help combat some of these issues. Honestly, Microsoft is doing the correct thing not only from a business 'save our ass' perspective but in being pro-active in protecting their users.
"Microsoft has announced that it has no plans to support its Windows operating system, citing numerous security concerns over the technology and branding the basic principles as 'harmful.'"
FTFY
Any new major features which allows the execution of code off the Internet is potentially dangerous. Its direct connection to hardware is also another cause for concern, especially with immature technology. However, there is also massive demand for hardware acceleration of downloaded code.
The reality is that if the browser vendors do this right, this is no more of a problem than the potential for users to download executables off the Internet and running them. Users can always screw things up and it is the browser vendors responsibility to put up massive safeguards to stop the browser from executing WebGL from untrusted sites and providing enough barriers to stop the user from enabling this on web sites without knowing the risks. I.e. requiring the user to open a dialog and selecting "I trust this website with my hardware".
I'm utterly convinced that Microsoft will implement this in some form or another, probably their own proprietary format using DirectX. Bashing WebGL in particular is just a ploy from them to avoid losing control in the field of gaming and graphics.
Microsoft saying that using any graphics library other than their own -- which happens to only be available on their operating system -- is harmful and should be avoided. Shocking.
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
Microsoft would prefer to push Silverlight (which does not support OpenGL or DirectX (good call) but still does some software 3D)
That doesn't make them wrong, WebGL is stupidly insecure, because making it secure means you start to destroy performances by having a large layer between the graphic card and WebGL, while right now you're basically calling OpenGL.
In fact, except by using a proper operating system (such as singularity incidentally) and a proper, fully controlled messaging system between the OpenGL calls and the graphic card, there's no real way out of this.
Poor performance in WebGL would not be acceptable. Poor security is not acceptable either.
Anyhow, we'll see how this turn out.
I agree. Plus the fundamental issue here is not a choice between WebGL and no 3D browser support because drivers are insecure and unstable. Its really a choice between WebGL and 3D browser plugins. People want 3D in their browser Microsoft saying no will not change this. They will simply get it through any number of 3rd party plugins as opposed to an open standard like WebGL. This is actually great news for Flash and Unity. It's bad news if you didn't want another proprietary 3rd party company setting the standard.
Can you explain to me, from your security point of view, how this is any different than using flash or silverlight on the web? Using those technologies, you're loading code form a website to be executed on a driver supplied to you by a third party which does NOT have a stellar security record.
There are two types of people in the world: Those who crave closure
agreed.
maybe microsoft its right and webGL is "harmful technology". But one thing MS has proven time and time again is that they don't care for users using "harmful technology" as long as MS's brand of "harmful technology".
Except Microsoft doesn't make video cards and video drivers.
An essential factor in security is trust
I don't trust you or Microsoft. How secure am I now?
You cannot trust a website you have never seen before to load code of its choosing to be executed on a driver supplied to you by third-party which may or may not have a stellar security record themselves.
Can you trust a website you have seen before? Do you surf with Javascript disabled? And just so you know: my driver happens to be supplied by the OS vendor, who does have a sufficient security record for my desktop needs.
Especially when "modern" operating systems like Linux run drivers as part of their monolithic kernel and so probably WILL crash when the website code messes up the driver runtime.
Pics or it didn't happen. Here's my preemptive cluebat: the Linux OpenGL stack runs in userspace (Mesa), along with the direct rendering manager. The only parts inside the kernel are the modesetting code, the direct rendering interface and the command submission checker. And guess what: the command submission checker is there for security reasons.
Windows is heading in all the right directions moving their graphics driver supporing infrastracture out of the kernel into userspace. At least that way, your entire OS won't crash bringing everything down with it.
From a security standpoint, an entire OS crash is actually safer than trying to recover from an unknown state.
At worst, smart people will figure out doing their favourite things - injecting their code through good old buffer overflows and what not.
Because that can never be harmful?
This is what you get when you pair three poorly isolating systems to eachother.
Warmth in the winter, coolness in the summer?
Microsoft may have done a lot of their own mess during the years with their products' security, but for once, they are right. Not the least, becaue they probably have gotten so much flak for it they finally decided enough is enough and started going by security checklist documets and automated programs that eliminate all the obvious bugs.
Doesn't matter if they are right. WebGL affects their bottom line so they have various reasons not to implement it. Given their track record on security, it would have been better not to say anything.
I sincerely hope they're getting it, for I for one am tired of hearing everyone bash them. Look into your own backyard when you get 20 million lines of code running wildly on a several hundred million computers around the globe, thanks. Or reduce your SLOC, but that, again, is another discussion.
I do not want to have wildly running code.
The title should be "Microsoft: WebGL Considered Harmful"
It seems that WebGL is basically an experiment how to implement a subset of OpenGL that can be part of a webpage. This experiment more or less ended in a standard which allows the website to use the graphics card to it's full extend.
As shaders are turing-complete and we do not have a secure IOMMU in every computer but the real possibility of access a lot of memory which the website should not be allowed to. Yesterday a new exploit was published which underlines this point (Exploit from contextis.com) So this boils down to a nice idea for some internal stuff, kind of downloading an executable and showing the results right in your browser. If we do not want to repeat ActiveX for the GPU instead of the CPU and all it's problems with blacklists, etc. there are very few viable alternatives. Either something like Java or Google's native client which provide a more or less secure sandbox or a good security architecture in the graphics driver which prevents these exploits.
Until one of these security measures are in place it is hard not to agree that WebGL is a big security risk and should not be used for websites out of your control.
Internet Explorer as a viable browser. Thank you, Microsoft.
"Do the Right Thing. It will gratify some people and astound the rest." - Mark Twain
The GPU has been getting more powerful and is far better for certain tasks. The GPU needs to be treated more like another core processor and less like an add-on. In fact, it's being integrated into the processor on chips like AMD Fusion.
Trying to put the graphics processing in userspace should be a bad joke at this point. The Linux Kernel has been moving to Kernel Mode Setting for a reason. Yes, it's not all of it by any means, a lot of the OpenGL stuff happens between them, but the direction it's moving in should be clear.
In other News: The world has announced that it has no plans to support Microsoft — a cross-continent low-level suite of Operating System and Office Software designed for world domination — in its future computers, citing numerous security concerns over the technology and branding the basic principles as 'harmful.'
Thus, "third party [drivers] which may or may not have stellar security" ...
Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
https://twitter.com/#!/ID_AA_Carmack/status/81732190949486592
The price is always right if someone else is paying.
Carmack seems to agree with MS here: "I agree with Microsoft’s assessment that WebGL is a severe security risk. The gfx driver culture is not the culture of security." http://twitter.com/#!/ID_AA_Carmack/status/81732190949486592
I would think that with Linux kernels 13M source lines of code versus Windows 7 kernel 3M, it's more of a critique of Linux in fact. And also, out of those 13M, more are driver code lines than is the case with Windows, which thankfully heeded to years and years of operating system security research and started to finally move stuff out of the kernel into user-space with the help of their user-mode driver framework.
Conceptually, WebGL is not flawed and cannot be blamed for errors that occur outside its domain, even if these can be attributed to WebGL itself. But as part of a bigger software "ecosystem", it is to blame. You help expose seven levels of hell with the help of a ladder. A stable well-built ladder, but a ladder nevertheless. Unfortunately, system security is not like a courtroom trial - you either have it or you don't. There is no such ting as "partially secure system", when one secure part of it nevertheless cannot protect it from intruding upon the rest of it.
Company names are almost always singular. A company name is not a collection of people, it is a proper name for a singular entity.
Otherwise you'll have more javascript "go download a *real* browser to use this site/webapp" and more exodus from IE.
A lot of people don't own all the computers that they use and thus lack administrative rights to switch browsers. Examples include a child using the family PC, someone visiting someone else's house and using a PC, an employee using a work PC, or someone using a PC in a public library or Internet cafe. Therefore, you'll probably see IE users switch to a competitor's site that offers both a WebGL front-end and one that uses whatever Microsoft can dream up.
You are flat wrong on a few points:
It's not the access to high performance video drivers, as they don't exist.
Bullshit. The nVidia drivers benchmark comparably on Linux and Windows. ATI might still be worse.
And this is where I think the Linux community missed an opportunity. Back when Quake 3 was the hot new shit, and was how benchmarks were done, someone benchmarked Windows vs Wine vs native Linux. They found the performance went roughly in that order -- Quake 3 was faster under Wine on Linux than it was on Windows, and the native Linux port was faster still.
So you're right that gamers need something better -- but we had that. We had a significant performance advantage for awhile, and that was out of the box. This was also back when desktop GUI environments were still fairly resource-intensive things, so you could get even more performance out of killing off your entire GUI and running just that game in its own X server (with no other X apps) -- and PC gamers were always looking for little tweaks like that to give them an edge.
None of these things are true anymore. Linux is no longer a performance edge by itself, and whatever performance there is to be gained isn't really going to make your framerate go up. That's where it's even comparable, because since then, Direct3D got better and much more popular. There was a point where OpenGL was just faster and better, when games would ship with multiple renderers (OpenGL, D3D, and software) in case one happened to be faster or better supported on your machine, but as I remember, after a certain point, Half-Life always ran faster under OpenGL. But again, things just aren't comparable anymore -- too many games are D3D only.
That, and there are so many new features (all of them high-performance) that you're not likely to get the best experience out of open source drivers, so if you're stuck with ATI, Linux is going to be significantly worse than Windows, even for an identical OpenGL game.
I feel like if we'd kept that edge just a bit longer, we might've seen a lot more start to change. I played an MMO with a friend, and aside from his Norton Anti-Virus always interrupting his game, I could run it windowed (via Wine hacks) while he couldn't -- and eventually, when the game's auto-patching system not only worked on Wine but not his Windows, but we "patched" his copy by pulling files out of my Wine copy, he was convinced -- a few months later, I set him up with Linux. That kind of thing happens much less often these days.
Anyway...
It's not the access to ubiquitous and non-finicky audio systems, as they don't exist.
I don't know, ALSA pretty much met that goal, and I haven't had issues with Pulse since I switched to it, though I did wait awhile before making that switch. For a gamer, though, I don't see needing anything more than ALSA. For that matter, I also don't see a game developer needing to use anything more than OpenAL.
You are, however, almost right about this:
The gamers need something better than what they have if they are going to move away from their current situation and negate their library of games... The majority of game companies won't make games on Linux until there is a market, which doesn't exist.
Linux support is still a very good idea for a new indie game. And if anything, I'd expect it to be easier to build a portable game than other kinds of applications -- the game's entire interface with the OS can be reduced to OpenAL, OpenGL, the filesystem, and the network. OpenAL and OpenGL are already ported, and the filesystem is almost automatically portable if you don't assume stupid things (don't add a bunch of backslashes; forward slashes work on Windows, too).
But then, indie developers can't really afford to exclusively support Linux, which means the game itself isn't an inc
Don't thank God, thank a doctor!
Yes. However, the point people are trying to make about Microsoft is as follows:
At this point, everyone is still developing the framework in which you securely access the GPU. Microsoft states that there are several security assurances that have been handed to the graphics driver programmers via WebGL. However, there are no assurances that Silverlight will mitigate this without A) substantial performance issues and B) introducing several bugs that can be exploited for equally viable and dangerous attacks. Finally, Microsoft can't simply ignore 3D graphics on the web, because they'd face yet another upset in desktop browsers by the competition (Firefox/Chrome).
The problem is that in the end, Microsoft complains that someone else's product has the same problems as Microsoft's product and provides no remedy. Thus, we conclude that while there are security issues, they are currently universal to GPU access by web code. Hence, Microsoft's position is considered to be only half true at best and in the spirit and intention of complete and utter FUD.
Developer: I'm going to make a great game for Linux, it's closed source.
Linux Community: closed source? BAH! No thank you, Linux is about Freedom man...
Seriously? Can you cite any actual examples of this actually happening?
I mean, I might grumble that a game is closed, and that I might be able to solve some issue it has if it's open, but I'll buy it. How many Linux users with nVidia cards refuse to run the nVidia proprietary drivers? Those are a much bigger issue than some game running in userspace.
Don't thank God, thank a doctor!
Sorry. I've become better about controlling the Grammar Nazi within in recent years, but sometimes he still escapes my grasp and tries to wreak havoc on my karma.
about security concerns?
ROFL
Maybe should just use a virtual-box like system for browsers. Just run the browser with some minimal version of Linux or BSD in a virtual machine on what every OS. Make a downloads and a config directory shared and be done with it.
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
Sure, gladly. You have half a point - indeed systems that communicate invariably affect and potentially may compromise each other. That's a fact, which can also be seen in any other field of engineering. Like they say, the only secure system is the one that is not connected [to the Internet]. But since we do connect systems, the factor here is the interface cross-section. Flash Player and Silverlight, ok I won't speak for Silverlight because I never said it is much better than WebGL, so yeah - Flash Player uses fewer and more benign interfaces than WebGL - it certainly does not execute that much GPU code, in fact most of the SWF code interpreted by it is run on your average CPU eventually, and the parts that are abstracted by Windows, again, run in USER MODE - font rendering, printer, mouse, sound etc - hence my choosing of the word "more benign". If Flash Player crashes, your OS doesn't (hopefully this includes Linux based OSes.)
Granted, Flash Player DOES now expose the GPU indirectly through its that-3d-rendering-api-codename-i-dont-remember-the-name-of, and indeed it's much of the same dilemma as with WebGL - untrusted code programming your graphic driver has the same chance of crashing your box as those fancy desktop 3d games that give you BSOD or Linux kernel panic.
To sum it all up: it's the interface cross-section that matters and the domain of the code the interfaces abstract.
ActiveX at least ran as the current user, not kernel.
The 2D canvas ultimately runs as the kernel. Scripts call methods of a canvas drawing context in the web browser, which makes calls to 2D drawing APIs provided by the operating system, which are finally executed in device drivers that run as part of the kernel. What's the difference between 2D and 3D in this respect, other than defects in certain 3D paths in NV and AMD video drivers?
harmful to whom?
Are they really that obvious?
microsoft has consistently attacked OpenGL in order to push directx. They are working hard to keep people on windows. One of the few things tying people to it is applications, and within that, the biggest marketshare comes from games. Office suits, video and music, ERPs, CRMs, and just about everything else is going to the web. But games are still mostly actual executable files that depend on the OS. With WebGL, we can have games as complex as we want that just run on the browser. Microsoft DOESN'T want that, specially since their browser is going the way of the dodo.
WTF am I doing replying to an AC at 5 A.M on a Friday night?
Anything that gets drawn in a browser is controlled by the browser. After 10 years of failure that part mosty is sandboxed into safety. The Code of web gl has almost complete access to the video driver. The video driver was never written for security. Speed and picture quality were the number one priorities. Since the application that ran them was alrady a local application that had a lot of access security was not really an issue. The application that access the drivers did not have to be checked extra, because they had already full access to the machine.
Display drivers are complex software, that might show the same level of vulnerabilities that plagues the browser.
However a subset of WEBGL that is more easy check could be implemented safely i think.
Let's simplify that: You cannor trust a website to load code.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Do you really need a briefing on security risks of something running in kernel vs something running in (restricted) userspace ? Not that im lauding silverlight, activex or flash here ..
http://validator.w3.org/check?uri=http%3A%2F%2Fwww.slashdot.org Errors found while checking this document as HTML5!
The difference is that flash and silverlight are designed for running untrusted code, while graphics drivers are not. You should RTFA.
Can't we all just wait for independent confirmation from labs or something? It's not completely unheard of that M$ isn't just blowing FUD.
I'd like to see a researcher clear this up, and if it's bunk....slap M$ around publicly for lying yet again.
1. Trust, although essential, is not everything in security. So, to answer your question, if you trust me as much as you trust Microsoft, even though I don't think one can measure trust simply like this, I would say on the grounds where this trust can be used, you are equally secure. But like I said, besides trust there are other things that are volatile - time being one of them. Example: even though you trust Microsoft, one of the two things may happen: their site is rewritten one day with the same security certificate remaining and the new code doesn't play well with your computer and 2) software on your end is updated, the web browser for instance, and again same thing happens. I feel like you should have answered your question yourself actually.
2. I didn't say first-party is paramount to security. You did. Even though your driver is supplied by your OS vendor, does not make it automatically secure. You still have to trust it. Do you? Sufficiently you say? Well, sufficiency does not figure here. You are either secure or compromised. If you haven't been compromised yet, it's doesn't mean you won't - maybe you haven't feed the "right" sequence of calls to your driver yet :-) To answer your question: no, I wouldn't trust a website I have seen before, because of a very simple observation: websites change, while their signatures (names, certificates) remain, fooling our sense of trust. Maybe you can trust the people that built the website, but again, people come and go. Can Microsoft be trusted? I dunno, 90000 employees and all...
3. True. For the sake of the argument, some of DRI - 'drm' kernel module and another one - run in kernel space. Also, the closed source drivers run in kernel space again, as does my open-source video driver (ATI Mobile Radeon) and some others. Ideally, DRI should rule, but the diverse and thriving Linux ecosystem somehow manages to live on its own. But you are sort of right, and I do admit I was a bit too fast on the trigger. Maybe its because in general, I am a bit paranoid thinking that I have around 15Mb of binary code running in kernel space right now :/
4. There is no unknown state - the state is enforced by hardware - process removed from process stack, memory reclaimed. That is all. It's a basic principle behind process isolation on pretty much any computer platform invented in and after the 80s. I thought you knew that? Or have I misunderstood you?
5. Only if there is temperature variations between them :-) Seriously though, beautiful comparison, but I really really really don't know how to apply it to the discussion! I think my brain may explode if I attempt to.
6. Is it fair to say that it is exactly because of their security track record, that they may be expected to finally take what they have learnt the hard way and do something about it? Take Apple as an example - they have been openly advocating Mac OS as a more secure system, then someone cared enough to write a trojan and where are we now? It's the same story really, except that little brother is so proud he has gotten to the top he hasn't noticed that he was following in his big brothers footsteps.
7. Me neither.
Lets face it; either you do WebGL or you do some Microsoft Silverlight Direct3D mambojambo it does not matter. As long as it touches something and even possibly uses data from somewhere it's a security risk. And this applies to everything.
However, given the open nature of WebGL compared to some Microsoft closed-source solution, static/runtime analysis tools can be developed (and integrated) in WebGL implementations to lower the risk, the standard (or what ever we call it) can be changed so that more dangerious things are disallowed (or for example to the screenshot thingy Mozilla has right now, limited), where as with Microrsoft you just pretty much hope that it will not go sideways, and that they will not later on screw it up with updates.
Plus, WebGL is cross-platform by design, which is the number one downside for Microsoft. Still, I can't believe they are still going down this path... Wasn't Ballmer already fired or was that just hearsay? Also, it'd sound really strange if you couldn't adapt GL paths to Direct3D, as Wine is already doing the same other way around, and AFAIK succeeding [in small steps].
Seriously, why is it needed? Why don't developers just write their own UI instead of trying to push everything into the browser?
There is no "-1 offended" or "-1 you don't agree with me" mod options for a reason.
You cannot trust an application you have never seen before to load code of its choosing to be executed on a driver supplied to you by third-party which may or may not have a stellar security record themselves.
I fail to see the difference between this and using some client-side application, other than the fact that WebGL is a cross-platform spec.
The /. post title should be "Microsoft security researchers says that WebGL is Harmful", because "Microsoft" != "Microsoft security researchers".
For example, the arguments used against WebGL could be used against Silverlight, Flash, Java or ActiveX (just search and replace WebGL for your preferred plugin).
But there is a big difference between is "considered bad for the MS security researchers" and "considered bad for MS". If MS executives sees that there is a competitive advantage over WebGL... I'm sure that they are going to adopt it.
Now the good concern that raises the article to me is this: since JavaScript is intended to be used as the Web Platform Language, I think that some method to handle fine grained permissions of JS should be needed in next browser versions.
There fixed that for you
Considering that most accelerated 3D drivers for video controllers are utter crap full security flaws, or “optimizations“, as some call them
At one point, weren't accelerated 2D drivers for video controllers also utter crap full security flaws, or “optimizations“, as some call them?
No issues...
Comment removed based on user account deletion
Learning from past mistakes is not their area of expertise. If it was, I wouldn't have to install a critical security update every other day... I'm not suggesting they're wrong, because I don't know WebGL, but I would say that their motives are suspect. MS says anything they perceive as a threat to their market share is bad... until they just can't convince people of it. If WebGL becomes popular enough, they'll jump on board without a word about how "dangerous" it is. And then we'll have a critical security update every day...
Flash does not have access to the underlying hardware on the machine, and indeed may be running on an unpriviledged account.
In order to compromise the operating system, you have to find a buggy openGL driver.
In many cases, this vulnerability will not be easily patched, as the vendor does not really care enough to maintain older, or even newer cards with prompt upgrades.
This is really very similar to ActiveX.
You not only need to trust the website. (say slashdot or sourceforge).
You also need to trust the website coders, their ISP, anyone that may steal their keys.
You also need to trust that the website is secure against code injection.
And if the last firewall against security is openGL drivers supplied as binary blobs, that have never been designed to be secure as they are not expected to be exposed to this sort of threat - your 'defence in depth' just got a whole lot shallower.
In order to compromise the operating system, you have to find a buggy openGL driver.
And in order to compromise the operating system with Flash or HTML5 Canvas, you have to find a buggy 2D driver. All I get out of this article is that 2D drivers are more mature than 3D drivers.
Hey Kettle, ur black. Ha! take that Pot your dirty dish!
meanwhile the microwave oven is kicking both ur asses. Microsoft should speak, the day they make a stable and secure product is the day... Hell freezes over???
Just amazing. Like don't buy an iPhone it has security issues, buy Windows Mobile 6.5! :-)
WebGL essentially lets web code run directly on bare metal.
Firefox for Windows runs WebGL, which is based on OpenGL, on top of Direct3D, which isn't based on OpenGL. If Firefox is translating WebGL calls into Direct3D calls, how is this "directly on bare metal"?
it will run quite easily installed as a normal, non-administrative user in some directory that the user can reasonably be expected to have write access to, %USERPROFILE%\My Documents\Firefox
Windows supports Software Restriction Policies to disallow execution from %USERPROFILE% or removable media.
or ~/bin
Many UNIX-clone operating systems support mounting /home and removable media as noexec.
EVERY file format added to browsers creates a larger attack surface. Remember the JPEG security issues in the 90s??
OpenGL is not a file format but it is a similar problem; arguably bigger and far more difficult to patch because of its size, scope and long time focus on SPEED over everything else. It is going to be a bigger problem than webfonts, canvas and any other outside technology being integrated.
Putting OpenGL on the web is like putting NFS on the WAN and it will take a lot of work before it will be "safe" and I think that somehow it may be a long time before the drivers are forced to change; you can only do so much with a bridge API to protect the backend.
Democracy Now! - uncensored, anti-establishment news
Personally I'll pass on the thought of an ad network or visiting link farm/crap site running shader programs on my GPU.
The web is annoying enough without also having to deal with fan noise and the lights dimming as some bottom feeder attempts to mine a few extra bitcoins at my expense.
Even if you could somehow guarantee safety I would still be against it.
Comment removed based on user account deletion
So anything that access 3D hardware to get good performance is unsafe regardless whether it's WebGL, Silverlight or Flash.
I assume it's because they all go through OpenGL or DirectX to get to the GPU and both API are not designed to protect from abuse.
MS seems to think they have a better way of doing it ... Put another software layer on top of OpenGL and DirectX?
WebGL considered harmful.
These are the guys that ruined the internet. People are forgetting just how bad they've delayed progress before Fireforx/Chrome forced their hand. Microsoft wants to delay everything from moving away from the old application model that makes them so much money. That's why upgrading IE6-7 isn't a mandatory upgrade, this is why IE9 won't run on XP. They know that as long as the internet needs to support their software, they make more money.
They ruin the internet.
Because they're d***s.
So just one more reason why people will leave IE behind ... when they find out that there are tons of websites they won't be able to watch videos from in the future.
It may well be that MS is making this decision for self-fulfilling reasons, EG to protect Silverlight in the marketplace. But with IE continuing to lose market share year after year (from its high of about 90%, it's under half nowadays with nary an uptick in sight) one has to ask if they can afford to, once again, be "the big guy who couldn't".
For the past two years, we've simply told our clients that, to use our system, they had to be running Firefox or Chrome, and that we didn't support IE - it simply couldn't do what we needed and we found that having the features is more important to our clients than having compatibility. They *will* switch if they need to, if you provide features they need.
Finally, with IE 9, we may consider supporting it this upcoming fiscal year. Now, in this market place, if I developed software that needed or used 3D effects in a browser, I wouldn't hesitate to drop IE support for even a second. Microsoft doesn't control the game, anymore. This may be their version of IBM's PS/2 Micro-channel debacle.
(For those who don't remember, IBM created the "PC-compatible" marketplace and thought they ruled the roost. They decided to come out with an incompatible schema for hardware called the Microchannel bus which offered numerous technical advantages over the industry standard ISA bus, which failed miserably because nobody else wanted to license the tech)
I have no problem with your religion until you decide it's reason to deprive others of the truth.
This BS *again*?!?!
GPU shaders != running code on the CPU.
WebGL allowing shader usage is pretty much a non-issue security wise. GLSL shaders are *extremely* limited in scope. They can't access anything besides model data and textures, and even then only the model data and textures provided to them by the host program. GLSL is very domain-specific and doesn't support pointers or any way to access things outside the purview of the GPU.
Furthermore, they aren't pre-compiled (aside from some vendor-specific methods on *OpenGL ES*, and even those only compile to bytecode IIRC), so WebGL can at least attempt to do some shader validation. OpenGL and WebGL programs literally hand the GLSL source code to the driver, which is then responsible for compiling it. This actually turns out to be good for performance, since future compiler improvements in the driver can result in the same shader on the same hardware running faster. It also means WebGL could do validation on the shaders before handing them off to the driver, to keep an eye out for any obvious attempts to do something bad.
And when it comes to malicious shaders, only two attacks can be executed: try to crash the GPU by running a very intensive shader, or try to peek at other web pages via what seems to be an implementation flaw in WebGL/HTML5 Canvas.
The first attack can be easily avoided. In fact, it *shouldn't* be possible at all on Windows, which is supposed to restart the GPU if the GPU crashes, and when it can't that's a *Windows* bug.
The second is a little harder but, again, looks to be an *implementation* flaw, not a fundamental flaw in WebGL or shaders or anything like that.
Face facts, modern GPUs don't offer any of the old fixed-function pipeline anymore. It's not anywhere to be found on the silicon; modern GPU drivers merely emulate it for old OpenGL programs. This means that if WebGL didn't have shader support it would be completely useless.
It was pretty dangerous for microsoft to have sql in the webbrowser : who would buy let's say access, sql from their shop then
http://html5doctor.com/introducing-web-sql-databases/
developer http://flamerobin.org
This has nothing to do with Windows. WebGL allows for GLSL code. This is going to be passed to the driver (and ultimately to hardware) on any OS which implements hardware acceleration.
VMs for Flash and Silverlight (and JavaScript) know that their input comes from untrusted sources. Therefore, such a VM is typically coded for security from grounds up, with meticulous attention to design of the sandbox and its verification, and a lot of testing.
GLSL was, historically, not coming from untrusted sources. Therefore, any code in video driver or GPU hardware that handles it would generally be coded for performance, disregarding security issues. Nor would security be heavily tested. Once you suddenly change the rules of the game, such that the code comes from arbitrary untrusted sources, your existing implementations become a security clusterfuck.
If you want a historical example, it's like what happened with Windows 9x when it - not designed or coded with security in mind - was shoved onto the Web. Hilarity ensued.
No, but given all the hacks/security risks that allow flash to run in unrestricted userspace, there really isn't much difference.
There are two types of people in the world: Those who crave closure
I fail to see the difference between this and using some client-side application, other than the fact that WebGL is a cross-platform spec.
The difference is that even legitimate websites are vulnerable to XSS. Consider all of the recent headlines of the websites of large companies and organizations being cracked. Virtually any site can be cracked and made to run a rogue JavaScript - this actually happened to the OpenGL website itself at one point last year. WebGL makes the threat of XSS even worse than it already is - the driver compiles GLSL to native GPU code, so you don't even have a sandbox.
Not to mention the fact that people, in general, give less thought to clicking on links than they do to running applications on their computer.
[GLSL] code is C-like and has things like pointer arithmetic. Validating it is about as hard as validating arbitrary C code - and if you can work out a way of doing that then you can make a lot of money.
Google Native Client defines a safe subset of x86 machine language into which C can be compiled. Google will make a lot of money.
It's passed to the driver after a token amount of validation.
Firefox and Chrome appear to use a library called ANGLE to translate GLSL into DirectX shader language. How is this translation merely "a token amount of validation"? If it is in fact more than "a token amount of validation", then what is passed to the kernel is not untrusted code. Can you recommend any web pages explaining GLSL validation or lack thereof in practical implementations of WebGL? Is there a better way for untrusted code to draw 3D graphics, and if so, what is it?
In a typical GPU, there is either no MMU or a badly designed, badly tested, buggy MMU
Then the "badly designed, badly tested, buggy MMU" should be replaced.
Ever since "gotos considered harmful", harmful is is about the biggest insult you can give in the computer world.
http://en.wikipedia.org/wiki/Considered_harmful
So, if an application is running with limited privileges does that mean there is a massive security hole which would allow it to have complete control over the system because it could call unsecure drivers using OpenGL or perhaps DirectX? I ask this because I know precious little about this and would like to be illuminated. It just doesn't seem likely that such a situation would still exist, especially on newer operating systems.
Potentially, yes. It's your typical error propagation scenario. There doesn't have to be an error in the application itself, nor will an error in application process itself crash the system, but if a path of application code - arbitrary or carefully and maliciously designed - causes a deliberate disruption of service in a component that has enough privilege to cause collateral damage in the system (a kernel mode driver for example) - even though ultimately the blame lies on that component, in practice the catalyst for the crash is your benign user-mode application. It is the detonator, if you want a car bomb analogy :) Isolation of system components to the level where the detonation described cannot occur is part of securing logical systems.
Ultimately the system is secure against the aforementioned attack if no application can indirectly corrupt system state. The important thing to consider here is also that most users don't care whether the "crash" is to be blamed on one component or the other. For them, it's the picture that matters. For the rest of us, we should blame NVidia if their driver can be compromised through its own public interface, but until it is fixed, we do a disservice to our users inviting them to use software that "detonates" said driver. One has to start from the bottom, not from the top, in my opinion. An infrastracture, a strategy has to be in place PREVENTING such chain reactions from occuring in the first place.
So, the goal is to prevent any component from corrupting global state. The devil is in the details. If you can't prevent a component from crashing itself, contain the damage. A video driver for instance is traditionally written for speed. That often causes developers to turn a blind eye on the more traditional security implications, and so the driver is released that is very fragile to unusual patterns of access. They crash it. In that case, at least contain the damage. Minix for instace will clean up as much as it can and "reload" the driver. It's all art of what is possible, but we instead hammer our way in a bit of a wrong direction. I think of our users, really. That said, I am no hater of WebGL, I just think the most dire problem with computers today is not how websites can take advantage of your GPU, it's security.
WebGL effectively executes code from the web (effectively) in ring0. Silverlight and flash execute code from the web in (effectively) a sandbox.
Point noted. Actually meant "the people at Microsoft" this time, not the entity (it's still a fault), that said "it" would have worked there too both in meaning and grammar.
AHEM: Apparently NOT when *NIX dorks say it here though!
"Security is just the biggest argument in the FUD arsenal" - by bzipitidoo (647217) on Friday June 17, @09:13AM (#36473372)
Now, for years here I have been hearing "Windows is a security nightmare full of security holes, (insert *NIX variant here) is not"
LMAO! Total b.s. & what's below will disprove THAT, with ease (and facts from a reputable source).
So - Who are you *trying* to fool with that then?
Hmmm?
Apple went around saying the same, even on T.V. in their ads (implying/inferring it, & MORE) as well.
So, what's "MacDefender" then for they also??
Hmmm??
* What a CROCK OF SHIT!
Still, in regards to that? Well, ok - let's take a peek @ the # of unpatched security vulnerabilities on not ONLY Windows 7, but nearly the ENTIRE GAMUT/ARRAY of what Microsoft gives us to do development & business with online, vs. THE LINUX LATEST-GREATEST KERNEL ONLY then, shall we?
This data's ALL from a respected source for known security vulnerabilities unpatched:
---
Vulnerability Report: Microsoft SQL Server 2008: (06/18/2011)
http://secunia.com/advisories/product/21744/
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft Internet Information Services (IIS) 7.x: (06/18/2011)
http://secunia.com/advisories/product/17543/
Unpatched 0% (0 of 6 Secunia advisories)
Vulnerability Report: Microsoft Exchange Server 2010: (06/18/2011)
http://secunia.com/advisories/product/28234/
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft SharePoint Server 2010: (06/18/2011)
http://secunia.com/advisories/product/29809/
Unpatched 0% (0 of 0 Secunia advisories)
Vulnerability Report: Microsoft Forefront Endpoint Protection 2010: (06/18/2011)
http://secunia.com/advisories/product/34343/
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft Office 2010: (06/18/2011)
http://secunia.com/advisories/product/30529/?task=advisories
Unpatched 0% (0 of 7 Secunia advisories)
Vulnerability Report: Microsoft Virtual PC 2007: (06/18/2011)
http://secunia.com/advisories/product/14315/
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft Internet Explorer 9.x: (06/18/2011)
http://secunia.com/advisories/product/34591/
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft Visual Studio 2010: (06/18/2011)
http://secunia.com/advisories/product/30853/?task=advisories
Unpatched 0% (0 of 2 Secunia advisories)
Vulnerability Report: Microsoft DirectX 10.x:
(06/18/2011)
http://secunia.com/advisories/product/16896/
Unpatched 0% (0 of 3 Secunia advisories)
Vulnerability Report: Microsoft .NET Framework 4.x
(06/18/2011)
http://secunia.com/advisories/product/29592/
Unpatched 0% (0 of 5 Secunia advisories)
Vulnerability Report: Microsoft Silverlight 4.x: (06/18/2011)
For years here I have been hearing "Windows is a security nightmare full of security holes, (insert *NIX variant here) is not"
LMAO! Total b.s. & what's below will disprove THAT, with ease (and facts from a reputable source).
Apple also went around saying the same, even on T.V. in their ads (implying/inferring it, & MORE) as well.
So, what's "MacDefender" then for they also??
Hmmm??
* What a CROCK OF SHIT!
Still, in regards to that? Well, ok - let's take a peek @ the # of unpatched security vulnerabilities on not ONLY Windows 7, but nearly the ENTIRE GAMUT/ARRAY of what Microsoft gives us to do development & business with online, vs. THE LINUX LATEST-GREATEST KERNEL ONLY then, shall we?
This data's ALL from a respected source for known security vulnerabilities unpatched:
---
Vulnerability Report: Microsoft SQL Server 2008: (06/18/2011)
http://secunia.com/advisories/product/21744/
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft Internet Information Services (IIS) 7.x: (06/18/2011)
http://secunia.com/advisories/product/17543/
Unpatched 0% (0 of 6 Secunia advisories)
Vulnerability Report: Microsoft Exchange Server 2010: (06/18/2011)
http://secunia.com/advisories/product/28234/
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft SharePoint Server 2010: (06/18/2011)
http://secunia.com/advisories/product/29809/
Unpatched 0% (0 of 0 Secunia advisories)
Vulnerability Report: Microsoft Forefront Endpoint Protection 2010: (06/18/2011)
http://secunia.com/advisories/product/34343/
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft Office 2010: (06/18/2011)
http://secunia.com/advisories/product/30529/?task=advisories
Unpatched 0% (0 of 7 Secunia advisories)
Vulnerability Report: Microsoft Virtual PC 2007: (06/18/2011)
http://secunia.com/advisories/product/14315/
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft Internet Explorer 9.x: (06/18/2011)
http://secunia.com/advisories/product/34591/
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft Visual Studio 2010: (06/18/2011)
http://secunia.com/advisories/product/30853/?task=advisories
Unpatched 0% (0 of 2 Secunia advisories)
Vulnerability Report: Microsoft DirectX 10.x:
(06/18/2011)
http://secunia.com/advisories/product/16896/
Unpatched 0% (0 of 3 Secunia advisories)
Vulnerability Report: Microsoft .NET Framework 4.x
(06/18/2011)
http://secunia.com/advisories/product/29592/
Unpatched 0% (0 of 5 Secunia advisories)
Vulnerability Report: Microsoft Silverlight 4.x: (06/18/2011)
http://secunia.com/advisories/product/28947/
Unpatched 0% (0 of 0 Secunia advisories)
Vulnerability Report: Microsoft XML Core Services (MSXML) 6.x: (06/18/2011)
http://secunia.com/advisories/product/6473/
For years here I have been hearing "Windows is a security nightmare full of security holes, (insert *NIX variant here) is not"
LMAO! Total b.s. & what's below will disprove THAT, with ease (and facts from a reputable source).
Apple also went around saying the same, even on T.V. in their ads (implying/inferring it, & MORE) as well.
So, what's "MacDefender" then for they also??
Hmmm??
* What a CROCK OF SHIT!
Still, in regards to that? Well, ok - let's take a peek @ the # of unpatched security vulnerabilities on not ONLY Windows 7, but nearly the ENTIRE GAMUT/ARRAY of what Microsoft gives us to do development & business with online, vs. THE LINUX LATEST-GREATEST KERNEL ONLY then, shall we?
This data's ALL from a respected source for known security vulnerabilities unpatched:
---
Vulnerability Report: Microsoft SQL Server 2008: (06/18/2011)
http://secunia.com/advisories/product/21744/
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft Internet Information Services (IIS) 7.x: (06/18/2011)
http://secunia.com/advisories/product/17543/
Unpatched 0% (0 of 6 Secunia advisories)
Vulnerability Report: Microsoft Exchange Server 2010: (06/18/2011)
http://secunia.com/advisories/product/28234/
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft SharePoint Server 2010: (06/18/2011)
http://secunia.com/advisories/product/29809/
Unpatched 0% (0 of 0 Secunia advisories)
Vulnerability Report: Microsoft Forefront Endpoint Protection 2010: (06/18/2011)
http://secunia.com/advisories/product/34343/
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft Office 2010: (06/18/2011)
http://secunia.com/advisories/product/30529/?task=advisories
Unpatched 0% (0 of 7 Secunia advisories)
Vulnerability Report: Microsoft Virtual PC 2007: (06/18/2011)
http://secunia.com/advisories/product/14315/
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft Internet Explorer 9.x: (06/18/2011)
http://secunia.com/advisories/product/34591/
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft Visual Studio 2010: (06/18/2011)
http://secunia.com/advisories/product/30853/?task=advisories
Unpatched 0% (0 of 2 Secunia advisories)
Vulnerability Report: Microsoft DirectX 10.x:
(06/18/2011)
http://secunia.com/advisories/product/16896/
Unpatched 0% (0 of 3 Secunia advisories)
Vulnerability Report: Microsoft .NET Framework 4.x
(06/18/2011)
http://secunia.com/advisories/product/29592/
Unpatched 0% (0 of 5 Secunia advisories)
Vulnerability Report: Microsoft Silverlight 4.x: (06/18/2011)
http://secunia.com/advisories/product/28947/
Unpatched 0% (0 of 0 Secunia advisories)
Vulnerability Report: Microsoft XML Core Services (MSXML) 6.x: (06/18/2011)
http://secunia.com/advisories/product/6473/
For years here I have been hearing "Windows is a security nightmare full of security holes, (insert *NIX variant here) is not"
LMAO! Total b.s. & what's below will disprove THAT, with ease (and facts from a reputable source).
Apple also went around saying the same, even on T.V. in their ads (implying/inferring it, & MORE) as well.
So, what's "MacDefender" then for they also??
Hmmm??
* What a CROCK OF SHIT!
Still, in regards to that? Well, ok - let's take a peek @ the # of unpatched security vulnerabilities on not ONLY Windows 7, but nearly the ENTIRE GAMUT/ARRAY of what Microsoft gives us to do development & business with online, vs. THE LINUX LATEST-GREATEST KERNEL ONLY then, shall we?
This data's ALL from a respected source for known security vulnerabilities unpatched:
---
Vulnerability Report: Microsoft SQL Server 2008: (06/18/2011)
http://secunia.com/advisories/product/21744/
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft Internet Information Services (IIS) 7.x: (06/18/2011)
http://secunia.com/advisories/product/17543/
Unpatched 0% (0 of 6 Secunia advisories)
Vulnerability Report: Microsoft Exchange Server 2010: (06/18/2011)
http://secunia.com/advisories/product/28234/
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft SharePoint Server 2010: (06/18/2011)
http://secunia.com/advisories/product/29809/
Unpatched 0% (0 of 0 Secunia advisories)
Vulnerability Report: Microsoft Forefront Endpoint Protection 2010: (06/18/2011)
http://secunia.com/advisories/product/34343/
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft Office 2010: (06/18/2011)
http://secunia.com/advisories/product/30529/?task=advisories
Unpatched 0% (0 of 7 Secunia advisories)
Vulnerability Report: Microsoft Virtual PC 2007: (06/18/2011)
http://secunia.com/advisories/product/14315/
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft Internet Explorer 9.x: (06/18/2011)
http://secunia.com/advisories/product/34591/
Unpatched 0% (0 of 1 Secunia advisories)
Vulnerability Report: Microsoft Visual Studio 2010: (06/18/2011)
http://secunia.com/advisories/product/30853/?task=advisories
Unpatched 0% (0 of 2 Secunia advisories)
Vulnerability Report: Microsoft DirectX 10.x:
(06/18/2011)
http://secunia.com/advisories/product/16896/
Unpatched 0% (0 of 3 Secunia advisories)
Vulnerability Report: Microsoft .NET Framework 4.x
(06/18/2011)
http://secunia.com/advisories/product/29592/
Unpatched 0% (0 of 5 Secunia advisories)
Vulnerability Report: Microsoft Silverlight 4.x: (06/18/2011)
http://secunia.com/advisories/product/28947/
Unpatched 0% (0 of 0 Secunia advisories)
Vulnerability Report: Microsoft XML Core Services (MSXML) 6.x: (06/18/2011)
http://secunia.com/advisories/product/6473/
And in order to compromise the operating system with Flash or HTML5 Canvas, you have to find a buggy 2D driver. All I get out of this article is that 2D drivers are more mature than 3D drivers.
Indeed.
The 2D APIs are less complex, they have a smaller attack surface, and you don't get direct access to the OS's 2D API from the browser (thinly wrapped access to Windows GDI would be almost as bad an idea as thinly wrapped access to OpenGL).
Coffee-driven development.
I fail to see the difference between this and using some client-side application, other than the fact that WebGL is a cross-platform spec.
Drive-by exploits.
Coffee-driven development.
thinly wrapped access to Windows GDI would be almost as bad an idea as thinly wrapped access to OpenGL
The "ANGLE" library in Firefox and Chrome for Windows translates OpenGL calls into Direct3D 9 calls. How is this "thinly wrapped"? If not, then one workaround on platforms other than Windows might involve running ANGLE on top of Wine's implementation of Direct3D.
But the sandbox isn't very effective, which is my point.
There are two types of people in the world: Those who crave closure
Company names are plural in British English, singular in American English. I would say "Microsoft are doing ...", an American would say "Microsoft is doing..."
Actually, company names are plural in British English, singular in American English. I would say "Microsoft are doing ...", an American would say "Microsoft is doing..." Without knowing his nationality, you can't say he's wrong.
Every of them are ok in French English.
Uhm.