I haven't seen any real-world attacks using WebGL yet; we probably won't for a couple years, since it's still very new technology and there's a lot to learn to be able to do even basic research there.
> Browser support for WebGL directly exposes hardware functionality to the web in a way that we consider to be overly permissive
The WebGL API -- outside of bounds checking and shader validation/translation -- is a direct conversion of the EGL API. This makes getting your data (legitimate or not) into the lower levels very easy. That cuts both ways, as I detailed.
> Browser support for WebGL security servicing responsibility relies too heavily on third parties to secure the web experience
Read: The security of WebGL depends on GPU driver vendors, who write terrible code. This point is well known by anyone who's worked on enough 3D code, or even just tried to fix graphics bugs in games by doing the driver update dance.
> Problematic system DoS scenarios
For the vast majority of GPUs, there's no way to set timeouts on rendering or shader execution, so DoSes are just downright trivial. This will be the first thing to get better, with the various robustness extensions that are coming.
All in all, I have absolutely no issues with what MS released on the subject.
"This makes getting your data (legitimate or not) into the lower levels very easy."
Bullshit. Completely unsubstantiated.
The browsers themselves are what are actually being compromised in reality, Microsoft by far more than others. The WebGL exploits are just theoretical. Every browser vendor is a third party.
Big fucking deal, somebody makes your browser or system freeze up.. like that is a new thing that you can't do with a browser or with Internet Explorer? Freezing the system isn't that easy to do with WebGL and depends on the specific setup of that machine. That's not a security concern, thats just a potential inconvenience.
I don't give a fuck what you dumbasses think, this is obviously Microsoft FUD. But its just another example of the sort of idiotic rationalizations that normally support the status quo.
And have you seen them? http://blogs.technet.com/b/srd/archive/2011/06/16/webgl-cons... Let's go over the points together:
> Browser support for WebGL directly exposes hardware functionality to the web in a way that we consider to be overly permissive
The WebGL API -- outside of bounds checking and shader validation/translation -- is a direct conversion of the EGL API. This makes getting your data (legitimate or not) into the lower levels very easy. That cuts both ways, as I detailed.
> Browser support for WebGL security servicing responsibility relies too heavily on third parties to secure the web experience
Read: The security of WebGL depends on GPU driver vendors, who write terrible code. This point is well known by anyone who's worked on enough 3D code, or even just tried to fix graphics bugs in games by doing the driver update dance.
> Problematic system DoS scenarios
For the vast majority of GPUs, there's no way to set timeouts on rendering or shader execution, so DoSes are just downright trivial. This will be the first thing to get better, with the various robustness extensions that are coming.
All in all, I have absolutely no issues with what MS released on the subject.