Hacker News Reader

Comment by superkuh | Hacker News Reader

Most bare metal features introduced into what used to be browsers, but are now virtual machines for running applications, are and will be used for malicious purposes. The idea that you should allow random strangers to run code on your machine, especially this low level, is even more crazy than opening every email attachment you get.

View on HN

WebKit and Mozilla simply refuse to implement many of the APIs because they cant' figure out how to prevent them from being abused.

See e.g.https://webkit.org/tracking-prevention/#anti-fingerprinting (Mozilla's positions are more spread out over various issues, see e.g. https://webapicontroversy.com )

Except Firefox is getting irrelevant, with Edge Chromium overtaking it, and Apple naturally would rather developers to use iOS APIs exactly for the same purpose, while collecting some revenue in Apple hardware for development purposes.

> Except Firefox is getting irrelevant, with Edge Chromium overtaking it

And this is a huge problem.

> and Apple naturally would rather developers to use iOS APIs

You're missing the point where Firefox agrees with Apple on these APIs.

But sure. "Apple bad" and all that.

FF should focus on a better UX. Try FF and Edge on Windows 10, Edge seems much snappier because it boosts the mouse scroll speed. A friend wanted to switch because of that, and increasing the overall mouse scroll speed on W10 did the trick for FF. It's little tricks like those that make non techy people switch.

I don't agree with "Apple bad" at all, if you see my comments history.

My point was that contrary to Mozilla, they do have an agenda regarding how much Web Safari should support on iOS.

How would you define bare-metal? WebGL is proxied via ANGLE, so there's no risk of crashing or other forms of leaky processes, which is typically the primary thing I think of when I worry about low-level APIs.

Regardless of how you define bare-metal, OP has a point here. Besides from bespoke web applications (which should be fully packages and signed, btw.), execution of turing-complete code inside the browser is pointless. At best, it helps to workaround certain limitations (bandwidth, browser quirks), or proves the UX of a page. But mostly it is just getting in the way or outright used against the user.

ANGLE is not a virtual machine but a translation layer from OpenGL ES (on which WebGL is based) to Direct3D. Inappropriate translation would result in a direct exploit unlike VM, since AFAIK there is no practical means to sandbox shaders. In some sense it is akin to JIT in a kernel which has the roughly same security ramification.

Don't forget bugs in the driver and/or GPU firmware.

Note that most of a GPU driver runs in user mode, trapped inside the browser's process sandbox.

>Inappropriate translation would result in a direct exploit unlike VM, since AFAIK there is no practical means to sandbox shaders.

What does it mean to sandbox shaders in this context ? GL ES shaders are sent down in a high level language and can't really do much besides do computation on input parameters to generate output in a pipeline. I wish they were more general purpose and worthy of sandboxing but the web GL shaders are really limited.

Well, not so.

https://www.contextis.com/us/blog/webgl-more-webgl-security-...

https://www.hpcwire.com/2018/05/31/gpus-excellent-performanc...

https://www.cs.utexas.edu/users/witchel/pubs/zhu17gpgpu-secu...

First link demonstrates reading from uncleared buffered to capture screen contents - and is from Windows XP era.

Second one is about running a bitcoin miner on the GPU, hypothetical memory breaches, and GPU DoS. You can stall the graphics pipeline without shaders, run a miner on CPU, and I'm going to need a demonstration of a usefull GPU memory breach with WebGL. On top of that any such breach is likely driver dependent and will only work on some specific driver/HW combination - that's such a low attack surface I doubt anyone will bother developing exploits targeting that.

I didn't bother going through third because I wasted enough time on first and second, I don't see how anything here suggest you need to sandbox shaders.

Until it eventually happens on your computer I guess.

Modern GPUs have process isolation just like CPUs, and if that is not enough for you, GPU APIs allow an application (in this case the browser) to request bounds-checked execution for extra safety.

What's used on platforms where Direct3D doesn't exist?

OpenGL directly, no ?

What about MacOS? Isn't OpenGL deprecated?

ANGLE is used to to a source to source translation irrespective of backend - it normalizes the source input to various GPUs (dropping things that have historically been funky like comment parsing, #controls, dodgy constructs, disallowed constructs, etc)

[Source: I worked on the original spec and spent a lot of time trying to prevent the more egregious security and privacy problems]

Besides Apple devices, not on game consoles.

... but Google Chrome is not running on game consoles anyways ? Blink likely can, but then it does not necessarily use ANGLE, e.g. for instance QtWebEngine definitely does not use ANGLE on Mac / Linux but does native GL calls instead.

PS 4 dashboard was done in WebGL.

https://news.softpedia.com/news/The-PS4-UI-Is-Built-Using-We...

I don't understand your point. Yes, it's using WebGL. Do you think that it's going to do WebGL -> OpenGL ES 2/3 calls -> ANGLE -> Direct3D -> PS4 graphics driver (like it does on e.g. chrome on windows) ? No, it's likely doing WebGL -> PS4 proprietary graphics API -> PS4 graphics driver, not going through ANGLE or whatnot

It uses a Chrome fork, so most likely Sony added LibGNM backend to ANGLE instead of redoing the whole graphics stack for Chrome.

but why would it go through ANGLE's libGLESv2.so and add a backend to that for the PS4 when the PS4 team could most likely provide their own libGLESv2 which maps directly to their driver (since they were doing that already for the PS3) ? As this is what chrome actually calls, gles functions.

Unless I missed something, when were they doing that with PS3?

The only effort to do any GL like stuff was on the PS2, with GL ES 1.0 + Cg, an effort that was dropped when almost no dev cared to use it.

Other than that there was the PSGL library for PS2 Linux.

Anyway, I did a bit more research and Chrome was actually only used for development purposes, they created their own WebGL engine on top of PhyreEngine for the console OS.

https://www.youtube.com/watch?v=sIhtcUvi0BQ&t=3325s

There's no need to translate?

MacOS?

PS4, XBox?

Wouldn't Xbox use Direct3D?

ANGLE has OpenGL and OpenGL ES backends in addition to Direct3D, as well as partial Metal support.

https://chromium.googlesource.com/angle/angle/+/master/READM...

OpenGL or Vulkan as appropriate. AFAIK there's a Metal backend in development for macs but it's not finished yet.

I'm not optimistic. https://medium.com/@afd_icl/crashes-hangs-and-crazy-images-b...

It's appalling that these kinds of privacy invasion are still considered legal.

What's up with the silent downvotes?

Reply on news.ycombinator.com