Slashdot Mirror
Brian Hook on the ActiveX Experience
Obiwan Kenobi writes "Brian Hook of id software fame got around to developing on ActiveX and found some minor grievances, particularly in the security department. To quote: "I've been doing some ActiveX coding on the side for a couple days, stuff I'm not familiar with, and I'm just flat out _appalled_ at how bad that entire API and design is. I can make an OCX that basically formats your hard drive, stick it on a Web page with a tag, and if your security settings are set low enough, you'll start formatting your hard drive the minute you visit my Web page.""
I think this could be considered as a proof of how ActiveX was vapor-designed by Microsoft to compete with original Netscape's plugins.
1. Examine more or less how competition works
2. Quick! Make a prototype and flat-out obvious bugs
(Missing step: redesign well taking into account security considerations)
3. Overhype
4. Profit!
So now we're stuck with an obsolete plugin model, which Microsoft neglects to fix because this would break backwards compatibility.
THE END.
I'm really finding it hard to give this guy any credibility at all. First off, none of the issues he cites are in any way new, these problems are old hat. But then to get all nit picky about the details of these issues by professing things like 'I don't use ATL, I write my ActiveX in MFC.' Shit, I don't even know where to begin. The guys just now digging into ActiveX and has decided flat out that MFC is the way to do it? Strike 1, and strike 2. Not immediately dropping it and moving on to something more suitable, you're out man.
I'm dumbfounded by this.
And editors, you're not helping any by posting stories like this. It's all too obvious that this article was posted because it fits the anti-MS slant quite well. That's all fine and good, but this article brings absolutely NOTHING to the table except another excuse to bash MS and an OLD MS technology.
No Comment.
even WIDESPREAD coverage that the site is LETHAL to a computer wouldn't keep people from visiting it. When the "I Love You" virus hit a while back, we actually had users open the e-mail "just to make sure" it wasn't really someone sending them a love letter (like they EVER got them before and would SUDDENLY begin to, entirely by coincidence, right then...)
Like the man said about tsunami alerts in the United States: "There's still a large segment of the population that would go get their kids out of school so they could drive to the beach and watch the big waves..."
This space intentionally left (almost) blank.
Well people start getting these warning messages and they realize that they are usually there to help them out they just go and lower their security settings so they don't get botherd by the messages. While the average useser plays dumb they will ineateate a high amount of intelegence to say get his online poker game to run. But after it corrupts his drive he will point to you and tell you to fix it.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
And what may I ask makes a signed active-X control any less dangerous than an unsigned one?
Joe Llywelyn Griffith Blakesley
[This post is in the public domain (copyright-free) unless otherwise stated]
i mean, any operating system is vulnerable to an exploit if it's security infrastructure is sufficiently loose.
The problem is, there aren't many OS's out there that arbitrarily run dangerous code from a web page with no interaction from the user other than visiting the page in question, low security settings or not.
any operating system is vulnerable to an exploit if it's security infrastructure is sufficiently loose. if you set your entire filesystem to 777 then you're completely vulnerable on any unix-based os too.
/tmp or /mnt/deleteme directory, you can make a web page that will delete it all from within my Firefox browser? On my Fedora Core 3 laptop?
Really? So, if I chmod 777 my, uh,
Are you sure?
See, to do this, you have to get a script or something to run on my system to delete these locations. Show me where even lowly jscript allows for this...
Now, I'm no jscript guru, so I did a google search for jscript delete files and, on at least the first page or two, only came up with stuff having to do with the ".NET framework" or involving ActiveX!
And the point isn't that files can be deleted, the point is that the API for ActiveX allows somebody to do this remotely.
I have no problem with your religion until you decide it's reason to deprive others of the truth.
That's it exactly.
To put it another way, if you change a single setting in a single program (IE) any web page can zap your system. To make your *nix box as insecure, you have to change the file permissions for every single file on the system.
IE is a single point of failure. That's what makes the comparison invalid. You'd have to go out of your way to screw up a *nix box that bad.
Weaselmancer
rediculous.
Does Verisign review the source code for the controls that its certificates are applied to? I think not.
About the only thing that we can "trust" is that Verisign got a check from the developers. The ability to mail a check != trustworthiness.
Sure. But you know the signer. And you agree to install it.
I'd rather have the Java model, where it requests specific permissions. I actually don't know the author, unless it's MS or Macromedia or someplace similar. Real security is proactive, not reactive. Besides, most software absolves itself of all responsibility, so what could you really do? Show up at their door with a baseball bat?
"We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"