WebGL pays strong attention to security - just as any web technology should. With growing recognition of WebGL in the press, we thought we would summarize Khronos' work and stance on this important topic.
- Khronos agrees that security is a vitally important consideration for any web standard. WebGL was architected with security in mind from the ground up.
- All WebGL implementations already necessarily contain safeguards which prevent out-of-range memory accesses during rendering operations and access of uninitialized memory; please see here and here. These safeguards are tested by the WebGL conformance suite.
- Defense against denial of service attacks is still evolving in WebGL implementations. Khronos has specified an extension to OpenGL and OpenGL ES, GL_ARB_robustness, designed to prevent denial of service and out-of-range memory access attacks from WebGL content, preventing any possibility of using WebGL to execute malware on a user's machine.
- GL_ARB_robustness has already been deployed by some GPU vendors and Khronos expects it to be deployed rapidly by others. Browsers can check for the presence of this extension before enabling WebGL content. This is likely to become the deployment mode for WebGL in the near future.
- The ability to incorporate cross-domain images into WebGL scenes provides great utility to developers, but the WebGL working group is considering requiring Cross Origin Resource Sharing (CORS) opt-in or other mechanisms to prevent possible future abuse of this capability.
- The WebGL working group has been working closely with the GPU vendors in the Khronos group to make accelerated WebGL implementations secure and WebGL is influencing GPUs to provide even more flexible security options in the future.
- There are no known WebGL exploits and Khronos will continue to place close attention to technical and ecosystem opportunities to ensure WebGL is a secure technology that can be used with confidence.
Updated May 16 2011
Jon Peddie Research has written up a great review of the Khronos Groups new StreamInput API. Kathleen Maher writes "There is a tipping point out there somewhere and it doesn’t seen too far away. The Internet of Things is practically building itself. Khronos’ first role will be to help developers take advantage of sensors for mobile and console devices, but the day is not far off when the applications for sensors broaden further into our everyday lives and capabilities."
If you missed the San Francisco WebGL Meetup in April, you now have a chance to find out what it was all about. Complete with pictures and lots of details from the meetup, this review is well done and paints a great picture!
The WebGL and COLLADA powered OurBricks lets you share and interact with 3D content in a modern webbrowser. Today they announce a design competition for 3D artists. The theme is “Modern Life.” Deadline for submissions is May 16 at 12pm PST.
The Geomatics Engineering departement at the University of Applied Sciences Northwestern Switzerland is now developer OpenWebGlobe for WebGL. OpenWebGlobe SDK lets you create your own virtual globe applications. You can develop your new application in your favorite language like C++, C#, Visual Basic, Python.
There will be a WebGL Meetup on April 28th 2011 in San Francisco. A complete list of all upcoming Khronos Group events is available online.
WebGL Report is an open source project that checks whether or not a browser supports WebGL, and if so, reports details such as supported extensions and implementation specific capabilities.
Travis Glines released a proof of concept chat app using WebGL, Node.js, Websockets and a few other technologies. Its a fun and interesting way to demonstrate a chat room in real time. "When you think of 3D on the web, you typically think of games first. Games in 3D are fun, but what if you could do multiplayer gaming inside a web browser, with a server that could scale?" wrote Travis. This demo reminds me a bit if BZFlag in its early days, and is worth a few minutes of your time to check out.
The Signals Blog has started a tutorial series on WebGL for Chemistry. To-date, only the first two tutorials in the series are complete, however it is looking to be a very promising tutorial.