Hacker News Reader

Comment by Gravyness | Hacker News Reader

I propose a "This website wants to use WebGL" browser dialog before returning `getContext("webgl")`

Firefox already the same thing for html5 canvas [1], enabled I think via privacy.resistFingerprinting (in about:config). A similar feature would make sense for webGL. In the meantime, power users can disable webGL entirely via webgl.disabled (but without a user-friendly prompt to warn you when it's being blocked).

[1] https://www.ghacks.net/2017/10/28/firefox-58-warns-you-if-si...

The problem with popups like that is too many, or ones where the user doesn't understand why it's blocked leads to fatigue where they just start approving everything

Agreed, but it would be nice to have an "advanced (paranoid) mode". E.g., I run little snitch and while it is super noisy, I don't mind the overhead, but I wouldn't force it on everyone.

Paradoxically, that backfires. If we only let a small subset of users disable WebGL... well, having WebGL disabled _becomes_ the identifying characteristic.

Probably not that hard to build an extension for.

The hard part is that WebGL is a pretty narrow to concept to communicate this way for most users. It's hardly a Camera or Microphone.

Most not technical users have no basis for action here.

"Do you want to let the website use WebGL? It's either for rendering 3D graphics, such as 3D games, or an attempt to exploit bugs in WebGL to maliciously take full control over your machine, which may succeed if you consent"

Full control only if the exploit works, otherwise you may end up with some data loss from the proprietary NVIDIA black screen of death on a linux.

Safari did this in the original implementation - it turns out to be absolutely useless. A person cannot know whether they should be clicking yes, even if they are well versed in the technology.

Exactly this. WebGL has plenty of legitimate use cases, but those won't really suffer much from such a dialog (as long as it's reasonably phrased).

Until poorly-constructed websites and/or 3rd-party ad spyware added by the marketing dept starts requiring it or the site breaks. Just like Javascript, third-party cookies, canvas, localstorage...

Also Google runs the browser standards by way of their Chrome market share, and they would surely never implement something like this until they were confident that they didn't need WebGL for fingerprinting, at which point they'd just stop supporting WebGL entirely in favor of something that they invented.

It's not Embrace Extend Extinguish with Google; it's more like Embrace Replace Extinguish.

You'd be surprised how many websites use WebGL now. You'd probably end up with some sort of whitelist like the Google one for web audio, otherwise end users would complain incessantly.

Web Audio's autoplay block was implemented in a very poor way though, basically guaranteeing that existing content will be broken with the user having no way to unbreak it.

Even simpler would be something like what Apple did with the clipboard in iOS, where it displays a message whenever it’s used.

except that as this post shows many sites will produce that, causing notification exhaustion

I definitely agree with you.

Reply on news.ycombinator.com