Slashdot Mirror
South Korea Begins To Deprecate ActiveX
jones_supa writes The reliance on proprietary technologies to deliver web services varies from country to country. South Korea's ActiveX problem has been in the news before. Yonhap brings us a short report that the government plans to finally start cleaning up this troublesome technology from public websites later this month, as Korea gears up to create a more friendly Internet environment. The country's online financial websites and shopping malls often use ActiveX to have their payments and identification programs securely downloaded to users' personal computers.
That country is pretty locked up as far as I know.
I keep hearing people say that ActiveX is "proprietary", and maybe it is. But then these same people say that HTML5 and JS and CSS are better because they're "open". I don't see how that's the case.
So Microsoft developing ActiveX makes it "proprietary". That's not different at all from how HTML5, JS and CSS have been developed. It's pretty much just Google, Mozilla, Apple and Opera (or people working for them) who have developed HTML5, JS and CSS. Even among those organizations, Google is clearly the heavyweight leading the show, with Apple only there because it has to be, and Mozilla and Opera trying as hard as they can not to be totally irrelevant.
The illusion of outside input may be there, but I don't think it actually exists. It's Google's way, or fuck off. As an outsider, I know I couldn't have had any meaningful impact on the HTML5, JS or CSS work. The same goes for pretty much every other outsider, too. So for us, there's no difference between a Microsoft-created web product and a Google-created web product. We don't have a say either way. All of these technologies are "proprietary" from our perspective. They're "open" in marketing only.
I'm pretty sure nearly every story posted on Slashdot about ActiveX had at least 50 responses that included the words "M$".
Holy shit snacks, does that mean that one day I might be able to use Korean government or online banking website with Firefox???
Probably not, the country's extremely monocultural when it comes to computing tech. ("Not Invented Here" was one of the problems in the first place.) For example, nearly all the PCs there are Windows/Intel/nVidia combos... you really need to jump though hoops and/or be really specific when ordering computers to get anything else. And, only people at Daum and KAIST seem to even have any idea about Linux. Anything outside the Windows (IE6+)/Intel/nVidia mindset is not going to work.
I worked with ActiveX technology close to 15 years ago. It was a much simpler era, where there was little need to worry about platforms other than Windows+IE, and where most of us hadn't really caught on yet to how ruthless the hackers were going to become. And frankly there wasn't a whole lot of alternative for pushing real app functionality from the web in those days. Some people were using Java, which certainly wasn't any more secure, and eventually Flash began to gain traction. So it's not completely hard to understand how we got where we are.
In case anyone is wondering what ActiveX is, it's essentially a Windows program you download that runs natively on your computer. It gets to draw to the specified element in the browser, which makes it look like it's part of a webpage. There isn't (or wasn't) any kind of sandboxing or security once the ActiveX component was installed - it could do anything it wanted on your computer like any other Windows program, because that's essentially what it was. The only security was whether or not you installed the ActiveX component in the first place. If I remember correctly they are really just DLLs, and used Component Object Model for the standard in which the DLL exposes methods, etc.
Better known as 318230.
obsessives and the something ccol Software lawyers
In Korea it is required to use a government sponsored certificate for all online transactions, and the certificate is available only if you have an ActiveX supported computer. This sounds very stupid but it is true.
Now that Microsoft has abandoned ActiveX, the Korean government has to give up ActiveX. The plan is to rewrite the ActiveX code and future online customers need to download and install an .exe file for handling the certificate. The real problem is not ActiveX. The real problem is the Korean government sponsored certificate. It is required by law for all online transactions in Korea. The government sponsored certificate is a lucrative business for corrupted bureaucrats and companies and they don't have any intention to abolish it.
'For example, “COM supports an undocumented feature called channel hooks. Well, they are semidocumented in the Win32 header files and in Don Box's ActiveX/COM column (MSJ, January 1998). Microsoft does not officially support channel hooks on either Windows NT 4.0 or Windows 2000 If you're still reading, then you've acknowledged that disclaimer and I can get into the details”' ref
...is not the adverb I'd use when talking about ActiveX.
Working in Korea once I needed to install a package with apt-get but the file came down empty. I asked around and it turns out that to download anything on the corporate network you had to install this active-x component which looks to see if a storage device is connected to USB. If a device is connected the download still won't work, but you can still make a local copy of the file, plug in the USB key, and copy the file that way, which is what we did on a windows box.
Half measures all over the place.
http://michaelsmith.id.au
responses that included the words "M$"
"M$" looks like a string variable in old-skool line-numbered BASIC, and Microsoft started out publishing BASIC interpreters. Could "M$" mean "The company should have stuck to BASIC and not branched into microcomputer operating systems"?
If they had stuck with Xenix we may not have ended bottom lip deep in a malware swamp
Could you explain how that might not have happened? Xenix (which became SCO OpenServer) was just Microsoft's port of AT&T UNIX to PCs. UNIX is just as vulnerable to malware as Windows: if you trick the user into elevating to install something, something will be installed.
Starting with a multiuser approach and being aware of a network that early on is likely to have made all of the difference.
Most of the shit is a legacy of having a single user non-networked environment for so long.
Currently it's a single click on an email to infect all the available network shares with cryptolocker - nothing about elevating to install something at all.
I worked at a very large computer company many years back. It was great that they let me wipe Windows completely off my company-loaned laptop and install Linux on it instead. However, I then had to use the company's internal travel website to book a business trip. The internal travel website used ActiveX and required Internet Explorer 6. I complained that this company which touted open standards externally should also use open standards internally instead of the ActiveX and Internet Explorer crap. My complaint was ignored and I either installed IE6 via wine or else I used a coworker's Windows laptop to book the trip.
I don't work there anymore, but to the people at that company who relied on dead-end proprietary web technology to design their internal travel website,
I told you so!
Seriously guys - every time I give an example of malware on an MS platform I get modded down - grow a pair instead of living in denial.
Back to the above poster, yes it may still happen in environments where security was considered from day one but I'm convinced the years of no privelage separation at all has resulted in the scale of the current problem.