IE8 May Be End of the Line For Internet Explorer

snydeq writes "InfoWorld's Randall Kennedy reports on rumors that IE8 may be Internet Explorer's swan song: 'IE8 is the last version of the Internet Explorer Web browser,' Kennedy writes. 'It seems that Microsoft is preparing to throw in the towel on its Internet Explorer engine once and for all.' And what will replace it? Some are still claiming that Microsoft will go with WebKit, which is used by Safari and Chrome. The WebKit story, Kennedy contends, could be a feint and that Microsoft will instead adopt Gazelle, Microsoft Research's brand-new engine that thinks like an OS. 'This new engine will supposedly be more secure than Firefox or even Chrome, making copious use of sandboxing to keep its myriad plug-ins isolated and the overall browser process model protected.'" The sticking point will be what Microsoft does about compatibility for ActiveX apps.

Comments

Misleading headline, and ActiveX

[Raindance]

1. Headline should read, IE8 May Be End of the Line for Internet Explorer Engine .

2. I don't see any reason why ActiveX apps couldn't be sandboxed like anything else. Granted, it has deep hooks into the OS-- but if nothing else, given how beefy computers are going to be by the time IE9 comes out, you could give each ActiveX app its own perfectly compatible virtual copy of XP+IE8 to run on, and just parse the result into IE9 format. Destroy the virtualized OS+browser when the app closes.

Moore's Law makes some problems easy, yay. :)

Re:Misleading headline, and ActiveX

[INeededALogin]

given how beefy computers are going to be by the time IE9 comes out

Moore's Law be damned. People have been using this excuse for years to write bloated, crappy software. How about for once we don't try to predict the future. Instead, lets write the code for todays hardware. People seem to forget that we have sold way more computers than people in the world... no reason to replace them all to run IE9.

Re:Misleading headline, and ActiveX

[east coast]

It is clear you do not understand why ActiveX must be married to the operating system.

Really? Because it's not clear that you do. Seriously, would it kill people to bring the issue to the surface in an intelligent manner that might benefit those of us who are outside the loop on this? I'm not asking for a thesis but rather a simple dialog that can be researched by people who are interested in learning more about the issue at hand.

Re:Misleading headline, and ActiveX

[Anonymous Coward]

Because Balmer frowns on extramarital sex between software components

Re:Misleading headline, and ActiveX

[pxlmusic]

i LOL'ed

Re:Misleading headline, and ActiveX

[Anonymous Coward]

ActiveX does not have deep hooks into the OS. It is a calling convention in a DLL with a list of function pointers to defined functions. That's it.

Re:Misleading headline, and ActiveX

[Anonymous Coward]

ActiveX can't be sandboxed because a ton of controls rely on having access to your machine; in fact, that was kind of the point of ActiveX in the first place.

Re:Misleading headline, and ActiveX

[icebike]

Mod parent insightful.

A browser designed for a netbook ought to run just fine on my aging laptop.

Re:Misleading headline, and ActiveX

[PitaBred]

Ever been to Windows update? That's an ActiveX control. How does it get so much information about your computer? By it's deep connection to the OS. ActiveX CANNOT be sandboxed because it needs too many things to be accessible in the OS. Almost all ActiveX components make use of that integration.

Re:Misleading headline, and ActiveX

[Anonymous Coward]

Huh?

Re:Misleading headline, and ActiveX

[geekoid]

Exactly..and Moore's law isn't exatly as reliable as it was 15 years ago when talking about a direct improvement to the desktop computers speed.

Re:Misleading headline, and ActiveX

[Ethanol-fueled]

Right. Everybody knows the name "Microsoft Internet Explorer" for being an insecure shell extension(or whatever it is, but it's not a standalone browser) as well as being the "browser" which is having its ass kicked by FireFox and every other real browser out there.

Microsoft will rebrand and slap a bunch of blinkenlights on their next browser, and then pay other strategic entities huge sums of money so that those others can shove it down our throats like they're trying to do with Silverlight.

Re:Misleading headline, and ActiveX

[Anonymous Coward]

I just like posting "Jew" every once in a while. It's always interesting to see how it gets modded. The fact that it almost invariably turns into "troll" says a lot about those who get blessed with mod points around here. It's a simple adjective, it has absolutely no context in the conversation, and yet people take it as some sort of epithet. What does that say in the larger scheme of things, I wonder?

Re:Misleading headline, and ActiveX

[BlackSnake112]

Needing information and having full control over the system are two different things. If all activex needs is the information, then let it have read only access. Now since most activex programs want a lot more then read only access, this will not work. The question is was it lazy programming that required full root/admin access in order to work or something else?

Some programmers feel that unless they have complete control they cannot get anything done. In development this is fine. Once in testing and production stages why do people insist that they still need to run as root/admin? Run as the least privileged level as you can.

Re:Misleading headline, and ActiveX

[sqlrob]

You can do the same thing with a signed Java Applet. OMG! Java is tightly integrated to the OS!

Re:Misleading headline, and ActiveX

[Anonymous Coward]

A lot of people seem to have little-to-no understanding as to what ActiveX is. It is a plug-in infrastructure based on COM, nothing more, nothing less. It allows for a library to provide a visual component that can be loaded by another application to display content. That plug-in infrastructure was used in Internet Explorer to load browser plug-ins. Those plug-ins run within the browser process under the current user security context. There is absolutely no functional difference between ActiveX in Internet Explorer on Windows or an XPCOM plug-in for Firefox on Linux.

The problem is that in both cases those plug-ins have to have a fairly wide amount of functionality. If that plug-in is intended to display video then it has to be able to work with the video API of the platform in question. As such these plug-ins generally cannot be sandboxed too tightly otherwise they would no longer be able to function and their usefulness of being able to extend the functionality of the browser is lost.

https://addons.mozilla.org/en-US/firefox/browse/type:7

This website lists the XPCOM plug-ins available for Firefox. There are quite a few more if you follow the link to the bottom. If a vulnerability is identified in ANY of those plug-ins a successful exploit will be fully capable of trashing the profile of the current user and there is nothing that Firefox can do to stop it, even on Linux.

Re:Misleading headline, and ActiveX

[the_humeister]

People seem to forget that we have sold way more computers than people in the world

Yes, especially since the emancipation proclamation was nearly 130 years ago.

Re:Misleading headline, and ActiveX

[Darkness404]

, you could give each ActiveX app its own perfectly compatible virtual copy of XP+IE8 to run on, and just parse the result into IE9 format

Sure, but what about the initial download + updates. Already in America not everyone can get high speed internet, even a 700 MB ISO file takes a while to download on many DSL connections so how are you going to download this Gigabyte+ browser compatibility package? It takes up about 1/4ths of a DVD so even including it on Windows 8 install media isn't going to really fly unless there is some rapid migration to Blu-Ray which I just don't see hapening.

Re:Misleading headline, and ActiveX

[Em Emalb]

Most people consider internet explorer to be "the internet".

It's all they've ever known.

Re:Misleading headline, and ActiveX

[Anonymous Coward]

Using quasi-mystical language like "deep connections" in a technical discussion is a good sign the person doesn't know what he's talking about.

ActiveX applications have no more "connections" than any other Win32 app.

Re:Misleading headline, and ActiveX

[TheRealMindChild]

An ActiveX library is not a .NET library. It is a DLL with a "Class Factory" to create your COM objects. Just like any DLL, how exactly are you going to sandbox it properly when the whole development cycle there was access to everything on the system? Can I write to the registry? Can I write to the file system? Can I load another DLL? It would just be a complete mess and still be exploitable in some corner that wasn't planned on. The alternatives being either provide a "safe" only API that ActiveX would have to use, OR you could run the control in a virtual machine of sorts...

And then you'll realize that you just reinvented .NET

Re:Misleading headline, and ActiveX

[afidel]

Well, because they are COM objects they don't just interact with the browser but with the entire system, you can't just sandbox them. A good example are all of the plugins my company uses, they tie functionality between our various enterprise systems ECM, ERP, CRM, etc and Office. This makes the life much easier for the user and provides all sorts of advanced functionality without needing to code up some new interface for the user to learn. Personally I think it would be fine to provide two browsers or two personalities for IE, one that loads when you access sites in the trusted sites zone that allows ActiveX and another that's used everywhere else that doesn't. Microsoft could either provide two executables or they could provide one and use sandboxing and virtualization behind the scenes.

Re:Misleading headline, and ActiveX

[Anonymous Coward]

ActiveX applications have no more "connections" than any other Win32 app.

But I was looking at ActiveX's facebook page and it had like a million friends in common with Windows - isn't that a deep connection?

Re:Misleading headline, and ActiveX

[Applekid]

The question is was it lazy programming that required full root/admin access in order to work or something else?

/. post of the future:

Microsoft breaks ActiveX on new IE/OS
Soandso reports that many people are using the alpha/beta/RTM of IE/OS and finding their ActiveX applications not working.
"Clearly something changed to the host where the ActiveX control lives with this release. Microsoft in one fell swoop has disabled alarmist percentage of web pages."

ActiveX isn't really secure... by interface contract. If they change things around behind the API layers to make it secure they, by contract, could break functionality.

And the dramedy with lazy programmer outcry with the transition from Windows 4 to 5 through even 6 (Cancel or Allow?) trying to make Windows secure only shows why Microsoft really painted themselves into a corner by insisting on maintaining full backwards compatibility.

Things were simply different back then... "When I became a man, I put childish ways behind me." ActiveX should have been depreciated long ago.

Re:Misleading headline, and ActiveX

[Anonymous Coward]

Actually, that seems like more of a flame than a troll...

Re:Misleading headline, and ActiveX

[Anonymous Coward]

Mod parent up. Now! If I had mod points, I'd do that.

Re:Misleading headline, and ActiveX

[Applekid]

ActiveX applications have no more "connections" than any other Win32 app.

But I was looking at ActiveX's facebook page and it had like a million friends in common with Windows - isn't that a deep connection?

You're probably thinking of eHarmony.

Re:Misleading headline, and ActiveX

[Gilmoure]

When my daughter came home from first day of computer class in kindergarten, she sat down at her computer (iMac G4) she poked around for a few minutes and then burst in to tears. She had a new website she wanted to show us but couldn't find the 'blue e' to get to it. I explained how web sites could be viewed by any web browser. She already had Firefox and Safari in the dock and once I showed her how to type in the web addy, she was good to go. Only have to explain a concept once to a kid, if you catch them early enough. She now (2nd grade) totally gets application/instruction file/data file concept.

Wish more of my users did.

Re:Misleading headline, and ActiveX

[AnalPerfume]

Writing software to force people to buy new PC's has been an integral part of Microsoft's strategy for years, it's only recently begun to bite them on the ass with Vista and the credit crunch happening at the same time. People keep forgetting that around 80% of Windows sales come from new PCs pre-installed with the current version of Windows that Microsoft are giving customers the choice of.

Re:Misleading headline, and ActiveX

[93 Escort Wagon]

Ever been to Windows update? That's an ActiveX control. How does it get so much information about your computer? By it's deep connection to the OS. ActiveX CANNOT be sandboxed because it needs too many things to be accessible in the OS. Almost all ActiveX components make use of that integration.

XP has not relied on the browser-based Windows Update for several years. I imagine the OS-side Windows Update/Microsoft Update may very well be based on the same code; but it's certainly not being triggered by a visit in a web browser to an external website for goodness sake.

ActiveX needs to die, plain and simple - the past decade has shown how fundamentally flawed the ActiveX concept is. Just think about all the horrible security exploits that wouldn't have happened over the past decade if ActiveX had never existed.

Re:Misleading headline, and ActiveX

[k33l0r]

Or rather IE8 May Be End of the Line for Trident

And one would certainly hope so, given what crap you have to deal with when designing web pages, just because IE doesn't do anything right.

Re:Misleading headline, and ActiveX

[Anonymous Coward]

ANYTHING can be sandboxed. It's just a matter of taking each API call and running it through a function call of your choice and suppling the needed results. Problem solved, now back to sleep script kiddies.

Re:Misleading headline, and ActiveX

[LifeWithJustin]

Right. Everybody knows the name "Microsoft Internet Explorer" for being an insecure shell extension(or whatever it is, but it's not a standalone browser) as well as being the "browser" which is having its ass kicked by FireFox and every other real browser out there.

That's right. FireFox is very secure.

Re:Misleading headline, and ActiveX

[LWATCDR]

The simple answer is because Active X is basically a singed windows executable that gets downloaded and then run in the browser.
It is pretty much dependent on the Windows API and was never really designed to be run in a sandbox.
You can run Active X under Linux if you get Wine and IE under Wine working. So yes it doesn't have too run only under windows.. But it really is just a terrible security plan from top to bottom.

Re:Misleading headline, and ActiveX

[ArsenneLupin]

This is Slashdot . Everyone around here knows that ActiveX must be married to the OS in order to have plausible cause to bundle the browser with the OS. If it could be sandboxed to easily, a judge might get the idea to force Microsoft to dissociate both products.

Re:Misleading headline, and ActiveX

[shutdown -p now]

There is absolutely no functional difference between ActiveX in Internet Explorer on Windows or an XPCOM plug-in for Firefox on Linux.

Except for one crucial thing: IE provides content authors with the ability to advertise ActiveX plugins required to view the content, which pops up the window on the client asking the user whether he wants to install the plugin. And it's damn easy to trick a user into clicking "yes". In a technical sense, it's secure. In practice, because of social and psychological factors, it is a very convenient attack vector.

Re:Misleading headline, and ActiveX

[frosty_tsm]

Exactly..and Moore's law isn't exatly as reliable as it was 15 years ago when talking about a direct improvement to the desktop computers speed.

Especially since it never was about speed, only the density of transistors on a chip. Which, through clever architecture, smart compilers, and good programming can result in more speed.

Re:Misleading headline, and ActiveX

[rkit]

Moore's law isn't exatly as reliable as it was 15 years ago when talking about a direct improvement to the desktop computers speed.

Since Moore's Law is about Transistor density and says nothing about speed, I see no difference in reliability.

Re:Misleading headline, and ActiveX

[Kjella]

Actually, in the sense the parent was talking about using the computer it is. Many virtual instances of XP could easily run on a 4+ core processor where it seems we're going. It's the single 3GHz core that won't become a 30GHz core.

Re:Misleading headline, and ActiveX

[Anonymous Coward]

Yes, they've been using that excuse for at least 15 years at this point. I remember having a discussion in #amiga about assembly code vs C(or most anything else) and one of the guys responded "It's worth a 10% speed decrease to use something slower if it means I can make my deadline" to which my response was "with an attitude like that, why don't you go program for Microsoft".

Come to find out the guy was one of the programmers for the Amiga's original "networking" stack. I see that attitude worked out well for him so I'm going down to the local Walmart and picking up another Amiga...oh wait..

Re:Misleading headline, and ActiveX

[TeXMaster]

Needing information and having full control over the system are two different things. If all activex needs is the information, then let it have read only access.

Which is already enough to be a humongous security breach.

Re:Misleading headline, and ActiveX

[Kenshin]

This full admin lazy programming thing drives me nuts.

I did some part time IT work at an agency, and I was severely annoyed when I found out that their booking system REQUIRES local admin privileges to run.

It needed local admin... TO INTERFACE WITH AN SQL DATABASE ON A SERVER.

I intended for all the users to run with limited local rights, since they had a high intern turnover rate and interns can't be trusted... but screw security, some program originally written in the Win98 days still has this idiocy in a new version released this year.

Re:Misleading headline, and ActiveX

[Ilgaz]

A company named Apple tried to save itself from the amazingly huge work and tried to modernise and secure MacOS. It took years and a top of the line IT director to admit it won't happen.

Their plan was exactly the same, sandboxed MacOS virtual machines.

They accepted that sad fact, (probably) mailed to their software vendors saying ''We are going with NeXT''

As MS is known for not admitting such facts and keep shipping that biggest PR disaster of all times named IE (I mean it), they may go with your method. There comes the issue of users NOT wanting to run Virtual Machines. Trust me, there are many of them out there.

For the IE engine? Even MS can't remove it from OS. It is like a monster in a horror movie, they created it and they can't kill it. What about third party apps and legendary compatibility which causes users live with 1990s 8.3 filename shit in 2009, even on Windows 7?

Re:Misleading headline, and ActiveX

[Anonymous Coward]

There is absolutely no functional difference between ActiveX in Internet Explorer on Windows or an XPCOM plug-in for Firefox on Linux.

Except for one crucial thing: IE provides content authors with the ability to advertise ActiveX plugins required to view the content, which pops up the window on the client asking the user whether he wants to install the plugin. And it's damn easy to trick a user into clicking "yes". In a technical sense, it's secure. In practice, because of social and psychological factors, it is a very convenient attack vector.

And Firefox does the same thing. If I don't have Shockwave installed and I navigate to a website that contains Flash content I will be presented with a little yellow information bar telling me that there is content on the page that requires a plug-in and asks me if I want to install that plug-in. Is there any browser that doesn't do this by default?

Re:Misleading headline, and ActiveX

[shutdown -p now]

And Firefox does the same thing. If I don't have Shockwave installed and I navigate to a website that contains Flash content I will be presented with a little yellow information bar telling me that there is content on the page that requires a plug-in and asks me if I want to install that plug-in. Is there any browser that doesn't do this by default?

There's still a difference. In Firefox, if you click "yes", it will send you to Adobe's download page for Flash; but you still need to initiate the download manually, and then run the downloaded installer. In IE, if you click "yes", it immediately downloads the ActiveX binary and executes it, all by itself.

Re:Misleading headline, and ActiveX

[zoips]

Unless they decide to scrap everything they've written with Gazelle, I seriously doubt Trident is going anywhere:

Excerpt:
Instead of undertaking a significant effort of writing our own HTML parser, ren- derer, and JavaScript engine, we borrow these components from Internet Explorer 7 in a way that does not compromise security. Relying on IEâ(TM)s Trident renderer has a big benefit of inheriting IEâ(TM)s page rendering compatibility and performance.

Re:Misleading headline, and ActiveX

[Ilgaz]

It seems people think ActiveX is just ''Netscape plugin'' like thing while it is way more powerful than many would assume.

They should see (non malicious) http://www.pcpitstop.com/ to see what is really possible with ActiveX or better use Seagate Hard Disk tools in IE (seagate.com). Both sites doesn't do what they are really capable of since it would make some users really paranoid.

It is UID0 access level, inside browser. Pure C code. No sandboxes.

Re:Misleading headline, and ActiveX

[JohnBailey]

Most people consider internet explorer to be "the internet".

It's all they've ever known.

So are they also limited to the apps that have icons on the desktop because there is no button marked "start" in Vista/7?

Re:Misleading headline, and ActiveX

[Anonymous Coward]

Then just disable (by default) certain "reads".
You can do exactly the same using several options in many parts of Windows, Registry being a great example.

Have a central control panel for ActiveX permissions.
If an applet requests certain information, pop-up confirmation and EXPLAIN as simply as possible what Allowing or Disabling access would do, none of the technobabble, most people don't even know what an extension is, never mind what ActiveX is.

Writes only go to a sandbox and destroyed / recovered to another folder if you enable it. (like Sandboxie, one of the most useful programs i have used in years)

Re:Misleading headline, and ActiveX

[arekusu_ou]

3rd party hardware boxes still rely on ActiveX to run their intranet controls, although I guess Java is becoming more popular, which I don't like.

But ActiveX has a huge level of vulnerability which lends to your statement, it needs to die.

Re:Misleading headline, and ActiveX

[icannotthinkofaname]

Using quasi-mystical language like "deep connections" in a technical discussion is a good sign the person doesn't know what he's talking about.

But didn't Microsoft way that Internet Explorer was "tightly integrated" into the OS? Seems to me like a "tightly integrated" application would have "deep connections" to the OS.

Hold it, that explains a lot!

*goes out and doubles efforts to convert people away from Windows*

Re:Misleading headline, and ActiveX

[Jurily]

Seriously, would it kill people to bring the issue to the surface in an intelligent manner that might benefit those of us who are outside the loop on this?

In the face of our beloved traditions?! Heretic!

Re:Misleading headline, and ActiveX

[Miseph]

Yeah, but it's also in an "it's complicated" with Trojans. Kind of a problem, really.

Re:Misleading headline, and ActiveX

[Anonymous Coward]

Actually, "Jew" is a noun. "Jewish" would be the adjective. -Grammar Nazi (ha!)

Re:Misleading headline, and ActiveX

[cnettel]

Uh, and how is that different from a Netscape plugin?

Re:Misleading headline, and ActiveX

[sqlrob]

It's not. It's even possible to put a Netscape plugin and an ActiveX control into the same DLL if you want to.

Re:Misleading headline, and ActiveX

[ChrisMP1]

Yes. My dad has me put icons on the desktop for him, because he can't find them in the menu (even on XP with a button clearly labelled "Start"). No matter how many times I show him, he just can't get it.

Re:Misleading headline, and ActiveX

[Ilgaz]

You better ask them, not me. Also several AV vendors who either uses ActiveX or signed java applet. Signed and admin installed activex control may have super user powers (like sudo without pwd) even while running as normal user. Or somehow they get way more access than a netscape (safari, firefox, google) plugin can achieve. I am sure they wouldn't want to lose 25% of market by not providing such plugin.

Re:Misleading headline, and ActiveX

[glittalogik]

A better technical explanation would be that ActiveX can lick Windows' bellybutton from the inside.

Re:Misleading headline, and ActiveX

[B3ryllium]

I'm pretty sure every activeX call already does this, with how fast it seems to be.

Re:Misleading headline, and ActiveX

[Anonymous Coward]

ActiveX is just a set of COM interfaces. The sins of the ActiveX/COM implementations had more to do with c++ than with the architecture.

I dont see, why reimplementing the same ideas inside a virtual machine its the better solution.

COM+/DCOM/ActiveX/COM/OLE2 where badly implemented... CORBA its hard, maybe ICE is better. (gnome bonobo its an ugly COM imitation but has not security risk reputation... wonder why?)

Re:Misleading headline, and ActiveX

[dbIII]

ActiveX needs to die, plain and simple - the past decade has shown how fundamentally flawed the ActiveX concept is

Even the decade before it existed it was known how stupid an idea it was. Remember this was the time when one of the main talking points about java was it running in a sandbox.

Even a librarian warned me about the danger of ActiveX just proir to it's release (training session on using search engines for academics). I have never understood why it was released. Just when everyone had learned how to disable it they had to turn it back on to get OS updates.

Re:Misleading headline, and ActiveX

[DarkOx]

Ok as a parent poster pointed out AxtiveX is really nothing to do with web browsers at all other then IE provides a nice platform from which to instantiate activeX com objects.

COM is a not nearly mysterious as Microsoft likes people to think but it is a complex and interconnected animal. If you know something about C and have ever encounterd a function pointer its sorta like that. What it boils down to is there are some functions at known locations in libraries which you can count on being able to access to get information. This information is in most cases the locations of other functions and structures. There are also a rather interesting threading and memory shareing elements.

All of these things being pre-defined allow higher level langues like VB and even C++ with the right classes to use objects libraries which are run time linked. Without having to have lots of information at build time, like header files with loads of function declaraitons etc, etc, and defines. The existing binary can actually tell your codes how to use it, to a certain degree.

It also provides a good deal of simplified inter process communication and sycronization. I am not saying as much about this but its arguably the more important aspect of COM.

Point is breaking ActiveX probably means breaking other parts of COM in a large way. Just patching up IE so it won't let you create objects out side its on memory space is easy but then you break all those IE based APPs. Sandboxing is not much of solution either b/c then you can't do much in the way of IPC else you don't really have a sand box.
   

Re:Misleading headline, and ActiveX

[Anonymous Coward]

Grammar Nazi just took out a Jew?

Re:Misleading headline, and ActiveX

[BenoitRen]

Or even better: let's write code for yesterday's hardware. Not everyone has a computer of today, and the more computers that can use your software, the better.

Re:Misleading headline, and ActiveX

[Anonymous Coward]

guess you never did an activex "safe for scripting"
in other words restricted to use a safe subset of the api

the problem is that the "safe for scripting" is buyed, and ensured by a review of the code submited for certification... ending with lots of points of failure in the process.

No need to reinvent Net, a bad solution for a non existing problem. Better will be to revive the oberon slim exe portable component format, and update the jit with the lates security verification techniques designed by Michael Franz; using that as the plugin engine

Re:Misleading headline, and ActiveX

[Anonymous Coward]

> XP has not relied on the browser-based Windows Update for several years.

Yes, it does.

The native automatic updates client doesn't support half the stuff the online one does. You can't install driver updates, or non-critical OS updates, for example.

Vista, on the other hand, doesn't have a browser-based Windows Update at all, and the native client can do everything XP's web-based client could.

Re:Misleading headline, and ActiveX

[Handover Phist]

Ever been to windizupdate? They seem to do just fine without the ActiveX stuff. Why can't MS? I realise that that's probably a dumb question, if I were steeped in MS corporate culture I'd probably shun me for suggesting such a thing, but other techs can do the work that ActveX currently does without all the hooks.

Re:Misleading headline, and ActiveX

[barzok]

There's still slavery in lots of places in the world. Even in the US.

Re:Misleading headline, and ActiveX

[russlar]

OMG! Java is tightly integrated to the OS!

Yanno, spilling coffee on your computer is generally _not_ a good thing.

Re:Misleading headline, and ActiveX

[Anonymous Coward]

And Java (and Flash while we're at it) sucks too, what's the problem?

Re:Misleading headline, and ActiveX

[ThousandStars]

People have been using this excuse for years to write bloated, crappy software.

I see this argument occasionally on /. and always find it more than a bit puzzling: if software that you think is "bloated" continues to be used (and to be sold to people willing to pay for it), then it must be of more value to its users than whatever hypothetical small and beautiful software that you're imagining. In fact, Joel Spolsky wrote a pretty good article called Bloatware and the 80/20 myth attacking the very line of thinking you're espousing.

Re:Misleading headline, and ActiveX

[IntlHarvester]

They probably install a background service running as System or something along those lines, because what you are describing is impossible.

Netscape plugin installers could do the same thing, but you have to restart the browser, so it's worse from a user-experience standpoint. (See the Microsoft Genuine Windows plugin for Firefox, for example.)

Re:Misleading headline, and ActiveX

[Hadlock]

Shit, you're lucky if they can even find the start button in XP. Whenever my mom's desktop fills up with files, she will call me to clean them up. Anything not directly clickable from the desktop is an enigma to her. The start button was a brilliant idea, but it still relies on the "things hidden behind interface", similar to digging through nested folders on the desktop. Some people just can't (more likely won't) grasp that concept.
 
Tabbed browsing scares the fuck out of older people. My friend has an Ubuntu box setup for his mom. It has a 1024x768 resolution, and the only icon on the desktop is firefox, as a 256x256 icon that immediately opens into hotmail. This is really all she needs and he literally hasn't had need to touch or upgrade the system since he set it up for her in early 2007, with him studying abroad and then working in Beijing for a year+
 
You'd be shocked how many people can barely work their computer's "Basic" functions.

Re:Misleading headline, and ActiveX

[fractoid]

That's a little harder (although obviously still doable) with native code than with an interpreted language. That was what was great about Java - the VM had total control over what the language could and couldn't do, and so was (in theory) exploit-proof. ActiveX controls are native code and so can do nasty things with interrupts and direct memory writes and soforth, which these days can be circumvented but back when it was released, could not.

Re:Misleading headline, and ActiveX

[ozphx]

MS have already made and released a sandboxable and verifiable COM.

They called it COM2+ for a while, and then released it as .Net.

Re:Misleading headline, and ActiveX

[fractoid]

*gives you a hug* Thank god someone else still thinks this! My old work computer was a perfectly good 1.5-year-old machine, and it took a solid minute to boot Outlook. I ended up using OWA just to stop it from bogging my machine down during compiles. No amount of custom window decoration can justify a goddamn email program taking up that much CPU time.

Re:Misleading headline, and ActiveX

[ozphx]

"Safe for scripting" was a bit which was set by the developer of a COM component, which every lazy developer flicked on.

JBlowhard would release his FileSystemFormatter COM component with his disk tools, and set the "Safe for scripting" bit. If BlowTools were popular enough then someone would pop an object tag on a website, instantiate his shitty component, and blow your C drive away.

MS's response to this was "Guess we can't trust you fuckers", and to introduce killbits (which is a blacklist of shitty components that lie about being safe for scripting).

Re:Misleading headline, and ActiveX

[fractoid]

True, although many virtual instances of anything are seldom useful to a single user. Luckily most applications are being designed with multiple cores in mind now, which is a good thing because it's often far easier to generalise software from 4 to N cores than it was to take it from 1 to 4 cores.

Sig response:

A truly clever developer will create code so easy to understand that a less than average developer could debug it.

I'd say that a truly clever developer's code won't need debugging. My measure of a truly clever developer is one that can create code so easy to understand that a less than average developer can elegantly extend it. :)

Re:Misleading headline, and ActiveX

[fractoid]

What asplodes my head is when I'm telling my wife how to do some computer-related task and I say "now open a windows explorer window" and she opens IE. I need to remember to say "open 'my computer'".

Then again it could be much worse. One girl I tutored used to use the File|Open dialog box in MS Word for ALL her file management. Just goes to show that if you make it possible, someone will do it.

Re:Misleading headline, and ActiveX

[ZorinLynx]

ActiveX dying would also be a good thing for cross-platform computing. Too many idiots use ActiveX for their embedded webservers and thus require MSIE to manage them.

Re:Misleading headline, and ActiveX

[Alex Belits]

Hey, I can do that, too!.

Re:Misleading headline, and ActiveX

[Jason Levine]

It doesn't even need to be a virtual XP+IE8. SandboxIE can already keep ActiveX controls within a sandboxed environment. If Microsoft built something like this into IE9 or Windows 8 (or whatever the next versions are called) they could easily keep ActiveX around, but sandbox it so it would be safe to use.

Re:Misleading headline, and ActiveX

[LifeWithJustin]

Hey, I can do that, too!.

I'm not sure who's more original you Carlos Mencia. But I'm putting my money on Mr. Mencia.

I'm not saying... I'm just saying

Also if you'd keep an eye opened you'd know that Firefox was the #1 most insecure browser for 2008

Re:Misleading headline, and ActiveX

[hedwards]

Mainly because it's difficult to explain.

It's for things like Windows update and web interfaces that need to directly interact with the OS. I'm not sure that it's such a wise idea, but it allowed a more sophisticated set of web sites than were possible at the time. Most being limited to running in a browser or on the server, not on the OS itself.

It turned out to be a huge security nightmare, but that's more or less what happens when you expose an API that much to the net.

That's probably not quite right, but I'm not really sure how better to explain.

Re:Misleading headline, and ActiveX

[Hurricane78]

Sorry, but when have you seen the last ActiveX anything?

The only plug-ìns that are widely spread are Flash and Java. They both can run as NSplugin. So if IE9 adopts that interface, and maybe another new one, they are good.

Re:Misleading headline, and ActiveX

[Hurricane78]

Then just disable (by default) certain "reads".

No. For it to be secure, you would have to first disable all access to anything, and then only open what is needed, on very very tight parameters. Like plug-in checksub plus application checksum plus source URL plus whatever you can parametrize it by.

Re:Misleading headline, and ActiveX

[drinkypoo]

XP has not relied on the browser-based Windows Update for several years.

You still need it to install non-critical updates on Windows XP (without downloading them from the windows catalog or windows support sites and installing them manually, which is unrealistic to expect of most users.)

Re:Misleading headline, and ActiveX

[BitZtream]

ActiveX is hooked about as deep into the OS as XPCOM is with Firefox.

In other words, its not hooked into the OS. ActiveX is essentially a plugin system as far as IE is concerned. They are security wise and feature wise practically identical.

I really wish people would learn what ActiveX is and what the ActiveX security issues are and how they are in fact not problems with ActiveX but problems caused by clueless developers.

Of course its easier for you to be ignorant, and funnier for me to watch as Firefox takes over and then everyone suddenly realizes its just easy is to fuckup a Mozilla plugin.

Making the whole thing even better is the fact that your the first post and a bunch of other ignorant twits modded you up for it.

Re:Misleading headline, and ActiveX

[WillyDavidK]

Would this really be surprising, I mean even www.microsoft.com already doesn't even work properly on IE8...

Re:Misleading headline, and ActiveX

[BitZtream]

An ActiveX is not a .NET library, however a .NET library IS an ActiveX component.

To bad you don't know a lot about either ActiveX or .NET. At the ABI level, .NET looks a whole like like ActiveX. Of course ActiveX looks a whole lot like COM.

Then you realize that MS didn't really invent .NET out of thin air. Its just COM 4.0.

Heres the rough lifetime of COM:
COM 1.0 (Called COM)
COM 2.0 (Called COM+)
COM 3.0 (Called ActiveX)
COM 4.0 (Called the .NET runtime, with more improved overhead).

Once you realize this, you'll also realize that the 'security' you seem to think exists, doesn't in fact exist. The 'security' implemented in .NET is more of simply not loading certain modules that provide that functionality. Since from a .NET library you can use the Win32 API, which has no restrictions, you'll very quickly find there is no real 'sandboxing' in .NET.

Re:Misleading headline, and ActiveX

[BitZtream]

As per typical with slashdot, even your silly statements are wrong.

ActiveX is nothing more than a library. ActiveX is really no different than XPCOM. Neither are married to the OS in any way.

ActiveX could be implemented on another OS, but no one cares, they use their own crap. CORBA, XPCOM, lots of names for what are essentially the same thing.

If you read about XPCOM you'll find that the developers of XPCOM themselves say they are essentially the same, closer digging finds they are almost binary compatible with each other. They store swaths of information in different ways (like user .dat files for xpcom and the registry for activex) that make things incompatible but their practical functionality is the same.

Re:Misleading headline, and ActiveX

[BitZtream]

COM objects are not tied to the system. They are not tied to the system any more than any other library is. COM is nothing more than a shared library. COM is very useful, and thanks to some pretty nifty macros and things like that, its relatively easy to use, so a lot of apps use it to allow functionality to be added later.

COM is not married to Windows, but since its so easy to use it in Windows A LOT of apps use it. This is good! This is the goal, this is what standards are all about! However, because its so easy to load other modules security an extremely complex issue.

The functionality you talk about is already in IE. Its been there for years. You can configure how ActiveX controls behave in each of the four zones that IE has. Sadly, IE is a buggy POS that likes to ignore those settings.

Re:Misleading headline, and ActiveX

[XDirtypunkX]

Pretty sure Windows has had memory protection and run user space in ring 3 since Windows 95 there kiddo. That is, you were prevented from doing nasty things with interrupts and direct memory writes. Sure they exposed some things to user land they probably shouldn't have, but writing to IO ports and trying nasty interrupts would just lead your application to GPF heaven.

The real problem is that 95/98 had pretty much no security, so an ActiveX control could do *anything* that user land allowed.

Re:Misleading headline, and ActiveX

[BitZtream]

XPCOM needs to die, plain and simple - the past decade has shown how fundamentally flawed the XPCOM concept is. Just think about all the horrible security exploits that wouldn't have happened over the past decade if XPCOM had never existed.

Funny. Doesn't sound the same that way does it? Your ignorance about what ActiveX is and isn't shows. ActiveX is nothing more than a plugin system. It is functionaly identical to XPCOM used in the Mozilla suite of code.

ActiveX does not 'NEED' the OS. It does use the registry as a way to reference other components without knowing where they are on the system at compile time. XPCOM does the same thing via a registry of its own, stored in a xpi.dat and compreg.dat or something like that in your profile directory. Other than that requirement, ActiveX doesn't need anything else from the OS, of course, neither does XPCOM.

Both XPCOM and ActiveX however run in the context of the app that loads them. This is a problem of all plugin systems, not just ActiveX.

If ActiveX didn't exist, it would have just been something else that was invented that did the same thing. The roll that ActiveX fills would have been made by someone else.

If you think ActiveX is bad then you must think XPCOM is bad. Do you realize that all XULRunner based Mozilla apps now are nothing more than an XPCOM loader which loads components to make what you see as 'Firefox' or 'Thunderbird'. Do you also realize that without XPCOM you couldn't have plugins in Mozilla based apps that do anything related to the system itself? There would be no Songbird. There would be no enigmail for Thunderbird. All of the GOOD plugins for Firefox or Thunderbird use XPCOM to get the real work done, with the exception of GreaseMonkey.

Its good that ignorant people like you keep spreading crap about ActiveX. It gives me something to make fun of on slashdot. At least do some looking at Wikipedia before you look like an ass.

Re:Misleading headline, and ActiveX

[Anonymous Coward]

The windows update argument is bogus. In Vista and Win7 windows update is not hosted in the browser, it's just a system component, it's just a system component.

Re:Misleading headline, and ActiveX

[fractoid]

Sorry, grandpa, when I was little I accidentally broke Windows 95 several times while learning to program. And I mean Windows, not my application, my best effort would reliably bluescreen then when Windows tried to restart start it would give me a 3.1-style dialog box saying I had to reinstall Windows. Fun times! :P

I'm sure that, on paper, Windows had all that stuff, but in practice...

Re:Misleading headline, and ActiveX

[BitZtream]

ActiveX is not 'married to the operating system'. There is nothing that prevents you from implementing ActiveX on another OS. The .NET runtime shared source implementation for FreeBSD that MS made to show off .NET when it came out actually includes a ActiveX implementation for FBSD. It gets better, it'll run Windows ActiveX controls on FBSD if they don't use any Win32 API calls.

ActiveX controls are all BUILT to run in Windows because ... duh, thats where they all run, of course theres a tendancy to use Win32 specifics. One would be an idiot to assume that a native Linux app would use WINE to emulate the Win32 api instead of just using native calls, why do people make the silly assumption going the other way? Why would code written for Windows specifically go to a bunch of effort to use a library other than the built in one, for no additional functionality?

If ActiveX is married to the OS, so is XPCOM, which is what Mozilla uses instead of ActiveX. They are nothing more than libraries. Shared ones at that. For all intents and purposes they are identical in functionality and security.

ActiveX and XPCOM are both just an API and ABI that allow code to load another binary module and learn about the functionality it provides. ActiveX is really just what they named a new version of COM, after COM+. (Just for reference, COM was really just a new version of OLE. And interestingly enough, .NET assemblies are nothing more than ActiveX components with some specific methods available to facilitate the .NET runtime which is why the FBSD .NET implementation also contains a ActiveX implementation)

If you look at the wikipedia articles:
http://en.wikipedia.org/wiki/ActiveX: ActiveX is a component object model (COM) developed by Microsoft for Windows

http://en.wikipedia.org/wiki/Xpcom: XPCOM (Cross Platform Component Object Model) is a cross platform component model from Mozilla. It is similar to CORBA and Microsoft COM.

They are just ways that let the browser load binary code from a 3rd party module and make it available to the browsers scripting engine and DOM. Extremely powerful plugin systems. Thats it.

There is no security related to ActiveX or XPCOM objects. The run in the context of the code that calls them. This is not a security flaw on either ones part, it is up to whatever is calling the COM module to sandbox it as needed to ensure safe operations.

The problem with ActiveX is two fold.

First, IE auto-installed ActiveX controls from pages configured to do so initially. It was possible via Tools->Options->Advanced or something like that to tell IE to prompt or ignore them. This bad default setting meant pretty much any web page could run code as the user IE was running as. Because of the other default security settings in Windows this mean a web page basically had admin rights on your machine.

MS tried, poorly to fix this problem by switching to prompting by default. This of course didn't help much as users just clicked yes when prompted. Then came the digital signatures, which were meant to allow users to determine if they should trust the control. Since end users don't know that anyone can get a signing certificate and that a signing certificate doesn't mean its safe, just that we know who made it (maybe, depending on the CA). So again, everyone just clicks next/continue/yes.

Next was the little yellow bar at the top of the rendering window which you see in IE now. At this point what they do doesn't matter, the users are always going to just click whatever it takes to get it to let them play 'whack a mole for a free iPod!'.

Also a problem was that IE is buggy enough that the bad guys found ways to get around the protections in IE to load ActiveX controls without prompting the user or regardless of what the users choic

Re:Misleading headline, and ActiveX

[Anonymous Coward]

Note also that processors haven't gotten much faster in the last few years. If anything they've only really added more cores or made memory cheaper. In reality it seems that moore's law has stopped.

Re:Misleading headline, and ActiveX

[BitZtream]

So does Java have deep OS integration? You can do pretty much everything that ActiveX does with Java.

Your statements are flawed and the fact that you're modded informative just goes to show the high level of ignorance that has invaded slashdot these days.

It is not 'integrated' any more than any other app on your system. ActiveX controls are just code that can be run. Just like an EXE, a DLL, or any of a bunch of other executables.

The only thing ActiveX NEEDS is a library that can resolve the ActiveX references of other components and the base libraries. The Windows implementation of ActiveX uses the registry as a repository for component registration. This is how apps and ActiveX components and lookup, learn about, and utilize other ActiveX components. On FreeBSD, the Microsoft Shared Source implementation of the .NET framework provides a ActiveX implementation that uses berkley db files instead of the windows registry format. Interestingly enough, this loader has no problem loading ActiveX controls compiled for Windows (that means without recompilation, or emulation). Seems to me, for something thats 'tightly integrated with the OS' that it'd have a pretty hard time running under an entirely different OS without an emulator.

Crawl back in your fanboy hole until you get a clue about the subject matter.

Re:Misleading headline, and ActiveX

[hairyfeet]

I hate to break the news to you, but the INTRANETS of many major corps as well as a ton of SMBs are filled with ActiveX crap. Insurance companies, parts shops, companies large and small have those damned ActiveX pages, often in mission critical roles. Could it be fixed? With a shitload of money and some retraining,yes. Are they going to spend that kind of cash in this economy? Not a chance in hell. Like it or not IE is a requirement for many businesses. And that of course doesn't even bring up the lack of GPO integration of any browsers other than IE, which is the deal killer with most admins I talk to. No GPO integration? No Sale.

Re:Misleading headline, and ActiveX

[BitZtream]

And its the same in Firefox, they click a xpi link instead of the yellow bar at the top of the page. If the page is made right, you make it look like IEs warning message.

As stated originally, there is no functional difference between ActiveX in IE and XPCOM in XULRunner, except people think ActiveX is somehow radically different and that open source has solved the problem in Mozilla. Its safe to say that people who think like that can be considered clueless.

Re:Misleading headline, and ActiveX

[shutdown -p now]

And its the same in Firefox, they click a xpi link instead of the yellow bar at the top of the page. If the page is made right, you make it look like IEs warning message.

I thought XPI can only contain JavaScript code, not native binaries? There certainly is a difference between running sandboxed code in a language with no pointers or other ways to mess with things, and quite another to run the code that can do absolutely anything a local process can.

Re:Misleading headline, and ActiveX

[__aawkdb2598]

There's still slavery in lots of places in the world. Even in the US.

Citation needed.

Seriously though, what do you mean? Slavery in the US? Now? Where? How?

Re:Misleading headline, and ActiveX

[XDirtypunkX]

Just because it had memory protection and ran stuff in ring 3, that doesn't mean that you couldn't fubar things completely from user space. After all, every program in user space could do pretty much anything it wanted short of calling hardware interrupts and directly using in/out on hardware ports (although, this was emulated for DOS mode apps).

Re:Misleading headline, and ActiveX

[Waccoon]

I don't see any reason why ActiveX apps couldn't be sandboxed like anything else.

What's to say ActiveX has to follow all the rules and won't be given a Free Pass? It doesn't take much to bore a hole in an application.

Re:Misleading headline, and ActiveX

[master_p]

It's not necessary to kill ActiveX, if Windows changed its security model to something better...

Re:Misleading headline, and ActiveX

[Anonymous Coward]

People seem to forget that we have sold way more computers than people in the world... no reason to replace them all to run IE9.

How many people have you sold? You know that's illegal now, you could get into big trubble.

Re:Misleading headline, and ActiveX

[Anonymous Coward]

"'This new engine will supposedly be more secure than Firefox or even Chrome,"

LOL, not a mention of Opera, when it comes to Security? Surely that is the benchmark of browser security....

Clearly the author of this article is a deluded Firefoc fanboy...

Re:Misleading headline, and ActiveX

[gazbo]

DEPRECATED, motherfucker. DEPRECATED.

Re:Misleading headline, and ActiveX

[Anonymous Coward]

...consenting software components.

Re:Misleading headline, and ActiveX

[Anonymous Coward]

Java bytecode is cross-platform unlike ActiveX which is native code. Java the runtime is tied to the OS but Java applications are not.

Re:Misleading headline, and ActiveX

[geordie_loz]

There's a saying isn't there. "Nobody ever got fired for choosing microsoft". Perhaps they should have been....

Re:Misleading headline, and ActiveX

[eggz128]

XPIs can contain native binaries, but by default XPI installation is only allowed from a few whitelisted addresses (both subdomains of mozilla.org).

Trying to install an XPI from an an online source that isn't in the whitelist fails, but you are asked if you would like to add the source as an exception. It's also made pretty clear you should only do this if you have absolute trust in the source.

IIRC the main difference is that the only way to trigger an XPI install request is if you actually click on an XPI link. If a page requests an ActiveX control, the install request is triggered automatically.

Re:Misleading headline, and ActiveX

[Anonymous Coward]

so let the companies that need ActiveX keep using the same old tired IE6-7. They can upgrade when they're ready.

In the meantime, maybe it's time to revamp IE for the other millions of people who use it.

Re:Misleading headline, and ActiveX

[Tarwn]

This full admin lazy installation thing drives me nuts.

I've worked in IT for a while and I am always severely annoyed when people automatically assume that receiving a permission denied dialod or two means that an application requires full administrative rights to the system.

They will generally go on about how life would have been easier if only that one application had let them do things the right way when, in reality, had that one application provided better notes (or had someone had called the vendor) on the subdirectories, external DLLs, or registry entries that needed permissions, then it would have been the next program that came along that required administrative rights. Of course the next admin would have come along and faced with an absolute lack of documentation from the previous admin, would have ended up giving anyone admin access all over again.

Re:Misleading headline, and ActiveX

[MadMidnightBomber]

"Depends on which computer" - says cynical sysadmin

Re:Misleading headline, and ActiveX

[ubrgeek]

> Needing information and having full control over the system are two different things.

Tell that to the Bush administration ... (Taking bets on "Flamebait," "Offtopic," "Troll," or "Funny" :))

Re:Misleading headline, and ActiveX

[Anonymous Coward]

see this is why i don't mind browsing at -1 now and then

Re:Misleading headline, and ActiveX

[ChameleonDave]

I just like posting "Jew" every once in a while. It's always interesting to see how it gets modded. The fact that it almost invariably turns into "troll" says a lot about those who get blessed with mod points around here. It's a simple adjective, it has absolutely no context in the conversation, and yet people take it as some sort of epithet. What does that say in the larger scheme of things, I wonder?

You don't know what "adjective" or "epithet" mean.

Re:Misleading headline, and ActiveX

[Anonymous Coward]

Did you even read what you replied to?

Moore's law is not and never was about speed. It's the number of transistors per unit of space. More cores are a very good example of Moore's law working exactly like when Moore first thought about it.

Re:Misleading headline, and ActiveX

[Anonymous Coward]

That's where the smart compilers and good programming come in. Unfortunately, you are right: it's not actually enough.

Re:Misleading headline, and ActiveX

[Inda]

WOW. I thought I was unique. I too have a user that uses the File|Open dialog box in MS Word for all her file management. Can't be the same person, can it?

Did she also say stuff like "I pressed save yesterday and now I can't find my work. Where did I save it?"

Re:Misleading headline, and ActiveX

[Anonymous Coward]

if software that you think is "bloated" continues to be used (and to be sold to people willing to pay for it), then it must be of more value to its users than whatever hypothetical small and beautiful software that you're imagining

Things that exist are generally of more value than hypothetical things. Even when "things" are software.

Re:Misleading headline, and ActiveX

[Keeper Of Keys]

ActiveX applications have no more "connections" than any other Win32 app. (emphasis added)

It is because a script included on a random web page could suddenly run on your computer like any other app - deleting files, installing trojans, etc - and without your knowledge, t'boot, that ActiveX is rightly hated by anyone with an eye on security. AFAIK it can still do this, albeit that the user is asked first if they want to allow it - and we all know how cautious Windows users are when faced with a security warning.

The web browser should be a sandbox in which scripts can do what they're allowed to do - draw things on the screen, rearrange DOM elements, communicate with the server from whence they came - without touching your host system. Any ActiveX controls out there that need to do more than this deserve to get broken.

Re:Misleading headline, and ActiveX

[GMFTatsujin]

"Almost all ActiveX components make use of that integration."

<voice style="yoda">That ... is why they fail.</voice>

Re:Misleading headline, and ActiveX

[Kayden]

I can't believe it; I thought I was the only person unlucky enough to have someone that vapid. I have a girl here that always calls me saying, "I saved this picture in Word and now I can't open it? Why is Word broken!?" I sent her a publisher document and instead of double clicking it, she opened Word, clicked open, navigated to the folder, and then complained when she couldn't find it! They get pissed at me when things don't work the way they imagine things should. Do you lock your door using your pecker? No, you use your keys. There are right tools and there are wrong tools for each job.

Re:Misleading headline, and ActiveX

[Keeper Of Keys]

I just wish the makers of bloatware like Word and Photoshop, which already include far more functionality than anyone needs, would take an entire iteration to optimize their code. How great it would be to hear that Photoshop CS5 has *no new features* but is 3x faster than CS4, or that Word 2010 has a fifth of the memory footprint of the already feature-complete 2007.

Re:Misleading headline, and ActiveX

[Keeper Of Keys]

One girl I tutored used to use the File|Open dialog box in MS Word for ALL her file management.

I waited a long time for them to implement that obvious feature - for a long time you could see the files but only do with them what the specific dialog allowed. If I'm searching for a file and notice that another one is mis-filed or mis-named, I want to be able to fix it right there and then.

I am currently using Ubuntu Intrepid for most of my dev work, and find the lack of such basic stuff so frustrating I am actually thinking of going back to Windows.

Re:Misleading headline, and ActiveX

[mpcjans]

And Firefox does the same thing. If I don't have Shockwave installed and I navigate to a website that contains Flash content I will be presented with a little yellow information bar telling me that there is content on the page that requires a plug-in and asks me if I want to install that plug-in. Is there any browser that doesn't do this by default?

There's still a difference. In Firefox, if you click "yes", it will send you to Adobe's download page for Flash; but you still need to initiate the download manually, and then run the downloaded installer. In IE, if you click "yes", it immediately downloads the ActiveX binary and executes it, all by itself.

This is a flaw in how IE handles ActiveX downloads , not an inherent flaw in ActiveX. It would be easily imaginable for Firefox to do the same. Also firefox does install XPIs after clicking yes so the whole point is more specific to how both browsers handle flash than any inherent difference in their plugin architectures.

Re:Misleading headline, and ActiveX

[harry666t]

I've got a Celeron 300MHz with 128MB of memory, standing on a top of a pile of junk. I used to work on that machine for some time, not that long ago (I've used Debian Etch, gcc, emacs, wmii, screen, aterm), and the only thing I didn't like about that setup was a shitty keyboard.

Re:Misleading headline, and ActiveX

[fractoid]

Actually I think it was that that brought the whole mess to my attention - a "Help, Sir, my computer ate my assignment!".

At first I thought (as Kayden, below, said) that it was incredibly vapid (I love that word!) to misuse a dialog like that. Then I actually thought through the process I would, as a totally unacquainted new user, go through, and figured that after doing an MS Word tutorial as my first introduction to Windows and then poking around a bit while doing it, even as my very intelligent self I'd probably end up doing something similar. O.o

Re:Misleading headline, and ActiveX

[fractoid]

As I said in my cousin-once-removed post (or is that second-cousin post? My knowledge of genealogy is somewhat sketchy.) It's very very useful to be able to do this. It does, however, open up a massive trap for new players in that we're wired to remember the first way we find to do something as 'the' way to do it until we have a good overall understanding of the system involved, leading to situations like this.

Re:Misleading headline, and ActiveX

[TheRealMindChild]

Firstly, COM would be "OLE 2.0". Second, a .NET library CAN be used as a COM lib, but they aren't the same. It uses ".NET Interop" which is a very special marshaling library. Thirdly, you can define a rule saying "Don't initialize any .NET code that calls unmanaged code". The security is implemented in the .NET runtime, so good luck getting around that.

You may want to come down off that horse. It is too high for you. You don't belong on it.

Re:Misleading headline, and ActiveX

[fractoid]

Forgive me for responding to myself, but... still trying to figure out how this is flamebait, unless it's really THAT rude to add an aside responding to a user's sig? Obviously I meant a truly clever developer's code won't need debugging _by someone else_, assuming they're clever enough to write robust, functional code and that 'clever' entails some deep understanding of code design rather than simply a penchant for clever coding tricks.

Re:Misleading headline, and ActiveX

[PitaBred]

That was the plan. Force something critical to be dependent on new tech for no good reason. That's how Microsoft does business.

Re:Misleading headline, and ActiveX

[Kagura]

Sorry, but when have you seen the last ActiveX anything?

The only plug-ìns that are widely spread are Flash and Java. They both can run as NSplugin. So if IE9 adopts that interface, and maybe another new one, they are good.

Korean websites use TOOOOOOOOOOONS of ActiveX. If you break ActiveX, then you basically break the entire Korean-language internet.

Re:Misleading headline, and ActiveX

[shutdown -p now]

This is a flaw in how IE handles ActiveX downloads , not an inherent flaw in ActiveX.

Of course it is. Did I say anything about how ActiveX itself is flawed? By itself, it's just a component model, nothing more. However, it's the one that does not permit for proper sandboxing nor portability (short of full x86 emulation). A sandboxed VM, as in the case of applets, is much preferable, and can do all the same thing (barring those that are simply unsafe to do). By the way, MS understands that, too - note that IE also allows to host .NET WinForms controls and WPF browser applications these days, and both are properly sandboxed.

Also firefox does install XPIs after clicking

I must admit I did not realize full implications of XPI installation, but as another poster pointed, out, by default, there is a whitelist of sites which are allowed to initiate XPI installation.

Re:Misleading headline, and ActiveX

[Kenshin]

Oh, but it was fully retarded unless it had admin rights. Plenty of quirks.

I personally spoke to the people who programmed the software. They said "It needs admin access. We're working on fixing that. Sorry."

Re:Misleading headline, and ActiveX

[Random BedHead Ed]

It's sad. Anyone who implemented an ActiveX intranet site failed to grasp the real promise of the Web. It's standards-based and potentially client agnostic, as well as extremely flexible, but a ton of businesses missed the point and wrote inflexible client-specific apps anyway.

I worked at a company that implemented an ActiveX-based app around 1999. At the time we had to remove Netscape from all workstations everywhere and get people using IE5. This struck me as very fishy, since even though I liked IE much more than the Netscape versions of the time I understood the benefits of implementing a web app as opposed to a Windows-specific app. And I wasn't even a web developer at the time. The resulting complications started fairly quickly: when Windows 98 Second Edition came out we discovered that the site didn't work with the new and improved (non-removable, non-downgradeable) IE6. People everywhere in the company were having problems using the ActiveX app because the API had changed. In other words, we'd have been better off with a Windows-specific app.

Too late to lament now, I suppose. The damage is done.

Re:Misleading headline, and ActiveX

[Anonymous Coward]

That's ok. In Korea, only old people use the internet.

Re:Misleading headline, and ActiveX

[MrNiceguy_KS]

I've seen a user do all their file management from the File|Open box in Word Perfect. She was really confused and mad that she couldn't open a PDF file that way. It wasn't even the standard, "Why can't I edit this file?", she just wanted to view it and opened everything from Word Perfect.

Re:Misleading headline, and ActiveX

[Kazoo the Clown]

I don't see any reason why ActiveX apps couldn't be sandboxed like anything else. Granted, it has deep hooks into the OS-- but if nothing else, given how beefy computers are going to be by the time IE9 comes out, you could give each ActiveX app its own perfectly compatible virtual copy of XP+IE8 to run on, and just parse the result into IE9 format. Destroy the virtualized OS+browser when the app closes.

Yeah, that ought to work great in my PDA's browser.

Re:Misleading headline, and ActiveX

[Kagura]

In Slashdot, only old memes get used.

Re:Misleading headline, and ActiveX

[Anonymous Coward]

Java can do the same thing and it's relatively sandboxed.

Re:Misleading headline, and ActiveX

[TeXMaster]

If an applet requests certain information, pop-up confirmation and EXPLAIN as simply as possible what Allowing or Disabling access would do, none of the technobabble, most people don't even know what an extension is

Most people will also just start clicking Allow automatically or panic, just like they already do with all the confirmation dialogs, UAC dialogs and whatever.

Re:Misleading headline, and ActiveX

[GWBasic]

Moore's Law makes some problems easy, yay. :)

I don't know about you, but given that my computer is 10 times faster then the one I had 3 years ago; I'd like the software to run 10 times as fast as well!

Re:Misleading headline, and ActiveX

[jonadab]

> People seem to forget that we have sold way more computers than people in
> the world... no reason to replace them all to run IE9.

Bear in mind, the person who suggested this was talking about compatibility for ActiveX-based content. This is not something that normal users need to view normal websites.

ActiveX has been deprecated ever since Microsoft found out that when you connect your PC to the internet security *is* an issue after all. Automatic ActiveX download-and-install support has been turned off by default, except in the intranet zone, for years. I don't remember *exactly* when they fixed this; it might have been XP SP1 that did it, or it could've just been an IE6 security update at some point. In any event, it was a while ago, well before they started working on IE7. Since it's been turned off for so many years, there are no public websites of any significance that still use it. There was some whining at first, but when it became clear that Microsoft was going to actually listen to the security people on this one, the web developers fell in line and found other ways to do things.

So for almost everyone, ActiveX is not needed. There are some things that will be needed that are currently *implemented* as ActiveX controls, but those things don't *need* to be implemented as ActiveX controls. They can be implemented another way. Microsoft already did this with XMLHttpRequest, which as of IE7 is built in, rather than being an ActiveX control.

The other major thing is plugins like Java and Flash, but, again, those don't *need* to be ActiveX controls. Another technology could be used. Firefox uses a different plugin technology, for instance. Believe me, if Microsoft still has anywhere near its current market share when IE9 comes out, the plugin developers will make their plugins for *whatever* plugin infrastructure IE9 uses. Sun talks big about not needing Microsoft, but when it comes down to brass tacks they will do the hundred yard belly crawl over splintered glass in their birthday suits if necessary to make sure the Java plugin works in Internet Explorer. Adobe will be even more motivated to make Flash work, because they won't want to leave a door open for Silverlight to get a foot into. (Right now there are approximately three websites that use Silverlight, and two of them were created by Microsoft to promote the technology; Adobe will want to keep it that way.)

Whatever solution Microsoft develops for ActiveX compatibility, almost all of the world's computers WILL NOT NEED IT, so there's no reason to suppose that all of the world's computers would need to be replaced because of whatever performance demands said solution might impose.

The only reason ActiveX would be needed at all, by anyone, is because there are some third-party line-of-business applications out there that rely on it. We're talking here about intranet stuff. This kind of software tends to develop at a glacial pace and then be upgraded even more slowly. Where I work, we were using DOS-based software until August of 2005, no fooling. So stuff that only works in IE6 will, as you can imagine, probably be around for a while. That's why the article says it will be a sticking point.

Honestly, though, such software would probably run just fine in emulation on today's hardware. Just roll out an IE6 VirtualPC image and Bob is very likely your uncle. I really don't see why IE9 needs ActiveX support at all.

Re:Misleading headline, and ActiveX

[jonadab]

> Headline should read, IE8 May Be End of the Line for Internet Explorer _Engine_ .

Indeed. Although, as much work as they put in to making IE8 render so many things so much better than IE7, I have a hard time believing they'll abandon it so soon.

> I don't see any reason why ActiveX apps couldn't be sandboxed like anything else

I'll go you one better: I don't see any reason why IE9 needs to support ActiveX apps at all. ActiveX* has been deprecated for so many years, the only things that still use it are line-of-business intranet apps, most of which were never updated to work in IE7 anyhow, because they're things that just don't get updated that much. There's no way in the world they're going to be updated for IE9. They're not developed that actively. They're *used* actively, but that's not the same thing.

So to support them, you just roll out an IE6-on-Win98 VirtualPC image and Bob is your uncle. IE9 doesn't need to do anything at all.

*Above I was speaking of ActiveX controls other than common well-known plugins like Java and Flash. These plugins will be needed for IE9, of course, but if IE9 uses a different plugin interface other than ActiveX, the plugins will be produced for that interface, and sites that use Java or Flash or whatever will work. There's no problem there.

Re:Misleading headline, and ActiveX

[jamsmith]

This is a general response to all the crap I see posted here about ActiveX 1. The whole argument is stupid beyond belief. So many of the same people who are so frightened of an ActiveX control from a site that is registered and easy to hold accountable, have no problem downloading and installing, or even worse off some blank CD someone handed them, a complete EXE that has equal ability to do massive damage. Its retarded, get over it. You have very little control over and EXE, at least with IE you have some control. For a developer there is NO DIFFERENCE between ActiveX and COM. Check your system32 folder - chock full of COM components! (OK, so an ActiveX Control is an OCX, not a DLL, thats splitting hairs.) 2. I am an application developer. You puny web site designers can get along fine with you Flash and your Firefox. My clients EXPECT the same capabilities from my browser based applications that they would expect from thier installed desktop applications. You cannot do with without ActiveX or active scripting like VBScript. Just cannot happen. Those of you who would beg to differ have NOT developed the app I have - and likely could not! 3. If you are a blog reading, FaceBook visiting weenie, FireFox is for you. If you are a professional developing professional applications to be used by professional and corporate concerns who want their apps web based, you WILL use ActiveX or you will create inferior products. One off topic point. I saw someone make a deal on someone's spelling. The true sign of a person who lacks superior skill and knowledge in programming and has to resort to high school crap instead. My spelling is atrocious (probably spelled that wrong!) and my typing is worse. My debugger find my typing based mistakes and I have plenty of people of lesser programming skill to correct my spelling mistakes. I love developing, by I really don't like much of the development community. Too much bullshit. I thank the Digital Gods everyday that I can figure out my own problems or learn from light tutorials so I don't have to post questions in forums. Reading forums gives one the impression that programmers are the dumbest people in the world. Dumb questions, even dumber answers. And God forbid someone asks a question someone asked 2 years ago! I wish Google would exclude forums from searches. I will leave you with a tip. If you HAVE to find a .NET answer in a forum, look for a C# forum. The VB.NET forums are chock full of the blind leading the stupid. Better yet, just read Scott Mitchell, one of the few out their that doesn't just regurgitate MDSN articles. )

Last Post!

[Anonymous Coward]

Oh wait...

Nope, not webkit...

[mdm-adph]

...they're going to buy Mozilla. Mark my words. :P

Re:Nope, not webkit...

[SatanicPuppy]

What a wasted buy. Firefox is dead, long live Iceweasel!

Can't kill an OSS project by buying it.

Re:Nope, not webkit...

[sakdoctor]

It was renamed IceCat

Re:Nope, not webkit...

[SatanicPuppy]

Those fucking weasels. At least they didn't call it LOLcat.

Re:Nope, not webkit...

[Anonymous Coward]

It's still iceweasel in Debian. Something I don't get, however, if the iceweasel change was made to make it completely free of trademark issues, why couldn't GNU use the name iceweasel too? Surely that would have been better than created yet another name - and a stupid one at that.

Re:Nope, not webkit...

[Anonymous Coward]

iScat?

Re:Nope, not webkit...

[retchdog]

It's not as bad as "gNewSense". On many levels...

Re:Nope, not webkit...

[Anonymous Coward]

No need. We'll all be using Silverlight instead.

Re:Nope, not webkit...

[FlyingBishop]

This actually would be a Good Thing in a lot of ways.

Now that Google's got Chrome, Mozilla's in danger of losing their primary patron. If MS takes over maintenance of the Gecko project, then each of the major players in the OS market is equally engaged in the browser market, and no one can afford to fall behind.

Granted, they would probably poison the Gecko well, but that might be happening anyway. And at least they would lose the anticompetitive advantage given them by IE. I'd be willing to give up Firefox to get rid of Trident. FF is getting really slow on Linux anyway.

Re:Nope, not webkit...

[Ilgaz]

Nokia basically knew (a good guess) that Apple will enter smart phone market and become the ultimate rival to their smart phone business but that didn't stop them from implementing Webkit S60 Browser to near hundred million phones giving Apple the ultimate credibility.

Of course, Nokia is a company which is run by market rules. If there is an opportunity, no matter where it comes from, they will pick it.

Somehow, MS can keep acting like a spoiled kid and keep pushing a technological and PR disaster since first ever IE exploit was released and it was proven that it is not a fixable thing, it was design flaw.

They are acting like an insane person who tries the same thing and expect different results. Ask Windows Mobile owners about their browsing experience with IE. They ported the very same junk to their mobile OS who runs on things that doesn't even have the power to run a full feature security suite like on Windows. That is the insanity.

Re:Nope, not webkit...

[dbIII]

why couldn't GNU use the name iceweasel too?

Because it was only a stupid little argument as to whether you could still use the firefox logo with anything based on firefox code or not.

They didn't like the firefox developers take on it so they forked it and gave it a new name. I really has nothing to do with free software at all apart from the fact that there would not have been the abilility to modify the code in the first place if it wasn't.

Re:Nope, not webkit...

[Alex Belits]

Except, of course, it's not going to happen. What else did you expect them to do, develop Linux?

Re:Nope, not webkit...

[hkmwbz]

Nokia used WebKit because they are too crap at this to build something from scratch. It shows. The S60 browser does suck.

Microsoft could build a new engine from scratch. They know how to build browsers. Their browsers may suck compared to the rest, but not as badly as the S60 browser.

Please kill ActiveX

[Thornburg]

The sticking point will be what Microsoft does about compatibility for ActiveX apps.

KILL IT!!!

Seriously. Since IE8 does it, people will just keep using that for the next decade...

If they don't kill ActiveX after IE8, we'll be stuck with it even longer than that. Since it's going to take 10 years to actually die, please start the process now, Microsoft.

Re:Please kill ActiveX

[sakdoctor]

Although I agree with your KILL IT sentiments on principle, in what way are we stuck with it even today?

You don't have to use IE, and if you use windows you can't uninstall it, but you can lock it down so it's less of a security hole.
That just leaves developers...but I don't remember the last time I saw a site that used ActiveX.

I heard that some banks do, though that would be one ghetto bank. And apparently a load of South Korean websites use it, so that's pretty limited damage if it goes the same way as everything else Microsoft named ^Active(.*)$

Re:Please kill ActiveX

[truthsearch]

In my experience ActiveX seems to be used most often in internal business applications (intranets). When you're on a homogeneous environment it's easy to build for the specific platform. Using ActiveX often allowed for continual updates without deployment issues. Thankfully it doesn't appear to be popular for new projects, but there's a lot of old business systems out there.

Re:Please kill ActiveX

[avandesande]

I think the main users of active x in IE are intranet sites/applications.

Re:Please kill ActiveX

[el americano]

I don't remember the last time I saw a site that used ActiveX.

Windows Update?

Re:Please kill ActiveX

[therealmorris]

Windows Update on XP and earlier yes, but Microsoft finally made it a separate app for Vista. At least I hope it doesn't still use ActiveX...

Re:Please kill ActiveX

[sortius_nod]

KILL IT!!!

How can you kill that which does not live?

Re:Please kill ActiveX

[e4g4]

How can you kill that which does not live?

By using sudo:
sudo kill -9 ...

Re:Please kill ActiveX

[zizzo]

You've clearly never tried to kill a zombie process.

Re:Please kill ActiveX

[jmorris42]

> > How can you kill that which does not live?

> By using sudo:
> sudo kill -9 ...

Nope. A process that isn't alive is a zombie. And kill -9 won't kill a zombie. We need a grenade_launcher command. After all, to quote the old Quake manual:

"Thou can not kill that with doth not live. But you can blow it to chunky kibbles."

Re:Please kill ActiveX

[Samah]

It's not too hard with a molotov and a hunting rifle. Just make sure you don't startle the witch.

Re:Please kill ActiveX

[tobiasly]

When you're on a homogeneous environment it's easy to build for the specific platform.... Thankfully it doesn't appear to be popular for new projects, but there's a lot of old business systems out there.

That's because it is being replaced by another homogeneous environment: XHTML + ECMAScript + CSS.

True, those old environments will still need to exist for a long time. I work at one of 'em (and we're still on IE6). But that's no reason why it needs to be enabled in the browser by default. Make ActiveX a separate plugin download that business have to intentionally download and push out to their users.

Re:Please kill ActiveX

[g2devi]

> And kill -9 won't kill a zombie.
True, but the kill implementation of Doom can:
http://www.cs.unm.edu/~dlchao/flake/doom/chi/chi.html

Re:Please kill ActiveX

[El_Oscuro]

sudo apt-get install grenade-launcher

Re:Please kill ActiveX

[Anonymous Coward]

looks like you don't have brains to do that.

Re:Please kill ActiveX

[perryizgr8]

Windows Update on XP and earlier yes, but Microsoft finally made it a separate app for Vista. At least I hope it doesn't still use ActiveX...

it doesn't need to. it's an elevated app, it does not need activex to run code.

Re:Please kill ActiveX

[kehren77]

Agreed. Either that find a way to make it OS-independent (which would probably make people stop using it too).

Re:Please kill ActiveX

[Anonymous Coward]

> > How can you kill that which does not live?

> By using sudo:
> sudo kill -9 ...

Nope. A process that isn't alive is a zombie. And kill -9 won't kill a zombie. We need a grenade_launcher command. After all, to quote the old Quake manual:

"Thou can not kill that with doth not live. But you can blow it to chunky kibbles."

A zombie process is a child process who's parent has died, so it has no process to report its exist status to. Thus it wanders through the cpu ... that is until Sun implemented a reaper() process that hunts zombies and buries a stake in their hearts, or cuts off their heads, or however you kill the bastards.

ActiveX won't matter

[Midnight Thunder]

Given the compatibility issues that ActiveX has in IE8, then it probably won't matter what Microsoft will do in the future. In all reality no site should be depending on ActiveX. If it breaks without it, then fix the site.

Re:ActiveX won't matter

[vux984]

Given the compatibility issues that ActiveX has in IE8, then it probably won't matter what Microsoft will do in the future. In all reality no site should be depending on ActiveX.

No external public facing site should rely on activeX. There is really nothing wrong with internal enterprise apps using it.

If it breaks without it, then fix the site.

You mean build the enterprise intranet application from scratch? When its working perfectly fine exactly the way it is? That will be a pretty tough sell.

Re:ActiveX won't matter

[IntlHarvester]

Actually every single IE plugin uses ActiveX (Flash, QuickTime, Java, etc.) Any future version of IE will likely have some ActiveX support for legacy plugins.

This is also the reason Google Chrome also supports ActiveX.

Re:ActiveX won't matter

[markdavis]

> No external public facing site should rely on activeX. There is really nothing wrong with internal enterprise apps using it.

Um, yes there most certainly is a MAJOR problem with internal enterprise apps using it. It means that everyone is chained to running MS-Windows and IE *only* on the desktops and every possible device that connects to that internal enterprise application. Just because you might not have a choice with what is running on the server doesn't necessarily mean you want to have no choice for the client.

Perhaps a company might want some additional choice.

Re:ActiveX won't matter

[Anonymous Coward]

No site should depend on javascript, flash or other client side scripts to function but that still happens.

Re:ActiveX won't matter

[vux984]

Um, yes there most certainly is a MAJOR problem with internal enterprise apps using it. It means that everyone is chained to running MS-Windows and IE *only* on the desktops and every possible device that connects to that internal enterprise application.

I doubt anyone starts new projects in ActiveX today. And when those activeX projects WERE started there weren't many options.

To get that level of functionality a few years back it was either ActiveX or Java. And at the time Java was quite a bit slower, and clumsier than the equivalent solution in ActiveX, and there were all kinds of disputes between Sun and Microsoft over Java and the JVM.

So ActiveX was actually a fairly good decision at the time.

I'm sure over time, enterprises are looking to rewrite things, to support blackberries and iphones, and Mac PCs, but that's beside the point. They've ALREADY got ActiveX, and would prefer it not be turned off on them.

Perhaps a company might want some additional choice.

I'm curious why doesn't that include giving them the choice to run activeX?

Re:ActiveX won't matter

[spectre_240sx]

No external public facing site should rely on activeX. There is really nothing wrong with internal enterprise apps using it.

So vendor lock-in is OK as long as you do it to yourself? Why should corporate end users or IT departments be forced to use Internet Explorer? ActiveX needs to go away. There's no reason for any of it anymore.

Re:ActiveX won't matter

[vux984]

So vendor lock-in is OK as long as you do it to yourself?

No more or less OK than relying on Microsoft Exchange, PowerPoint, SQL Server, GarageBand, Final Cut Pro, Adobe Flash, Silverlight, Lotus Notes...

Some degree of vendor lock-in is pretty much just a part of life for any business. Deal with it.

Why should corporate end users or IT departments be forced to use Internet Explorer?

They are always free to port their enterprise intranet to something else. And I expect most that are even somewhat forward looking ARE doing just that.

ActiveX needs to go away.

Why should corporate IT departments be forced to port a working system they are happy with on your schedule?

ActiveX needs to go away. There's no reason for any of it anymore.

Clearly there -is-.

Re:ActiveX won't matter

[Kenshin]

I doubt anyone starts new projects in ActiveX today.

Lazy programmers stick with the tools they know. Many business people aren't tech-savvy, so they wouldn't know any better with regards to that.

Re:ActiveX won't matter

[Mad Merlin]

I doubt anyone starts new projects in ActiveX today.

Lousy programmers stick with the tools they know. Many business people aren't tech-savvy, so they wouldn't know any better with regards to that.

There, fixed that for you.

Re:ActiveX won't matter

[dbIII]

To add to the fine comment above:

Eventually a CEO or leading salefolk sees those internal activeX sites and wants to show them to their customers - someone with little experience may then be pressured to immediately expose the thing to the public internet.

Any large enough corporate network has to be treated as being potentially hostile anyway, who knows what some drunken golfing friend of anyone or child or anyone is going to plug into the network.

Re:ActiveX won't matter

[Alex Belits]

No more or less OK than relying on Microsoft Exchange, PowerPoint, SQL Server, GarageBand, Final Cut Pro, Adobe Flash, Silverlight, Lotus Notes...

All those products represent much broader classes of applications -- lock-in to them would be indeed stupid.

Re:ActiveX won't matter

[filterban]

Technical debt builds up, and having a bunch of ActiveX apps around means you are accruing a shitload of that debt each day. 5 years ago, when 95% of the world used Windows and IE, it was still a dumb idea to build an app that used ActiveX.

Kill it, MS. Please!

Re:ActiveX won't matter

[spectre_240sx]

ActiveX needs to go away. There's no reason for any of it anymore.

Clearly there -is-.

Clearly? You haven't given us anything to support your argument other than "I don't want to bother with it". Give me something that you can do with ActiveX that you can't do with technology that's more readily available. My guess is that you can't.

Also, who said anything about a schedule? You should notice that I didn't give an explicit timeframe. I've worked as a web developer and done light software development for myself. I'm well aware that there's a process that needs to take place before support can be dropped for an API or rich media plug-in like ActiveX. They could very easily do what they've done with OWC and CDO: Remove them from the shipping application, but make them readily available as add-ins. This shows developers that the technology is truly deprecated and shouldn't be used for new projects, but it's very easy for IT departments to continue supporting applications they already have.

Re:ActiveX won't matter

[BitZtream]

Right, because there is some magical web app out there that is more than slightly complex that works perfectly across all browsers and renders properly on everything from Safari on the iPhone, to MobileIE to Firefox To Opera on Symbian to Chrome on Windows.

I've never seen that perfect web app, I doubt you have either, its more likely your 'my webbrowser kicks your webbrowsers ass' goggles that blinded you from seeing the problems.

Companies really don't have a problem standardizing on methods of doing things. Its not about choice, its about getting the job done, hopefully efficiently. Also, this is the important part, are you listening? The world doesn't revolve around you. I'm not kidding, it really doesn't. Its not all about YOU getting to run the browser YOU want to run, and it won't be. Companies are going to continue standardizing on these things so they can keep support costs to a reasonable level. And regardless of how many times you say other wise, your favorite browser has its own share of quarks and customer support issues. Its not really in the best interest of the company to waste resources supporting additional browsers to please you. Its far more efficient for them to just fire your ass if you don't stop whining about it.

Its funny that you're concerned about being 'locked in' on the client, but that is acceptable on the server. This is just dumb. I'm in the process of rewriting a major system to deal with the fact that a 3rd party software package we use has went away, it'll take me months to get back to a productive chunk of code. Yep, sure am glad I had server software lockin rather than web browser lockin.

Re:ActiveX won't matter

[perryizgr8]

I'm sure over time, enterprises are looking to rewrite things, to support blackberries and iphones, and Mac PCs,

the ultimate oxymoron.

Re:ActiveX won't matter

[rjstanford]

Generally, not really. By setting a single standard you risk lock-in, yes. But you also gain the ability to use that tech stack to the limits of its ability, rather than to the least common denominator you have to work with. You can also develop using very specific pathways, your testing burden is greatly reduced, et cetera. In the public facing world you have to support a wide array of clients because you can't control them. That costs in time, money, and feature set. Why make the tradeoff for an intranet when the requirement isn't there?

BTW, I happen to develop nothing but internet-facing browser-neutral webapps myself. But (or perhaps because), I can certainly see the benefits that would be gained for an intranet app going the way that they did. Just one example - tight integration with Excel? Easy... and I've never seen any kind of architecture-neutral plugin to a web app that could do a few percent of what a hardcore business user can do with Excel. There are hundreds more reasons, too.

Re:ActiveX won't matter

[sam0737]

In turns, Microsoft might promote the use Silverlight or XBAP (Full-blown .NET 3.5 client deployment in web browser) to replace ActiveX...

Re:ActiveX won't matter

[Anonymous Coward]

Well clearly when they wrote the app they didn't care much about choice. If all a company is going to gain by rewriting such an app is the choice to move to another platform, when the current one is working fine, they really gain nothing at all.

Re:ActiveX won't matter

[markdavis]

Look, I never said it was "OK" to be locked in on the server side either. I don't like that anymore than client lockin. I strongly support multiplatform and portable solutions, preferably as open as possible.... no matter what the type of system or location.

There is no magical "works on everything equally well and is open" solution. But there ARE alternatives that are a LOT more so than ActiveX. Half the crap I have seen that requires ActiveX is junk that could have been done without ANYTHING special, they just used it because their development environment used it automatically. A quarter of the sites that block browsers supposedly because they aren't IE work just fine with Firefox or Opera (sometimes with some quirks or some a few non-absolutely-necessary features that don't work).

Finally, trust me, it is not the world revolving around me. If you think *I* am the only one that is irritated by lack of choice in server and client choice, you are sadly mistaken. Read Slashdot! And if 20+% of the users in the world are not using IE, then that sends a pretty clear message right there.

Re:ActiveX won't matter

[markdavis]

>By setting a single standard you risk lock-in, yes. But you also gain the ability to use that tech stack to the limits of its ability, rather than to the least common denominator

That is certainly true. You get more features and power (and less testing headaches) by using a proprietary stack and user lock-in. But for many types of applications, compatibility and flexibility are as important or more important than just features. I can't tell you how many times I have encountered incompatibility at the sake of some programmer wanting to do something cute. For example, I don't give a damn about Flash or Silverlight. But if I go to a ticket site wanting to buy tickets and can't, because they wrote the site to DEPEND on one of them, I am really pissed. I don't need animated tickets and fly-out menus. I want to buy tickets (or rent a movie, or a car, or download some info, or check a bank balance, etc, etc).

>Why make the tradeoff for an intranet when the requirement isn't there?

Because we, as consumers, can't choose to run the platform of our choice. We can choose any platform as long as it is MS? If, for example, every electronic medical record vendor decided "the requirement isn't there" and they just require MS on the server and client, then medical facilities have no choice what platform to run. They are locked into one platform for 100% of their environment. So "the requirement isn't there" isn't because the customer chose it, it is because the developer forced it to be that way.

>Just one example - tight integration with Excel? Easy... and I've never seen any kind of architecture-neutral plugin to a web app that could do a few percent ...

And I would respond that having tight integration with Excel is not a HORRIBLE thing. But does that exclude also allowing an import/export as a standard CSV file? Does it always have to be all-or-nothing?
>

Re:ActiveX won't matter

[Anonymous Coward]

"You mean build the enterprise intranet application from scratch? When its working perfectly fine exactly the way it is? That will be a pretty tough sell."

But who is selling anything here?

You'd just be stuck with whatever will run IE8 until you migrate away, thus always was the story of proprietary software and lock-in. Had the application been built on technology with competing implementations, you could have switched provider, had it been built on free (as in freedom) software you'd have the additional option of supporting it yourself, or via a consortium. But if you build on technology from one vendor, and that vendor stops supplying you are stuffed. Google "dual sourcing".

Presumably Microsoft would only drop ActiveX when it made commercial sense to, but then they don't get much revenue from the browser side, but I'd be surprised if it was dropped completely. Still Microsoft surprise me most weeks, and given I use Debian desktop at home and work, and mostly Debian on the servers, that is quiet a lot of surprise given the amount of exposure.

Thinks like an os, eh?

[mevets]

Given their history, this could be pretty funny.

Re:Thinks like an os, eh?

[MrEricSir]

They're doing it for the lulz.

Re:Thinks like an os, eh?

[xSander]

Blue Page of Death

Re:Thinks like an os, eh?

[corprew]

"thinks like an OS" == "Has Internet Explorer embedded in it."

But seriously, isn't this the third or fourth engine for Internet Explorer? If there's one thing that MSFT has taught the IT industry, it's that branding and tech aren't necessarily related and there's no reason that branding (MSIE) and engine (CERN or Spyglass or whatever == IE1, IE3, IE4...) have to be related at all. (Vista == IE6, etc...)

If you're writing summaries of articles, it would be handy to understand them.

Re:Thinks like an os, eh?

[Anonymous Coward]

By "thinks like an os" they mean that refreshing a page will require a reboot.

Re:Thinks like an os, eh?

[Anonymous Coward]

They should make it slightly more violet. Then they could call it Indigo Page of Death, or IPoD for short.

Re:Thinks like an os, eh?

[xSander]

Don't give them ideas...

Re:Thinks like an os, eh?

[logixoul]

http://upload.wikimedia.org/wikipedia/commons/5/52/Aw%2C_Snap!.png

WebKit?!

[rbanffy]

"Some are still claiming that Microsoft will go with WebKit"

Microsoft will never allow the browser that ships with Windows to become a commodity. They will go with Gazelle or whatever they develop that's as incompatible to official standards as possible while still being called a web browser engine.

Their goal is lock-in. A standards-based engine would negate that.

Re:WebKit?!

[fuzzyfuzzyfungus]

Not necessarily: Pages that are mostly Flash blobs are not "standard" in any useful sense, even if the html/CSS/javascript that embeds the blobs is perfectly well formed.

If, for instance, MS decided to use webkit; but push Silverlight, you could easily end up with an equivalent situation.

Re:WebKit?!

[geekoid]

But they have failed to do lock in, and if they try they will get shut down.
  They show signs of learning to keep at when they do well and sell to that market instead of trying to lock in at the puny application layer. By putting an OS on almost every box, they are getting paid to be the gate keeper.
the 1000 year view MS had isn't panning out, and all the people that bought into it when the document was created are leaving MS.

Re:WebKit?!

[Dracos]

More likely Gazelle is a ruse, as is interest in WebKit. I wouldn't be surprised if MS attempted a hostile takeover of Opera. Opera doesn't have that much usage share among desktops/laptops, but its share on cell phones and other mobile devices is huge.

Re:WebKit?!

[markdavis]

>But they have failed to do lock in, and if they try they will get shut down.

Wrong. They have failed to lock in PUBLIC facing web sites. But they have done a MARVELLOUS job of lock-in for corporate web applications and inside apps with IE. Trust me, I have fought that monster over and over again.

Re:WebKit?!

[Anonymous Coward]

The summary is typical Slashdot bullshit. Gazelle is an architecture for a secure web browser. MS could implement this architecture with any HTML engine they wanted to. To say that Gazelle could be used as the HTML engine is meaningless.

MS will either continue to use the current engine, or they'll switch to a different third-party one. They are not going to implement a new proprietary engine.

Re:WebKit?!

[Anonymous Coward]

Nobody put a gun to their head to use ActiveX. You should think about stepping out of your fantasy land into the real world where people choose solutions which are the easiest to implement. I guess it didn't occur to you that Microsoft provides software solutions and out of the 6-odd billion people on this planet some of them actually prefer using Microsoft's tech.

Its amusing to see the anti-ms trolls try to come up with new ways to blame MS for everything. Is there like a troll prize or something? Troll with the most FUD wins?

Re:WebKit?!

[Firehed]

What is there to be gained by Microsoft from a non-standards-compliant browser? ActiveX is its own thing, as are plugins such as Flash and Silverlight. All that the lack of standards compliance in IE6 and 7 (8 seems pretty decent so far, in my limited testing) brings Microsoft is ill will from web developers, which is hardly in their best interest given how much browser market-share they've already lost.

I can see the advantage to keeping Word docs proprietary (or so obscure that they might as well be, as seems to be the case with ooxml) - that pushes Office licenses. But shitty HTML/CSS/JS support in their browser doesn't push any of their products, let alone ones that make money. Companies with old legacy apps that need the ActiveX support or run with IE6's quirks in mind are already MS shops. And those places are either not switching away from MS, or are looking for any alternative options because dealing with their lack of standards compliance is simply too damn expensive. Even Microsoft's own web apps work in pretty much all major browsers, including SharePoint. Maybe not perfectly 100% of the time, but well enough that non-IE users aren't totally screwed.

Re:WebKit?!

[jmorris42]

> Their goal is lock-in. A standards-based engine would negate that.

True enough, but they are learning of late. They were so hellbent on pushing OOXML they perverted the ISO. But enough people stood firm and resisted so they are putting ODF support into the next Office service pack. We will see if they manage to put a sting into it. I'd bet they won't make it possible to set ODF as the default save format. Or ensure subtle conversion errors force large instituitions to not use ODF as their primary interchange format.

Re:WebKit?!

[nine-times]

Or they're both a ruse because they're going to stick with the current IE engine. There are always rumors that Microsoft is going to do something cool and/or open, and sometimes they even announce that they're going to do something big. It never happens. A couple years later, they release the new miracle product, and it's a slightly tweaked version of the old one.

Re:WebKit?!

[Dracos]

From what I've heard since IE7 was in development (and I'm no MS hanger-on), Trident is a mess of spaghetti code and patches. If they are creating a new engine, it will be their first one built from scratch, and someone inside Redmond realized what a nightmare Trident is.

Re:WebKit?!

[fuzzyfuzzyfungus]

In fact, in the article on "Gazelle" they said that they used trident in their proof-of-concept implementation...

Re:WebKit?!

[Anonymous Coward]

Troll with the most FUD wins?

Oh the irony...

Re:WebKit?!

[AxelTorvalds]

I can't imagine that they'd use anything but their own rendering engine.

Lock-in is one thing. The other thing is they're a huge target for hackers, they have to be responsible for fixing things and they've never shown that they can play nice with opensource and opensource tends to be hostile towards them. If they did use webkit, it would effectively be a branch, just because of their requirements. They'd be going from zero to full blown dependence on something they don't completely own.

Second, it undermines one of their most fundamental cultures. However good Webkit, or Opera or Firefox is, it somehow misses the spirit of the standard in their view and there is some new shit that must be added to make it whole. It'd be like webkit with BASIC instead of ecma/javascript and then a javascript to basic translator bolted on top. I don't even think it's always done out of malice, I think sometimes they see a standard of sorts and if they don't change it then they "didn't give back" or feel they didn't "contribute." In all likelihood, it's silverlight that needs to pushing right now.

It'd be huge, I mean if MS wanted to ever show that they have changed their colors, supporting open browsers would be a start. I just can't see it though.

Didn't they claim that they couldn't take IE out of windows?

Re:WebKit?!

[Ghubi]

Regression happens. When step 2 extend fails revert to step 1 embrace and try again.

Re:WebKit?!

[rbanffy]

"Nobody put a gun to their head to use ActiveX"

No. but the cheapest labor is also the dumbest and the most shortsighted. It's no surprise all things being equal, monkeys prefer anything Visual Studio does with the fewer clicks.

"where people choose solutions which are the easiest to implement"

Because, of course, they will not need any maintenance.

"out of the 6-odd billion people on this planet some of them actually prefer using Microsoft's tech."

Exactly half the people of a given population has below-100 intelligence. Since IQs below 120 are not exactly bright and these things are really complex, it's no surprise many people chose Microsoft - they do so because they can't grasp the differences with their puny brains and limited intellects.

"come up with new ways to blame MS for everything"

What you see as new and what you perceive as old seems to depend on your limited memory span. Various kinds of lock-in are perhaps their most enduring strategies.

Re:WebKit?!

[rbanffy]

Unfortunately, there are still lots of public-facing web-sites that are designed specifically for IE and sort of break with anything else.

Many big portals still don't test for Safari.

Re:WebKit?!

[ozphx]

So you are suggesting businesses ignored a bunch of standards and picked the solution that delivered the best ROI?

For shame! These bastards are going to send our GDP skyrocketing!

Re:WebKit?!

[rbanffy]

"So you are suggesting businesses ignored a bunch of standards and picked the solution that delivered the best ROI?"

ROI depends on your time horizon. If all you see is the next quarter, the cheapest solution may be the best. If you intend to give the best ROI over a couple years (or decades) that's a whole different story and you will have to find the good ones, not the cheap ones.

Any idiot can give a decent ROI over the next quarter and aiming your measurements that short guarantees you will select idiots to run your business.

Re:WebKit?!

[domatic]

Actually MS has built an engine from scratch before. IE for the Mac used it's own engine and it was quite good in it's day.

Re:WebKit?!

[Anonymous Coward]

If you actually read the paper on Gazelle (page 2 on http://research.microsoft.com/pubs/79655/gazelle.pdf), you will notice that Gazelle is just a (clever) C# shell written around the IE engine (probably v7.) It may be a model for the next MS browser, but it needs to kick the IE engine to be something progressive.

Re:WebKit?!

[rbanffy]

The beauty in this conclusion is that nobody even needs to know what Gazelle is. Whether MS goes for Trident under Gazelle or something completely new is irrelevant. The point is they will never allow whatever HTML engine they put in Windows to be fully interoperable with other platforms.

Coming full circle?

[mcrbids]

First, Microsoft tried to make the browser part of their operating system, without paying much attention to security. Now, they're trying to make a browser into an operating system with security first in mind?

Looks like an about-face if you ask me...

Funny how the vendor of one of the world's most insecure operating systems now considers that they're going to one-up the competition with the most secure browser / operating system? I guess they'd have an excellent track record of finding out what not to do... ?

PS: Good luck with retro compatibility!

Re:Coming full circle?

[RAMMS EIN]

``Funny how the vendor of one of the world's most insecure operating systems now considers that they're going to one-up the competition with the most secure browser / operating system?''

I wonder if Windows is still one of the world's most insecure operating systems. Microsoft have certainly been working hard to improve things, which is more than I can say for many other operating system vendors. Meanwhile, Linux user seem to be content pointing and laughing at Microsoft's efforts and pointing out that Linux is so much more secure.

I won't make any claims about which operating system is more secure than another operating system (because I think it is fundamentally impossible to measure, let alone to know), but if I see that Microsoft is introducing things like address space layout randomization and non-executable stacks, I have to wonder why those features aren't in other mainstream operating systems yet. OpenBSD has done a lot of pioneering work already, but when will we see the day that all of Debian is compiled with -fstack-protector and ships with PaX enabled?

Re:Coming full circle?

[mcrbids]

Meanwhile, Linux user seem to be content pointing and laughing at Microsoft's efforts and pointing out that Linux is so much more secure.

Because it is. There. I said it.

The relatively simple, understandable Unix security model has a very long history, and has grown gracefully as the strength, power, speed, and ability of the individual computers have. Everything is a file, and all files have the three permissions: Users, Groups, and Other. Each of these can have read, write, and execute permissions. Simple, understandable, easy to enforce. It's so taken for granted as such that it's routinely used in embedded devices (such as routers) where updates are few and far between, yet they are rarely, if ever, compromised.

Compare/contrast that with the Windows security model, where there are actually alternate file spaces within the existing file system. With the Windows API, it's trivial to save a file that's in an alternate namespace and thus cannot be found with *any* normal Windows system call. There are many examples of strangeness like this!

There was a recent article I read about the confessions of a grey-hat programmer... he describes Windows as incredibly complex, labyrinthine, and basically impossible to secure well. He laughed at so-called "security vendors" like anti-virus.

Re:Coming full circle?

[INeededALogin]

which is more than I can say for many other operating system vendors

Are you serious about this statement. Microsoft is only focusing on security because of all the bad PR it has gotten in losing the virus war. Meanwhile, I can still install an older RedHat version without it being exploited 5 minutes after install.

While people on here might disagree because of being partial to one OS over another... Solaris is mighty ahead of the curve when it comes to security and have done a lot more than Microsoft on the security front IMHO

Re:Coming full circle?

[Kalriath]

The fact that NTFS supports file streams is nothing to do with the Windows NT security model whatsoever, just as the fact that HFS+ supports data and resource forks has nothing to do with the Mac OS security model. I also wouldn't be surprised if there were some way to embed crud tons of meta data into an alternative fork on the ext file systems (which would again have nothing to do with the Unix/Linux security model). The Windows NT security model for NTFS file systems is actually far more granular - and if you ask me, preferable to that of Linux with the ext file system.

Re:Coming full circle?

[lgw]

Everything is a file, and all files have the three permissions: Users, Groups, and Other.

Don't forget the sticky bit! Much as one might like to, let's not forget that the "simple Unix permissions" included one Hell of an egregious security flaw.

there are actually alternate file spaces within the existing file system. With the Windows API, it's trivial to save a file that's in an alternate namespace and thus cannot be found with *any* normal Windows system call.

There is no alternative namespace, there are merely alternate streams in a file - named locations for storing meta data. The file is right there in the filesystem, obvious to all. The file data may be a bit hidden, requiring normal Windows system calls to read (just like one uses normal Windows system calls to create alernate data streams), instead of Notepad. Oh, wait, you can read them with Notepad too. What a bunch of FUD.

he describes Windows as incredibly complex, labyrinthine, and basically impossible to secure well.

Vista clearly lost the thread, going for security through complexity, but any OS that doesn't have a read-only kernel is impossible to secure. Any OS that does have a read-only kernel is impossible to patch. No OS can secure itself. Scanning for modifications to kernel bits from a hardware-protected hypervisor is the only way, but as long as "Trusted Computing" is used for evil, we can't get there.

Re:Coming full circle?

[EvanED]

There is no alternative namespace, there are merely alternate streams in a file - named locations for storing meta data. The file is right there in the filesystem, obvious to all. The file data may be a bit hidden, requiring normal Windows system calls to read (just like one uses normal Windows system calls to create alernate data streams), instead of Notepad. Oh, wait, you can read them with Notepad too. What a bunch of FUD.

This... is actually not the whole story.

NTFS is actually a case-sensitive file system. You can illustrate this by installing Services for Unix. This is an alternative subsystem that doesn't go through the normal Windows API (or the DLLs implementing it) and collection of Unix programs that have been "ported" to it. Once you install this, programs that are part of SFU are able to create files with the same case-sensitive name but different case.

Instead, the reason you normally can't do this is because the DLLs that are part of the Windows subsystem (the one providing the normal Windows API) hides this case-sensitivity in concert with the file system driver. (IIRC, open commands in the driver get a flag saying whether to be case-sensitive or not.) Instead of making calls through the Windows API, you can either use another subsystem like SFU or make native system calls directly (though that interface isn't supported).

Finally, the implementation of the Windows API is such that if you create two files with different case but the same name, only one will be visible through the Windows API, at least with NTFS's implementation of all of this.

This means that if you want to write security software for Windows, to catch malware written by people who know about this hole, you need to make API calls to an undocumented interface if you don't want to require people to install SFU. (Of course, security software does so much other stuff that's even worse that's hardly a drop in the bucket.)

Re:Coming full circle?

[onefriedrice]

Don't forget the sticky bit! Much as one might like to, let's not forget that the "simple Unix permissions" included one Hell of an egregious security flaw.

Do you mean the setuid (S_ISUID) bit? That's different from the sticky bit (S_ISVTX). Whether or not setuid is a "security flaw" is debatable. A setuid binary can be used in controlled ways to grant privileges they need without giving them more privileges than they need, which would be a bigger security flaw. The security implications of setuid are generally very understood today, although I would only trust a very knowledgeable coder to write a program meant to be run setuid-root. It's not hard, but you have to know what you're doing. I wouldn't say that makes setuid "one hell of an egregious security flaw" any more than the C programming language is... although maybe you would argue that C is a security flaw. I say they're both tools which are only as flawed as the programmers who use them.

Re:Coming full circle?

[Drew M.]

There is no alternative namespace, there are merely alternate streams in a file - named locations for storing meta data. The file is right there in the filesystem, obvious to all. The file data may be a bit hidden, requiring normal Windows system calls to read (just like one uses normal Windows system calls to create alernate data streams), instead of Notepad. Oh, wait, you can read them with Notepad too. What a bunch of FUD.

Because as we all know, no security issues ever came out of the namespace differences between C:\Program Files\foo and C:\PROGRA~1\foo

http://www.cert.org/advisories/CA-1998-04.html
http://www.kb.cert.org/vuls/id/544392

Re:Coming full circle?

[perryizgr8]

I'm sure over time, enterprises are looking to rewrite things, to support blackberries and iphones, and Mac PCs,

whatever the reason may be behind microsoft's recent focus on security, fact remains that they are looking at their os's security while debian and ubuntu are content with their current model.

Re:Coming full circle?

[Waccoon]

Everything is a file

Don't tell that to a Plan9/Inferno user. ;)

UNIX is good, but it's still old.

Re:Coming full circle?

[Anonymous Coward]

NTFS is actually a case-sensitive file system. You can illustrate this by installing Services for Unix. This is an alternative subsystem that doesn't go through the normal Windows API (or the DLLs implementing it) and collection of Unix programs that have been "ported" to it. Once you install this, programs that are part of SFU are able to create files with the same case-sensitive name but different case.

As the SFU installer tells you, it actually flips a setting in the registry (i.e. you don't need SFU to do this). And yes, Win32 does use the insensitive calls anyway.

Fun stuff to try: install Alcohol (the CD image fake drive thing). Flip that thing in the registry. Watch it stop being able to mount your images because the part that passes it to the fake drive driver changes the case and it can't find the image file. No SFU needed.

Re:Coming full circle?

[Anonymous Coward]

Ya, the next big thing from microsoft is going to be the most stable, most secure "thing" around... until it is released.

Re:Coming full circle?

[Late Adopter]

Everything is a file, and all files have the three permissions: Users, Groups, and Other.

Yes. This. I wish DBUS et al would realize that having more levels of abstraction just makes something harder to secure and use with standard Unix tools.

As a side-note, there *is* a flaw with this security model: it's very difficult if not impossible to sandbox an app so that it has some write access for the user running it, but not access to trash his entire home directory. SELinux and AppArmor supposedly fix this. Perhaps they will get more popular if Linux malware starts to pop up.

Re:Coming full circle?

[lgw]

Your post would make more sense if you didn't say "Windows API". There are multiple system libraries in Windows (multiple ways to get kernel functionality from user-mode programs). Win32, WOW16, WOW64, POSIX compatibility layer, OS/2 compatibility layer, and maybe others. These are all implemented on top of the RTL, not on one another. There are several dirty tricks you can play using one of these that won't be visible through another.

This isn't a "hole" or an "undocumented interface", it's an entirely different system library. Just like different filesystems have different rules for naming files, the different system libraries that sit on top have different rules for naming files. NTFS will happily let you create a file with a '/' in it, but I don't think any of the system libraries will let you delete that file.

The multiple libraries can be a real problem for non-signature based security software, since that usually just replaces the Win32 (and maybe WOW) layer, ignoring the others.

Re:Coming full circle?

[lgw]

Sigh - this is why engineers typically make poor security guys. You're looking at how that feature is *intended* to be used, not how it can be *abused*.

If an admin has a console session open with root permissions (which used to be quite common, back in the day) and I can distract him for 30 seconds, I can gain root access to the entire system, potentially for a very long time, with a single shell command (copy the shell itself to an obscure location with the S bit set, so it always runs as root. For bonus points, create a process that keeps the shell file open, then delete the file so it can't be found with a scan).

Anything that easy to abuse is a major problem.

Re:Coming full circle?

[lgw]

Well, good point. Windows has *always* been screwed by not being sufficiently defensive against really crappy software. That's really the Windows security problem in a nutshell - there's this amazing fine-grained security model of great complexity that almost no one fully understands, and little attention paid to preventing crappy software from screwing everything up. It just doesn't seem to occur to MS that making the security model dead simple would significantly reduce the number of developers who misunderstood it.

Re:Coming full circle?

[EvanED]

Your post would make more sense if you didn't say "Windows API". There are multiple system libraries in Windows (multiple ways to get kernel functionality from user-mode programs). Win32, WOW16, WOW64, POSIX compatibility layer, OS/2 compatibility layer, and maybe others.

But only one thing that's actually called "the Windows API"; the Win32 and 64 subsystem and WOW subsystems implement it (and all implement it the same with respect to what I'm talking about).

This isn't a "hole" or an "undocumented interface", it's an entirely different system library.

I would argue it is a hole, because writing a program that will be able to properly detect virus or whatnot in files "hidden" by the Windows subsystems (i.e. Win32/64, WOW) case insensitivity becomes non-trivial. You either need to use native system calls (and thus an undocumented interface) or write part of your component to use document calls in a subsystem that DOES provide access to these files -- to my knowledge, this is only the POSIX subsystem/SFU/SUA/Interix/whatever you want to call it. Since you can't mix your uses of the subsystems, this means that your program now needs to be split in two parts, one that runs in the Windows subsystem and provides the UI, and one that runs in the POSIX subsystem and does the actual scanning. Oh, and you can't use a lot of the Windows API calls in that part. Oh, and no one writing security software actually does this, because they don't want to make people install SFU. This means that, based on what I know, either current security software will miss such files or they are making calls to the undocumented system call interface. (Given the syscall hooking and such that a lot of security software does, I know which one I would guess.)

Re:Coming full circle?

[lgw]

But only one thing that's actually called "the Windows API"; the Win32 and 64 subsystem

I've heard every library that Microsoft has ever written, and a few created by third parties, called "the Windows API". I think you mean "Win32", as that's the library most user-mode systems guys program against.

You either need to use native system calls (and thus an undocumented interface)

I don't know why people keep imagining all these "undocumented" interfaces. Microsoft lost all those lawsuits long ago, and everything is documented (though sometimes crapily, as with anything). The library stack is basically:

Win32 (or whatever)
--- kernel mode ---
"The RTL" (all the functions start with RTL_).
The kernel

Because the kernel varies from machine to machine, no one writes against the kernel. The RTL is fairly well documented, and most of the funtionality exposed by the system libraries is just wrappers around the RTL. I think WOW16 actually makes some direct kernel calls, which is one reason you can't run 16-bit apps on a 64-bit machine. You can get a license to look at the source code for these parts, so even where the documentation is crappy you can get the truth.

It is certainly a bit messed up that MS won't show the source code for NTFS (even under some expensive, restrictive license), and MS certainly deserves some critisism there, but those APIs are also well documented (again, as well as things ever are).

Re:Coming full circle?

[EvanED]

I think you mean "Win32", as that's the library most user-mode systems guys program against.

"Win32" hasn't been the official name for a while, and it's now called the Windows API. (After all, it also works on 64-bit builds of Windows.) See the second sentence on Wikipedia.

I don't know why people keep imagining all these "undocumented" interfaces. Microsoft lost all those lawsuits long ago, and everything is documented (though sometimes crapily, as with anything).

I'm not as convinced I'm right, but I'm still seeing some evidence. For instance, there are several functions on an old Sysinternals page on the Native API that I can't find documentation of (either under the Nt* name, Zw* name, or Ke* name), such as NtCreateSemaphore. undocumented.ntinternals.com has a bunch that I can't find on MSDN. Still, I'm willing to concede I might be wrong on this point, and merely say that until relatively recently (even in terms of the history of NT), it was undocumented.

Re:Coming full circle?

[EvanED]

Because the kernel varies from machine to machine, no one writes against the kernel.

Oh, I forgot to reply to this before. Malware sometimes does. After all, it doesn't have to run everywhere it tries, just a lot of the time.

Re:Coming full circle?

[lgw]

Some of the better documentation is "third party" now - if you can call former MS employees a third party. Some specific functions aren't documented - not because MS is hiding anything, but simply because no one ever got around to commenting the function (and presumably no one still employed has a clue about it, as is normal with any legacy code).

Usually when people blather about "secret undocumented Windows APIs" they're ranting about MS keeping the good stuff for themselves. That's just not the case anymore. But there are certainly a set of functions (never intended to be exposed externally, but callable nonetheless) that no one anywhere has a clue about. That's been the way of things in multiple shops I've worked at with ancient legacy code (and sadly, I've had to support code far older than NT). And of course, sometimes the API docs are just wrong.

Of course, any old, complex system has this problem, and sometimes there are exploits lurking, but no system ever becomes younger or simpler over time, so what are you going to do?

Re:Coming full circle?

[EvanED]

Usually when people blather about "secret undocumented Windows APIs" they're ranting about MS keeping the good stuff for themselves. That's just not the case anymore.

Oh, I agree with that.

Actually, I've heard that back in the days when other MS products were using the at-the-time undocumented interfaces (which I assume means the Native API), when the Windows team heard about it, they were livid because that interface is not supposed to be targeted so they can change it without breaking stuff.

Really?

[Jonah Bomber]

Thank goodness!

ActiveX

[dedazo]

The sticking point will be what Microsoft does about compatibility for ActiveX apps.

That's not going to be a problem, I think. They're being phased out all over the place in favor of Ajax foofyness. By the time IE8 is EOL'ed, I hope ActiveX will be long gone.

Re:ActiveX

[Shados]

There's a decent amount of activex that use the browser as a kind of software delivery platform for full blown applications...stuff that cannot just be done with Java or Flash (easily...though lately most are finding ways), from VPN clients, to anti-virus, to archaic bank systems, integration with RDP, etc.

Many of the ones I just pointed out are possible without ActiveX, but its very hard to do it as well as with a model that lets you do "anything and everything", so they're, in many cases, more primitive.

Doesn't change the fact that its just used because there's no better solution...but if they were to kill ActiveX, some third party would quickly make one, Im sure.

Re:ActiveX

[gers0667]

Then I say kill it... ActiveX scares me, and it would be nice to have a more open solution.

Doesn't microsoft say this about everything?

[Zakabog]

Others insist that that the whole WebKit story is merely a feint and that Microsoft will in fact be adopting a brand-new engine coming out of its Microsoft Research division. Dubbed "Gazelle," this new engine will supposedly be more secure than Firefox or even Chrome, making copious use of sandboxing to keep its myriad plug-ins isolated and the overall browser process model protected.

Doesn't Microsoft scream "This one's WAAAAAY more secure than the last one!" about everything they release? When has that actually meant anything? Sure, I'd take Windows XP over Windows 95, but it's not very hard to do better than their old lousy products. Making the claim that it'll be more secure than Firefox or even Chrome, that's a bold statement and I doubt they'll be able to back it up. Plus all the security in the world is useless if the thing doesn't conform to any web standards.

Also, are they changing just the engine or is the name changing too?

Re:Doesn't microsoft say this about everything?

[Anonymous Coward]

That's a funny statement given that Internet Explorer 7.0 and 8.0 are of the most secure browsers available on any OS given the nature of Protected Mode and UAC in Vista. If there is a bug in a plug-in any exploit is limited to execution within an exceptionally tight jailed subset of the current user context. They cannot write any files at all, not even to the profile of the current account. If/when someone finds a vulnerability in a plug-in loaded by FireFox on a Linux box an exploit can still trash the context of the current user, and there is plenty of damage that can be done even if that user is not root. There has yet to be a browser-born vulnerability that can affect Internet Explorer 7.0 on Vista when Protected Mode is enabled, which is the default state.

Google likes to advertise the isolated process job model employed in Chrome as a secure and reliable method of hosting renderers within a web browser, and they should, it's a great idea. It was a great idea when Microsoft implemented it in the public beta of Internet Explorer 8.0 more than five months before Google Chrome was announced to exist at all. It is quite clear that Google borrowed a page from Microsoft as the implementation is eerily similar. I'm sure the distortion field will give credit to Google, but that only works if Microsoft has a working time machine.

Re:Doesn't microsoft say this about everything?

[alexborges]

I need a job. What does MS pay for astroturfing?

Re:Doesn't microsoft say this about everything?

[Anonymous Coward]

That's a funny statement given that Internet Explorer 7.0 and 8.0 are of the most secure browsers available on any OS

LOL

How many zeros after the crooked number did it take to get you to astroturf that CRAP?

Given Microsoft's history of handling security like a Thalidomide baby with a hand grenade, how on God's good Earth can you call pre-release Microsoft code "the most secure browsers on any OS"?!?!?!

Good Lord, that's utterly whacked.

Or maybe you're the Jonathan Swift of Slashdot posters, right?

given the nature of Protected Mode and UAC in Vista.

Would that be the same UAC that Microsoft itself subverted in order to keep their stuff running?

Gee, do you think any other process could take advantage of UAC's built-in brokenness? Like, say a virus or a trojan?

Re:Doesn't microsoft say this about everything?

[Excors]

Gazelle is from Microsoft Research, and their paper discusses the details of the security model - it's not just a marketing claim.

The idea is that every 'origin' (basically a domain name, which is used as the basis for access control in all modern browsers) is separated into its own sandboxed process. If a page on your domain embeds an iframe from an advertiser's domain, the iframe is rendered in a separate process, and all communication is handled through a Browser Kernel which enforces the security constraints (e.g. preventing the advert from touching or rendering anything outside its iframe box, even if an attacker can find a way to execute arbitrary code in it). Plugins are handled in the same way.

Chrome's security model doesn't handle that kind of separation of multiple sites within a single page. But Gazelle sacrifices some backward compatibility (e.g. it removes the document.domain attribute, and it requires all plugins to be rewritten to use the Browser Kernel instead of directly accessing the network or filesystem), which is unlikely to be acceptable in practice.

And Gazelle is certainly not a replacement for the IE engine - it's built on the existing IE7 components for parsing, rendering, scripting, etc. It's research, and the value is its ideas, some of which could perhaps be integrated into current browser engines to improve security. It's not meant to be a real browser engine, but it seems successful as a research experiment.

"Thinks like an OS"? From Microsoft, that's scary

[Anonymous Coward]

Microsoft's OS efforts haven't been exactly technically sound.

Look at UAC. First chance they get, Microsoft has to subvert it just to get their own crap to work.

legacy hardware

[way2trivial]

I for example have a couple of panasonic IP cameras that use it in their internal webserver to display motion video to the end user.

IE8 may be end of the line for Trident

[Shin-LaC]

The rendering engine. The browser itself will probably still be called Internet Explorer 9, no reason to throw away a strong brand. It will use a new layout engine with deep Silverlight integration.

Re:IE8 may be end of the line for Trident

[red_blue_yellow]

It will use a new layout engine with deep Silverlight integration.

I think you are spot on with this... and I dread it. Deep Silverlight integration will open a whole new world of incompatibilities.

Re:IE8 may be end of the line for Trident

[JazzyMusicMan]

I have always liked the word trident, it sounds awfully mighty. With IE though, its just mighty awful. I guess since trident means a spearwith 3 prongs, I'll let you decide the 3 things you thought were the most awful in IE Trident and let you 'spear' it:

1:_____________________
2:_____________________
3:_____________________

Re:IE8 may be end of the line for Trident

[Pixelstuff]

The reason to throw away the strong brand is because it's notorious for crappy standards support. A new name on the new browser might have a small psychological benefit. Maybe.

Re:IE8 may be end of the line for Trident

[Anonymous Coward]

It will use a new layout engine with deep Silverlight integration.

Serious question: what form could this 'deep integration' take?

I'm having trouble envisioning how Microsoft could push Silverlight -- more than they already are -- using their browser.

Thinking about it, the Web may become proprietary unless we can get some SVG development tools that are as good as Microsoft's tools for developing Silverlight.

Re:IE8 may be end of the line for Trident

[supersloshy]

The browser itself will probably still be called Internet Explorer 9, no reason to throw away a strong brand.

What is this "brand" you speak of? All the average user cares to know about it is that its a big E on their desktop and its name is "the internet".

Re:IE8 may be end of the line for Trident

[Anonymous Coward]

no reason to throw away a strong brand.

What about the stench?

Re:IE8 may be end of the line for Trident

[PotatoFarmer]

What is this "brand" you speak of? All the average user cares to know about it is that its a big E on their desktop and its name is "the internet".

And when they click on "the internet", a window pops up that says Internet Explorer on the top, and probably takes them straight to MSN, where they can check their email through Hotmail. It's all part of the MS brand, and they're not about to toss any piece of it.
Good marketing is a lot like whale hunting - you might not notice one or two small harpoons/elements of the branding strategy, but eventually you end up tied to the ship. After which your ribs are made into corsets and your precious body fat is rendered into fuel oil. Or something.

Methinks I should think these metaphors through before I start writing them.

Netscape do over

[Dan667]

Wouldn't it be ironic if microsoft decides to rebuild IE9 from the ground up like Netscape did when they were dominant? Would be the wheel of life making a complete turn I think.

Re:Netscape do over

[k1980pc]

Undoing wrong moderation.

ActiveX

[Anonymous Coward]

Abandon it. It's all viruses and spyware crap anyways isn't it?

It may contain a core of truth

[Daimanta]

IE has failed to do what it was designed for, dominate the standards. Internet Explorer's aim was to change the standard from the open w3HTML to MSHTML and use it to bind "The Internet" to Windows and Microsoft as its Autocrat. Now with the rise of Firefox and open standards another attempt to control the standards will only break old (IE-only) sites therefore MS has decided to throw in the towel(or so is the theory) and stop working on its rendering engine. The use of Webkit is probably because it's a widespread engine(a lot of browsers use it) and it's not Gecko(although I don't know if you can use Gecko in close sourced software). Internet Explorer is a burden now, so they will probably only do what is neccesairy for its healthy development(bugfixes and essential features).

Re:It may contain a core of truth

[blueg3]

Gecko is licensed under MPL, GPL, and LGPL -- two of these allow you to use it in closed-source software.

Re:It may contain a core of truth

[qbast]

It worked for a while. But know I guess this goal will be passed to Silverlight. Yeah, I know there is fig leaf in form of Moonlight but let's not kid ourselves - the end result will be just like Wine. Most sides almost kinda working but not really.

Not End of the Line

[Anonymous Coward]

Ballmer: The only reason that Microsoft is stopping development of IE is because it has attained a state of perfection.

Avg /.er: Yeah, it's perfect alright. A perfect piece of shit.

Ballmer: Ha! But you still agree that it's perfect!

and just in

[Anonymous Coward]

And, the next one will still be as insecure, and unstable as IE8, and IE7, and 6 and so on.

Antitrust suit 2?

[mr_lizard13]

How dare they use their browser monopoly to gain market share in the OS market!!

Browser as a milli-application

[bluefoxlucid]

http://blackfiber.wordpress.com/2008/07/06/the-web-browser-as-a-milli-application/

I am obsessed with microkernels. This idea's been in my head for years, since I looked at how KDE sandboxes Flash and thought, "Hey, this should be for every piece of the whole application!"

Silverlight to replace ActiveX?

[Anonymous Coward]

Not that I know how ActiveX has been implemented or what people are actually doing with it, but -- reading between the lines -- I get the feeling that Silverlight might be the MS exit strategy for ActiveX.

Web Brower Like as OS?

[markdavis]

>Microsoft will instead adopt Gazelle, Microsoft Research's brand-new engine that thinks like an OS.

Great, just what we need, a single-platform browser that thinks like an OS- something that will further guaranteed web "sites" designed in a manner that will only work with MS-Windows and their own browser. Been there, done that.

Nobody Will Use IE By Version 9

[WebmasterNeal]

I seriously doubt IE will have the majority of the market share by the time IE9 comes out. Many of the web usage reports out there are showing that Firefox is at 20% or higher and that Safari is around 5% or so.

I would also argue that a lot more 'dumb consumers' (people like my parents) are buying Macs now to be trendy which will help IEs market share drop.

Also has anyone used IE8 yet and tested sites out on it? I've used it and it rendering engine is pretty terrible, even when set in emulate IE7 mode which then introduces a complete new set of rendering bugs.

Re:Nobody Will Use IE By Version 9

[Orion Blastar]

As long as IE comes bundled with Windows whatever version, people will still continue to use it.

If Windows 7.0 comes with IE 9 people will still use it.

IE stands for Internet Exploder, which is what it really does.

Re:Nobody Will Use IE By Version 9

[Anonymous Coward]

Also has anyone used IE8 yet and tested sites out on it? I've used it and it rendering engine is pretty terrible, even when set in emulate IE7 mode which then introduces a complete new set of rendering bugs.

Cancel Reply

A lot of those are poorly formed pages that worked in IE7 and earlier because they were hacked to work in them, and worked in Firefox et al because they've had to work in IE-compatability hacks over the years. Hacks all around!

My own, well formed pages work perfectly fine, whereas many horrendously non-validating pages I've seen fail utterly...

Re:Nobody Will Use IE By Version 9

[Phoenix Rising]

I've been testing my company's web app in IE8 for some time now. It's an improvement on IE7 (which isn't saying much). Much faster at JavaScript and overall rendering of pages - though still lagging behind other browsers. The first (semi-)working development environment for IE. Supports more standards and has a much better idea of CSS layout principles.

In other words, it's going to break all the pages everyone's been spending years coding to Microsoft's broken idea of a standard.

Re:Nobody Will Use IE By Version 9

[WebmasterNeal]

Believe me, I am a validation nazi so the problems is with Microsoft.

Hypothetical news?

[icepick72]

The author states: At least, that's what I'm hearing through the grapevine
The author is effectively saying his story is not credible! Slashdot is supposed to run with a hypothetical situation about IE8 demise instead of commenting on real news? It should be fun scanning through these comments to find out who bites (not the big one ... but the fantasy woven by the author).

Re:Hypothetical news?

[Anonymous Coward]

Slashdot is supposed to run with a hypothetical situation about IE8 demise instead of commenting on real news?

You must be new here ;-)

Russian Roulette with a Fully Loaded Gun

[wdhowellsr]

I worked through thick and thin with Microsoft for over twenty years and find this to be a classic example of pure insanity. My primary work load is n-tier web application development using Asp.net, VS and C#. The .Net framework is very closely tied to the IE engine and I don't even want to think of the headaches in trying to migrate all existing applications to whatever they release.

This is obviously a dream, but it would be nice to have some sort of standard system for Internet Cloud and Browser software and hardware not unlike the telco and cellular market. There would still be billions to make for all of the Tech companies.

Re:Russian Roulette with a Fully Loaded Gun

[dwiget001]

I am sure, for **enough** money, Microsoft will sell you tools to help with the migration.

And you will be grateful, Microsoft will tell you so.

Re:Russian Roulette with a Fully Loaded Gun

[h4rr4r]

That would be a nightmare. Like the telco and cellular market everything would be expensive, locked down and closed/drmed to hell and back.

Re:Russian Roulette with a Fully Loaded Gun

[zoips]

The .Net framework is very closely tied to the IE engine

In what way is .NET tied to IE? WPF doesn't use Trident at all, and that's the only thing I can really think of that might be in .NET that could be tenuously tied to IE. So what am I missing?

Re:Russian Roulette with a Fully Loaded Gun

[Anonymous Coward]

...it would be nice to have some sort of standard system for Internet Cloud and Browser software

Exactly. That's what the world has been telling Microsoft for years.

Re:Russian Roulette with a Fully Loaded Gun

[nxtw]

In what way is .NET tied to IE? WPF doesn't use Trident at all, and that's the only thing I can really think of that might be in .NET that could be tenuously tied to IE. So what am I missing?

The only thing that might be tied to IE is some of the JavaScript client-side code (like form validation), and this has nothing to do with .NET itself - just what's included in ASP.NET out of the box. But the client-side JavaScript has been compatible with other browsers since ASP.NET 2.0 (2005).

Back when ASP.NET's client side code was only compatible with IE, ASP.NET didn't send any of the incompatible JavaScript to non-IE browsers - so pages still worked, jut without all the fancy features JavaScript provides.

Re:Russian Roulette with a Fully Loaded Gun

[makomk]

Back when ASP.NET's client side code was only compatible with IE, ASP.NET didn't send any of the incompatible JavaScript to non-IE browsers - so pages still worked, jut without all the fancy features JavaScript provides.

...such as actually being able to submit forms correctly. Seriously, ASP.NET seems to have a problem where, if you code simple forms in a seemingly logical fashion, working form submission requires JavaScript which isn't sent if your User-Agent isn't a recognised one.

Re:Russian Roulette with a Fully Loaded Gun

[icepick72]

Right now I'm debugging n-Tier .NET applications (Visual Studio 200) using Google Chrome, sometimes Firefox, etc. with breakpoints on server-side fully functioning. However the same client-side script support doesn't seem to be there. I think it's possible IE is becoming less tied as a requirement of .NET web development?

Re:Russian Roulette with a Fully Loaded Gun

[skbach]

.NET is not tied to IE in any way... You'd find more javascript reliance than .net... .NET is tied to IIS pretty tightly, but that's more acceptable.

Re:Russian Roulette with a Fully Loaded Gun

[Anonymous Coward]

If you build web applications, that rely on random, absolutely non-standard client functionality, then I question your experience.

It's like buying non-standard wheel rims, that only one manufacturer serves with tyres: In a few years where do you get the next set? Will they even be available yet?

Re:Russian Roulette with a Fully Loaded Gun

[Anonymous Coward]

One word: Debugging. In ASP.NET you can set breakpoints in your website code and the break will be triggered *only* if your site is running in IE.

Re:Russian Roulette with a Fully Loaded Gun

[kiddygrinder]

You can override that, but you're right, a lot of their "absolutely cross browser compatible code" isn't

Re:Russian Roulette with a Fully Loaded Gun

[hkmwbz]

it would be nice to have some sort of standard system for Internet Cloud and Browser software

What, everyone using the same browser?

Repeat after me: Browser. Monoculture. Is. Harmful.

Not just because of the security nightmare it is to have a browser monoculture, but who's going to push everything forward?

time to buy

[nonicknameavailable]

champagne

They might....

[weston]

Their goal is lock-in. A standards-based engine would negate that.

Honestly, I've agreed with you up until now. Spending resources to play catch-up with what Webkit and Gecko have been able to do for years doesn't make any sense at all... unless your goal is to depart from those implementations.

However, I've wondered if someday, the resource logic wouldn't occur to Microsoft, or the trident codebase wouldn't become such a problem that it'd become stronger. They don't need to have their own rendering engine to embrace and extend. Using webkit or gecko would mean that they could lose any advantage they might have by people coding websites to IE, but they don't need that to try and get Silverlight out there or even keep the world using Active X. And rich / active components are probably about the only hope they have of being able to get any kind of lock on the web again.

Re:They might....

[AxelTorvalds]

However, I've wondered if someday, the resource logic wouldn't occur to Microsoft, or the trident codebase wouldn't become such a problem that it'd become stronger. They don't need to have their own rendering engine to embrace and extend. Using webkit or gecko would mean that they could lose any advantage they might have by people coding websites to IE, but they don't need that to try and get Silverlight out there or even keep the world using Active X. And rich / active components are probably about the only hope they have of being able to get any kind of lock on the web again.

How much embrace/extend can you do to Gecko or Webkit before you're in the same position again? Admittedly, I think it's all about silverlight. Why not just let IE kind of die off and encourage users to install a new browser or something and then focus on plugins for all the other browsers?

The only thing I can think of that would make any sense to me is that this is the worst recession ever, they probably have better forecasting that we do and they can see the it might be decades before the decadence is back, if ever. In that case, they need to cut all the fat that they can. They did just RIF a bunch of folks... IE isn't exactly free to develop and it's not clear that they're getting much from it.

Re:They might....

[rbanffy]

You don't have to play catch-up when you are the gatekeeper. Every Windows box comes with IE and only a fraction of those IEs ever download another HTML engine.

And, of course, in case they ever feel that strategy is about to fail, they will push Silverlight into every Windows box.

ActiveX Must Die

[Nezer]

The sticking point will be what Microsoft does about compatibility for ActiveX apps.

No sticking point... ActiveX needs to die.

Re:ActiveX Must Die

[weicco]

... and revive as 'plugin'? I've never understood what's different between IE ActiveX component and Firefox plugin. Basically they do the same thing.

What will they do with ActiveX?

[Millennium]

Hopefully they'll do the right thing: deprecate it as of IE8's release, so people have plenty of warning, and start releasing tools for those still stuck with it to migrate it something perhaps not quite so fundamentally flawed.

Re:What will they do with ActiveX?

[argent]

Oh, please, don't tease me like that.

They refused to get rid of it at the risk of having the company broken up. What makes you think they'll get rid of it merely because it's fundamentally insecure and inherently unfixable?

Re:What will they do with ActiveX?

[Millennium]

Oh, please, don't tease me like that.

They refused to get rid of it at the risk of having the company broken up. What makes you think they'll get rid of it merely because it's fundamentally insecure and inherently unfixable?

Because I think they'd rather do that then port it to another engine, especially if -as some claim will be the case- that engine is open-source.

Re:What will they do with ActiveX?

[argent]

ActiveX is not part of the Microsoft HTML control.

Contrariwise, as Tweedledee (or was it Dum) said, the Microsoft HTML control is an ActiveX control.

Microsoft has enormous experience in turning components into ActiveX controls.

Re:What will they do with ActiveX?

[Millennium]

I was talking about porting the ability to embed ActiveX controls into HTML, more than ActiveX itself. I don't believe Microsoft will want to port that to another engine.

Re:What will they do with ActiveX?

[argent]

Oh, well, that way around... it's just another plugin, and one that has already been written... google for "activex firefox".

Supposedly being the key word here

[jocknerd]

The suspense of Gazelle is killing me.

memory

[buchner.johannes]

Won't sandboxing be extremely memory-intense? Lots of processes not allowed to share resources?

Re:memory

[turgid]

Doesn't matter. People are married to Windows (and all Microsoft apps) and will go along with it this time, just like like they always have for the last 15+ years.

Remember when XP was a bloated, incompatible, unusable resource-hog? Now it's the user-friendly low-spec. standard by which Vista is compared.

Peoples' expectations will be engineered. They'll get used to the new low bar in performance and usability, and it'll be double-plus good. Nothing will change. Microsoft will continue to dominate.

Re:memory

[CannonballHead]

Uh... Ubuntu, openSuSE, Fedora, etc., don't exactly run too well on 256mb RAM either. Yeah, Xubuntu is ok and there are distros like PuppyLinux, TinyME, gOS, etc., but XP will run on 256mb, too. It IS pretty user-friendly low-spec in comparison to most modern OS's. Try running OS X on 256mb ram? :)

Not to defend Vista, but let's be fair to XP/Vista at least. Last time I installed SLES 10.2, the recommended RAM was around 768MB ram.

Re:memory

[EvanED]

Memory's not the problem, because read-only pages (like code) can be shared. It's more like just taking the existing memory space and dividing it up into different ones. There might be a little slop because of pages not being complete, but that's at most a couple per process, so even with 50 processes you're looking at 1MB of additional memory.

Of more concern is the increased context switching time, increased TLB misses, etc.

Re:memory

[domatic]

With a 256MB machine or better, Puppy does a neat trick. It loads itself entirely into RAM and will let you eject the CD. So you get the use of the CD drive and it is wicked fast on anything made in the last five years.

Re:memory

[turgid]

Eh? Where did that come from?

Plays for Sure

[clarkn0va]

The sticking point will be what Microsoft does about compatibility for ActiveX apps.

How sticky are we talking? Sticky like trying to make PlaysForSure compatible with the Zune? Sticky like ongoing support for MSN Music?

If Microsoft has taught us anything, it's that today's lockin is tomorrow's lockout. The day MS decides that ActiveX no longer serves their purposes is the day that every site requiring ActiveX is out of luck.

Re:Plays for Sure

[gbjbaanb]

I can see it happening, ActiveX is out, now you only need to write Active.NET applications using the smart composite application block framework or something similar.

I can easily see activex components being thrown away in favour of dynamically loaded and run .net applications that run without the obvious container of IE, they'll use a different container really built directly into the OS.

Re:Plays for Sure

[ozphx]

Yeah, its called ClickOnce. Been using it for years ;)

Re:Plays for Sure

[ThrowAwaySociety]

The sticking point will be what Microsoft does about compatibility for ActiveX apps.

How sticky are we talking? Sticky like trying to make PlaysForSure compatible with the Zune? Sticky like ongoing support for MSN Music?

If Microsoft has taught us anything, it's that today's lockin is tomorrow's lockout. The day MS decides that ActiveX no longer serves their purposes is the day that every site requiring ActiveX is out of luck.

The difference is, ActiveX is heavily used by business and enterprise customers.

The Microsoft music stores were used by consumers, and not even particularly valuable consumers; mostly kids whose parents didn't know what a real iPod looked like.

If enterprise customers tell Microsoft to jump, Microsoft asks, "How high?" If some snot-nosed kid with an Archos whatsit tells Microsoft to jump, Balmer throws a chair at him.

"myriad plug-ins" Heh, yeah right

[gilgongo]

"This new engine will supposedly be more secure than Firefox or even Chrome, making copious use of sandboxing to keep its myriad plug-ins isolated and the overall browser process model protected.'

IE doesn't have any plugins, does it? At least, if it does, they're nagware garbage compared to the truly myriad plugins for Firefox. Really, if it wasn't for FF add-ons, I doubt it would have even a half percent share.

Re:"myriad plug-ins" Heh, yeah right

[Anonymous Coward]

http://www.ieaddons.com/en/

Does anyone care?

[Anonymous Coward]

"The sticking point will be what Microsoft does about compatibility for ActiveX apps."

Does anyone even CARE anymore? Other than for work, who are to stupid to use a proper browser, I don't touch IE. As in the last few years (and more so in the next 2 years) users switch to Linux in droves, Microsoft and their IE become just a noisy fiasco on the edge of computing. A place, incidentally, which they've deserved for a long time and is overdue.

Pure imagination

[Anonymous Coward]

that's pure speculation. Gazelle it's an architecture, not a rendering engine. That might still be Trident, nobody ever said it wouldn't.

Thats easy to solve!

[submain]

ActiveX security problems? Easy.

Just make every tab a separate sandboxed process that can emulate x86, so you can install windows inside IE, and therefore run IE inside your windows that you installed on your IE...

(starts getting dizy)

Re:Thats easy to solve!

[RyuuzakiTetsuya]

Yo dawg I herd u like...

Actually, I can't complete that meme with out wanting to take a small pistol to my temple these days.

Sticking point...

[Anonymous Coward]

The sticking point is ActiveX? Last time I went to a webpage that used it for legitimate purposes was... Hold on... Yes, I'm being told that ActiveX has never been used for legitimate purposes. Carry on.

What??

[uberjack]

You mean I can finally write XHTML and Javascript in a standards-compliant manner? I don't think I can take that much freedom...

Re:What??

[DanJ_UK]

I would probably have an aneurysm if that day came.

ActiveX

[gers0667]

Pardon my ignorance, but what ActiveX components are left? Vista and 7 have moved away from Windows Update in the browser and that's the only one I could think of.

I guess Flash is ActiveX, but they also distribute a non-activex version with Firefox, Safari, etc al. use.

Why no just kill ActiveX? Flash, Javascript, Silverlight... they all seem capable of the job.

Trident != IE

[kevind23]

Uh, I think you meant the Trident engine, not IE.

Moore's Law makes some problems easy, yay. :)

[symbolset]

Intel giveth, Microsoft taketh away.

awesome Gazelle engine

[zigurat667]

Great! Now I can steal see the ads when the webpage crashed it's process.

Mobile computing educates them

[Ilgaz]

Do you know what hit them very seriously? I mean the coders laughing to vendors like Opera for struggling not to code CPU and speed dependent stuff?

Mobile computing. It is like ultimate punishment for them. Do you remember those fanatics calling people to ''buy more RAM'' no matter what their issue with memory is? Top of the line smart phone comes with 512MB RAM or something and 400 Mhz ARM CPU. Opera ships 9.5 beta which runs the exact same engine as Desktop version to 256MB RAM having, 200Mhz CPU UIQ3 devices with zero vendor support.

I know some professional OS X developers keeping a G4 Mac Mini no matter how many xeons they have, just to make sure their application runs on low end computers fine. So far, thanks to their wise decision, their software gets good feedback not just from low end but very high end computers too. If it works on low end, it will rock on high end. Trust me, some of the ''cool guys'' out there still couldn't figure this basic rule.

When Webkit proved to work on Nokia S60 Symbian devices and got very good feedback from users, I said Webkit is the future. What mattered was, can the code run under 128MB RAM, completely alien OS? S60 browser proved it.

Re:Mobile computing educates them

[KiloByte]

I always kept saying that every developer should be forced to use a slow machine, at least where compilation and automated tests are not involved. If you sit your butt at a fast box, you simply never notice anything is unacceptable slow.

I've personally caught myself ignoring complaints that a piece of my code is slow and noticing it only after seeing it crawl on a slow machine myself.

Re:Mobile computing educates them

[Hadlock]

Can we get the coders of GIMP to give up their octo-core SSD-drive dev boxes? My lowly core2duo with 2 gigs of ram and a mechanical hard drive absolutely crawls with the major overhaul of The GIMP. Whatever they did to their in program file browsing code, ... I don't know but it shouldn't take 3-5 seconds to populate a folder of 50 jpgs all less than 500k each. This is on a work computer with no issues running only firefox, gimp and two proprietary buisness apps. Wtf.

Re:Mobile computing educates them

[i.of.the.storm]

In fact, I think the very top of the line smartphone has 288MB of RAM only. I bet 512MB would seem like heaven. Although for a long time I think smartphones were stuck at 64MB, but recently they realized that WinMo sucks down a lot of RAM and that DRAM prices have been falling so why not give these things more RAM? I think this is why Firefox has been having trouble getting onto smartphones, right now I think the Fennec alpha is only supposed to run on an HTC Touch Pro which is the one with 288MB RAM (depending on model/carrier though).

Re:Mobile computing educates them

[Anonymous Coward]

preferable with a low memory amount too - I dont know a single developer that cares if their apps leak memory.

Maybe thats why we dont have a famous counterpart for valgrind in the windows universe =-P

I learned the lesson myself when I started coding mobile games, only to see them dying after a few seconds. A few sleepless nights and hours staring at the screen made re-leaarn how to code.

Re:Mobile computing educates them

[whereiswaldo]

I think this is partly why Apple has done so well with OS X on Intel. Apple has been coding for relatively slower CPUs for years (Power PC) and now that they finally have fast CPUs their operating system and applications fly. I hope they keep up this trend but based on iTunes performance I'm not holding my breath, unfortunately.

Re:Mobile computing educates them

[somenickname]

Why not instead use a fast machine and test in virtual machines. Not only do you get a performance hit in the VM, you also get a way to test on varying memory configurations and, more importantly, a clean reproducible environment for testing. Honestly, if you are developing end user software these days and not testing it in a virtual machine, you are doing it wrong.

How to make 30% of planet hate a browser?

[Ilgaz]

Have a stupid blogger who could say things like ''This new engine will supposedly be more secure than Firefox or even Chrome''

That is 30% of entire Web browser market, you have guaranteed that they will do everything to joke about your code without being even released to public.

Also very advanced coders who are talented enough to work on Mozilla or Google will come up with real information debunking your allegations. They may ask a very basic question: ''How can people review your code?''. Mozilla, Google and even Apple has answer, you don't.

Yeah, right!

[cashman73]

I'll believe this one when chairs fly out of my butt!

hmm

[Anonymous Coward]

another dumb story by slashdot, when will it cease, sorry i cant even be bothered to read the article, IE flaws and all is a strong brand and for slashdot to give credence to think MS (even though they did drop flightsim) would drop IE is pure ignorance.Really dont know why i read SD anymore it so past being relevant.

Enterprise pipe dreams

[Valdrax]

By the time IE8 is EOL'ed, I hope ActiveX will be long gone.

Just like COBOL is.

Clippy?

[deanston]

When did OS started to think? A browser that thinks like an OS? Sounds like day after day the fallout recognized by Andressen and Gates were right. But we all know MSFT puts its IE engine in every piece of its software, so whether a separate browser client exists doesn't matter. Even if the new engine is called Gazelle it doesn't mean the browser cannot be called IE still (Gecko/Firefox, WebKit/Safari).

This is great

[symbolset]

Right up until they want to play NickJr.com or some such. They require ie plugins to work.

One less broswer engine to support!

[senixon]

As a web developer I wouldn't miss it. There hasn't been a browser released by MS or any other company/group that did not have it's own quirks. Lately MS has not been able to keep up on the major trends of the web and that is the reason they must disappear or up their game.

Moore's Observation = Godwin's Law for Technology

[bussdriver]

All complexity is NOT linear.

These are observations not laws. Given how its a 2D problem, its estimated growth is not that surprising.

dumping IE!!!

[Anonymous Coward]

Knowing that Financial Markets, Banks, Pentagon, Investment brokerage computers and traders computers that were all included in a controlled attack against the USA financial system...dumping IE would be would be the best decision that ever came from Redmond....dumping Windows will be the best decisions those instiutions will make....

Proposed migration path for ActiveX

[Nurgled]

I propose that Microsoft adopt the same migration path that Firefox and other browser vendors offer: allow the new, non-ActiveX browser to be installed at the same time as the legacy ActiveX-supporting browser, and thus allow users to use the legacy browser only for legacy apps.

IE's biggest backward-compatibility problem is that it's designed to only allow one version to be installed at a time. Microsoft's latest workaround is to simply include the legacy rendering engine in the new version, but clearly that's not a sustainable approach as five versions from now the browser would be huge and there'd be hundreds of random corner-cases.

dumb

[Anonymous Coward]

Hey article writer, it's not april 1 yet!

Microsoft will NEVER use anyone elses renderer

[kiddygrinder]

It's not controlled by MS so it would be completely against what they are trying to do with the internet. They want everything to be server based or heavily server dependent, if they use a renderer that might start using canvas tags or something that might push the client side forward in any serious way it might start actually cutting in to their market.

Human Trafficking

[probityrules]

http://www.humantrafficking.org/countries/united_states_of_america http://www.sharedhope.org/where/unitedstates.asp

Fine!

[Fuzzypig]

Some how I can't see then fixing the standards they spent years breaking! Why is it when you code for browsers, you spend 10% of the time coding which more or less works on all browsers and then you spend 90% of the time kludging to get it to work on IE?!

Which plugins exactly..?

[Keeper Of Keys]

If your children are playing games on sites that use something other than Flash or Shockwave, I'd be interested to hear the names of these peculiar plugins. To my kids, Firefox is the web. I haven't even had a request from them to install Silverlight.

May as Well

[Anonymous Coward]

Microsoft may as well ditch IE. After all, if they can't use IE as a tool for customer lock-in, why go to the expense of developing it at all ? Why not just let its serfs ( I mean customers ) use Firefox ?

WebKit is also from KDE

[josepha48]

Um, my understanding is that webkit was KDE's HTML rendering engine. So maybe this is why there are rumors of MS "embracing" open source.

Keeping old machines around

[IdahoEv]

I know some professional OS X developers keeping a G4 Mac Mini no matter how many xeons they have, just to make sure their application runs on low end computers fine.

Count me in. I'm a Java developer and a Rails/PHP web developer, and I keep both a G4 PowerBook and an old Dell Pentium 3 around for exactly this reason. If any of my shit doesn't run well on them, I go back and fix it.

Which can be hard, given the crappiness of Apple's Java implementation, but there you have it...

But yeah, I code on top of the line machines, because some of my projects have test suites with 1000+ tests in them, running continuously in the background. (ZenTest/autotest for Ruby is so wonderful). And waiting three minutes for a test suite to complete is not fun.

How many times...

[Anonymous Coward]

I wonder how many times Slashdot has predicted the death of

A) Windows
B) IE
C) Microsoft
D) the PC
E) PC Gaming

Alls I know is if I had a dollar for each time in just one of those categories... I'd be Bill Gates kinda wealthy.

Who is Microsoft?

[Anonymous Coward]

Microsoft will never do anything that makes sense. They won't go with Webkit, because that would make too much sense. And they won't just go away, because as a web developer that would make me happy.

GNU/linux

[Anonymous Coward]

GNU/linux is full of packages free software, and our last problem is to think to internet explorer
or safari.

Will interest, if there are violations of licenses such as http://www.gnu.org/licenses/licenses.html http://www.gnu.org/licenses/license-list.html#SoftwareLicenses and http://gpl-violations.org

i just dedicate myself to the project started in 23 Dec 2005 about Refund an in 2008 was posted from fsf europe on http://wiki.fsfe.org/Windows-Tax_Refund#Italy there are bad experiences of guys
that bought pc, licenses, court rulings, where to buy hardware without windows, with GNU/linux or others os, or how to having a refund of windows (paolodelbene's blog entry) or you can see too the page http://paolodelbene.blogspot.com/2008_08_01_archive.html

and in these days i am working to the blog http://gag-to-internet.blogspot.com called to Censorship, we are having the same problems as in China, but it is a general problem, it seems that
there are too in Germany, Switzerland, United States... all us have this problem, and we must
to help ourself.

Silvio Berlusconi the "psycho runt", Gianpiero D'Alia, Franco Riccardo Levi, Roberto Cassinelli, Gabriella Carlucci, all these men and one woman are raving

happy hacking !!!!

Paolo