Microsoft Brands WebGL a 'Harmful' Technology

An anonymous reader writes "Microsoft has announced that it has no plans to support WebGL — a cross-platform low-level 3D graphics API designed for web use — in its future browsers, citing numerous security concerns over the technology and branding the basic principles as 'harmful.'"

Microsoft should know...

[Bill_the_Engineer]

a dangerous web idea when they see one. They created ActiveX.

Re:Games on Linux means the end of the MS Empire

[schnikies79]

The business world keeps Microsoft in power, not gamers.

Hate to Say This...

[mrpacmanjel]

The security issue is a valid question.

In one of the links in the summary it shows that the video memory can be read and get a snapshot of the user's desktop (in the example a confidential document is viewable) - exceptionally bad. Use an exploit like this with something else means their is potential for a severe security breach.

Then again it's early stages and I'm sure the security issues will be resolved in time.

It's an exciting techology especially with regard to streaming games over the internet.

Who remembers VRML???

It is true. It is harmful.

[140Mandak262Jamuna]

The question is what is harmed. In this it looks like it is harmful to Microsoft's market share and profits.

WebGL bugs already demonstrated

[lseltzer]

Context Information Security has already tested WebGL implementations and demonstrated the sorts of bugs Microsoft warns about [pcmag.com]. In fact, it looks like maybe they got a tip about it from Redmond, but they do demonstrate it, and Mozilla has acknowledged the bugs for Firefox 4 [mozilla.com].

Re:Microsoft should get out of browsers ASAP

[nschubach]

Windows doesn't come pre-loaded with wget yet (as far as I'm aware) so it's a little more difficult:

(Start / Run:)
cmd
ftp releases.mozilla.org
(User: anonymous)
(Pass: [e-mail])
cd /pub/mozilla.org/firefox/releases/latest/win32/en-US/
binary
mget *.exe
(answer yes)
quit
dir Firefox*
(Run listed program)

Pretty sure I didn't miss anything...

Re:WEBGL makes the drivers more visible.

[TheRaven64]

You seem to have no idea of how a modern graphics stack works. Canvas drawing is mediated by the browser. You do something like lineTo() from JavaScript. The JavaScript code then translates this into a call to a host OS API call. The call comes from the browser and its arguments are checked by the browser for sanity, then they're checked by the graphics stack, then they're checked by the driver. In contrast, WebGL takes a blob of GLSL code and a blob of data and passes it straight to the driver. The browser can try checking this, but it doesn't really know what to look for. The drivers then compile this C-like code, using a compiler that wasn't designed for security. Then they chuck it over the bus and the card (which may have DMA access to all of system memory) runs it. Comparing the two is like comparing a telephone with someone dictating messages and a fax machine: you're only likely to be goatse'd by one...