W3C home > Mailing lists > Public > public-fx@w3.org > October to December 2011

Re: Merging CSS Shaders proposal into Filter Effects

From: Vincent Hardy <vhardy@adobe.com>
Date: Mon, 31 Oct 2011 16:47:53 -0700
To: "Tab Atkins Jr." <jackalmage@gmail.com>
CC: Patrick Dengler <patd@microsoft.com>, Dirk Schulze <vbs85@gmx.de>, Dean Jackson <dino@apple.com>, "public-fx@w3.org" <public-fx@w3.org>
Message-ID: <55FD7F38-9B1F-4F52-B849-CAAC92C1AC13@adobe.com>

On Oct 31, 2011, at 4:34 PM, Tab Atkins Jr. wrote:

> On Mon, Oct 31, 2011 at 10:30 AM, Vincent Hardy <vhardy@adobe.com> wrote:
>> Tab: you mention that more things than the shading language are contentious.
>> Can you explain what these contentious issues are?
>> Are you referring to the issues raised on the mailing list:
>> http://www.w3.org/Graphics/fx/wiki/Custom_Filters#Issues_List
>> or something else?
> I'm specifically referring to the issue of selecting through a vertex
> filter, and the security issues with using a fragment shader to
> extract information through a timing channel.  Both of these are
> unaddressed and probably difficult to deal with, and may take a decent
> amount of time to deal with.

The issue of selection in a shader (vertex and/or fragment) is the same as with other filter effect. It may be more obvious with vertex shaders, but essentially, the issue is the same.

There has been a lot of discussion on the timing attack, but I would note two important things:

a. it is much harder to time the processing time in a CSS shader than in WebGL. You can basically time a shader the same way to time any rendering in HTML/CSS/SVG.

b. from discussions with Dean on the webkit-dev mailing list (I think Dean will forward his points), it is possible to mount a timing attack with regular filters.

My point here is that these issues are important but not unique to CSS shaders. They apply to filter effects in general and I think they should be addressed together, one more reason to want to keep filter effects and shaders together.

>> The CSS shaders proposal responds to the feCustom 'question' in the 'Filter
>> Effects' specification and it seems more natural to integrate it than keep
>> it a separate specification.
> Or we can just move the definition of <feCustom> to Shaders.

Sure, but my point was that CSS shaders are in the scope of Filter Effects.

Received on Tuesday, 1 November 2011 00:10:33 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 19:49:39 UTC