5 ms·

Seriously? It's damned if you do, damned if you don't for MS. ActiveX is the last bastion of archaic plugin APIs that have been replaced with native html5 featu

by atonse 12y ago

Seriously? It's damned if you do, damned if you don't for MS. ActiveX is the last bastion of archaic plugin APIs that have been replaced with native html5 features (in most cases). It's about time MS took this thing out and shot it. The awesome thing about Edge is that they can make these decisions and start fresh without hurting backwards compatibility (because there IS no backwards in Edge, it's brand new), and they can just say "you want all this legacy stuff? use IE" - IE, with its 4 rendering engines, ActiveX, and various zones and modes to appease IT departments, is not going away.

mschuster91 12y ago
> and various zones and modes to appease IT departments, is not going away. That "zone" crap is something I never understood anyway. It's a real PITA to setup a Windows Server (tried 2008 and 2008 R2, and I believe its predecessors also had it), because you have to click a dozen different buttons, checkboxes and sliders just to visit a website - and to download stuff like a driver or, heaven forbid, another browser, even more clicks. Also, these days I don't believe that the whitelisting approach works anymore either, because every website on the web loads content (ohai Jquery and friends) from others... hope it's gone for good in the "new IE".
- qq66 12y ago
  Out of the box, Windows Server assumes that you don't know what you're doing, probably because many Windows Server deployments are configured by brand-new or amateur users. If you do know what you're doing and want all those warnings to go away, you can turn them off in the control panel.
  - dogma1138 12y ago
    Considering the costs of most Windows servers i doubt that has anything to do with that. I can guarantee you that the amount of inexperienced people that try to configure a simple LAMP server every day out numbers the people who try to configure a MSFT server by several orders of magnitude. MSFT just tries to harden the server as much as possible from the get go, as it assumes you won't need to use the internet to configure it or to download additional software from the internet. Whether the assumption is correct or not, a server coming out of the box in it's most hardened usable generic state is actually a preferred thing whether your an experienced user or a complete beginner.
    - MichaelGG 12y ago
      Yeah it's a CYA move by MS. Same reason they don't ship a telnet client by default. Or why you have to double opt-in for gzip with ASP.NET+IIS. I'm guessing, like SELinux, what users end up doing is just disabling things completely (or enabling all options) instead of figuring out all the specifics. I understand, no one wants to be responsible for shipping a vulnerability by default, like MS products used to be. Also see their terrible HTTP.SYS reservation system. Any program can listen on a socket. But if you want to use that socket for HTTP and use the OS-provided functions? Boom, special ACLs apply; enjoy figuring out a special one off utility. Or just run your service as a local admin.
      - dogma1138 12y ago
        Yeah it's not great, but there's a good reason why there's an ACL for HTTP.SYS name reservations, a malicious application can actually reserve system reserved names, or overwrite the names of other services which already reserved a name such as the IIS or SQL server running on the machine. It's quite an annoying thing to understand Windows permissions, especially when you are using built-in drivers and services such as HTTP.SYS. Also don't forget that when you interact with HTTP.SYS you are interacting with a kernel mode driver, sockets can be bound in user space, so you are dealing with more privileged content. P.S. Network Service can use HTTP.SYS reservations, and pretty much anything else AFAIK.
        MichaelGG 12y ago
        Right, so deny access to apps trying to listen on reserved ports/namespaces. Instead, if you use sockets, you're free to listen on, say, 6666 just fine. But asking for HTTP on the same port results in a permissions error. This is obviously dumb behavior.
        dogma1138 12y ago
        Different scopes, HTTP.SYS actually processes and routes HTTP requests in the system, think of it as an HTTP proxy router. This is a kernel mode driver, and a misuse of it can compromise the entire system. It's not dumb behavior, but that's the "price" you have to pay when you have a system component that allows you to handle HTTP requests easily, it also removes the requirement for an HTTP server to have a working socket on the system since HTTP.SYS for example can route requests to multiple virtual servers on the same machine using the same socket based on the URI requested. And more importantly allows applications to communicate over HTTP without implementing a TCP/IP or any other networking stack, they only need to register with HTTP.SYS and it works, heck if you really want too you can instruct HTTP.SYS to strip all the HTTP protocol related stuff from the traffic and then you don't even need to implement "HTTP" in your application either. Sockets require very little permissions to bind because binding a socket cannot have adverse affects on the entire system, if it's in use by another app it wont allow you to do it.
- dogma1138 12y ago
  All servers since 2003 had the IE Enhanced Security mode. It actually has nothing directly to do with Zones. Zones were MSFT's vision from the early 2000's in which your internet access will be divided between internal corporate resources, trusted parties preferably trough some sort of AD federation (anyone remembers when MSFT tried to make global AD federation over the internet with Andromeda or w/e it was called?) and the internet. Each zone would have a different security setup which will restrict what kind of information you can pass to a site (e.g. your NTLM/Kerberos credentials) and what kind of actions the site can perform on your browsers. It wasn't a bad idea, the market just never went there and even corporate resources today are accessed via the global internet and not in the intranet or some sort of a federated network. MSFT has always had some weird things, some were way a head of it's time and like many things which are a head of their time when they miss they miss by a mile. Heck every Windows machine connected to the internet still has (or can have i think in Windows 8 it's not enabled by default any more but i could be wrong) a globally translated name trough PNRP akin to DNS, I've actually used it during the early Vista days for remote access when DyDNS services were still in their infancy and not many trustworthy services were out there. PNRP was also quite a neat idea (especially once they've dropped the IPv6 requirement from it) in which all Windows machines publish their own unique name via DHT's these names can be signed and the address is then quite hard to spoof (ala ToR hidden services), but i doubt that even 5% of Windows power users know about it, and probably less than 5% of those who do use it.
  - frik 12y ago
    > anyone remembers when MSFT tried to make global AD federation over the internet with Andromeda or w/e it was called? Microsoft Marvel, the Cairo directory service - see Bill Gates (former internal) 1994 memo: "Windows: The Next Killer Application on the Internet": http://www.microsoft.com/about/companyinformation/timeline/timeline/docs/di_killerapp_InternetMemo.rtf http://www.microsoft.com/about/companyinformation/timeline/t... "The existing Domain Name System is becomes quickly eclipsed by the Cairo directory service; providing universal resource location services without the need for specialized, arcane applications like archie. Users of the SMTP mail infrastructure take advantage of the advanced features of EMS while remaining backward compatible with their current Internet messaging solutions. Distributed information on the Internet is indexed by Cario and browsed using the Explorer across thousands of information servers worldwide without the need of tools like WAIS and Mosaic. Windows becomes the global infostructure explorer. The hottest content server on the Internet? Microsoft Marvel. It’s already integrated with all of these services and has a huge content base and commercial vendor support. Perhaps most importantly, Marvel solves the difficult electronic commerce problem well ahead of the Internet: the ability to securely purchase goods in a networked environment. Cairo becomes the clear platform choice for new information providers, offering the most flexibility in both management and technology. OLE Windows applications are now Internet-enabled - people schedule meetings across the Internet and share ideas using Microsoft application products on Windows. No more specialized tools, no more need for Unix to carry the infostructure. Access to the Internet is a natural extension of the base Windows system as well as Microsoft applications."
dogma1138 12y ago
Wasn't saying it's a bad thing, but the enterprise market, especially in finance is bloated with various ActiveX components because it was the flavor of the week (turned into the falvor of the decade) when companies had to transform legacy thick client applications to web applications, the sad part is that by the time everything was in place ActiveX was already legacy :) Heck I've had to review ActiveX builds are recent as last year which were "brand new". I personally loath ActiveX, i hate pretty much any tech that require me to load a 3rd party app inside my browsers whether it's the pesky JRE which you can never update because the 1 site you need it for won't support anything past JRE 7.1, or that ancient ActiveX which you need to open in IE10 in IE7 compatibility mode with virtually every security measure disabled. I'm just saying this move might hurt quite a bit of people, but MSFT seems to be moving away from their usual desktop software modus operandai and moving towards becoming more and more of a services providers/SAAS company. It doesn't mean that if they decide to take out ActiveX it won't hurt allot of people, and even MSFT in the short time, luckily they still will have some sort of backwards compatibility support and i hope it will be available to normal consumers on demand also. Since sorry but once in a while i need to use an ActiveX too, whether it's some old WebEx or Citrix installation or some really outdated SSL VPN and i don't want to keep some Windows XP/7 VM on hand all the time to do it. I know it's not what the cool kids do, but sadly for people that tend to work with big and sometimes anachronistic enterprises it's a reality.
- atonse 12y ago
  > I know it's not what the cool kids do, but sadly for people that tend to work with big and sometimes anachronistic enterprises it's a reality. Right, and nothing will change for those people, because IE will continue to exist for many years. Knowing MS, they'll probably provide patches for it for another 5 years. By then, if people haven't moved on, then some IT folks need to be fired - you've had 15 years to think about upgrading out of ActiveX, really no excuses left.
- deleted 12y ago
  [deleted]

by atonse 12y ago

mschuster91 12y ago

> and various zones and modes to appease IT departments, is not going away. That "zone" crap is something I never understood anyway. It's a real PITA to setup a Windows Server (tried 2008 and 2008 R2, and I believe its predecessors also had it), because you have to click a dozen different buttons, checkboxes and sliders just to visit a website - and to download stuff like a driver or, heaven forbid, another browser, even more clicks. Also, these days I don't believe that the whitelisting approach works anymore either, because every website on the web loads content (ohai Jquery and friends) from others... hope it's gone for good in the "new IE".

qq66 12y ago
Out of the box, Windows Server assumes that you don't know what you're doing, probably because many Windows Server deployments are configured by brand-new or amateur users. If you do know what you're doing and want all those warnings to go away, you can turn them off in the control panel.
- dogma1138 12y ago
  Considering the costs of most Windows servers i doubt that has anything to do with that. I can guarantee you that the amount of inexperienced people that try to configure a simple LAMP server every day out numbers the people who try to configure a MSFT server by several orders of magnitude. MSFT just tries to harden the server as much as possible from the get go, as it assumes you won't need to use the internet to configure it or to download additional software from the internet. Whether the assumption is correct or not, a server coming out of the box in it's most hardened usable generic state is actually a preferred thing whether your an experienced user or a complete beginner.
  - MichaelGG 12y ago
    Yeah it's a CYA move by MS. Same reason they don't ship a telnet client by default. Or why you have to double opt-in for gzip with ASP.NET+IIS. I'm guessing, like SELinux, what users end up doing is just disabling things completely (or enabling all options) instead of figuring out all the specifics. I understand, no one wants to be responsible for shipping a vulnerability by default, like MS products used to be. Also see their terrible HTTP.SYS reservation system. Any program can listen on a socket. But if you want to use that socket for HTTP and use the OS-provided functions? Boom, special ACLs apply; enjoy figuring out a special one off utility. Or just run your service as a local admin.
    - dogma1138 12y ago
      Yeah it's not great, but there's a good reason why there's an ACL for HTTP.SYS name reservations, a malicious application can actually reserve system reserved names, or overwrite the names of other services which already reserved a name such as the IIS or SQL server running on the machine. It's quite an annoying thing to understand Windows permissions, especially when you are using built-in drivers and services such as HTTP.SYS. Also don't forget that when you interact with HTTP.SYS you are interacting with a kernel mode driver, sockets can be bound in user space, so you are dealing with more privileged content. P.S. Network Service can use HTTP.SYS reservations, and pretty much anything else AFAIK.
      - MichaelGG 12y ago
        Right, so deny access to apps trying to listen on reserved ports/namespaces. Instead, if you use sockets, you're free to listen on, say, 6666 just fine. But asking for HTTP on the same port results in a permissions error. This is obviously dumb behavior.
        dogma1138 12y ago
        Different scopes, HTTP.SYS actually processes and routes HTTP requests in the system, think of it as an HTTP proxy router. This is a kernel mode driver, and a misuse of it can compromise the entire system. It's not dumb behavior, but that's the "price" you have to pay when you have a system component that allows you to handle HTTP requests easily, it also removes the requirement for an HTTP server to have a working socket on the system since HTTP.SYS for example can route requests to multiple virtual servers on the same machine using the same socket based on the URI requested. And more importantly allows applications to communicate over HTTP without implementing a TCP/IP or any other networking stack, they only need to register with HTTP.SYS and it works, heck if you really want too you can instruct HTTP.SYS to strip all the HTTP protocol related stuff from the traffic and then you don't even need to implement "HTTP" in your application either. Sockets require very little permissions to bind because binding a socket cannot have adverse affects on the entire system, if it's in use by another app it wont allow you to do it.
dogma1138 12y ago
All servers since 2003 had the IE Enhanced Security mode. It actually has nothing directly to do with Zones. Zones were MSFT's vision from the early 2000's in which your internet access will be divided between internal corporate resources, trusted parties preferably trough some sort of AD federation (anyone remembers when MSFT tried to make global AD federation over the internet with Andromeda or w/e it was called?) and the internet. Each zone would have a different security setup which will restrict what kind of information you can pass to a site (e.g. your NTLM/Kerberos credentials) and what kind of actions the site can perform on your browsers. It wasn't a bad idea, the market just never went there and even corporate resources today are accessed via the global internet and not in the intranet or some sort of a federated network. MSFT has always had some weird things, some were way a head of it's time and like many things which are a head of their time when they miss they miss by a mile. Heck every Windows machine connected to the internet still has (or can have i think in Windows 8 it's not enabled by default any more but i could be wrong) a globally translated name trough PNRP akin to DNS, I've actually used it during the early Vista days for remote access when DyDNS services were still in their infancy and not many trustworthy services were out there. PNRP was also quite a neat idea (especially once they've dropped the IPv6 requirement from it) in which all Windows machines publish their own unique name via DHT's these names can be signed and the address is then quite hard to spoof (ala ToR hidden services), but i doubt that even 5% of Windows power users know about it, and probably less than 5% of those who do use it.
- frik 12y ago
  > anyone remembers when MSFT tried to make global AD federation over the internet with Andromeda or w/e it was called? Microsoft Marvel, the Cairo directory service - see Bill Gates (former internal) 1994 memo: "Windows: The Next Killer Application on the Internet": http://www.microsoft.com/about/companyinformation/timeline/timeline/docs/di_killerapp_InternetMemo.rtf http://www.microsoft.com/about/companyinformation/timeline/t... "The existing Domain Name System is becomes quickly eclipsed by the Cairo directory service; providing universal resource location services without the need for specialized, arcane applications like archie. Users of the SMTP mail infrastructure take advantage of the advanced features of EMS while remaining backward compatible with their current Internet messaging solutions. Distributed information on the Internet is indexed by Cario and browsed using the Explorer across thousands of information servers worldwide without the need of tools like WAIS and Mosaic. Windows becomes the global infostructure explorer. The hottest content server on the Internet? Microsoft Marvel. It’s already integrated with all of these services and has a huge content base and commercial vendor support. Perhaps most importantly, Marvel solves the difficult electronic commerce problem well ahead of the Internet: the ability to securely purchase goods in a networked environment. Cairo becomes the clear platform choice for new information providers, offering the most flexibility in both management and technology. OLE Windows applications are now Internet-enabled - people schedule meetings across the Internet and share ideas using Microsoft application products on Windows. No more specialized tools, no more need for Unix to carry the infostructure. Access to the Internet is a natural extension of the base Windows system as well as Microsoft applications."

dogma1138 12y ago

Wasn't saying it's a bad thing, but the enterprise market, especially in finance is bloated with various ActiveX components because it was the flavor of the week (turned into the falvor of the decade) when companies had to transform legacy thick client applications to web applications, the sad part is that by the time everything was in place ActiveX was already legacy :) Heck I've had to review ActiveX builds are recent as last year which were "brand new". I personally loath ActiveX, i hate pretty much any tech that require me to load a 3rd party app inside my browsers whether it's the pesky JRE which you can never update because the 1 site you need it for won't support anything past JRE 7.1, or that ancient ActiveX which you need to open in IE10 in IE7 compatibility mode with virtually every security measure disabled. I'm just saying this move might hurt quite a bit of people, but MSFT seems to be moving away from their usual desktop software modus operandai and moving towards becoming more and more of a services providers/SAAS company. It doesn't mean that if they decide to take out ActiveX it won't hurt allot of people, and even MSFT in the short time, luckily they still will have some sort of backwards compatibility support and i hope it will be available to normal consumers on demand also. Since sorry but once in a while i need to use an ActiveX too, whether it's some old WebEx or Citrix installation or some really outdated SSL VPN and i don't want to keep some Windows XP/7 VM on hand all the time to do it. I know it's not what the cool kids do, but sadly for people that tend to work with big and sometimes anachronistic enterprises it's a reality.

atonse 12y ago
> I know it's not what the cool kids do, but sadly for people that tend to work with big and sometimes anachronistic enterprises it's a reality. Right, and nothing will change for those people, because IE will continue to exist for many years. Knowing MS, they'll probably provide patches for it for another 5 years. By then, if people haven't moved on, then some IT folks need to be fired - you've had 15 years to think about upgrading out of ActiveX, really no excuses left.
deleted 12y ago
[deleted]