Slashdot Mirror
Brian Hook on the ActiveX Experience
Obiwan Kenobi writes "Brian Hook of id software fame got around to developing on ActiveX and found some minor grievances, particularly in the security department. To quote: "I've been doing some ActiveX coding on the side for a couple days, stuff I'm not familiar with, and I'm just flat out _appalled_ at how bad that entire API and design is. I can make an OCX that basically formats your hard drive, stick it on a Web page with a tag, and if your security settings are set low enough, you'll start formatting your hard drive the minute you visit my Web page.""
I wonder if anybody knew that before... LOL.
Loading...
I can make an OCX that basically formats your hard drive, stick it on a Web page with a tag, and if your security settings are set low enough, you'll start formatting your hard drive the minute you visit my Web page
Please. DO IT NOW. Thanks.
Free XBox, PS2
what rock has he been under all these years?
AZTEK
Well, that would eliminate the problem of people not knowing how to format their hard drive
I'm not sure I want to follow that link...
Ooh, a sarcasm detector. Oh, that's a real useful invention.
Does he mean the settings low enough to actually use it on the internet?
Why not just create a "zone" hopper, then he doesn't have to worry about your settings. Better yet, just use one of the existing ones.
A computer once beat me at chess, but it was no match for me at kick boxing. Emo Philips
Firt po...
Formatting C: 5% Complete
Can you send a link?
...to point out potential issues in .Net. Even MS is no longer pushing ActiveX/COM. They are rewriting that trash out of their architectures as fast as they can. Maybe .Net doesn't come off as bad as COM, so can't be used to ridicule MS.
I guess it's surprising brian hook is interested in anything to do with web design, an activex intrest is even more odd.
:)
ActiveX is an aweful problem, I guess the only reason IE users are as safe as they are is the level of integrity in many website (better than we have thought in the past maybe...)
Btw, thanks for the FP editors
"And we have seen and do testify that the Father sent the Son to be the Savior of the World"
1 John 4:14
I think he's more famous for creating glide when he was at 3DFX
I hope virus writers won't find out about this!
-------
Warning: Slashdot may contain traces of nuts.
That is, more ammo to use when telling people to get off of MSIE. The prospect of having a webpage completely wipe their hard drives clean is something that should scare even the most lackidaisical of users.
What if the hokey-pokey really is what it's all about?
I shutter at the thought of running any code that I (or at least someone else) has not inspected. Just another reason to use Firefox and other opensource software.
Slashdot = ((Technology + Politics) / Trolls) % Grammar Nazis
Setup www.formatmyharddrive.com. Online hard drive formatting, done in minutes, only $5.
I think this could be considered as a proof of how ActiveX was vapor-designed by Microsoft to compete with original Netscape's plugins.
1. Examine more or less how competition works
2. Quick! Make a prototype and flat-out obvious bugs
(Missing step: redesign well taking into account security considerations)
3. Overhype
4. Profit!
So now we're stuck with an obsolete plugin model, which Microsoft neglects to fix because this would break backwards compatibility.
THE END.
Nasty? But I got all this stuff installed on my hard drive without having to worry about it. Programs like Gator are so nice! I mean, they pop up without me even having to find them. And Norton says this one programs says it's logging my keystrokes. It's so nice to have a typing analyst installed automatically. I wonder if it'll tell me which words I misspell the most.
I'm really finding it hard to give this guy any credibility at all. First off, none of the issues he cites are in any way new, these problems are old hat. But then to get all nit picky about the details of these issues by professing things like 'I don't use ATL, I write my ActiveX in MFC.' Shit, I don't even know where to begin. The guys just now digging into ActiveX and has decided flat out that MFC is the way to do it? Strike 1, and strike 2. Not immediately dropping it and moving on to something more suitable, you're out man.
I'm dumbfounded by this.
And editors, you're not helping any by posting stories like this. It's all too obvious that this article was posted because it fits the anti-MS slant quite well. That's all fine and good, but this article brings absolutely NOTHING to the table except another excuse to bash MS and an OLD MS technology.
No Comment.
Active X was never meant to be completely secure. It was designed to be faster and more powerful then Java. And it is that, faster because all the code runs natively with no virtual machine, and more powerful because all those annoying security designed are non existent. That is why it is so widely used. And that is why IE systems are full of spyware, that are spamming everyone! But during this time in the late 90s. IT wasn't thinking of security. And why should they. Hacker only came in on non firewalled systems. Downloading an untrusted active X control is just like downloading any other program be it a trogon or a virus, these usually worst case just messed up your files or in nasty cases put bad sectors on your disk (But I think that is an urban myth, I haven't studied virus that much to know for sure). So that was a user error. And with Windows 95 and 98 as a primary OS they already had access for mess up the drive from the system anyways. So while a lot of people were going THINK OF SECURITY MAN! They just go well it is faster then java plus I easily save files to the disk. I am using this.
The move to a strong security model just started to really happen by the year 2000 when common people started getting high-speed internet access at less cost then the companies are paying for their T1 lines. Then they started clamoring to make everything secure but because they laid off the bulk of their IT employees they became under manned to fight security. So it is now a long slow process of building up IT security.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
even WIDESPREAD coverage that the site is LETHAL to a computer wouldn't keep people from visiting it. When the "I Love You" virus hit a while back, we actually had users open the e-mail "just to make sure" it wasn't really someone sending them a love letter (like they EVER got them before and would SUDDENLY begin to, entirely by coincidence, right then...)
Like the man said about tsunami alerts in the United States: "There's still a large segment of the population that would go get their kids out of school so they could drive to the beach and watch the big waves..."
This space intentionally left (almost) blank.
If only the media could understand the magnitude of how completely frakked this OS design is in Windows, our government would start using systems less likely to be compromised during hostile acts against the US and its population.
Not that any OS that doesn't use ActiveX is perfect...nothing is. But allowing the OS to be commanded through something as commonplace as a Web page or email is just ASKING for it.
"No networked computers on my ship," says Adama in the new Galactica series. That point saves their asses from the other ships of the fleet, whose computers were rooted by the Cylons and quickly destroyed because of over-integration.
Sure, it's fiction. But fiction has a grain of fact in it to make it real.
Vos teneo officium eram periculosus ut vos recipero is.
...but it should be repeated until everyone has heard it loud and clear. ActiveX is dangerous.
- Sco claims ownership of linux source code!
- Apple has released new products!
- DVD CSS encryption has been broken!
- RIAA threatened by P2P networks!
- Darth Vader is Lukes Father!
- BSD is dying!
Its good to keep up to date on all the latest news.
air and light and time and space
He'd never lie to us, would he?
See what I've been reading.
...I can tell you you can create some pretty cool stuff in a short time.
Like a webpage that formats your hard drive!
Like the man said about tsunami alerts in the United States: "There's still a large segment of the population that would go get their kids out of school so they could drive to the beach and watch the big waves..."
Those who still do not believe in natural selection raise their hands. No-one? Didn't think so.
Black holes are where God divided by zero
That's it exactly.
To put it another way, if you change a single setting in a single program (IE) any web page can zap your system. To make your *nix box as insecure, you have to change the file permissions for every single file on the system.
IE is a single point of failure. That's what makes the comparison invalid. You'd have to go out of your way to screw up a *nix box that bad.
Weaselmancer
rediculous.
Microsoft makes it pretty clear that arbitrary code can be ran from a web page in the security dialog.
What is lacking is sandboxing. Here is a typical example. I go to a site to use a service. It has an active X control. I need to use the control, but don't fully trust them. My options are A) find another service, or B) run it and hope for the best. That is unacceptable. There needs to be an option C) run it in a sandbox, and don't let it read my files, or overwrite anything. I mean this is not brain surgery here. Java can do it, and Sun does not have the OS code.
For those old enough to remember Windows95 and Windows3.1, activeX was called "ole" short for Object Linking and Embedding.
It was used in VB to drag and drop controls and parts of applications. Thats it.
For example you could slap together an app that uses Excel by using the ole (activeX) control from the program and putting it on the form.
Anyway its powerfull and security is not an issue since it was designed to be used in internal apps at compile time by VB and VC developers.
MS was panicked by netscape plugins wbecause ms didn't control it. What MS should have done was base ActiveX on ole, take out some features and add security oriented ones in return. Instead they gave out the ole controls with a dumb hackable trust based pop-up as a bandaid solution for the security.
http://saveie6.com/
Yep, sounds like a great deal.
ich bin der musikant
mit taschenrechner in der hand
kraftwerk
The default button (which I think is "Ok") will let the thing run.
The default button is and always has been "NO".
When ActiveX was first announced in the 90's people complained about it's lack of security model. ActiveX was MS's answer to Java applets. Problem was that Java was built from the ground up with security in mind. The security model runs applets in a constrained (sandbox) environment to eliminate the threat of malware. ActiveX initially had no security model. Early on, when complaints were voiced MS added code-signing putting the onus on users to distinguish between legitimate code and malware.
Over the years, the view of the critics have proved accurate. Java applets have had a few security problems - usually related to buffer overflows in the VM. ActiveX has been and continues to be a security disaster.
[Insert pithy quote here]
It's lose, darnit, lose lose LOSE !
Wait a minute, you actually meant to say "loose", didn't you?
Between using "lose/loose" correctly and not writing "This begs the questions:", I'm prompted to ask: what are you doing on Slashdot? We don't take decent grammar lightly around here, bucko.
Dewey, what part of this looks like authorities should be involved?
My wife isn't terribly computer savvy (at least, she wouldn't be if she weren't married to a CompSci person), but she's perfectly content with Mac OS X asking for her password before updating system software. It's an immediate red flag that something important is about to happen, and I think she'd be extremely hesitant to type it in response to clicking on a link to a web page.
Dewey, what part of this looks like authorities should be involved?
ActiveX is simply a "better" Netscape plugin.
You seem to have misspelled "horribly horribly worse" as "better" there. Hope that helps. Have a nice day.
...to play in FireFox's sandbox, not to t0t411`/ 0wn3rz uR |-|4r|) |)15k or any other hardware you happen to have, which is the level of trust you're extending to ActiveX.
There's a slight difference.
Got time? Spend some of it coding or testing
The original poster wrote: if it's security infrastructure is sufficiently loose. I say we ask Taco to unban him in light of this new evidence.
Vino, gyno, and techno -Bruce Sterling