8 ms·

10 years ago it would have been unimaginable, but 20 years ago you could have done all of this with ActiveX controls. (Oh and yeah 20 years ago I had AJAJ by j

by dheera 6y ago

10 years ago it would have been unimaginable, but 20 years ago you could have done all of this with ActiveX controls. (Oh and yeah 20 years ago I had AJAJ by just loading the target URL in a hidden/offscreen iframe and reading its contents programmatically. Never mind the fact that I could also read contents from the user's hard drives ... although I didn't use it for this)

abhiminator 6y ago
Ah ActiveX -- a gold mine for malicious actors.
- AnIdiotOnTheNet 6y ago
  You say that like the web hasn't been. Hell, even if everything always worked properly, there were not XSS attacks, and users weren't easily fooled, the web would still be full of malicious actors in the form of tracking and advertisement. Remember, we invented pop-up blockers because advertisers abused it, and we've been in an arms race with those assholes ever since. Tracking and ads in desktop apps came from the web ecosystem and now we're stuck with it.
  - spookthesunset 6y ago
    I don’t think you can equate the two. ActiveX was barely sandboxed... in fact I’d like to say they were not sandboxed at all. They were native code running basically as root on your machine. It was something that came back when Microsoft was still convinced the internet would be a fad. Those activeX things could do all sorts of fun exciting things on your computer.
    - AnIdiotOnTheNet 6y ago
      Oh ActiveX was definitely worse, I should know since I was using the internet plenty when it was prominent. My point is, though, that malicious actors still basically control the web. They may not be executing native code without any controls, but that doesn't mean that the modern web isn't still their playground.
  - dheera 6y ago
    Oh yeah speaking of popups I once made a horrendous bouncing image script for IE 5.5 that allowed images to fly around your screen outside the browser window. http://dynamicdrive.com/dynamicindex4/bounceimage2.htm http://dynamicdrive.com/dynamicindex4/bounceimage2.htm
tjoff 6y ago
And JavaScript is just as bad as ActiveX was. The only difference is that you are expected to have JavaScript turned on.
- JohnBooty 6y ago
  There are many negative things that could correctly be said about Javascript. But this? This comment is absolutely special. ActiveX controls were native code, with full system access by design. Possibly even worse, it was an absolutely blatant attempt by Microsoft to monopolize the web and maintain Windows' and Internet Explorer's dominance, as the controls were of course (in practice) intimately tied to IE on Windows on x86.
  - tjoff 6y ago
    Yet JavaScript is much more harmful than ActiveX ever was. Flash was an abonimation, yet you could disable it with barely any consequences. Same with ActiveX.
    - JohnBooty 6y ago
      It was incredibly common to see Windows installs utterly compromised by ActiveX controls doing god-knows-what, to both the infected computer and every other computer on the corporate network. The damage to individuals and the economy in terms of lost productivity and compromised personal information directly attributable to ActiveX's "compromise my system by design" nature is incalculable. To compare that to Javascript is rather spectacular. If you want to argue that Javascript has been able to wreak more damage over time precisely because it's not as objectively insane and immediately destructive as ActiveX, well fine. It could be said that Javascript is Covid-19 to ActiveX's ebolavirus. Ebola is so wantonly destructive that it kills many of its victims before they have a chance to infect others, whereas Covid's less-awful nature has actually allowed it to harm more people over time and is now probably here to stay, like influenza. Flash was an abonimation, yet you could disable it with barely any consequences. Same with ActiveX. This was very nearly not the case. IE/Win had close to 100% market share at one point. We were a hair's breadth away from a future where you could, in fact, not disable ActiveX without shutting yourself off from much of the web, like Javascript today. South Korea was actually there for a time. If you wanted to spend money online, various regulations meant running ActiveX was a requirement.

by dheera 6y ago

abhiminator 6y ago

Ah ActiveX -- a gold mine for malicious actors.

AnIdiotOnTheNet 6y ago
You say that like the web hasn't been. Hell, even if everything always worked properly, there were not XSS attacks, and users weren't easily fooled, the web would still be full of malicious actors in the form of tracking and advertisement. Remember, we invented pop-up blockers because advertisers abused it, and we've been in an arms race with those assholes ever since. Tracking and ads in desktop apps came from the web ecosystem and now we're stuck with it.
- spookthesunset 6y ago
  I don’t think you can equate the two. ActiveX was barely sandboxed... in fact I’d like to say they were not sandboxed at all. They were native code running basically as root on your machine. It was something that came back when Microsoft was still convinced the internet would be a fad. Those activeX things could do all sorts of fun exciting things on your computer.
  - AnIdiotOnTheNet 6y ago
    Oh ActiveX was definitely worse, I should know since I was using the internet plenty when it was prominent. My point is, though, that malicious actors still basically control the web. They may not be executing native code without any controls, but that doesn't mean that the modern web isn't still their playground.
- dheera 6y ago
  Oh yeah speaking of popups I once made a horrendous bouncing image script for IE 5.5 that allowed images to fly around your screen outside the browser window. http://dynamicdrive.com/dynamicindex4/bounceimage2.htm http://dynamicdrive.com/dynamicindex4/bounceimage2.htm

tjoff 6y ago

And JavaScript is just as bad as ActiveX was. The only difference is that you are expected to have JavaScript turned on.

JohnBooty 6y ago
There are many negative things that could correctly be said about Javascript. But this? This comment is absolutely special. ActiveX controls were native code, with full system access by design. Possibly even worse, it was an absolutely blatant attempt by Microsoft to monopolize the web and maintain Windows' and Internet Explorer's dominance, as the controls were of course (in practice) intimately tied to IE on Windows on x86.
- tjoff 6y ago
  Yet JavaScript is much more harmful than ActiveX ever was. Flash was an abonimation, yet you could disable it with barely any consequences. Same with ActiveX.
  - JohnBooty 6y ago
    It was incredibly common to see Windows installs utterly compromised by ActiveX controls doing god-knows-what, to both the infected computer and every other computer on the corporate network. The damage to individuals and the economy in terms of lost productivity and compromised personal information directly attributable to ActiveX's "compromise my system by design" nature is incalculable. To compare that to Javascript is rather spectacular. If you want to argue that Javascript has been able to wreak more damage over time precisely because it's not as objectively insane and immediately destructive as ActiveX, well fine. It could be said that Javascript is Covid-19 to ActiveX's ebolavirus. Ebola is so wantonly destructive that it kills many of its victims before they have a chance to infect others, whereas Covid's less-awful nature has actually allowed it to harm more people over time and is now probably here to stay, like influenza. Flash was an abonimation, yet you could disable it with barely any consequences. Same with ActiveX. This was very nearly not the case. IE/Win had close to 100% market share at one point. We were a hair's breadth away from a future where you could, in fact, not disable ActiveX without shutting yourself off from much of the web, like Javascript today. South Korea was actually there for a time. If you wanted to spend money online, various regulations meant running ActiveX was a requirement.