Hacker News Reader

Comment by anonymouz | Hacker News Reader

True. But once those plugins go away, something else will become the new low hanging fruit. Personally, I wonder how well WebGL will hold up, given that 3d graphics drivers are absolutely not written with security mind, and were never really intended to be hooked up to the web...

View on HN

That is a good point. A bit like how people would switch to Macs to avoid viruses, but all they were really doing was moving to a place that wasn't being targeted yet.

I don't like the monolithic design of modern browsers - it is rendering engine, javascript interpreter, sandbox, audio, video, webgl, user management, local store etc. all in one big heap.

We will need features to let users swap parts out, highly customize them, apply advanced ACL's to each component (since the browser becomes the new OS) and disable them (chrome://flags)

Can you point out an example of a Mac virus?

There are many, but they don't get the publicity other malware gets. One example of Mac-malware would be SabPub: https://www.securelist.com/en/blog/208193467/SabPub_Mac_OS_X...

It wasn't self-propagating, but MacDefender scareware still claimed a lot of machines. http://en.wikipedia.org/wiki/Mac_Defender

Apple also has a poor record at security patching, which allows for more drive by downloads, especially through Java. Further reading: http://voices.washingtonpost.com/securityfix/2009/06/apple_p... http://krebsonsecurity.com/tag/mac/

Microsoft is refusing to support WebGL for security reasons. I can't make up my mind about whether to be annoyed or impressed.

As with many (but not all) things Microsoft do, when the thick layers of gelatinous hivemind diatribe are pealed away what's left are sound, conscientious engineering decisions made by an organization with a near pristine history of supporting end users and going to extraordinary lengths to preserve backwards compatibility.

As for instances where they have not preserved support and compatibility, Silverlight comes to mind, and they dumped that largely in favour of frameworks targeting HTML+JS.

(I'm not a Microsoft employee, just a user who appreciates the APIs I cut my teeth on 20 years ago remain applicable today)

  | when the thick layers of gelatinous hivemind diatribe
  | are pealed away what's left are sound, conscientious
  | engineering decisions

Like waiting years to take security seriously? :P

That's covered by the "backwards compatability" item.

It took them a while to even take patching security vulnerabilities in a timely manner seriously. I can understand that secure design (e.g. not running everything as admin) could fall under "backwards compatibility."

You can be both! But I am usually more annoyed by rich content than the lack thereof. It grabs your CPU and memory and screams out to anyone in your vicinity, "Look what x is browsing!"

Yeah, I read that a few weeks ago, I can't remember the source. It will be really funny in the next year or two if the security experts encourage everyone to use IE to ensure a safe browsing experience.

If I remember there is some issues with passing untrusted shader code to the GPU

So it may be a legitimate concern (only blown out of proportion)

>I wonder how well WebGL will hold up, given that 3d graphics drivers are absolutely not written with security mind

It doesn't seem to be holding up too well against normal use, never mind deliberate attempts to exploit it: it's not uncommon for WebGL demos to crash at least one browser/hardware combo. Example from the last WebGL submission I read a few days ago: http://news.ycombinator.com/item?id=5211211

Reply on news.ycombinator.com