Hacker News Reader

"I agree with Microsoft’s assessment that WebGL is a severe security risk. The gfx driver culture is not the culture of security." -- John Carmack

And Carmack is not precisely known as a MS cheerleader.

Carmack is right - there are security risks with allowing web content to run GPU shaders.

But Microsoft is inconsistent since it allows Silverlight content to run GPU shaders - proving that while there are risks, they are manageable, especially with Microsoft's deep security measures in recent Windows versions.

The issues with drivers can be and are being mitigated. The question is will Microsoft support WebGL once drivers are secure? I still doubt it, for the business reasons.

"Mitigated" is not the same as solved.

Graphics drivers are inherently not designed to be exposed like that to hostile content.

I don't agree. The sorts of games that are microsoft-exclusive are mostly big-name high-performance titles, not the sort of casual free-to-play minimal-intensity stuff that's possible with HTML5. Javascript is nowhere near performant enough to be suitable for AAA development, and plenty of casual titles are often ported to multiplatform more reliably via flash / unity or similar.

It's not the lack of WebGL that keeps studios developing primarily for Microsoft platforms; it's the ability to write low level, native code in high performance languages, the ability to have as few layers inbetween game and hardware as possible. Writing native, you have hardware - os - api - game; if you're creating a high caliber performance-critical title such as, say, unreal, quake, starcraft, or half-life, why on earth would you choose to use hardware - os - api - browser - browser api - game?

Quake 3 WebGL demo http://media.tojicode.com/q3bsp/

GLSL test tool http://www.iquilezles.org/apps/shadertoy/

http://www.khronos.org/webgl/wiki/Getting_Started

WebGL is a cross-platform, royalty-free API used to create 3D graphics in a Web browser. Based on OpenGL ES 2.0, WebGL uses the OpenGL shading language, GLSL, and offers the familiarity of the standard OpenGL API.

WebGL is a low-level API, so it's not for the faint of heart. OpenGL's shading language, GLSL, is itself an entire programming environment.

Quake 3 was released in 1999, 13 years ago. It ran well on my 700mhz Pentium 3, with a 32mb TNT2 graphics card.

Show me a WebGL demo with the level of realtime visual fidelity and physics simulation from a game five years old - say, Crysis - and then I'll believe that WebGL is suitable for game development.

It's likely that Crysis still doesn't run on many gaming machines, WebGL or no.

Not all games are crysis.

A lot of games these days run on mobile with limited graphics, or use lower-end game engines like Unity as opposed to AAA ones.

There is plenty of room for WebGL gaming, but you are right, it will not intersect with AAA gaming in the foreseeable future.

This particular conversation is precisely about AAA titles dominating on Windows.

Otherwise, the web is becoming a more viable target for small and indie devs. But as another commentator pointed out, without a overhaul in how video driver developers approach their work, WebGL as a concept cannot be made secure. Either browser vendors will wake up to this fact and at least start disabling WebGL by default, or enterprising black-hatters will start taking advantage of WebGL exploits, forcing browser vendors' hands.

High performance graphics on the web is a tough pickle :\

Apologies, I didn't realize this was just about AAA games, I saw Quake 3 in there... ;)

I don't think a major overhaul is necessary to make WebGL secure. There is really just one remaining issue, which is DOS attacks from slow shaders. This is not an issue on recent Windows releases which can almost seamlessly restart the GPU.

Aside from that, yes, there will be GPU driver exploits. There are also browser exploits and network stack exploits - we don't stop making browsers and network-connected applications though.

WebGL-ready browsers have very good capabilities to work around such exploits, either by simply blacklisting known bad drivers, or adding things like bounds checks to shaders etc. (which is currently done). Otherwise, exploits will happen and browsers will prevent them, just like browsers already do for non-WebGL content.

There aren't any serious WebGL attacks that have actually been demonstrated. Just a lot of FUD and some laughable Hollywood-style mock-ups designed to scare people.

On the other hand, there are many demonstrated usable attacks against Internet Explorer.

The entire conversation is ridiculous.

aboslutely - my team and I are close to finishing ours (shameless plug: http://www.jollycorpse.com), and I already mentioned Unity and Flash in my prior comment.

Though there's no way I'd write our 2D platformer using HTML5 due to absent gamepad support, a laughable audio engine, abysmal load times, and dodgy multiplayer capabilities, my original counterpoint was that WebGL support has absolutely nothing to do with developers' gravitation towards windows.

Are you saying that someone writing a -level renderer- that uses 35% cpu for a 13 year old video game means WebGL is ready for studio quality AAA titles?

Not everything is AAA titles. I agree WebGL will not compete in the AAA space anytime soon, but there is a huge market for non-AAA games.

What kind of computer are you on? My Chrome process, with numerous tabs, doesn't go above 5%.

> Everyone thinks I am a 'conspiracy theorist' or something for saying this, but I really think that Microsoft is holding back WebGL for business reasons.

You're not a conspiracy theorist, and I think you are 100% right here.

> When WebGL takes off, Microsoft Windows sales will take a big hit because people will be able to play the popular games on Macs or even on Linux machines.

I believe that when WebGL takes off, Microsoft will support it.

Say what you will of Microsoft, it is a rational player in the market. If everyone plays WebGL games, IE will not be the only browser - and Windows 8 tablets the only device - that cannot play that content. Microsoft will simply implement WebGL (it probably already has internally).

> Microsoft will simply implement WebGL

But you still have to wonder what this will do to their profitable desktop business, and hence their share value, and hence their shareholder confidence.

I suppose I'm really wondering if Microsoft can turn into an IBM.

I agree, when WebGL takes off it will definitely harm their desktop business, and this is a main reason why they oppose it (for now).

I agree that it seems weird Microsoft would implement an open standard like WebGL. Microsoft doesn't implement open standards, they create their own one and make it fundamentally incompatible with the open one (ODF/DOCX, OpenGL/DirectX, UPnP/Windows Media Shares, SMB, Direct2D, H264/WebM, etc).

Microsoft is known for their embrace, extend, extinguish strategy. I think given the chance, they would do the same to WebGL. But at this stage they don't see WebGL as a serious threat: if they do, expect to see WebX, or DirectWeb, or something like that. I think Microsoft is 10x more likely to implement their own 3D Javascript API than to implement WebGL in Internet Explorer.

> Microsoft is known for their embrace, extend, extinguish strategy.

They were back in the latter 1990s, when the desktop was the new platform and they owned it. Now, handhelds are the new growth platform and MSFT has not gained much of a foothold there; exact marketshare numbers don't matter as much as perception of dominance, and MSFT doesn't have that. They allowed Apple and Google to get too big, instead of being first and achieving lock-in via network effects.

Think back to IBM: They owned the IBM PC platform and forced everyone else to copy them or choose a different platform entirely. Then Compaq beat them to the punch with releasing an 80386-based PC, then the Microchannel bus failed to catch on, and pretty soon IBM was irrelevant to the PC world. (And that isn't even taking into account what MSFT did relative to all this.)

So, if MSFT makes an I-Can't-Believe-It's-Not-WebGL, they'll have to deal with the fact Apple and Google know about Embrace-Extend-Extinguish and that MSFT doesn't dominate handhelds. So their proprietary extension will be limited to their devices, which will mean all of the iOS and Android users would be locked out, which means developers would have to choose between targeting a majority of users or MSFT, which means MSFT would have screwed itself sideways with a rake.

I doubt MSFT will screw itself sideways with a rake. However, I also don't see how MSFT can continue its growth without a new platform to dominate.

In terms of WebGL though, I think the major platform for it is the traditional Desktop OS. When people talk about creating WebGL MMOs with 3D graphics, etc. I think there's too much of a performance-bottleneck in terms of graphics for WebGL to be hugely popular on phones. If this was the case, Microsoft would still have the home-team advantage, and the ability to set the tone for future web graphics APIs. They did the same thing to the console market: when they came in, OpenGL and fragmented proprietary APIs dominated the market. Post-Xbox, DirectX became the first-class API for 3D game development. I think we could well see the same thing happen with WebGL if Microsoft makes a move to do so. And at this stage I can't see any other reason for them to hold out for so long in implementing WebGL in IE, unless they plan on subverting it.

That said, Microsoft didn't create a competitor to canvas and many other new web APIs (but I don't know how standards-compliant they are these days in terms of Javascript, Canvas, SVG, etc.).

WebGL would have to have a killer app on mobile for Microsoft's lack of mobile presence to hurt them. Currently all WebGL Demos I've seen have assumed a desktop-level of graphics performance, and no phones are "officially" capable of WebGL yet.

I just tried the three.js examples from my Galaxy Nexus (running 4.1) and couldn't get any of them working in either Chrome for Android or the default browser. That said, I know it's possible with some hacking and tweaking. From what I hear iOS has about equivalent support at this stage. That said, Apple and (to a lesser extent) Google could roll out this support pretty easily in an update, but I maintain my initial reservation; that phone hardware will not be performant enough to make WebGL a viable replacement or complement to native OpenGL development on those platforms.

> In terms of WebGL though, I think the major platform for it is the traditional Desktop OS.

Currently. However, that's how these things tend to start off, isn't it? On the one hand, handhelds have gone from dumb phones to the Droid and iPhone platforms; on the other, well, people wrote playable games for the Atari 2600.

> Microsoft Windows sales will take a big hit because people will be able to play the popular games on Macs or even on Linux machines.

Nope, because only 1% of computer users ever install their own OS, and less than that build their own, so they are buying prebuilt machines from distributors that put Windows on it. They see Linux and reject change, and try to stay close to the platform they have used for a decade, even if it is shoddy. And they would never fathom going through the process of installing an operating system.

It would start a trend towards Linux, if PC gamers could switch to barebones distros to optimize their rigs performance in games (yay for cruft like Aero desktop slowing down 3d performance), then Linux becomes "cool", and soon the communal nerd of every family is actively putting it on pcs to play games, and then the parents get used to it, etc.

But that is a gradual thing, and having the ability to play web games on Linux doesn't translate into a jump off the Microsoft bandwagon any more than the tens of millions of people who use their laptops only for Facebook and Twitter have jumped in the last 5 years.

I didn't think this was a conspiracy theory, I thought it was obvious!

Maybe not now but in future if 3D gaming is equally great on all platforms, who needs windows?

In fact I thought this was just part of the broader strategy of Internet Explorer. Read Bill Gates' 1995 Internet Tidal Wave letter. He's worried the Internet will become the new platform where people use apps and make Windows irrelevant. What did they do? The first browser wars left IE6 stagnating - meaning you had to make any serious apps for desktop, and that meant mainly Windows. Even though they're losing share now, they still won: 5+ years of extra Windows license sales. That's a lot of money, and even arguably bought them enough time to survive Vista.

Microsoft are more forwards-looking than they are given credit for, I think. Gates foresaw what is happening now, which is apps are moving to the web and making the OS irrelevant, as far back as 1995 - and took successful steps to stop it. Lack of WebGL support is exactly the same routine for the same reasons.