Don't mix up Java and Javascript. They're two completely different things.
Java applets require a plugin (IcedTea for OpenJDK) to work in a browser, and
Java is known to be insecure, though I got the impression when reading this
that this was mostly the proprietary implementation. Javascript is a language
interpreted by web browsers directly; it doesn't need a plugin. WebGL is a
standard for Javascript, not Java.
Yes, I know that WebGL provides a way to give specific instructions to the
GPU, though I don't really know much about that. It's still giving these
instructions to the browser, though, and the browser has to pass the
instructions along. Of course it's bad when browsers do this automatically,
but that's because they end up executing proprietary software on your
computer, and this happens with a lot of Javascript code already. It's a
separate problem that won't be made any worse by a graphics rendering
standard.
I suppose my real question is: what's so bad about web applications using the
GPU "directly", as you say (giving more low-level instructions, I take it)?
Unless there are instructions that can make your GPU melt itself, I can't
think of any possible security problems that could be introduced by that. All
I can think of is that maybe some dickhead could tell the GPU to start
screwing with the display by making it all purple or something, which would
be malicious, but it doesn't have a chance to compromise security in any
really meaningful way; it's just annoyware. And since, as I say, it has to
pass through the browser, if something stupid like that gets prominent,
browsers can offer a way to disable all WebGL code currently running, and if
it's disabled by default (which I think is a good idea to prevent abuse of
the API for things it's not designed for), that kind of code would work in
the first place.
