7 ms·

Microsoft nixes ActiveX add-on technology in new Edge browser

55 points by uladzislau 11y ago

MichaelCrawford 11y ago
Yay.
dogma1138 11y ago
Wow, not even legacy support? Not sure if that's going to fly the amount of both extremely old and even brand new enterprise crap systems that still use ActiveX is quite staggering for everything from banking applications to VPN and such ActiveX is still used quite a bit. Edit: nvm didn't load half the page, enterprise version will have ActiveX & BHO support :D
- atonse 11y ago
  Seriously? It's damned if you do, damned if you don't for MS. ActiveX is the last bastion of archaic plugin APIs that have been replaced with native html5 features (in most cases). It's about time MS took this thing out and shot it. The awesome thing about Edge is that they can make these decisions and start fresh without hurting backwards compatibility (because there IS no backwards in Edge, it's brand new), and they can just say "you want all this legacy stuff? use IE" - IE, with its 4 rendering engines, ActiveX, and various zones and modes to appease IT departments, is not going away.
  - mschuster91 11y ago
    > and various zones and modes to appease IT departments, is not going away. That "zone" crap is something I never understood anyway. It's a real PITA to setup a Windows Server (tried 2008 and 2008 R2, and I believe its predecessors also had it), because you have to click a dozen different buttons, checkboxes and sliders just to visit a website - and to download stuff like a driver or, heaven forbid, another browser, even more clicks. Also, these days I don't believe that the whitelisting approach works anymore either, because every website on the web loads content (ohai Jquery and friends) from others... hope it's gone for good in the "new IE".
    - qq66 11y ago
      Out of the box, Windows Server assumes that you don't know what you're doing, probably because many Windows Server deployments are configured by brand-new or amateur users. If you do know what you're doing and want all those warnings to go away, you can turn them off in the control panel.
      - dogma1138 11y ago
        Considering the costs of most Windows servers i doubt that has anything to do with that. I can guarantee you that the amount of inexperienced people that try to configure a simple LAMP server every day out numbers the people who try to configure a MSFT server by several orders of magnitude. MSFT just tries to harden the server as much as possible from the get go, as it assumes you won't need to use the internet to configure it or to download additional software from the internet. Whether the assumption is correct or not, a server coming out of the box in it's most hardened usable generic state is actually a preferred thing whether your an experienced user or a complete beginner.
        MichaelGG 11y ago
        Yeah it's a CYA move by MS. Same reason they don't ship a telnet client by default. Or why you have to double opt-in for gzip with ASP.NET+IIS. I'm guessing, like SELinux, what users end up doing is just disabling things completely (or enabling all options) instead of figuring out all the specifics. I understand, no one wants to be responsible for shipping a vulnerability by default, like MS products used to be. Also see their terrible HTTP.SYS reservation system. Any program can listen on a socket. But if you want to use that socket for HTTP and use the OS-provided functions? Boom, special ACLs apply; enjoy figuring out a special one off utility. Or just run your service as a local admin.
        dogma1138 11y ago
        Yeah it's not great, but there's a good reason why there's an ACL for HTTP.SYS name reservations, a malicious application can actually reserve system reserved names, or overwrite the names of other services which already reserved a name such as the IIS or SQL server running on the machine. It's quite an annoying thing to understand Windows permissions, especially when you are using built-in drivers and services such as HTTP.SYS. Also don't forget that when you interact with HTTP.SYS you are interacting with a kernel mode driver, sockets can be bound in user space, so you are dealing with more privileged content. P.S. Network Service can use HTTP.SYS reservations, and pretty much anything else AFAIK.
  - dogma1138 11y ago
    Wasn't saying it's a bad thing, but the enterprise market, especially in finance is bloated with various ActiveX components because it was the flavor of the week (turned into the falvor of the decade) when companies had to transform legacy thick client applications to web applications, the sad part is that by the time everything was in place ActiveX was already legacy :) Heck I've had to review ActiveX builds are recent as last year which were "brand new". I personally loath ActiveX, i hate pretty much any tech that require me to load a 3rd party app inside my browsers whether it's the pesky JRE which you can never update because the 1 site you need it for won't support anything past JRE 7.1, or that ancient ActiveX which you need to open in IE10 in IE7 compatibility mode with virtually every security measure disabled. I'm just saying this move might hurt quite a bit of people, but MSFT seems to be moving away from their usual desktop software modus operandai and moving towards becoming more and more of a services providers/SAAS company. It doesn't mean that if they decide to take out ActiveX it won't hurt allot of people, and even MSFT in the short time, luckily they still will have some sort of backwards compatibility support and i hope it will be available to normal consumers on demand also. Since sorry but once in a while i need to use an ActiveX too, whether it's some old WebEx or Citrix installation or some really outdated SSL VPN and i don't want to keep some Windows XP/7 VM on hand all the time to do it. I know it's not what the cool kids do, but sadly for people that tend to work with big and sometimes anachronistic enterprises it's a reality.
    - atonse 11y ago
      > I know it's not what the cool kids do, but sadly for people that tend to work with big and sometimes anachronistic enterprises it's a reality. Right, and nothing will change for those people, because IE will continue to exist for many years. Knowing MS, they'll probably provide patches for it for another 5 years. By then, if people haven't moved on, then some IT folks need to be fired - you've had 15 years to think about upgrading out of ActiveX, really no excuses left.
    - deleted 11y ago
      [deleted]
- outside1234 11y ago
  There will still be Internet Explorer for the dinosaurs that need ActiveX.
- karmakaze 11y ago
  Good choice by MS. If something's not available by default for consumers, then it isn't mainstream tech. What happens in a special edition is only relevant for that submarket.
deskamess 11y ago
Interesting... so for non enterprise users it looks like applets are out. Do not care either way, but that leaves just Firefox supporting applets across all user bases.
zerr 11y ago
ActiveX is generally considered as an old tech, but what are the alternatives outside the browser? I mean for desktop apps.
cies 11y ago
Now lets prevent this dark in history from repeating itself. Let keep the web free of proprietary "single-browser" tech.
- bad_user 11y ago
  PNaCL? Dart VM?
  - esrauch 11y ago
    I don't think DartVM was ever turned on in Chrome
  - Igglyboo 11y ago
    Almost no one uses either of those, Dart VM never even made it into a non-experimental version of Chrome.
  - cies 11y ago
    Is PNaCl proprietary? Is it something that other browser could not support? Would the maker of this technology put effort in preventing other implementations?
    - kuschku 11y ago
      Is ActiveX proprietary? Is it something that other browsers could not support? Would the maker of this technology put effort in preventing other implementations? Is Silverlight proprietary? Is it something that other browsers could not support? Would the maker of this technology put effort in preventing other implementations?
    - jordanthoms 11y ago
      The specification is pretty open AFAIK, but it's very difficult for other browsers to implement since it requires a strong sandbox, which only chrome has managed so far.
      - bad_user 11y ago
ptx 11y ago
I was recently reading David Chappell's "Understanding ActiveX and OLE" (published in 1996) and found this part amusing: "Once the Windows shell itself lets you browse the Web, the need for a separate web browser application becomes less apparent. But while web browsers as such might one day fade into the mists of history, that day hasn't yet arrived. And even if browsers per se vanish, [COM] components such as the Web Browser object and the HTML viewer will survive."
- frik 11y ago
  > Windows shell itself lets you browse the Web Microsoft implemented it, called "The Microsoft Network" (MSNv1): http://en.wikipedia.org/wiki/MSN_Dial-up#The_Microsoft_Network http://en.wikipedia.org/wiki/MSN_Dial-up#The_Microsoft_Netwo... . It used the Win95 Explorer as interface. Internet Explorer 1 (rebranded Mosaic) shipped with Win95b / Win95 Plus add-on CD. http://en.wikipedia.org/wiki/Mosaic_(web_browser) http://en.wikipedia.org/wiki/Mosaic_(web_browser) See MSN1 in action, the introduction film with Jennifer Aniston: https://youtu.be/kGYcNcFhctc?t=17m16s https://youtu.be/kGYcNcFhctc?t=17m16s (watch it for 2-3 min to get the idea; or direct link to MSN1: https://youtu.be/kGYcNcFhctc?t=19m16s https://youtu.be/kGYcNcFhctc?t=19m16s) Read Bill Gates (former internal) 1994 memo: "Windows: The Next Killer Application on the Internet": http://www.microsoft.com/about/companyinformation/timeline/timeline/docs/di_killerapp_InternetMemo.rtf http://www.microsoft.com/about/companyinformation/timeline/t... . "The memo starts with a background on the Internet in general, and then proposes a strategy on how to turn Windows into the next "killer app" for the Internet." -- http://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish http://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish
  - bdcravens 11y ago
    > Internet Explorer 1 (rebranded Mosaic) Keep in mind that this wasn't the original NCSA Mosaic "Spyglass, Inc. licensed the technology and trademarks from NCSA for producing their own web browser but never used any of the NCSA Mosaic source code. Microsoft licensed Spyglass Mosaic in 1995 for US$2 million, modified it, and renamed it Internet Explorer." http://en.wikipedia.org/wiki/Mosaic_(web_browser) http://en.wikipedia.org/wiki/Mosaic_(web_browser)
shimonamit 11y ago
HTML5 is an excellent alternative to ActiveX, particularly in the area of mime type handling, but it does not facilitate native desktop interaction. There is still a basic need for certain websites to interact with pre-installed native/legacy applications using a secure method such as Google Native Messaging, but Microsoft hasn't committed to anything similar.
Animats 11y ago
Also leaving: Browser Helper Objects. This seems to be the death knell of Flash.
RRRA 11y ago
Can they ditch Silverlight too so we can -finally- get rid of plugins on the web?!
- nathankunicki 11y ago
  Sadly no. The one last remaining hurdle, the main reason for still using Silverlight (And to a lesser extent, Flash), still hasn't been solved - that of the requirement for DRM by rights holders. Until all vendors get on board and ditch their idealistic objections (Right or wrong), those plugins will remain.
  - kuschku 11y ago
    Actually, we have DRM in HTML5 now :/
    - junto 11y ago
      Yep and that's a travesty in itself. My two cents... DRM has no place in the open web.
shmerl 11y ago
Good. It's long overdue.
tuna-piano 11y ago
In related news from last month, South Korea is finally moving away from ActiveX, with the goal of having at least 90 percent of the country's top 100 websites 'ActiveX-free,' by 2017... http://www.theregister.co.uk/2015/04/02/south_korea_to_deport_microsoft_activex/ http://www.theregister.co.uk/2015/04/02/south_korea_to_depor... For those who need some background: "A law passed in the late 90's to facilitate ecommerce security requires using an ActiveX control, and therefore IE, to shop on Korean sites." http://www.washingtonpost.com/world/asia_pacific/due-to-security-law-south-korea-is-stuck-with-internet-explorer-for-online-shopping/2013/11/03/ffd2528a-3eff-11e3-b028-de922d7a3f47_story.html http://www.washingtonpost.com/world/asia_pacific/due-to-secu... http://www.zdnet.com/article/south-koreans-use-internet-explorer-its-the-law/ http://www.zdnet.com/article/south-koreans-use-internet-expl...

55 points by uladzislau 11y ago

Yay.

Wow, not even legacy support? Not sure if that's going to fly the amount of both extremely old and even brand new enterprise crap systems that still use ActiveX is quite staggering for everything from banking applications to VPN and such ActiveX is still used quite a bit. Edit: nvm didn't load half the page, enterprise version will have ActiveX & BHO support :D

atonse 11y ago
Seriously? It's damned if you do, damned if you don't for MS. ActiveX is the last bastion of archaic plugin APIs that have been replaced with native html5 features (in most cases). It's about time MS took this thing out and shot it. The awesome thing about Edge is that they can make these decisions and start fresh without hurting backwards compatibility (because there IS no backwards in Edge, it's brand new), and they can just say "you want all this legacy stuff? use IE" - IE, with its 4 rendering engines, ActiveX, and various zones and modes to appease IT departments, is not going away.
- mschuster91 11y ago
  > and various zones and modes to appease IT departments, is not going away. That "zone" crap is something I never understood anyway. It's a real PITA to setup a Windows Server (tried 2008 and 2008 R2, and I believe its predecessors also had it), because you have to click a dozen different buttons, checkboxes and sliders just to visit a website - and to download stuff like a driver or, heaven forbid, another browser, even more clicks. Also, these days I don't believe that the whitelisting approach works anymore either, because every website on the web loads content (ohai Jquery and friends) from others... hope it's gone for good in the "new IE".
  - qq66 11y ago
    Out of the box, Windows Server assumes that you don't know what you're doing, probably because many Windows Server deployments are configured by brand-new or amateur users. If you do know what you're doing and want all those warnings to go away, you can turn them off in the control panel.
    - dogma1138 11y ago
      Considering the costs of most Windows servers i doubt that has anything to do with that. I can guarantee you that the amount of inexperienced people that try to configure a simple LAMP server every day out numbers the people who try to configure a MSFT server by several orders of magnitude. MSFT just tries to harden the server as much as possible from the get go, as it assumes you won't need to use the internet to configure it or to download additional software from the internet. Whether the assumption is correct or not, a server coming out of the box in it's most hardened usable generic state is actually a preferred thing whether your an experienced user or a complete beginner.
      - MichaelGG 11y ago
        Yeah it's a CYA move by MS. Same reason they don't ship a telnet client by default. Or why you have to double opt-in for gzip with ASP.NET+IIS. I'm guessing, like SELinux, what users end up doing is just disabling things completely (or enabling all options) instead of figuring out all the specifics. I understand, no one wants to be responsible for shipping a vulnerability by default, like MS products used to be. Also see their terrible HTTP.SYS reservation system. Any program can listen on a socket. But if you want to use that socket for HTTP and use the OS-provided functions? Boom, special ACLs apply; enjoy figuring out a special one off utility. Or just run your service as a local admin.
        dogma1138 11y ago
        Yeah it's not great, but there's a good reason why there's an ACL for HTTP.SYS name reservations, a malicious application can actually reserve system reserved names, or overwrite the names of other services which already reserved a name such as the IIS or SQL server running on the machine. It's quite an annoying thing to understand Windows permissions, especially when you are using built-in drivers and services such as HTTP.SYS. Also don't forget that when you interact with HTTP.SYS you are interacting with a kernel mode driver, sockets can be bound in user space, so you are dealing with more privileged content. P.S. Network Service can use HTTP.SYS reservations, and pretty much anything else AFAIK.
- dogma1138 11y ago
  Wasn't saying it's a bad thing, but the enterprise market, especially in finance is bloated with various ActiveX components because it was the flavor of the week (turned into the falvor of the decade) when companies had to transform legacy thick client applications to web applications, the sad part is that by the time everything was in place ActiveX was already legacy :) Heck I've had to review ActiveX builds are recent as last year which were "brand new". I personally loath ActiveX, i hate pretty much any tech that require me to load a 3rd party app inside my browsers whether it's the pesky JRE which you can never update because the 1 site you need it for won't support anything past JRE 7.1, or that ancient ActiveX which you need to open in IE10 in IE7 compatibility mode with virtually every security measure disabled. I'm just saying this move might hurt quite a bit of people, but MSFT seems to be moving away from their usual desktop software modus operandai and moving towards becoming more and more of a services providers/SAAS company. It doesn't mean that if they decide to take out ActiveX it won't hurt allot of people, and even MSFT in the short time, luckily they still will have some sort of backwards compatibility support and i hope it will be available to normal consumers on demand also. Since sorry but once in a while i need to use an ActiveX too, whether it's some old WebEx or Citrix installation or some really outdated SSL VPN and i don't want to keep some Windows XP/7 VM on hand all the time to do it. I know it's not what the cool kids do, but sadly for people that tend to work with big and sometimes anachronistic enterprises it's a reality.
  - atonse 11y ago
    > I know it's not what the cool kids do, but sadly for people that tend to work with big and sometimes anachronistic enterprises it's a reality. Right, and nothing will change for those people, because IE will continue to exist for many years. Knowing MS, they'll probably provide patches for it for another 5 years. By then, if people haven't moved on, then some IT folks need to be fired - you've had 15 years to think about upgrading out of ActiveX, really no excuses left.
  - deleted 11y ago
    [deleted]
outside1234 11y ago
There will still be Internet Explorer for the dinosaurs that need ActiveX.
karmakaze 11y ago
Good choice by MS. If something's not available by default for consumers, then it isn't mainstream tech. What happens in a special edition is only relevant for that submarket.

deskamess 11y ago

Interesting... so for non enterprise users it looks like applets are out. Do not care either way, but that leaves just Firefox supporting applets across all user bases.

zerr 11y ago

ActiveX is generally considered as an old tech, but what are the alternatives outside the browser? I mean for desktop apps.

cies 11y ago

Now lets prevent this dark in history from repeating itself. Let keep the web free of proprietary "single-browser" tech.

bad_user 11y ago
PNaCL? Dart VM?
- esrauch 11y ago
  I don't think DartVM was ever turned on in Chrome
- Igglyboo 11y ago
  Almost no one uses either of those, Dart VM never even made it into a non-experimental version of Chrome.
- cies 11y ago
  Is PNaCl proprietary? Is it something that other browser could not support? Would the maker of this technology put effort in preventing other implementations?
  - kuschku 11y ago
    Is ActiveX proprietary? Is it something that other browsers could not support? Would the maker of this technology put effort in preventing other implementations? Is Silverlight proprietary? Is it something that other browsers could not support? Would the maker of this technology put effort in preventing other implementations?
  - jordanthoms 11y ago
    The specification is pretty open AFAIK, but it's very difficult for other browsers to implement since it requires a strong sandbox, which only chrome has managed so far.
    - bad_user 11y ago

ptx 11y ago

I was recently reading David Chappell's "Understanding ActiveX and OLE" (published in 1996) and found this part amusing: "Once the Windows shell itself lets you browse the Web, the need for a separate web browser application becomes less apparent. But while web browsers as such might one day fade into the mists of history, that day hasn't yet arrived. And even if browsers per se vanish, [COM] components such as the Web Browser object and the HTML viewer will survive."

frik 11y ago
> Windows shell itself lets you browse the Web Microsoft implemented it, called "The Microsoft Network" (MSNv1): http://en.wikipedia.org/wiki/MSN_Dial-up#The_Microsoft_Network http://en.wikipedia.org/wiki/MSN_Dial-up#The_Microsoft_Netwo... . It used the Win95 Explorer as interface. Internet Explorer 1 (rebranded Mosaic) shipped with Win95b / Win95 Plus add-on CD. http://en.wikipedia.org/wiki/Mosaic_(web_browser) http://en.wikipedia.org/wiki/Mosaic_(web_browser) See MSN1 in action, the introduction film with Jennifer Aniston: https://youtu.be/kGYcNcFhctc?t=17m16s https://youtu.be/kGYcNcFhctc?t=17m16s (watch it for 2-3 min to get the idea; or direct link to MSN1: https://youtu.be/kGYcNcFhctc?t=19m16s https://youtu.be/kGYcNcFhctc?t=19m16s) Read Bill Gates (former internal) 1994 memo: "Windows: The Next Killer Application on the Internet": http://www.microsoft.com/about/companyinformation/timeline/timeline/docs/di_killerapp_InternetMemo.rtf http://www.microsoft.com/about/companyinformation/timeline/t... . "The memo starts with a background on the Internet in general, and then proposes a strategy on how to turn Windows into the next "killer app" for the Internet." -- http://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish http://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish
- bdcravens 11y ago
  > Internet Explorer 1 (rebranded Mosaic) Keep in mind that this wasn't the original NCSA Mosaic "Spyglass, Inc. licensed the technology and trademarks from NCSA for producing their own web browser but never used any of the NCSA Mosaic source code. Microsoft licensed Spyglass Mosaic in 1995 for US$2 million, modified it, and renamed it Internet Explorer." http://en.wikipedia.org/wiki/Mosaic_(web_browser) http://en.wikipedia.org/wiki/Mosaic_(web_browser)

shimonamit 11y ago

HTML5 is an excellent alternative to ActiveX, particularly in the area of mime type handling, but it does not facilitate native desktop interaction. There is still a basic need for certain websites to interact with pre-installed native/legacy applications using a secure method such as Google Native Messaging, but Microsoft hasn't committed to anything similar.

Animats 11y ago

Also leaving: Browser Helper Objects. This seems to be the death knell of Flash.

RRRA 11y ago

Can they ditch Silverlight too so we can -finally- get rid of plugins on the web?!

nathankunicki 11y ago
Sadly no. The one last remaining hurdle, the main reason for still using Silverlight (And to a lesser extent, Flash), still hasn't been solved - that of the requirement for DRM by rights holders. Until all vendors get on board and ditch their idealistic objections (Right or wrong), those plugins will remain.
- kuschku 11y ago
  Actually, we have DRM in HTML5 now :/
  - junto 11y ago
    Yep and that's a travesty in itself. My two cents... DRM has no place in the open web.

shmerl 11y ago

Good. It's long overdue.

tuna-piano 11y ago

In related news from last month, South Korea is finally moving away from ActiveX, with the goal of having at least 90 percent of the country's top 100 websites 'ActiveX-free,' by 2017... http://www.theregister.co.uk/2015/04/02/south_korea_to_deport_microsoft_activex/ http://www.theregister.co.uk/2015/04/02/south_korea_to_depor... For those who need some background: "A law passed in the late 90's to facilitate ecommerce security requires using an ActiveX control, and therefore IE, to shop on Korean sites." http://www.washingtonpost.com/world/asia_pacific/due-to-security-law-south-korea-is-stuck-with-internet-explorer-for-online-shopping/2013/11/03/ffd2528a-3eff-11e3-b028-de922d7a3f47_story.html http://www.washingtonpost.com/world/asia_pacific/due-to-secu... http://www.zdnet.com/article/south-koreans-use-internet-explorer-its-the-law/ http://www.zdnet.com/article/south-koreans-use-internet-expl...