I'm not mixing them up. Merely illustrating the point that giving websites
too much power to execute anything but properly sandboxed, constrained code
is a bad thing.
It's in fact a somewhat good way to contrast, JavaScript is an interpreted
scripting language that's heavily sandboxed, and Java is a powerful,
compiled, full-featured language that can be used for heavy-duty
applications. JavaScript was made with a browser in mind, Java was made with
a powerful, cross-platform programming language in mind. Trying to shoehorn
it into a sandbox for the web long after the fact has had some rather
predictable results.
WebGL is an OpenGL API exposed by way by JavaScript, never claimed it had
anything to do with Java, and Java has it's own libraries of OpenGL bindings
anyway.
The freedom issue is unrelated to the security issue, which is what I'm
talking about.
Point is, all software has bugs, that's just the reality. Ideally speaking,
due to proper sandboxing and the browser running with limited priviledges,
and NX bits, the worst thing a bug in a javascript interpreter can do is
crash your browser. Again, ideally speaking.
Now contrast that with a decent dedicated GPU, more or a less a powerful
computer in itself, and consider what some bugs in the WebGL, or even the
graphics driver, might enable.
..Well yeah, of course it passes through the browser, and the browser
controls if and when to make these calls avaliable. And "modern" browsers btw
all have this enabled by default. Even mobile browsers.
Obviously I'm being paranoid here. Probably much, much too paranoid, but
history has proven time and time again, the very concept of exposing powerful
lower-level features / API's / whatever to the web is quite frankly just a
bad idea.
Flash, Java, ActiveX, they've all been security nightmares, oh so powerful
and oh so convenient at times, but still security nightmares. While WebGL
isn't the same thing, is limited to shader code and can't do too awful much
in theory, it's still another potentially nasty attack vector, and it's still
trading security for.. Eh.. Well, I donno, the ability to play doom in your
browser?
