Yes, but I've also had audio, webcam, scanner & IDE drivers BSOD my computers over the years as well. Drivers usually get better with time, but crappy drivers aren't unique to video cards.Absolutely. But webcam, scanner, and disk drivers are not accepting attacker-chosen data from the internet. The audio driver may occasionally. I would be surprised if there had never been any remotely exploitable security vulnerabilities, particularly involving driver support of complex audio compression formats.
VM software is getting better at passing 3D through to the native hardware, so it may be easier than you think.
Yeah, this will be something to watch.
This is the story of software in general. As long as there will be software, there will be bugs, some of them severe. Doesn't mean you just accept it & not try to prevent them, but you also don't stifle innovation because of the fear of causing them.
The world's botnet and antivirus vendors thank you for your commitment innovation.
Not really, they've supported multiple 3D accessible contexts for years & years now.
Right, but to what extent have they been really tested as a security boundary?
http://www.google.com/search?q=malicious+shader -> 30 results. It is the dawning of a new era.
Also if you're running Vista or Windows 7 you are more than likely already relying on the 3D hardware to render your 2D desktop. Web browsers are already using features of 3D hardware to further accelerate non-WebGL content.
No, web browsers are not accepting shader code from websites and feeding it to the GPU.
>The GPU can access host memory directly with no access permissions.
So can your CPU, what's stopping rogue apps from doing so? Software.
A lot of software built on very carefully designed hardware memory protections that took decades to mature into the brittle systems we have now.
Out of curiosity, do any GPUs have no-execute page permissions?
And what stops a GPU from modifying the execute-disable bits on CPU-managed memory pages?
WebGL mainly involves writing GLSL scripts that act on buffers & arrays of data. You are limited to what data types you can upload into the video card.
GLSL is a Turing-complete language, so no, it is an unlimited data type. It is provably impossible to put limits on its behavior before you run it. The best you can do is run it with limited access to other memory space. But if that were implemented perfectly, video drivers would never crash.
Perhaps there are more vectors for vulnerability, but I'd rather see WebGL take off as a transparent standard, than rely on Adobe.
Well anything looks good if your standard of comparison is low enough. :-)
I admit I'd like to see more granularity as far as control. Last thing I want is WebGL ads eating up my GPU/CPU/Battery rendering stupid ragdolls physics simulations.
Noscript is your friend!