WebGL is a way to call OpenGL calls from a web page.

Silverlight  is a high level language that indirectly calls the host system.  on Windows it calls DirectX

*BUT*  the Silverlight app  does not make *DIRECT* calls to DirectX

so while Silverlight can create graphics it is not the same.

Honestly IMHO  if you need to do a lot of animated graphics should it be a web page ?

if for example it's a game I would rather have a native app that runs w/o a browser in the middle.

that's just one example.

*shivers*

1. Silverlight is a plugin, which means that to all intents and purposes it's a native code executable. There is no point trying to prevent native code executables from calling native code, it just can't be done. Any security flaw in a native executable, be it Silverlight, Flash, Acrobat or any .exe is as risky as any other. This is why modern browsers allow you not to load executable code from iffy websites or, better yet, ban it entirely. By contrast, WebGL would be right inside HTML, there is no opt-in choice. Any power you grant to WebGL is granted to the entire web.
2. WebGL doesn't solve real web problems, it's about graphics card manufacturers wanting to be able to sell high-end hardware to people who just want to surf the web. This is why blindingly obvious functionality like being able to put arbitrary HTML content on 3D surfaces is entirely ignored, because getting that working and usable is far harder than just exposing a stripped down portion of OpenGL.
3. The spec itself contains security issues. Not purely implementation ones due to bugs, but fundamental security design problems, which are far harder (maybe even impossible) to resolve down the line. When pointed out to the Khronos group, the "fix" was to add more functionality to OpenGL instead to try and mitigate them (it didn't BTW). That's like discovering a design flaw in DirectX and suggesting you can fix it by changing GDI. It's just stupid.

For far more involved discussion, see the six and a half billion other threads on why WebGL is a mess.

1 hour ago, IDWMaster wrote

For a company claiming to support HTML5 and use it to innovate the web, it is not a good idea to pick and choose only a small subset of HTML5 features.

For the umpteenth time: Kronos is not the W3C; the fact that they self proclaimed WebGL a "web standard" doesn't make it part of HTML5. Thank the universe for it.

3 hours ago, AndyC wrote

1. Silverlight is a plugin, which means that to all intents and purposes it's a native code executable. There is no point trying to prevent native code executables from calling native code, it just can't be done.

Silverlight is a plugin, and IE makes no attempt to secure it as you rightly point out. On the other hand, Silverlight webapps are not native programs. They are sandboxed by Silverlight in much the same way that Javascript is sandboxed by IE. That's not to say that bugs in the sandbox don't prevent websites from getting native code execution - after all, that's what an exploit is, but let's be clear that Silverlight really should be trying to prevent web sites from calling native code, because I really don't like the idea of a website asking Windows to write a file to disk and CreateProcess it.

5 hours ago, figuerres wrote

if for example it's a game I would rather have a native app that runs w/o a browser in the middle.

++. For one the game would be able to spend it's time loading content and drawing graphics for me using it's highly optimised C code for me to play with rather than spending time constantly jitting javascript into poorly optimised assembly code with every index into every array getting checked, no types to help the compiler out and the bulk of having a full web-browser bolted on to what I actually just want to be an internet connected game in an executable.

Microsoft is a company that still relies on "proprietary standards" to make their own platforms more appealing. Consider that even a lot of Linux fans run dual boot so they can play games.

2 minutes ago, Bass wrote

I think they probably think WebGL will give OpenGL some legitimacy they don't want it to have. Because if more people use OpenGL, that's less reason to use Windows because OpenGL runs everywhere.

It's because it's a not a standard - it's a shim between javascript and OpenGL. It's like me deciding to introduce pinvokes into javascript, calling it WebPinvoke and trying to force vendors to support it.

It's a Khronos Group-backed standard, which is a member-funded standards consortium that represents a wide swath of the technology industry. Microsoft remains the only major web browser vendor that is not onboard with WebGL development or implementation.

10 minutes ago, Bass wrote

@evildictaitor:

It's a Khronos Group-backed standard, which is a member-funded standards consortium that represents a wide swath of the technology industry. Microsoft remains the only major web browser vendor that is not onboard with WebGL development or implementation.

That's because it's not a standard. It's a shim to OpenGL. Microsoft would probably back it they did a proper security job like they did with the <video> tag in HTML5 - by seriously locking down the number of codecs that are available and saying speed is important when playing a video, so let's not use javascript to draw everything and have direct lines of communication between websites and the graphics driver.

If there were some hypothetical 3D for web (let's call it Web3D) that was built from the ground up with security in mind, was all sandboxed, and was written in such a way that you could do stuff fast and securely, then maybe Microsoft would get on board.

But as it is, it's just bolting OpenGL to the side of a browser and then hoping that the guys that wrote OpenGL and the guys that wrote the graphics drivers that have to run the geometry and shader pipelines built it securely enough to cope with russian malware domains throwing dodgy bytes at them.

I wonder where all these Microsoft security people were when Silverlight 5 was released with shader support.

You can disable/uninstall Silverlight and you have to install it when a website uses it. WebGL is just there, opening a nice comfortable path for anyone wanting to inject code on your system. Can you see the difference?

Besides, it's not a standard.

9 minutes ago, PaoloM wrote

@Bass:Probably doing a much better job at understanding the issue.

You can disable/uninstall Silverlight and you have to install it when a website uses it. WebGL is just there, opening a nice comfortable path for anyone wanting to inject code on your system. Can you see the difference?

I don't really see the difference, especially considering by Microsoft's own estimates 60% have Silverlight installed. Flash supports accelerated 3D with shaders, and really how many people don't have Flash installed? If it was a major security problem it would have manifested itself by now.

Besides, it's not a standard.

It's not just a standard, it's a web standard. Go ahead and and try to convince all the browser makers outside of Redmond as well as the Khronos Group otherwise.

Sadly though, I do have WebGL because Google Chrome installed it without asking me, I have no intention of ever using it, and it makes my entire system much more vulnerable to russian exploit sites - and hence makes me much more likely to lose my credit card details.

At least if I lost my credit card details to Silverlight I'd have actually chosen to install it.

24 minutes ago, Bass wrote

If it was a major security problem it would have manifested itself by now.

You mean like this one: http://www.kitguru.net/software/security-software/carl/webgl-exploit-opening-browser-users-to-serious-attacks/

https://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/sdk/tests/extra/lots-of-polys-example.html

Or you can just run NoScript. Blocks Flash, all JavaScript (JavaScript itself is a liability), Java, Silverlight, and more! With a whitelist of course for sites you trust.

1 minute ago, Bass wrote

@evildictaitor:

Or you can just run NoScript. Blocks Flash, all JavaScript (JavaScript itself is a liability), Java, Silverlight, and more! With a whitelist of course for sites you trust.

That's backwards. Why should I have to install a plugin to remove a feature that I never wanted from my browser and which reduces my security, instead of having to install it when I want to view a site running WebGL?

And JavaScript's data acquisition model itself is full of unfixable vulnerabilities even today. Forget about XSS? Guess what still a problem! It can be used for identity theft not just DoS attacks.Basically, people who truly care about their cyber security use a JS whitelist.

4 minutes ago, Bass wrote

Because all the things I mentioned are insecure. Hell, I actually somehow got rootkit'ed from a Java applet exploit once. Yes, really. Rootkit. From visiting a website as a non-admin. No f**king idea how that worked, to be honest.

And JavaScript's data acquisition model itself is full of unfixable vulnerabilities even today. Forget about XSS? Guess what still a problem! It can be used for identity theft not just DoS attacks.Basically, people who truly care about their cyber security use a JS whitelist.

What you're really saying to me is that Microsoft should somehow block Java applets from the Internet zone as well. I should really go and mention that to some of the IE guys and see what they say. Maybe they can shim it into Metro or something. That would be good.

Also XSS doesn't install rootkits. If the server pushes down some script for you to run because the server is broken, well that's the fault of the server, not the fault of IE. That's not an exploit from the point of view of IE.

Oh, and also you chose to install Java, because it's a plugin - hence you at least got to choose to make your browser insecure. Everyone using Google Chrome didn't choose to install WebGL, because it's not a plugin. I have absolutely no problem with WebGL being deployed as a plugin. I have a problem with my browser letting russian malware sites talk to my insecure graphics drivers by default and without asking.

But we must balance security with functionality (you can't truly have both). As long as computers can do things, they can do malicious things. They can't easily tell the difference between them.

Everything new is going to have untested security problems, that does NOT mean we shouldn't ever do anything new.

9 minutes ago, Bass wrote

XSS can steal your identity. 

Only if I give my identity to a website that is vulnerable to XSS. That's like saying people can steal my credit card details by hacking into my bank. That's not a problem with my security - it's a problem with theirs.

If someone wants to break into a server that I use, good luck to them. But when they try and break into my machine to steal my documents and credit cards, that's when I get angry that applications like Google Chrome are putting my security at risk.

11 minutes ago, Bass wrote

And there is nothing magical about how JS engines are written today that would prevent this.

At least javascript was built with security in mind, bugs in javascript are actively patched by browser vendors, and in the event that they are exploited, they only get execution in low-integrity.

WebGL on the other hand allows attacks on bits of my system that were never built with security in mind, are almost never prompty patched for security holes, and in the event that they are exploited they are already running as kernel and hence can load arbitrary drivers on my system without having to break out of a sandbox.

I'm all for balancing security with functionality. I just don't think wizzy graphics in my browser are worth the ring-zero exploits that I have to pay to get them.

9 minutes ago, Bass wrote

Oh and you choose to install Chrome.

When I installed Chrome WebGL hadn't been invented yet. WebGL silently appeared in Chrome without ever asking me.

And if WebGL is unturnoffable and installed by default in Chrome, IE and Firefix as you so dearly want, then there will be no choice but for me to give up on my vain hope of having some control of what ring0 code lives in my system whenever I dare to fire up a browser.

Well it could be prevented if you just disable JS. XSS needs JS to work, you know.

2 minutes ago, evildictaitor wrote

*snip*

At least javascript was built with security in mind

JavaScript was built by a guy in a week to make a language that "looks like Java". True story. There wasn't much thought into producing it at all, anything on top of JavaScript has always been a series of hacks to get around limitations in the language. It's not your security teams favourite language, that's for sure.

45 seconds ago, Bass wrote

@evildictaitor:

Well it could be prevented if you just disable JS. XSS needs JS to work, you know.

It also needs you to put your identity into the webpage for it to steal it. A ring-zero exploit in WebGL needs no such user-interaction. It can just install a driver and steal all of your keystrokes and files directly to the russian hackers that installed it.

31 seconds ago, Bass wrote

@evildictaitor:

*snip*

JavaScript was built by a guy in a week to make a language that "looks like Java". True story. There wasn't much thought into producing it at all, anything on top of JavaScript has always been a series of hacks to get around limitations in the language.

Microsoft's implementation of Javascript wasn't. And neither was Google Chrome's or Firefoxes. Just because the syntax was bad, doesn't mean the implementation was.

Unfortunately WebGL, no matter how good the implementation, is still all about shoving attacker controlled data directly up to your ring-zero drivers that are not built by the security teams of Microsoft, Google and Mozilla who understand the risks of russian malware sites. They are built by the graphics teams of Intel, NVidia and ATI who care rather more about how many polygons they can draw per frame, because that's how you sell GPUs.

You still have to take a lot of the problems with JavaScript with you if you build a compatible runtime.

1 hour ago, Bass wrote

It's not just a standard, it's a web standard.

Now you're just making s*it up. What the hell is a "web standard"?

It's either supported by a standards organization or it's not. And no, the Kronos Group or even the w3c are NOT standards organizations. For that look at ISO, ECMA, DIN, etc... everything else is just boys playing with sticks.

Read the website I linked to, it's specifically advertised as a "web standard" and is underwritten by pretty much all the browser makers in that manner.

If you want to pop off on me about that, go right ahead. I don't care. The fact is WebGL is advertised as a web standard, and that's what I am going to call it.

6 hours ago, evildictaitor wrote

*snip*

Silverlight is a plugin, and IE makes no attempt to secure it as you rightly point out. On the other hand, Silverlight webapps are not native programs. They are sandboxed by Silverlight in much the same way that Javascript is sandboxed by IE.

Well more like Flash code should be sandboxed by the Flash runtime, it's a slightly different thing (which is not to say Silverlight shouldn't sandbox things). The minute you click "Yes, I want to let this ActiveX control run on this page", you might as well be clicking a "Yes I want to download and run this .exe file". And that's what seperates plugins, with all their flaws, from things like WebGL which are basically baked right into HTML.

If you want to pop off on me about that, go right ahead. I don't care. The fact is WebGL is advertised as a web standard, and that's what I am going to call it.

Thankfully the rest of the world doesn't follow such a dumb principle. Otherwise Flash would be advertised as "a web standard" and so would ActiveX, PDF, Quicktime, Angry Birds.... ad inifinitum

Something doesn't get to be a standard just because the group who thought it up decide to declare it one.

4 hours ago, evildictaitor wrote

Or this one, which still crashes my NVidia graphics drivers (part of which run in ring0, and hence Chrome's sandbox it just window dressing).

https://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/sdk/tests/extra/lots-of-polys-example.html

Whoa! That certainly shows a problem with BOTH Google Chrome's and NVidia's implementations!  It's really annoying that a website can cause a computer to freeze like that. Google Chrome should work with NVIdia to fix that bug! However, the vulnerability isn't indicative of a flaw in WebGL or OpenGL itself, but instead indicates a crucial vulnerability in the implementation of the specification. 

3 hours ago, evildictaitor wrote

*snip*

It also needs you to put your identity into the webpage for it to steal it. A ring-zero exploit in WebGL needs no such user-interaction. It can just install a driver and steal all of your keystrokes and files directly to the russian hackers that installed it.

WebGL can easily be disabled from a command line option passed into most WebGL compliant browsers. Also; who says that WebGL HAS to run whenever a page requests it? Couldn't browsers make it so the user is required to OK the use of WebGL before it runs on the system? There's nothing that says that a browser can't do this.

10 minutes ago, IDWMaster wrote

Another thing I would like to point out is that if Microsoft completely kills the desktop, users will then be stuck with Internet Explorer as the only browser, and will not be able to choose any other browser (Metro doesn't support runtime compilation of code, so there will be no way to make a reasonably performant browser for it).

Umm how does that conclusion work, especially as Firefox is building a Metro browser

webgl considered harmful

The key point of the blog post: Silverlight and your web browser were hardened against attacks because they were designed to run in a hostile environment.  The graphics driver for your display adapter wasn't.

3 hours ago, IDWMaster wrote

WebGL can easily be disabled from a command line option passed into most WebGL compliant browsers. Also; who says that WebGL HAS to run whenever a page requests it? Couldn't browsers make it so the user is required to OK the use of WebGL before it runs on the system? There's nothing that says that a browser can't do this.

A prompt doesn't help - the prompt would be "Do you want to see the 3d dancing bunnies?"  And there is only one reasonable answer to that prompt: Yes.  Because the user ALWAYS wants to see the dancing bunnies.

6 hours ago, Bass wrote

@PaoloM:

If you want to pop off on me about that, go right ahead. I don't care. The fact is WebGL is advertised as a web standard, and that's what I am going to call it.

 

I personally like the IETF definitions. There are two kinds of standards: Informational ones and standards track ones.  The informational standards are invariably proprietary protocols where the owner of the protocol wants to document the protocol.  The standards track protocols are created by doing the work of gaining consensus on the design and implementation of a protocol.  

Do the WebGL folks allow people to contribute to their standard?

And a dedicated ActiveX 3D game engine is actually way more safer than WebGL. Normally a 3D game engine would only take harmless data such as texture and mesh. Not something that you feed into WebGL that could potentially freeze your PC.

Again, if you want to use WebGL, use other browsers. And when it crashed your PC while rendering a 3D looking advertisement, remember to use IE9 or use command prompt to disable WebGL.

6 hours ago, IDWMaster wrote

*snip*

Whoa! That certainly shows a problem with BOTH Google Chrome's and NVidia's implementations!  It's really annoying that a website can cause a computer to freeze like that. Google Chrome should work with NVIdia to fix that bug! However, the vulnerability isn't indicative of a flaw in WebGL or OpenGL itself, but instead indicates a crucial vulnerability in the implementation of the specification. 

The implementation is correct according to the WebGL spec. The "fix" is that graphics card manufacturers have to identify the situation when data is passed to the OpenGL layer and reset the graphics card if it's going to lock up.

And that is a long way from being the worst example, browser independent data-theft has been demonstrated on numerous occasions simply because the spec almost entirely ignores the possibility that it might be misused and the onus for any issue just gets the "oh, well OpenGL drivers will have to be fixed to stop that" response. Quite how that's supposed to help any implementation not running on OpenGL seems lost on them.

*snip*

WebGL can easily be disabled from a command line option passed into most WebGL compliant browsers. Also; who says that WebGL HAS to run whenever a page requests it? Couldn't browsers make it so the user is required to OK the use of WebGL before it runs on the system? There's nothing that says that a browser can't do this.

Imagine, just for one second, what your browsing experience would be like if that becomes the answer to difficult questions:

This page uses image tags - Allow/Deny
This page uses video tags - Allow/Deny
This page uses downloadable fonts - Allow/Deny
This page uses bold text - Allow/Deny
This page uses Javascript that modifies the page - Allow/Deny
This page uses Javascript that contacts a server - Allow/Deny

....

some time later and several hundred prompts later, you finally get to see the page. Alas it didn't have the information you want so now you're going to have to repeat the whole process to look at another page. And that's leaving aside the issue Larry mentions, that users don't care what the prompt says they just click through to get to the thing they wanted to see in the first place, whilst cursing the browser for being stupid.

10 hours ago, IDWMaster wrote

It's really annoying that a website can cause a computer to freeze like that.

That's not your computer freezing. That's your graphics card driver crashing. It's also not a bug in WebGL. It's a bug in your drivers. WebGL as Bass keeps reminding us is well written. NVidia and Intel drivers as I keep reminding him are not.

That particular bug is a DoS, so it can't be used to steal data from your machine, but other bugs are not a denial of service and will allow a malicious website to take control of your system - and it comes completely free with a jump out of the browser's sandbox, because the crash isn't in your browser. It's in your graphics driver.

16 hours ago, Larry Osterman wrote

*snip*

I personally like the IETF definitions. There are two kinds of standards: Informational ones and standards track ones.  The informational standards are invariably proprietary protocols where the owner of the protocol wants to document the protocol.  The standards track protocols are created by doing the work of gaining consensus on the design and implementation of a protocol.  

Do the WebGL folks allow people to contribute to their standard?

Larry,

This is not a small unknown consortium.

This is just a few of the companies that drive the Khronos Group:

Apple, Google, ARM, Epic Games, Freescale, Imagination Graphics, Intel, Nokia, Oracle, Sony, Ericsson, Nvidia, AMD, Samsung, Qualcomm, Texas Instruments, Adobe, Mozilla, NEC, Opera, Toshiba, Accenture, Creative Labs, Electronic Arts, Fujitsu, HTC, IBM, Motorola, Panasonic, Broadcom, Yamaha.

The Khronos Group is the defacto standards body for computer graphics, just like the IETF is for the Internet.

Conspicuously missing from Khronos membership is Microsoft of course. But it's basically everyone minus Microsoft. So my question would be why is Microsoft not interested in working with the rest of the technology industry in advancing the state of computer graphics?

Well, MS could easily join the group and still contribute nothing. They should have done that to avoid debates.

This is beyond ridiculous, to the point where now one can click "Add bookmark to web browser start page" and declare themselves an "app developer" because they created a bookmark to yahoo.com and have a nice big icon for it when their browser starts, and clicking on the bookmark opens it full screen. "ooohh..an app"

I certainly don't need web pages setting bits in ring 0 code. WTF I swear the entire Internet has gone stupid. Well, I guess that goes without saying.