Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Run user code in a worker #5

Open
1j01 opened this issue Aug 22, 2018 · 0 comments
Open

Run user code in a worker #5

1j01 opened this issue Aug 22, 2018 · 0 comments

Comments

@1j01
Copy link
Owner

1j01 commented Aug 22, 2018

Use WebGLWorker to proxy WebGL code.

  • User code should be sandboxed. Ideally the WebGL graphics stuff would also run in the worker, but running their code in a worker should be enough to prevent tampering with the UI, e.g. stealing accounts if there were any, or overriding inspection features like View Source to hide a virus, and propagating it via Export.
  • The UI should be kept responsive. You should be able to cancel skipping ahead in time, crucially. Currently it's really easy to jump way ahead in time without realizing what you're doing (it looks like simple video controls), and then the page freezes up and you have to close-and-reopen or kill it.

It will likely still be very easy to cause a page crash. Or freezing, but it shouldn't freeze up for reasonable code not trying to be a nuisance.

Ultimately WebGL stuff is still gonna run on the GPU, and go thru video drivers and such, so there are potential exploits there. But if it can't access the network, hopefully it can't do too too much, i.e. can't report information back to a server, and anyways, we can leave that up to browser vendors (hopefully).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant