Chrome dev on WebGL security and Microsoft bullshit
games.greggman.com
games.greggman.com
The guy himself gives examples in which they have to work around known bugs which exploit vulnerabilities with formally valid inputs. But what about the unknown bugs? Those are the ones that will get us, no?
Now, I don't know if Flash 11 or Silverlight are just as bad. Maybe they are (although I see claims in this thread that this is not so for Silverlight). But this is not a good reason to support a hugely insecure technology. It's a reason to fear these other technologies as well.
I am not a web developer; I just live in their world. And it's clear that we'll get WebGL and a bunch of other things like it anyhow, since there is tremendous pressure to make web apps more like local apps.
Here are some well-known things about graphics drivers - I do have some knowledge in this domain, but honestly, these are things that anyone can find out himself:
-- They've become quite complex. With the rise of GPGPU, the graphics driver now includes a C compiler, a virtual machine (or several specialized virtual machines), debug hooks, and tons of other code.
-- The driver development teams are not focused on security. Their API is meant to be used by a local application, and if you're running an executable, especially one that can talk to the driver for your screen, the executable can already do whatever it wants.
-- There has not been any sort of a scramble among video driver teams to prepare for WebGL. It's not in the job description of their product to provide a sandbox for malicious code. The graphics driver is not a JVM. And I am very unconvinced by the proposed measures for WebGL security in the browser, which include such things as blacklisting a driver once a vuln is reported. What about before it's reported?
-- If you're using virtualization for security, I seriously recommend not using the "accelerated 3D" option. I don't know of published exploits, and the virtualization does make it somewhat difficult for a malware writer, but you are NOT getting any sort of a hardware-enforced guarantee the moment you enable the passing of commands to GPU. Now, VMWare (and others) are very aware of security issues, and are working on GPU virtualization with that in mind. But it's still not the same guarantee.
My bottom line is that I would seriously prefer for WebGL not to become popular, until a serious standard for sandboxed virtual GPUs is worked out. But it seems some people just can't wait.
It's that this article is from a Google employee, and so you're going to get the Google defenders coming out of the woodwork.
Also, if Silverlight is susceptible to the same vulnerabilities, then that makes MS hypocritical, not wrong! And comparisons with Java and Flash getting hardware shaders is beside the point - MS doesn't have control over which features those products choose to include or not, they only have control over IE and Silverlight.
I hope a reasonable scenario develops where IE does get WebGL, perhaps a whitelist of drivers that adhere to higher degrees of security for use with WebGL.
The point is, Microsoft will have to do that exact same things to secure 3D in Silverlight 5. Why not use that work for WebGL in IE10?
The author also point it out that microsoft is in one of the best position to help secure WebGL by putting pressure on Driver vendors and using their knowldege of the OS. In fact Gregg in the post talks about the reset ability in windows which lets browser reset GPU when they see browser operation blocking them for too long. This is a feature that he claims is only well supported on Windows. And that Microsoft could work with GPU vendors to make that even better on Windows.
I always wondered about those IDC and Gartner predictions that WP7 will become #2 mobile OS by 2015, when it can't even get past 2% right now and its growth is slowing down. How did they get those numbers all of the sudden, when they couldn't even predict half of Android's growth when Android was actually growing fast. So that seemed very fishy to me at the time.
If Microsoft is paying companies to do this kind of "publicity" that favors them, then I wouldn't be surprised if they are behind those so called predictions either.
And I am sure that the ContextIS report is accurate and that WebGL represents a security risk, but TFA is also right - if WebGL is a security risk, than so are Silverlight 5 and Flash and Java applets, which are and will be everywhere anyway.
But because WebGL will get multiple competing implementations and everything is in public review, I'm also sure that it will be just better than the various other browser plugins that allow access to the GPU. The only problem with this picture would be IExplorer, since it has such awful upgrade cycles, that's why I'm kind of hoping they won't implement WebGL instead of coming up with something half-baked that ruins the experience for everybody.
I also couldn't care less about Gartner and IDC predictions: they never predicted anything worthwhile anyway. But WP7 will be popular. Maybe less than both Android and iOS, but popular nonetheless.
That's not exactly true. I never saw a Microsoft press release clearly stating they funded a report they are referring to. They usually read like "$firm has published a study showing $product destined to dominate" or something like it.
Here is an entertaining flame about the analysts:
I find it amusing that even John Carmack (strong OGL supporter) agrees with MS on this one yet it is some random Google employee who gets his word spread. This author knows FUD very well, I give him that. He's proficient in spreading it.
I am not amazingly familiar with windows development, but "The core of the XNA Games Studio 4.0 graphics libraries is now included in Silverlight 5 Beta and is used to create 3D graphics. ", doesnt seem like a large assumption
> "John Carmack (strong OGL supporter) agrees with MS on this one yet it is some random Google employee who gets his word spread"
I have a feeling the chrome developers have a better idea about how to sandbox a browser than John Carmack does, as awesome as he is, this is just arguing to authority when there is a long list of points that OP made that havent been refuted.
In fairness, we have no idea of the extend of the authors expertise, I would bet John Carmack as an insanely intimate knowledge of drivers and their issues.
We should just discuss the points made, not who is making them.
Also, I've followed Carmack's exploits for something like twenty years. In my humble opinion, when he speaks of anything OpenGL I would suggest you listen to what he has to say.
If you dont understand a subject enough to be able to debate on the points that are being made rather than who is making them you should not be debating it
I just dont think its good practice to disregard someones opinion just because someone you have heard of disagrees with them
It is for the reason I've mentioned before: XNA abstracts out pretty much everything. With XNA you're not programming to the metal anymore, which is unfortunately true with WebGL. The greatest concern seems to be with the way OGL handles various buffers. For example in WebGL it is possible to create bufferData stating that it's of size X and provide Y values with Y much smaller than X. What you get is a buffer full of stale data from the memory. Bad idea.
Also there's much less "stuff" you can break in XNA with lower profile levels (feature sets) which are suitable for the web. E.g. you can't write shaders for the mobile devices today for both security and perf reasons. You get a preset amount of them and that's it. Yes, it's limiting, but you can't choke GPU to death and you can't submit shader payload that's known to crash given driver.
It's all about false equivalence that author makes in his blog entry. Problems exist with pretty much every piece of advanced software. But you can add small attack vector, or a large one. They are not equal and making it seem otherwise is bogus.
JS is amazing and I love 2D canvas. But WebGL is trying to put low-level stuff in the high-level code. It's awesome in terms of performance, but is inherently fragile and may be abused easily. It seems that it's not sensible programmers MS is afraid of but malicious attackers. And it's very unlikely that WebGL won't be happily abused.
As for Carmack, he stated at various occasions that he's closely following web graphics. He's also more than knowledgeable about the issues with drivers, how they can be hit even accidentally and how (un)likely it is for hardware vendor to fix them timely.
Also aside from the security, drawing from my experience, it is extremely difficult to make semi-advanced graphics code perform well and look acceptably similar on different GPUs. This is something APIs exposed in the high-level languages (which JS I think undeniably is) should hide from the developer, not dump on him. The fact that there are two different 3D canvas contexts - webgl and experimental-webgl - doesn't really help.
Please at least check these things before asserting them. Assuming good will, I can see how it might be easy to assume that some things that are true in desktop opengl will be true in webgl, but both the linked blog post and the webgl spec explicitly state that all buffers are initialized upon creation, and all access calls are bounds checked. Tests of this are also part of the webgl conformance suite.
If you want to see where it is specified, see here: http://www.khronos.org/registry/webgl/specs/latest/#4.1
I have not followed silverlight development for some time, but looking at their documentation, they are using shaders written in HLSL under shader model 2.0. This is roughly equivalent to GLSL ES, which is what WebGL uses. As for the graphics functionality subset for mobile: that is exactly what OpenGL ES 2 was written for (with and by the mobile hardware vendors themselves). Hence the limitations on looping, dynamic indexing, etc.
Carmack is probably more familiar with hardware drivers and 3D APIs than anyone working on Chrome. Plenty of the points made have been refuted in the discussion here.
That's not exactly true. OpenGL support was introduced with Windows NT, IIRC. At that time, Microsoft found OpenGL support critical for NT to compete with the unix workstation segment.
They later started emphasizing Direct3D as the preferred way to do 3D, possibly because supporting OpenGL would make porting 3D-heavy games to other platforms easier.
Working at a low level with OpenGL is really painful, and there are no Direct3D-quality libraries on top of it to blunt that pain.
* A total lack of typing. Everything is a GLuint. By the time I've bodged together sufficient type safety to be comfortable, it looks like DirectX.
* Extensions suck. Abjectly suck. While Direct3D has its problems, it does a pretty good job of saying "you must support these things". OpenGL attempts to vaguely say the same thing, but the difference is that Direct3D enforces support of things I want to use. It seems that you end up with many more code paths for OpenGL if you want to properly handle a lot of stuff.
* Difficult to query about GLSL problems, if possible at all. (An older example that's stuck with me is the noise() function, which nobody implemented the last time I dealt with this stuff. They returned a constant. Detecting this failure mode was nontrivial.)
* Tooling. As usual, Microsoft is way ahead in this area.
A project of mine uses OpenGL instead of D3D, but that's primarily because I'm not the graphics guy on that project. My own stuff just uses XNA, as it's 2D stuff I want to deploy to the 360.
This isn't really material to the discussion at hand, though.
>They later started emphasizing Direct3D as the preferred way to do 3D, possibly because supporting OpenGL would make porting 3D-heavy games to other platforms easier.
With the side effect that the standard moved much faster unlike OpenGL that got stuck in the 'design-by-committee' hole, not to mention a much cleaner API with way better dev tools and features.
He's got me sold.
* DOS vulnerability in Silverlight 5s 3D (similar to WebGL DOS vulnerability) http://news.ycombinator.com/item?id=2680001
* Microsoft architect Avi Bar-Zeev: "Why Microsoft and Internet Explorer need WebGL (and vice-versa)" http://news.ycombinator.com/item?id=2667332
"I work at Google on Chrome ... I was on Microsoft’s side in the Java lawsuit, the Internet Explorer lawsuit and several others."
I would expect Google to get a demand notice from Oracle to make the poster available for deposition in their suit :-)
Secondly, this bit:
"So imagine my disappointment when I start seeing the FUD from Microsoft about IE9 vs other browsers. Cherry picking benchmarks, cherry picking conformance tests and generally basically lying."
This has been a standard of tech marketing in some circles for so long, its astonishing that you are just now seeing it. From HP claiming memorex disk media would cause disk head erosion (these were flying heads) and invalidate your warranty, to Oracle lying about DB2 performance or the configurations, or storage vendors benchmarking on systems where they used thousands of disk drives so that none of them actually had to seek.
When there are only 'standards' Microsoft's browser team has to out execute other browser development teams. Market share declines suggest that this isn't a 'winning' strategy for them. When there are proprietary 'standards' for which other browser teams have incomplete information, browser dominance is assured. And as Microsoft is fond of saying, "Windows is 'open' because you get Windows based computers from any vendor."
Microsoft's goal is to make you look stupid, your goal should be to make what they think irrelevant. Complaining about their tactics just wastes time.
"[The GPU process] validates that the shaders submitted to the GPU use only the minimal features allowed by the spec. That means no dynamic indexing of sampler arrays. It means no infinite loops."
Halting problem solved. News at 11 :-)
Not necessarily, WebGL could simply restrict the shaders language to not be turing-complete. No need for solving the halting problem if you start from a total language.
if(document.getElementById("canvas").getContext("webgl"))
actually I think most people can't tell the difference between a browser and a search engine ;)
1. It's not hard to expose a way to disable WebGL support, especially for admins. And no, overall people do not often disable plugins and they're not very conscious about plugins being an attack surfaces (though admins may be).
2. Are you saying it's OK to ship technologies known to be broken as long as it's in a plugin? Do you really think that makes sense?
Context went through the effort to do a proof of concept to show the OpenGl flaws. I think Google and Mozilla should at the very least show these same flaws exist in SL before asserting they do.
first of all:
- silverlight might be completley different division of microsoft company than IE. and have nothing in common.
- i dont recall silverlight is included in IE either.
Not relevant. Silverlight is shipped by the same company and provides the same capabilities with no significant differences/restrictions
> - i dont recall silverlight is included in IE either.
Not relevant either, silverlight is shipped by Microsoft and some microsoft websites prompt for its installation, so Microsoft as a company does not seem to have much problem with Silverlight and its 3D capabilities.
depends "C:\Users\<user-name>\AppData\Local\Google\Chrome\Application\14.0.797.0\libglesv2.dll"
It shows that D3D.DLL is used. There is simply no reason to complicate the life of QA and have two renderers.
Besides tracking down what works and what doesnt is very hard, and often depends on other things - drivers, settings, etc. (I have some experience with it, I work in gamedev company and we do port to PC regularly).
I myself like OpenGL much more than D3D, but my graphics peers think that D3D gives you more power to the metal. Now AngleProject is just trying not to be close to the metal, but to use what seems to work a bit more than OpenGL. (Although in honestly I haven't seen problem with desktop OpenGL on my Vista and XP machines - I have to use Maya, MotionBuilder and others and they do use OpenGL).
We do - just not VS :)
I used to work on Microsoft SQL Server. Our build system back then was substantially the same as Windows's. We used the Visual C++ command-line compiler, but we didn't use Visual Studio projects. Instead, our build utility was the BUILD.EXE program in the Windows driver development kit (http://msdn.microsoft.com/library/ff542351). BUILD is a wrapper for make that defines various useful macros, and enforces certain conventions for makefile contents (for example, the Sources file contains all and (mostly) only the source filenames to be compiled in the current directory). Our build environment wasn't the public DDK, but both have the same origin.
Relatively few people used Visual Studio, mainly because its C++ Intellisense was very slow (it took half an hour one time for the VS debugger to load a just-in-time crash dump). Instead, I used the Source Insight editor (a proprietary third-party product, but site-licensed by Microsoft), and used the WinDBG debugger from the public Debugging Tools for Windows. Source Insight is very fast at code browsing, fast enough for SQL Server's code base - indeed that is its main marketing bullet point. WinDBG isn't particularly fast, but it's no slouch either.