Credit to Microsoft for reversing their previous stance on WebGL.
Credit to Mozilla for pushing 3d on the web and forcing the issue. Any browser that doesn't implement WebGL will soon be considered crippled; Microsoft desperately wants to avoid that title again, so in a way, Mozilla forced their hand.
"And [Mozilla's Mike Shaver] affected my framing of the problem deeply – I remember one day a couple of years back when we were talking about some market share point, thinking about how incredibly, insanely competitive the browser technology landscape was – and he said to me: “Look, this is the world we wanted. And this is the world we made.” Wow. Exactly right. He taught me so much about how enormous an impact a group of dedicated people can make."
"Any browser that doesn't implement WebGL will soon be considered crippled"
Really? I don't think WebGL is that important. What's it really good for besides laggy browser games? What's with the hype on browser games anyway? They're always going to perform much slower than native code. I don't see WebGL becoming such a critical aspect of browsing that the average user would consider IE "crippled" for not supporting it.
What engineering did they do to reduce the security risk? As much as I like WebGL as a dev, Microsoft's arguments against feeding arbitrary machine code to buggy graphics cards that have kernel-level memory access privileges... seemed a bit convincing.
Just want to reply to say I also would like to hear an answer to this question. Something I've wanted to do for a while is write a fuzzer [1] that puts together arbitrary garbage shader script code and runs it with weird webgl operations looking for exploitable crashes. I would expect there to be a ton of bugs found, but then again the monetary barrier to entry might be high considering differences between hardware.
It also looks like the good folks at Mozilla have already been doing this to some degree [2], presumably shrinking the untested threat surface considerably (man I love those guys).
I don't know anything about what Microsoft has done in particular. But I can tell you what other WebGL implementations do, for example: rewrite shaders to ensure their memory accesses are safe, not accept as valid shaders code that is dangerous (but would be valid GLSL in general), validate input to the graphics card (e.g., buffers are bound, avoids depending on the GL driver to check that), do fuzz testing, maintain blacklists of known buggy drivers, etc. etc.
I would guess Microsoft is doing much the same, but it does have the extra advantage of only caring about one OS and also owning that OS.
You know, the drivers could have just gotten better over time. Remember when Vista came out, they moved to a new driver model, and there were lots of bugs...people were worried about untrusted shader code bringing down machines (not quite security vulnerability, but definitely a DOS!).
These days, the driver model is more mature, drivers that consumers have are a bit more robust, they probably re-evaluated their worries, which I think is great! Dynamism and flexibility is good in big.corp.
Disclaimer: Microsoft employee, but speaking for myself.
I agree that the threat is present, but rather than restrict freedom it is better to place decisions in the user's hands sometimes. There are security threats everywhere, even beyond the software or hardware level (i.e. phishing for passwords). I think that rather than not implement WebGL, it would be better to ask permission if the user trusts the domain (just as Chrome does with any plugin).
> Microsoft's arguments against feeding arbitrary machine code to buggy graphics cards
That would indeed be a bad idea. This is not how WebGL works. There's a translation layer that gets the WebGL calls and relays them to the graphics drivers after determining the calls are safe.
This layer can have bugs of course, like other sandboxes
(javascript, flash, etc).
Shader validation in ANGLE and black-listed drivers are how this is protected against in Chrome and Firefox. Microsoft was never really clear what the security issues were- really felt like a bunch of FUD.
tl;dr: While it was talking up the security risk of WebGL, Microsoft was allowing Silverlight to permit untrusted code to access graphics APIs in exactly the same way. Chrome validates everything before calling the actual driver APIs, so the opportunities for fuzzing are limited.
Love the new changes in IE and the direction it is taking.
>IE11 allow you to turn off the SmartScreen filter right in the download UI.
Now only if chrome would do that I can keep myself from switching away from it. Its frustrating to know that everytime I download a file or save an image, the file hash, IP and the download URL is sent to Google. The whole NSA thing isn't making it better either. [1][2]
I, for one, welcome our new WebGL overlords. Seriously though, it's good to see Microsoft reversed their stance on WebGL no doubt their hand was forced by Mozilla and Webkit (probably Mozilla more so). And SPDY support as well? Looks like IE11 might actually be a decent contender in the browser race. The future of web development doesn't look so bad after all.
This is potentially great news for anyone using a browser. Let's hope that the implementation is close to spec, and makes for a relatively seamless experience across all browsers.
I feel this whole "but IE won't ever support it!" argument was seriously holding WebGL back. IE still has very significant market share, and since they arguably got their act together lately, I doubt it's going to get smaller in the short term.
Considering that existing C++/OpenGL code bases can be ported to the web relatively easy with Emscripten, my bet is that we'll see a bunch of games come to the browser over the next ~3 years.
IE has a lot of market share with IE7, IE8 and possibly IE9. They don't have a lot of marketshare with IE11 - and possibly never will.
So the argument that "WebGL is not supported by IE so I'll never use it" was pretty bogus anyway, since the people using those versions of IE were probably never in your target market anyway.
Have they said it won't be on Windows 7? I would expect them to release it on Win7 to try and keep their market share. I hope they do as I am building a WebGL application for work :)
Is it just me, or are that others that think "Didn't it support that yet?!" at every IE release? I don't use Windows so I never use IE anymore, but I'd think IE9 or 10 would support WebGL by now...
Will Microsoft support the full OpenGL on Windows, too, now? Or will they just run WebGL through Google's ANGLE project?
At least Google had the "excuse" to use it because they couldn't put OpenGL on Windows themselves, so they had to translate DirectX to OpenGL to make WebGL work.
What's Microsoft's excuse? They should support OpenGL and allow Google and Mozilla to use the OpenGL API's directly, too. Then we'll all get faster, and possibly richer WebGL.
They need to support these newer browsers on older operating systems. If the OS is still being actively patched, new browsers should be made backwards compatible to work on it otherwise we'll have exact same problem with IE8 on XP and IE9 on Vista. And soon to be IE10 on Windows 7.
What are we supposed to take away from those links? The latter isn't even written from the perspective of Microsoft, it's just another generic {Open/Web}GL rant (if anything, you've granted MS legitimacy here by acknowledging other legitimate complaints about the spec).
Yes, I was annoyed when they boldly claimed they wouldn't be supporting it at all. I'm also gracious enough to say "Thanks" when handed a gift. The IE team is clearly making an effort.
I have to give credit to IE10 though...a cool feature that I have only seen in safari (through quicktime), is IE10 allows multi audio track support for html5 mp4...great for multi-language videos, and adapting a single video to play on multiple devices (like some that don't support 5.1 audio).
[+] [-] judah|12 years ago|reply
Credit to Mozilla for pushing 3d on the web and forcing the issue. Any browser that doesn't implement WebGL will soon be considered crippled; Microsoft desperately wants to avoid that title again, so in a way, Mozilla forced their hand.
Competition at work.
[+] [-] leeoniya|12 years ago|reply
"And [Mozilla's Mike Shaver] affected my framing of the problem deeply – I remember one day a couple of years back when we were talking about some market share point, thinking about how incredibly, insanely competitive the browser technology landscape was – and he said to me: “Look, this is the world we wanted. And this is the world we made.” Wow. Exactly right. He taught me so much about how enormous an impact a group of dedicated people can make."
[+] [-] jimmaswell|12 years ago|reply
Really? I don't think WebGL is that important. What's it really good for besides laggy browser games? What's with the hype on browser games anyway? They're always going to perform much slower than native code. I don't see WebGL becoming such a critical aspect of browsing that the average user would consider IE "crippled" for not supporting it.
[+] [-] dman|12 years ago|reply
[+] [-] ihsw|12 years ago|reply
[+] [-] hatu|12 years ago|reply
[+] [-] camus|12 years ago|reply
One cant believe anything MS says. And it's another proof of that.
Remember when WebGL wasnt "secure"? Strange , now it is.
I say bull* , like their bull Venture Capital sh*t.
But I guess they have enough spare change to do community management on HN ( ie propaganda ), looking at all the MS spin here.
[+] [-] idupree|12 years ago|reply
[+] [-] pvnick|12 years ago|reply
It also looks like the good folks at Mozilla have already been doing this to some degree [2], presumably shrinking the untested threat surface considerably (man I love those guys).
[1] http://en.wikipedia.org/wiki/Fuzz_testing
[2] https://bugzilla.mozilla.org/show_bug.cgi?id=665936
[+] [-] azakai|12 years ago|reply
I would guess Microsoft is doing much the same, but it does have the extra advantage of only caring about one OS and also owning that OS.
[+] [-] seanmcdirmid|12 years ago|reply
These days, the driver model is more mature, drivers that consumers have are a bit more robust, they probably re-evaluated their worries, which I think is great! Dynamism and flexibility is good in big.corp.
Disclaimer: Microsoft employee, but speaking for myself.
[+] [-] mtgx|12 years ago|reply
[+] [-] gavanwoolery|12 years ago|reply
[+] [-] sampk|12 years ago|reply
Typical way: Download game -> Confirm execution -> Play
WebGL way: Confirm execution -> Play
[+] [-] fulafel|12 years ago|reply
That would indeed be a bad idea. This is not how WebGL works. There's a translation layer that gets the WebGL calls and relays them to the graphics drivers after determining the calls are safe.
This layer can have bugs of course, like other sandboxes (javascript, flash, etc).
[+] [-] randomfool|12 years ago|reply
[+] [-] cmccabe|12 years ago|reply
http://games.greggman.com/game/webgl-security-and-microsoft-...
tl;dr: While it was talking up the security risk of WebGL, Microsoft was allowing Silverlight to permit untrusted code to access graphics APIs in exactly the same way. Chrome validates everything before calling the actual driver APIs, so the opportunities for fuzzing are limited.
[+] [-] nivla|12 years ago|reply
>IE11 allow you to turn off the SmartScreen filter right in the download UI.
Now only if chrome would do that I can keep myself from switching away from it. Its frustrating to know that everytime I download a file or save an image, the file hash, IP and the download URL is sent to Google. The whole NSA thing isn't making it better either. [1][2]
[1] http://superuser.com/questions/387724/how-to-disable-downloa... [2] http://blog.chromium.org/2012/01/all-about-safe-browsing.htm...
[+] [-] JoshTriplett|12 years ago|reply
[+] [-] DigitalSea|12 years ago|reply
[+] [-] sdoowpilihp|12 years ago|reply
[+] [-] chez17|12 years ago|reply
I got so excited for a moment and then you had to go and post this. Microsoft seems to have a desire to make things difficult for web developers.
[+] [-] fhd2|12 years ago|reply
I feel this whole "but IE won't ever support it!" argument was seriously holding WebGL back. IE still has very significant market share, and since they arguably got their act together lately, I doubt it's going to get smaller in the short term.
Considering that existing C++/OpenGL code bases can be ported to the web relatively easy with Emscripten, my bet is that we'll see a bunch of games come to the browser over the next ~3 years.
[+] [-] mtgx|12 years ago|reply
So the argument that "WebGL is not supported by IE so I'll never use it" was pretty bogus anyway, since the people using those versions of IE were probably never in your target market anyway.
[+] [-] mzarate06|12 years ago|reply
Would also love for IE 11 to be available on Windows 7.
[+] [-] winslow|12 years ago|reply
[+] [-] lucb1e|12 years ago|reply
[+] [-] mtgx|12 years ago|reply
At least Google had the "excuse" to use it because they couldn't put OpenGL on Windows themselves, so they had to translate DirectX to OpenGL to make WebGL work.
What's Microsoft's excuse? They should support OpenGL and allow Google and Mozilla to use the OpenGL API's directly, too. Then we'll all get faster, and possibly richer WebGL.
[+] [-] CJefferson|12 years ago|reply
[+] [-] cromwellian|12 years ago|reply
[+] [-] bhauer|12 years ago|reply
The new developer tools, especially that UI responsiveness report [1] are hot looking. Looking forward to giving that a spin.
[1] http://microsoft-news.com/wp-content/uploads/2013/06/UI-Resp...
[+] [-] roschdal|12 years ago|reply
[+] [-] signed0|12 years ago|reply
[+] [-] showwebgl|12 years ago|reply
[+] [-] Zikes|12 years ago|reply
[+] [-] adrr|12 years ago|reply
[+] [-] warfangle|12 years ago|reply
[+] [-] dstorey|12 years ago|reply
[+] [-] orf|12 years ago|reply
[+] [-] opinali|12 years ago|reply
Shaming link 2: http://www.extremetech.com/computing/87696-webgl-is-fundamen...
[+] [-] drivebyacct2|12 years ago|reply
Yes, I was annoyed when they boldly claimed they wouldn't be supporting it at all. I'm also gracious enough to say "Thanks" when handed a gift. The IE team is clearly making an effort.
[+] [-] quackerhacker|12 years ago|reply
I have to give credit to IE10 though...a cool feature that I have only seen in safari (through quicktime), is IE10 allows multi audio track support for html5 mp4...great for multi-language videos, and adapting a single video to play on multiple devices (like some that don't support 5.1 audio).
[+] [-] tmzt|12 years ago|reply
[+] [-] cscx|12 years ago|reply
[+] [-] aoberoi|12 years ago|reply
[+] [-] MatthewPhillips|12 years ago|reply