Microsoft Gets Slammed for Its Hypocritical Stance on WebGL

Last week, I reported that Microsoft won’t be supporting WebGL in Internet Explorer due to security concerns. WebGL is a cross-platform 3D graphics API for the web that enables web applications running in the browser to do all sorts of cool stuff. Currently all the major browser vendors apart from Microsoft (i.e. Mozilla, Google, Opera, and Apple) actively support the WebGL initiative. Microsoft gave a pretty detailed technical explanation of their issues with WebGL, which led me to remark that Microsoft might be doing the right thing for a change. However, I might have been too hasty in giving the software giant, which has built a reputation of not willing to play nice, the clean chit.

One of the things I have long criticized tech-giants like Microsoft and Apple for is hypocrisy. As it turns out, the latest WebGL vs. Microsoft incident is another glowing example of the same. The biggest problem with Microsoft’s criticism of WebGL was first highlighted by Opera Software’s HÃ¥vard K. Moen and later elaborated upon by Google’s Gregg Tavares.

Microsoft: Criticizes something WebGL is doing. Does the exact same thing with Silverlight. Sigh.less than a minute ago via web Favorite Retweet Reply

It appears that Microsoft’s security consciousness magically vanishes as soon as it moves away from WebGL, with which it has clear conflicts of interests. WebGL is based on OpenGL, which is the main competitor of Microsoft’s DirectX. Adobe’s Flash and Microsoft’s own Silverlight suffers from many of the same drawbacks highlighted by Microsoft. However, Microsoft has no qualms about allowing these plug-ins to work on Internet Explorer. Tavares, who has been working on Chrome’s GPU acceleration and WebGL features, is understandably furious.

The latest FUD is Microsoft’s claim that they won’t support WebGL because it’s insecure. They might have a little more credibility if they weren’t promoting a technology, Silverlight 5, that provides the EXACT SAME FEATURES with all the same issues. They can’t have it both ways. Either it’s possible to make this tech safe or else it’s not. If it is possible to make it safe in Silverlight 5 then it’s also just as possible in WebGL. If it’s not possible to make it safe Microsoft would have to come out and say (1) They are removing GPU access from Silverlight 5. (2) They are banning Unity3D from running in IE since it also provides access to the EXACT SAME FEATURES. (3) They are banning Flash 11 from running in IE since it also provides access to the EXACT SAME FEATURES.

He also alleges that the research done by ContextIS into the security vulnerabilities present in WebGL was sponsored by Microsoft. If that is true, then this won’t be the first time that Microsoft has done something like this. However, at the very least, the results presented by ContextIS aren’t manipulated like the ones by NSS labs.

Tavares also tackled the main objections raised by Microsoft. One of the objections was related to denial of service, wherein a malicious process can prevent other processes from accessing the services of the GPU by asking the GPU to process something that takes too long.

The simplest solution is to time how long the GPU is taking to execute each task. If it’s taking too long reset the GPU and kill the page that issued the command. Microsoft Windows is one of the only OSes that currently provides this solution. They should be proud of this. They can basically claim the best place to run WebGL is on Windows. The Khronos group is working to bring similar functionality to other OSes as fast as possible and it may already be available in some drivers.
Of course it’s completely unacceptable if your machine gets DOSed. My only point is (1) there are fixes, Windows already support them and they are coming soon to other OSes. (2) it’s not has (sic) bad as your machine getting owned. In fact most likely very soon now, if a page takes too long on the GPU it will be marked bad by the browser. If you try to visit it again you’ll be warned. Similarly using techniques like Safe Browsingwe can warn you in advance while we work on providing the real fixes in all OSes.

The other point raised by Microsoft was that WebGL provides low-level hardware access in a way that is overly permissive. Bugs present in the graphics driver can create serious security issues. Tavares suggests that sandboxing coupled with a multi-process architecture can go a long way towards solving these issues. Google currently parallelizes all WebGL calls. Before anything is passed to the GPU, Chrome performs strict validation and even tries to work around several known GPU driver bugs.

Undoubtedly, the current status of WebGL is far from ideal. However, it’s still a work in progress, and the Khronos group is still busy tying up all the loose ends. One thing that is for certain is that WebGL is essential for cross-platform, cutting-edge, next-gen web applications that will blur the line between native and web applications.

Published by

Pallab De

Pallab De is a blogger from India who has a soft spot for anything techie. He loves trying out new software and spends most of his day breaking and fixing his PC. Pallab loves participating in the social web; he has been active in technology forums since he was a teenager and is an active user of both twitter (@indyan) and facebook .

  • Matthew Fabb

    Several people from Adobe have mentioned that security was built into their new 3D engine, molehill that limits the types of problems found in WebGL. Here’s a couple of quotes off of Twitter from Thibault Imbert, Product Manager for the Adobe Flash Runtimes (!/thibault_imbert ):

    “Nope Flash 11 does not provide access to the same features. Restrictions we actually have make it more secure.”
    “No loops or functions in shader programs, we limit program length and number of draw calls per frame.”
    “Shaders are input as a very simple bytecode that is vastly easier to verify/validate than the GLSL dialect used by webgl.”
    “Cross domain images are no issue, as all images are uploaded from BitmapData or ByteArray which is already readable.”
    “This is why we present Molehill as “secure” GPU APIs, because we do not give you access to everything.”

    It’s quite possible that Microsoft, as built in similar restrictions and checks with Silverlight 5.