Brian Hook on the ActiveX Experience

← Back to Stories (view on slashdot.org)

Brian Hook on the ActiveX Experience

Posted by Hemos on Monday January 17, 2005 @05:32AM from the poorly-made-and-maintained dept.

Obiwan Kenobi writes "Brian Hook of id software fame got around to developing on ActiveX and found some minor grievances, particularly in the security department. To quote: "I've been doing some ActiveX coding on the side for a couple days, stuff I'm not familiar with, and I'm just flat out _appalled_ at how bad that entire API and design is. I can make an OCX that basically formats your hard drive, stick it on a Web page with a tag, and if your security settings are set low enough, you'll start formatting your hard drive the minute you visit my Web page.""

37 of 523 comments (clear)

Gee, that's news... by Assmasher · 2005-01-17 05:33 · Score: 4, Funny

I wonder if anybody knew that before... LOL.

--
Loading...
1. Re:Gee, that's news... by Frymaster · 2005-01-17 05:39 · Score: 4, Interesting
  I wonder if anybody knew that before...
  well, it is pretty obvious. although the key phrase here is "if the user's security settings are set low enough."
  i mean, any operating system is vulnerable to an exploit if it's security infrastructure is sufficiently loose. if you set your entire filesystem to 777 then you're completely vulnerable on any unix-based os too.
  the real questions here are:
  
  how low is "sufficiently low"
  
  how low is the security level out of the box
  --
  2 1337 4 u!
2. Re:Gee, that's news... by Gordonjcp · 2005-01-17 05:45 · Score: 5, Interesting
  
  If you set your entire filesystem to 777 then loads of stuff will just throw up its metaphorical hands and refuse to run. Try it on a throwaway box some time (actually, User Mode Linux is good for experimenting with Practical Unix Terrorism, but that's a whole other topic).
3. Re:Gee, that's news... by jellomizer · 2005-01-17 05:48 · Score: 4, Insightful
  
  Well people start getting these warning messages and they realize that they are usually there to help them out they just go and lower their security settings so they don't get botherd by the messages. While the average useser plays dumb they will ineateate a high amount of intelegence to say get his online poker game to run. But after it corrupts his drive he will point to you and tell you to fix it.
  
  --
  If something is so important that you feel the need to post it on the internet... It probably isn't that important.
4. Re:Gee, that's news... by sepluv · 2005-01-17 05:53 · Score: 5, Insightful
  
  And what may I ask makes a signed active-X control any less dangerous than an unsigned one?
  
  --
  Joe Llywelyn Griffith Blakesley
  [This post is in the public domain (copyright-free) unless otherwise stated]
5. Re:Gee, that's news... by All+Names+Have+Been · 2005-01-17 05:53 · Score: 4, Insightful
  
  i mean, any operating system is vulnerable to an exploit if it's security infrastructure is sufficiently loose.
  
  The problem is, there aren't many OS's out there that arbitrarily run dangerous code from a web page with no interaction from the user other than visiting the page in question, low security settings or not.
6. Re:Gee, that's news... by mcrbids · 2005-01-17 05:57 · Score: 4, Insightful
  
  any operating system is vulnerable to an exploit if it's security infrastructure is sufficiently loose. if you set your entire filesystem to 777 then you're completely vulnerable on any unix-based os too.
  
  Really? So, if I chmod 777 my, uh, /tmp or /mnt/deleteme directory, you can make a web page that will delete it all from within my Firefox browser? On my Fedora Core 3 laptop?
  
  Are you sure?
  
  See, to do this, you have to get a script or something to run on my system to delete these locations. Show me where even lowly jscript allows for this...
  
  Now, I'm no jscript guru, so I did a google search for jscript delete files and, on at least the first page or two, only came up with stuff having to do with the ".NET framework" or involving ActiveX!
  
  And the point isn't that files can be deleted, the point is that the API for ActiveX allows somebody to do this remotely.
  
  --
  I have no problem with your religion until you decide it's reason to deprive others of the truth.
7. Re:Gee, that's news... by realdpk · 2005-01-17 06:02 · Score: 4, Informative
  
  A signed control can come from anywhere, too. A lot of spyware is signed.
8. Re:Gee, that's news... by Waffle+Iron · 2005-01-17 06:41 · Score: 4, Insightful
  
  Of course you have to trust the CA who issued the certificate that signed the control
  Does Verisign review the source code for the controls that its certificates are applied to? I think not.
  About the only thing that we can "trust" is that Verisign got a check from the developers. The ability to mail a check != trustworthiness.
9. Re:Gee, that's news... by Fulcrum+of+Evil · 2005-01-17 07:35 · Score: 4, Insightful
  
  Sure. But you know the signer. And you agree to install it.
  
  I'd rather have the Java model, where it requests specific permissions. I actually don't know the author, unless it's MS or Macromedia or someplace similar. Real security is proactive, not reactive. Besides, most software absolves itself of all responsibility, so what could you really do? Show up at their door with a baseball bat?
  
  --
  "We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
Do it by savagedome · 2005-01-17 05:33 · Score: 5, Funny

I can make an OCX that basically formats your hard drive, stick it on a Web page with a tag, and if your security settings are set low enough, you'll start formatting your hard drive the minute you visit my Web page

Please. DO IT NOW. Thanks.

--

Free XBox, PS2
1. Re:Do it by mordors9 · 2005-01-17 05:39 · Score: 4, Funny
  
  But does it run on Linux ;-)
2. Re:Do it by CactusInvasion · 2005-01-17 05:45 · Score: 4, Funny
  
  Aha! Finally a reason for me to have been running BeOS for all these years!
So... by Aztek · 2005-01-17 05:34 · Score: 5, Funny

what rock has he been under all these years?

--
AZTEK
Easy Formatting by kdark1701 · 2005-01-17 05:34 · Score: 5, Funny

Well, that would eliminate the problem of people not knowing how to format their hard drive
First Post by Anonymous Coward · 2005-01-17 05:35 · Score: 4, Funny

Firt po...

Formatting C: 5% Complete
Wouldn't it be more useful... by Anonymous Coward · 2005-01-17 05:36 · Score: 4, Interesting

...to point out potential issues in .Net. Even MS is no longer pushing ActiveX/COM. They are rewriting that trash out of their architectures as fast as they can. Maybe .Net doesn't come off as bad as COM, so can't be used to ridicule MS.
Oh, no! by Jacco+de+Leeuw · 2005-01-17 05:37 · Score: 4, Funny

... and if your security settings are set low enough, you'll start formatting your hard drive the minute you visit my Web page.
I hope virus writers won't find out about this!

--
-------
Warning: Slashdot may contain traces of nuts.
More Ammo by TSR+Wedge · 2005-01-17 05:37 · Score: 5, Interesting

That is, more ammo to use when telling people to get off of MSIE. The prospect of having a webpage completely wipe their hard drives clean is something that should scare even the most lackidaisical of users.

--
What if the hokey-pokey really is what it's all about?
1. Re:More Ammo by Mysticalfruit · 2005-01-17 05:45 · Score: 4, Funny
  
  If your going todo that, you might as well go full monte and create an activeX control that would format the harddrive and install linux... then it would be something useful...
  
  --
  Yes Francis, the world has gone crazy.
Crazyness by bburton · 2005-01-17 05:37 · Score: 4, Interesting

"First off, by default IE will not allow you to run an unsigned control. A control can be digitally signed, verifying that it came from you, and the signing process is arduous enough that, say, a bored junior high school student won't bother with the process. Unfortunately, anyone with $20 and who DOES care can get signed relatively easily."
Besides the obviously stupidness inherent with ActiveX and its purpose, this is another really good reason why I refuse to use it. It doesn't have to be a program that formats my hard drive. It can be a piece of spyware, or some annoying ad pop-up that gets installed. There is no good way to implement natively executed ActiveX controls, at least for anything other than a company or website I know in advance that I trust unconditionally.

I shutter at the thought of running any code that I (or at least someone else) has not inspected. Just another reason to use Firefox and other opensource software.

--
Slashdot = ((Technology + Politics) / Trolls) % Grammar Nazis
Hey, I bet he could make money by Anonymous Coward · 2005-01-17 05:37 · Score: 5, Funny

Setup www.formatmyharddrive.com. Online hard drive formatting, done in minutes, only $5.
1. Re:Hey, I bet he could make money by headkase · 2005-01-17 05:59 · Score: 4, Funny
  
  Just make sure their credit card details are sent before their hard drive is formatted...
  :)
  
  --
  Shh.
Vapor design by Spy+der+Mann · 2005-01-17 05:38 · Score: 5, Insightful

I think this could be considered as a proof of how ActiveX was vapor-designed by Microsoft to compete with original Netscape's plugins.

1. Examine more or less how competition works
2. Quick! Make a prototype and flat-out obvious bugs
(Missing step: redesign well taking into account security considerations)
3. Overhype
4. Profit!

So now we're stuck with an obsolete plugin model, which Microsoft neglects to fix because this would break backwards compatibility.

THE END.
Re:ActiveX Experience by CactusInvasion · 2005-01-17 05:39 · Score: 4, Funny

Nasty? But I got all this stuff installed on my hard drive without having to worry about it. Programs like Gator are so nice! I mean, they pop up without me even having to find them. And Norton says this one programs says it's logging my keystrokes. It's so nice to have a typing analyst installed automatically. I wonder if it'll tell me which words I misspell the most.
Nothing new. by GeckoX · 2005-01-17 05:43 · Score: 4, Insightful

I'm really finding it hard to give this guy any credibility at all. First off, none of the issues he cites are in any way new, these problems are old hat. But then to get all nit picky about the details of these issues by professing things like 'I don't use ATL, I write my ActiveX in MFC.' Shit, I don't even know where to begin. The guys just now digging into ActiveX and has decided flat out that MFC is the way to do it? Strike 1, and strike 2. Not immediately dropping it and moving on to something more suitable, you're out man.

I'm dumbfounded by this.

And editors, you're not helping any by posting stories like this. It's all too obvious that this article was posted because it fits the anti-MS slant quite well. That's all fine and good, but this article brings absolutely NOTHING to the table except another excuse to bash MS and an OLD MS technology.

--
No Comment.
1. Re:Nothing new. by arendjr · 2005-01-17 06:02 · Score: 4, Interesting
  
  While I agree it's somewhat of a flamebait story, there's some validity to bashing ActiveX. You call ActiveX an old technology and so MS shouldn't be bashed for it, but as long as MS hasn't developed something better (which can take quite a while) it should be counted for as their currently best offering in that area, which is quite pathetic really. If you add to that the fact they dropped Netscape plugin support with IE6 so as to get everyone on ActiveX, it's really their own fault they're getting bashed about it.
2. Re:Nothing new. by brunogirin · 2005-01-17 07:08 · Score: 5, Insightful
  
  I think you're missing the context here. First, this is a personal entry on a site that is read by very few users, it wasn't meant to be "news". Second, Brian, who had never done anything with ActiveX, decides to try the technology "on the side". He has heard all the horror stories about ActiveX but actually *using* the technology makes him realise that all the horror is real and, slightly amazed by his discovery, posts on that site. He is just expressing his dismay at the fact that all the horror stories about ActiveX are not myth but reality. Everyone of us does this: experiment to see for oneself and then share one's experiment with others. The findings might be old news for some but are not without interest.
  In practice, I find this article very interesting for what it is: the findings of someone who is a recognised programmer into a field he has no knowledge about; and that prove that all the ghastly rumours about ActiveX are true, not hype. Now whether it should be on /. is another question.
Site visit results in disk reformat. Sad thing is: by The_REAL_DZA · 2005-01-17 05:44 · Score: 4, Insightful

even WIDESPREAD coverage that the site is LETHAL to a computer wouldn't keep people from visiting it. When the "I Love You" virus hit a while back, we actually had users open the e-mail "just to make sure" it wasn't really someone sending them a love letter (like they EVER got them before and would SUDDENLY begin to, entirely by coincidence, right then...)

Like the man said about tsunami alerts in the United States: "There's still a large segment of the population that would go get their kids out of school so they could drive to the beach and watch the big waves..."

--

This space intentionally left (almost) blank.
Other Big News Items: by PopeAlien · 2005-01-17 05:46 · Score: 4, Funny

- Sco claims ownership of linux source code!
- Apple has released new products!
- DVD CSS encryption has been broken!
- RIAA threatened by P2P networks!
- Darth Vader is Lukes Father!
- BSD is dying!

Its good to keep up to date on all the latest news.

--
air and light and time and space
Re:You know... by The+Cisco+Kid · 2005-01-17 05:51 · Score: 5, Funny

If you are using IE, I'd be scared to follow any link if I were you.
Re:Site visit results in disk reformat. Sad thing by allanj · 2005-01-17 05:59 · Score: 4, Funny

Like the man said about tsunami alerts in the United States: "There's still a large segment of the population that would go get their kids out of school so they could drive to the beach and watch the big waves..."

Those who still do not believe in natural selection raise their hands. No-one? Didn't think so.

--
Black holes are where God divided by zero
Bingo. by Weaselmancer · 2005-01-17 05:59 · Score: 4, Insightful

That's it exactly.

To put it another way, if you change a single setting in a single program (IE) any web page can zap your system. To make your *nix box as insecure, you have to change the file permissions for every single file on the system.

IE is a single point of failure. That's what makes the comparison invalid. You'd have to go out of your way to screw up a *nix box that bad.

--
Weaselmancer
rediculous.
1. Re:Bingo. by adiposity · 2005-01-17 06:40 · Score: 4, Insightful
  
  Actually, that's false. This is only true if you run in windows as "root" (Administrator). If you login into X-windows as root, you're just as vulnerable (assuming you are using a program like IE that will allow some script to do something malicious).
  
  The obvious problem is that it's much more common to run Windows as "root" than it is on *nix, for various reasons. Not the least of which is the fact that *nix users usually are smart enough to use one account for administration, and other for doing "user" stuff. Also not the least of which is that many Windows apps aren't written in such a way that it's feasible to run them in non-root mode.
  
  This isn't to say that Active-X isn't dangerous...it is. But the big difference between *nix and Windows here, is that *nix is run by somewhat security-savvy people, and Windows (often) isn't. With "user-friendly" linuxes coming out, many of which login as root by default, a lot of that protection will go away.
  
  The average user simply isn't willing to have an "administrator" account that they have to use every time they want to install an app. That fact means that for *nix to go mainstream, a lot of security inherent in *nix philosophy will have to be lost.
  
  Luckily, mozilla/firefox are being designed in such a way that they are much less likely to exploit lax security than IE is. This will only partially mitigate the problem, though, as people dumb enough to click on a random link and run the program can still get screwed.
  
  -Dan
Re:Yeah, well... by 99BottlesOfBeerInMyF · 2005-01-17 06:05 · Score: 4, Interesting

Microsoft makes it pretty clear that arbitrary code can be ran from a web page in the security dialog.

What is lacking is sandboxing. Here is a typical example. I go to a site to use a service. It has an active X control. I need to use the control, but don't fully trust them. My options are A) find another service, or B) run it and hope for the best. That is unacceptable. There needs to be an option C) run it in a sandbox, and don't let it read my files, or overwrite anything. I mean this is not brain surgery here. Java can do it, and Sun does not have the OS code.
Grammar check, please! by Just+Some+Guy · 2005-01-17 08:06 · Score: 4, Funny

i mean, any operating system is vulnerable to an exploit if it's security infrastructure is sufficiently loose.
It's lose, darnit, lose lose LOSE !
Wait a minute, you actually meant to say "loose", didn't you?
Between using "lose/loose" correctly and not writing "This begs the questions:", I'm prompted to ask: what are you doing on Slashdot? We don't take decent grammar lightly around here, bucko.

--
Dewey, what part of this looks like authorities should be involved?
Ever heard of OS X? by Just+Some+Guy · 2005-01-17 08:22 · Score: 4, Informative

The average user simply isn't willing to have an "administrator" account that they have to use every time they want to install an app.
My wife isn't terribly computer savvy (at least, she wouldn't be if she weren't married to a CompSci person), but she's perfectly content with Mac OS X asking for her password before updating system software. It's an immediate red flag that something important is about to happen, and I think she'd be extremely hesitant to type it in response to clicking on a link to a web page.

--
Dewey, what part of this looks like authorities should be involved?