Slashdot Mirror
South Korea Begins To Deprecate ActiveX
jones_supa writes The reliance on proprietary technologies to deliver web services varies from country to country. South Korea's ActiveX problem has been in the news before. Yonhap brings us a short report that the government plans to finally start cleaning up this troublesome technology from public websites later this month, as Korea gears up to create a more friendly Internet environment. The country's online financial websites and shopping malls often use ActiveX to have their payments and identification programs securely downloaded to users' personal computers.
You;re thinking of North Korea.
The main difference that makes HTML5/JS/CSS "open" in this case is that any person or company can use the technology free of charge in any capacity without fear of a copyright claim or demands for payment. With ActiveX, only the end users who write scripts may use it free of charge. If you want to implement it in a browser or some other capacity, you have to sign a licence agreement with Microsoft or get sued. That's what "open" means in this case though I fully understand and agree with the FOSS community that this is not what "open" should mean but, I'll take it over the alternatives we have at the moment.
"Be particularly skeptical when presented with evidence confirming what you already believe." -
"ActiveX is a software framework created by Microsoft that adapts its earlier Component Object Model (COM) and Object Linking and Embedding (OLE) technologies for content downloaded from a network, particularly in the context of the World Wide Web. It was introduced in 1996 and is commonly used in its Windows operating system. In principle it is not dependent on Microsoft Windows, but in practice, most ActiveX controls require either Microsoft Windows or a Windows emulator. Most also require the client to be running on Intel x86 hardware, because they contain compiled code." HTML5 is a standards based format, so is CSS. JavaScript has been standardized in the ECMAScript language specification.
I'm pretty sure nearly every story posted on Slashdot about ActiveX had at least 50 responses that included the words "M$".
Holy shit snacks, does that mean that one day I might be able to use Korean government or online banking website with Firefox???
Probably not, the country's extremely monocultural when it comes to computing tech. ("Not Invented Here" was one of the problems in the first place.) For example, nearly all the PCs there are Windows/Intel/nVidia combos... you really need to jump though hoops and/or be really specific when ordering computers to get anything else. And, only people at Daum and KAIST seem to even have any idea about Linux. Anything outside the Windows (IE6+)/Intel/nVidia mindset is not going to work.
Standardization processes involving a small number of organizations, each with restricted membership, coming up with specifications and standards without much, if any, outside influence and input really are proprietary in practice. That's exactly what the GP was pointing out. These standards aren't open. They're proprietary by the very nature of their limited-access development.
South Korea is a very advanced and prosperous country, with income levels broadly similar to the European average. They most certainly have computers.
He probably is. But a decade or two ago, before the South Korea's economical breakthrough, how many of us knew what kind of country South was either? Poor, rich? Many computers or not? How about a country like Mongolia today? Are good computers ubiquitous there? Not many people can give an answer off-the-shelf.
Just a meta-observation. :)
I worked with ActiveX technology close to 15 years ago. It was a much simpler era, where there was little need to worry about platforms other than Windows+IE, and where most of us hadn't really caught on yet to how ruthless the hackers were going to become. And frankly there wasn't a whole lot of alternative for pushing real app functionality from the web in those days. Some people were using Java, which certainly wasn't any more secure, and eventually Flash began to gain traction. So it's not completely hard to understand how we got where we are.
They are researching RadioActiveX.
Then where do Samsung phones come from?
China
In case anyone is wondering what ActiveX is, it's essentially a Windows program you download that runs natively on your computer. It gets to draw to the specified element in the browser, which makes it look like it's part of a webpage. There isn't (or wasn't) any kind of sandboxing or security once the ActiveX component was installed - it could do anything it wanted on your computer like any other Windows program, because that's essentially what it was. The only security was whether or not you installed the ActiveX component in the first place. If I remember correctly they are really just DLLs, and used Component Object Model for the standard in which the DLL exposes methods, etc.
Better known as 318230.
With HTML, CSS and JS, you have a choice between well working open source implementations, that you can improve, and publish browser forks on your own. I mean, it was open source which eased google to make chrome the first place.
It would be funny if it was true. They manufacture most of their phones, especially the high-end ones, locally in South-Korea.
Anyone can read the HTML5, CSS and Javascript specs, and implement them. Only Microsoft can read the ActiveX spec and implement it.
If you want to implement it in a browser or some other capacity, you have to sign a licence agreement with Microsoft or get sued.
That's an outright lie.
I guess that is pretty insightful, as far as total bullshit goes.
But then these same people say that HTML5 and JS and CSS are better because they're "open".
I hate using non-open technologies like TCP/IP. They never once consulted me and now I have to go by their "standards" instead of what I want to do this week.
Dewey, what part of this looks like authorities should be involved?
COM and OLE are also open standards. They have been implemented on other platforms, but afaik no other browser has implemented them. HTML5 is more popular, that's about it.
I don't see how that's the case.
Maybe you are trying to start some kind of pedantic discussion, but I don't really understand your argument. The reality is:
ActiveX: Works on MS Windows running IE.
HTML5/JS/CSS: Works on Android, IOS, MacOS, Linux, Solaris, the BSDs, Chrome, Windows, Windows Phone, etc.
You can play with definitions all you like, but you are not locking yourself into a single vendor like you do with ActiveX.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
In the 80's, before China opened up, everything was 'made in korea'. Korea's huge industrial success was what lead, in part, to China's economical thaw.
I don't know the proportions, but I do know that they have a lot of manufacturing in China.
ActiveX executes compiled binaries instead of scripts... but anyway, there is no proof that you have to sign a license agreement to make an ActiveX implementation. For example Konqueror received ActiveX support back in the day, although that was just a Wine-like wrapper. Probably the reason that no one has made a native ActiveX implementation for Linux is simply that ActiveX is very Windows-centric technology and expects many Windows APIs to be available.
In Korea it is required to use a government sponsored certificate for all online transactions, and the certificate is available only if you have an ActiveX supported computer. This sounds very stupid but it is true.
Now that Microsoft has abandoned ActiveX, the Korean government has to give up ActiveX. The plan is to rewrite the ActiveX code and future online customers need to download and install an .exe file for handling the certificate. The real problem is not ActiveX. The real problem is the Korean government sponsored certificate. It is required by law for all online transactions in Korea. The government sponsored certificate is a lucrative business for corrupted bureaucrats and companies and they don't have any intention to abolish it.
'For example, “COM supports an undocumented feature called channel hooks. Well, they are semidocumented in the Win32 header files and in Don Box's ActiveX/COM column (MSJ, January 1998). Microsoft does not officially support channel hooks on either Windows NT 4.0 or Windows 2000 If you're still reading, then you've acknowledged that disclaimer and I can get into the details”' ref
...is not the adverb I'd use when talking about ActiveX.
I've written many ActiveX controls, some for use in a browser, some not.
At no point was I required to sign or agree to a license to do so.
You can make ActiveX controls with any compiler that supports WIndows and will create DLLs with C++ calling conventions that match the MS style ... So pretty much all Of them.
ActiveX is no different than XPCOM ... Which is at the very core of Firefox, it's just a convention for generic, self describing plugins and is fully publicly documented.
The only insightful thing about your post is that slashdot has fallen to the point that this sort of ignorance is so commonplace that you got modded to +5
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
A decade ago South Korea had had a well-publicized StarCraft obsession for years. The fact that they are stuck on ActiveX is due to them being early adopters of internet banking and government activities. IIRC, a decade ago there were already articles and discussions about being South Korea being stuck on ActiveX...
Can you be Even More Awesome?!
I've written many ActiveX controls, some for use in a browser, some not.
At no point was I required to sign or agree to a license to do so.
With requiring a license he was talking about creating the ActiveX runtime environment for a web browser.
Two decades ago would be about when Hyundai cars were introduced to Europe. That is pretty significant, we don't hear of cars from Vietnam or even China (I believe China has a huge car industry, but it's not sold globally and we can't even cite one constructor from China whereas I know S.K. has Samsung, Kia, Hundyai and SsangYong. I forgot Daewoo cars)
A decade ago : South Korea known for being where most RAM is made, and then a ton of flash memory as well. We can't have our PC compatibles and shit without South Korea, in the same way we can't do without Taiwan for the motherboards or Thailand for the hard drives.
It's not enough to support COM and OLE, you have to support all the Windows APIs that controls might want to use.
What about cheap N-Korean labour?
Working in Korea once I needed to install a package with apt-get but the file came down empty. I asked around and it turns out that to download anything on the corporate network you had to install this active-x component which looks to see if a storage device is connected to USB. If a device is connected the download still won't work, but you can still make a local copy of the file, plug in the USB key, and copy the file that way, which is what we did on a windows box.
Half measures all over the place.
http://michaelsmith.id.au
Mandatory policies of being sent to re-education camp for speaking with foreign customers and suppliers tend to put a damper on any such advantage.
There's no such thing as complete freedom from lock-in. unless you're totally vertically integrated from the rare earth mines, up through the wafer fabs, all the way to the OS and the user software. Example: SpaceX, which does almost everything, including software, in house and doesn't have to march to the beat of somebody else's drum.
Back to software: you're locking yourself into something whenever you deploy anything. ActiveX makes you stuck on Microsoft. Java, though claimed to be multiplatform with compliant JVMs shipped by Oracle, IBM, and the FOSS community, really makes you stuck on whichever one you start developing on. HTML5/J5/CSS will make you stuck on whatever browser version you go with when you start. Hell, even "fully open source" systems like Linux make tweaks to the kernel API that render drivers obsolete (this has nothing to do with systemd, just normal tweaks and architecture changes that are generally a Good Thing for a healthy project). So if you ship drivers that compile with 2.6.23, you need to tweak your memory allocation for 2.6.24+, and other things for 2.6.39+, and so on and on.
Bottom line: you're "locked" to whatever you go with because when they make a change, you need to spend time and money catching up with them.
The sell a shit tonne of cars here in Australia. Main brand is called "Great Wall"
There is a huge difference between being locked into a single vendor and being "locked in" to every major platform of the day.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
responses that included the words "M$"
"M$" looks like a string variable in old-skool line-numbered BASIC, and Microsoft started out publishing BASIC interpreters. Could "M$" mean "The company should have stuck to BASIC and not branched into microcomputer operating systems"?
What you have said makes zero sense ... I hope you realise this?
They tried it for a while - N. Korea had a special zone just across the border where South Korean companies could send in managerial staff daily, but it turns out that such a scheme is not sustainable in the political climate that exists between the two Koreas. I don't think many South Korean companies are interested any more in having a factory that they can be closed down on a whim every time the supreme leader has a tantrum.
It was also due to the government's insistence that their homegrown encryption algorithms be used, combined with a delay in getting the algorithms registered as an official Cipher Suite for SSL/TLS, that led to them being implemented at the application layer rather than the transport layer.
I've written many ActiveX controls, some for use in a browser, some not.
At no point was I required to sign or agree to a license to do so.
With requiring a license he was talking about creating the ActiveX runtime environment for a web browser.
No license is required for that either. All ActiveX is, at heart, is a hierarchy of C++ style interfaces (classes with nothing but pure virtual functions) rooted in a single interface (IUnknown), together with a handful of global C functions (e.g. CoCreateInstance). It can be supported on any platform as long as the C++ compiler implements virtual functions with a pointer to a vtable at the beginning of any object with virtual functions. That's every major compiler on every major platform. Actually you can do COM "manually" in plain old C too, so you can do COM anywhere with a C compiler. Put pointer to an array of pointers to functions (the vtable) at the beginning of a struct, if the functions have the proper signatures then the struct is a COM object.
I know this because I've also written many ActiveX and COM components, and ported COM/OLE/ActiveX code to Linux and OS/X. Generally the problem with implementing ActiveX on other platforms has nothing to do with ActiveX itself. The problem is that virtually all ActiveX components are written for Windows and make Win32 calls.
Daewoo cars are now mostly branded as Chevrolet (maybe still Opel or Vauxhill in Europe), even in Korea. They are responsible for most of the smaller car designs from GM (from the Cruze down).
Chery is the only Chinese manufacturer I've seen locally, though another poster commented that Great Wall is available in Australia, so different manufacturers may be targeting different markets.
That's only true if you want to run controls that were written for windows. If COM and OLE were supported on other platforms, then presumably people would write COM/OLE components for those platforms, and those would run fine on their platforms.
Back in the 90s, there were some other systems that supported COM/OLE (IBM and Sun Microsystems for example.)
CORBA is practically the same thing, and is available everywhere. The problem with CORBA is that is a typical design-by-committee mess. It ended up way too complicated, even compared to COM/OLE.
The problem that COM and CORBA both solved (or at least tried to solve) still exists, with no commonly accepted solution. The "standard" binary interface between components on every single platform is the C function. That's the only code that can be called directly from (almost) every language without creating "bindings". Not even C++ code from different compilers can be mixed in the same program, because C++ doesn't define the binary interface.
Something like COM or CORBA is still needed. If we had it, and it was universally available, you could expose more than just C functions at the binary level (without bindings or without recompiling everything).
Because of all the years of bad press, nobody is going to believe it, but COM was and is a good idea, and it's completely unencumbered by patents or licensing issues. Being able to combine components written in different languages (or even just different C++ compilers) is a good thing, and is too complicated without something like COM.
Only Microsoft can read the ActiveX spec and implement it.
That's utterly false, as has been pointed out numerous times in the comments. All of the documentation is available and always was. It was never encumbered by patents or licensing issues. It can be (and has been) implemented on other platforms. It was just never very popular outside of Windows.
The GP was right; for a right-wing nutjob he makes a lot of sense. I've been saying the same thing for years, nobody listens.
You're never really "locked in". All that is really meant by that is that there is a cost to moving away from some external dependency, and there is always a cost. Every external dependency a project takes on is "lock in." That includes the operating system, programming language, third party libraries, and everything else that isn't part of the project itself. You can try to minimize it with abstraction layers, but that has a cost too, and it is often paid unnecessarily when the dependency never needs to be removed or changed. Or you can also try to minimize it by using the good old advice to avoid nonstandard/non-portable extensions. But that has a cost too when the nonstandard extension does exactly what you need and it's expensive to do yourself. That's just wasted effort if you never actually end up needing to switch.
The only good advice is to choose your dependencies carefully and if necessary have an escape plan. (But don't spend too much effort on the escape plan unless there's a high likelihood you'll actually use it.)
what the f... you really must be an american. aren't you?
If they had stuck with Xenix we may not have ended bottom lip deep in a malware swamp
Could you explain how that might not have happened? Xenix (which became SCO OpenServer) was just Microsoft's port of AT&T UNIX to PCs. UNIX is just as vulnerable to malware as Windows: if you trick the user into elevating to install something, something will be installed.
Starting with a multiuser approach and being aware of a network that early on is likely to have made all of the difference.
Most of the shit is a legacy of having a single user non-networked environment for so long.
Currently it's a single click on an email to infect all the available network shares with cryptolocker - nothing about elevating to install something at all.
You are right that you are "locking in" a certain development environment. But that is only part of your application... you will have end-users actually putting your application to use. It is one thing to lock in your single development machine or handful of machines to a single vendor - quite another to lock in all of your users as well. It was all well and good to blow off the 5% of people back when smart phones and Macs were marginal 10 years ago. It is quite another to blow off 50% of people on alternate platforms... the calculus has changed.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
I worked at a very large computer company many years back. It was great that they let me wipe Windows completely off my company-loaned laptop and install Linux on it instead. However, I then had to use the company's internal travel website to book a business trip. The internal travel website used ActiveX and required Internet Explorer 6. I complained that this company which touted open standards externally should also use open standards internally instead of the ActiveX and Internet Explorer crap. My complaint was ignored and I either installed IE6 via wine or else I used a coworker's Windows laptop to book the trip.
I don't work there anymore, but to the people at that company who relied on dead-end proprietary web technology to design their internal travel website,
I told you so!
Seriously guys - every time I give an example of malware on an MS platform I get modded down - grow a pair instead of living in denial.
Back to the above poster, yes it may still happen in environments where security was considered from day one but I'm convinced the years of no privelage separation at all has resulted in the scale of the current problem.
Two decades? Try four.
Back in the early 80s various friends at high school had various iterations of the Hyundai Pony and most were decade old beaters at that point.
You're not the only one who forgot Daewoo cars. They went bankrupt and are part of GM now - and that had a lot to do with the product failing crash tests worldwide.
China has such a big internal market that they're not exporting much. The market is big enough that VW, Fiat, Toyota, Nissan and Ford are all running major assembly lines in china putting together CKD kits and exporting to the rest of SE asia in association with Chinese comglomerates.
Chery anf Geely are selling in Europe (and they got 5 star ENCAP ratings for their newest products - the days of "deathtraps" are long gone)
Several European makers are now wholly-owned subsidiaries of chinese companies (India owns a couple of brands too).
"You can make ActiveX controls with any compiler that supports WIndows and will create DLLs with C++ calling conventions that match the MS style ... So pretty much all Of them."
All of them that run windows, maybe.
I've yet to see DLLs in OSX or Linux.
"The problem is that virtually all ActiveX components are written for Windows and make Win32 calls."
Inna nutshell - yup.
This is why I've sucessfully argued with UK govt regulators that web pages which rely on ActiveX are proprietary and discriminatory - as such they are prohibited under open government rules and it's relatively easy to order govt authorities (local/national/regional) to cease using them immediately (the threat of having their funding cut off for non-compliance is the kind of thing which gets attention)
It's even more fun when having been blown off by some council manager as a "kook", you can demand (and get) an apology and climbdown.
In South American countries we have recently (last 5 years or so) started receiving cars made in china, and there are A LOT of brands.
Many of their models are cheap knock-offs of known models by other manufacturers (see Chery QQ vs Chevrolet Spark, or BYD F3 vs Toyota Corolla), and all of them sell a lot cheaper than the other brands. Usually lacking in the safety side, but sadly on par with the cars made in Brazil or Argentina for our local markets. And in a country (Uruguay) where, due to taxes, a Honda Civic costs U$S 40.000, and a Chevrolet Spark costs U$S 15000, these brands are slowly eating the low-end with cheap (~ U$S 15000) sedans like the Lifan 620 or the BYD F3.
Some of the known brands around here: Lifan, Chery, Geely, Great Wall, JAC, BYD, FAW, Haima.
We don't give a shit if JS is proprietary or not. Korea's web technologies and coding skills sucks, and they are using ActiveX everywhere, it makes your life miserable. You can't visit a website without IE, you have to install 100's of 'plugins' on your computer made by unknown companies... Basically, to go on internet you have to install possible spyware, malware, back door software... If you were a Hacker that's where you strike.
And the funniest part is that those limations are also on all government websites or banking.