Slashdot Log In
Brian Hook on the ActiveX Experience
Posted by
Hemos
on Mon Jan 17, 2005 12:32 PM
from the poorly-made-and-maintained dept.
from the poorly-made-and-maintained dept.
Obiwan Kenobi writes "Brian Hook of id software fame got around to developing on ActiveX and found some minor grievances, particularly in the security department. To quote: "I've been doing some ActiveX coding on the side for a couple days, stuff I'm not familiar with, and I'm just flat out _appalled_ at how bad that entire API and design is. I can make an OCX that basically formats your hard drive, stick it on a Web page with a tag, and if your security settings are set low enough, you'll start formatting your hard drive the minute you visit my Web page.""
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Gee, that's news... (Score:5, Funny)
Re:Gee, that's news... (Score:3, Informative)
Re:Gee, that's news... (Score:5, Insightful)
Parent
Re:Gee, that's news... (Score:5, Informative)
Parent
Re:Gee, that's news... (Score:3, Insightful)
Same is true for a firefox extension. By installing the extension, you're saying that you know and trust the originator of the extension.
Code signing allows you to KNOW the originator of the control - they had to pay money to Verisign (or whoever) to sign their code, which rules out a lot of random malware.
Now then, it IS possible to hide the origin of the control (if the control comes from "You must agree to load this control to view your Div
Re:Gee, that's news... (Score:4, Insightful)
Does Verisign review the source code for the controls that its certificates are applied to? I think not.
About the only thing that we can "trust" is that Verisign got a check from the developers. The ability to mail a check != trustworthiness.
Parent
Re:Gee, that's news... (Score:3, Insightful)
OK, so in your search you find that the extension was signed by a company in the Bermudas or India or something. Do you really care to take it further than that?
"Of course you have to trust the CA who issued the certificate that signed the control"
There are no trustworthy CAs. They've all made mistakes, and there will be mistakes in the future. The whole CA thing, mandated through browser warnings and such, is a "false sense of security" scam.
Re:Gee, that's news... (Score:5, Insightful)
Sure. But you know the signer. And you agree to install it.
I'd rather have the Java model, where it requests specific permissions. I actually don't know the author, unless it's MS or Macromedia or someplace similar. Real security is proactive, not reactive. Besides, most software absolves itself of all responsibility, so what could you really do? Show up at their door with a baseball bat?
Parent
Re:Gee, that's news... (Score:3, Insightful)
Re:Gee, that's news... (Score:5, Interesting)
well, it is pretty obvious. although the key phrase here is "if the user's security settings are set low enough."
i mean, any operating system is vulnerable to an exploit if it's security infrastructure is sufficiently loose. if you set your entire filesystem to 777 then you're completely vulnerable on any unix-based os too.
the real questions here are:
Parent
Re:Gee, that's news... (Score:5, Interesting)
Parent
Re:Gee, that's news... (Score:5, Insightful)
Parent
Re:Gee, that's news... (Score:5, Insightful)
The problem is, there aren't many OS's out there that arbitrarily run dangerous code from a web page with no interaction from the user other than visiting the page in question, low security settings or not.
Parent
Bingo. (Score:5, Insightful)
That's it exactly.
To put it another way, if you change a single setting in a single program (IE) any web page can zap your system. To make your *nix box as insecure, you have to change the file permissions for every single file on the system.
IE is a single point of failure. That's what makes the comparison invalid. You'd have to go out of your way to screw up a *nix box that bad.
Parent
Re:Bingo. (Score:5, Insightful)
The obvious problem is that it's much more common to run Windows as "root" than it is on *nix, for various reasons. Not the least of which is the fact that *nix users usually are smart enough to use one account for administration, and other for doing "user" stuff. Also not the least of which is that many Windows apps aren't written in such a way that it's feasible to run them in non-root mode.
This isn't to say that Active-X isn't dangerous...it is. But the big difference between *nix and Windows here, is that *nix is run by somewhat security-savvy people, and Windows (often) isn't. With "user-friendly" linuxes coming out, many of which login as root by default, a lot of that protection will go away.
The average user simply isn't willing to have an "administrator" account that they have to use every time they want to install an app. That fact means that for *nix to go mainstream, a lot of security inherent in *nix philosophy will have to be lost.
Luckily, mozilla/firefox are being designed in such a way that they are much less likely to exploit lax security than IE is. This will only partially mitigate the problem, though, as people dumb enough to click on a random link and run the program can still get screwed.
-Dan
Parent
Ever heard of OS X? (Score:5, Informative)
My wife isn't terribly computer savvy (at least, she wouldn't be if she weren't married to a CompSci person), but she's perfectly content with Mac OS X asking for her password before updating system software. It's an immediate red flag that something important is about to happen, and I think she'd be extremely hesitant to type it in response to clicking on a link to a web page.
Parent
Re:Gee, that's news... (Score:5, Insightful)
Really? So, if I chmod 777 my, uh,
Are you sure?
See, to do this, you have to get a script or something to run on my system to delete these locations. Show me where even lowly jscript allows for this...
Now, I'm no jscript guru, so I did a google search for jscript delete files [netreach.net] and, on at least the first page or two, only came up with stuff having to do with the ".NET framework" or involving ActiveX!
And the point isn't that files can be deleted, the point is that the API for ActiveX allows somebody to do this remotely.
Parent
Grammar check, please! (Score:5, Funny)
It's lose, darnit, lose lose LOSE !
Wait a minute, you actually meant to say "loose", didn't you?
Between using "lose/loose" correctly and not writing "This begs the questions:", I'm prompted to ask: what are you doing on Slashdot? We don't take decent grammar lightly around here, bucko.
Parent
Other Big News Items: (Score:5, Funny)
- Apple has released new products!
- DVD CSS encryption has been broken!
- RIAA threatened by P2P networks!
- Darth Vader is Lukes Father!
- BSD is dying!
Its good to keep up to date on all the latest news.
Parent
Re:Other Big News Items: (Score:3, Funny)
Thanks for ruining the movie for me.
Do it (Score:5, Funny)
Please. DO IT NOW. Thanks.
Re:Do it (Score:5, Funny)
Parent
Re:Do it (Score:4, Funny)
Parent
Re:Do it (Score:3, Funny)
It's doable.
Back in the Windows 95 days when I was fifteen, Best Buy's computer sales department pissed me off so badly at a particular store that I added the format statement to the autoexec.bat files on their demo computers as I browsed around. They installed security software in that particular store after that.
At some point Microsoft modified format.exe (or was it format.com?) to make it clear the buffer before prompting for yes/no.
So... (Score:5, Funny)
Easy Formatting (Score:5, Funny)
You know... (Score:3, Funny)
Re:You know... (Score:5, Funny)
Parent
First Post (Score:4, Funny)
Formatting C: 5% Complete
Wouldn't it be more useful... (Score:4, Interesting)
Anyone surprised? (Score:3, Interesting)
ActiveX is an aweful problem, I guess the only reason IE users are as safe as they are is the level of integrity in many website (better than we have thought in the past maybe...)
Btw, thanks for the FP editors
Oh, no! (Score:5, Funny)
I hope virus writers won't find out about this!
More Ammo (Score:5, Interesting)
Re:More Ammo (Score:5, Funny)
Parent
Crazyness (Score:4, Interesting)
I shutter at the thought of running any code that I (or at least someone else) has not inspected. Just another reason to use Firefox [firefox.com] and other opensource [gnu.org] software.
Hey, I bet he could make money (Score:5, Funny)
Re:Hey, I bet he could make money (Score:5, Funny)
Parent
Vapor design (Score:5, Insightful)
1. Examine more or less how competition works
2. Quick! Make a prototype and flat-out obvious bugs
(Missing step: redesign well taking into account security considerations)
3. Overhype
4. Profit!
So now we're stuck with an obsolete plugin model, which Microsoft neglects to fix because this would break backwards compatibility.
THE END.
Nothing new. (Score:4, Insightful)
I'm dumbfounded by this.
And editors, you're not helping any by posting stories like this. It's all too obvious that this article was posted because it fits the anti-MS slant quite well. That's all fine and good, but this article brings absolutely NOTHING to the table except another excuse to bash MS and an OLD MS technology.
Re:Nothing new. (Score:5, Interesting)
Parent
Re:Nothing new. (Score:5, Insightful)
In practice, I find this article very interesting for what it is: the findings of someone who is a recognised programmer into a field he has no knowledge about; and that prove that all the ghastly rumours about ActiveX are true, not hype. Now whether it should be on /. is another question.
Parent
Security was never needed (Score:4, Informative)
The move to a strong security model just started to really happen by the year 2000 when common people started getting high-speed internet access at less cost then the companies are paying for their T1 lines. Then they started clamoring to make everything secure but because they laid off the bulk of their IT employees they became under manned to fight security. So it is now a long slow process of building up IT security.
Site visit results in disk reformat. Sad thing is: (Score:4, Insightful)
Like the man said about tsunami alerts in the United States: "There's still a large segment of the population that would go get their kids out of school so they could drive to the beach and watch the big waves..."
Re:Site visit results in disk reformat. Sad thing (Score:5, Funny)
Those who still do not believe in natural selection raise their hands. No-one? Didn't think so.
Parent
Too Bad Rest of World Doesn't Understand (Score:3, Interesting)
Not that any OS that doesn't use ActiveX is perfect...nothing is. But allowing the OS to be commanded through something as commonplace as a Web page or email is just ASKING for it.
"No networked computers on my ship," says Adama in the new Galactica series. That point saves their asses from the other ships of the fleet, whose computers were rooted by the Cylons and quickly destroyed because of over-integration.
Sure, it's fiction. But fiction has a grain of fact in it to make it real.
But, but ,but ... (Score:4, Funny)
He'd never lie to us, would he?
Re:ActiveX Experience (Score:4, Funny)
Parent
Re:Ah blah.... (Score:3, Informative)
Like a webpage that formats your hard drive!
Re:Yeah, well... (Score:5, Interesting)
Microsoft makes it pretty clear that arbitrary code can be ran from a web page in the security dialog.
What is lacking is sandboxing. Here is a typical example. I go to a site to use a service. It has an active X control. I need to use the control, but don't fully trust them. My options are A) find another service, or B) run it and hope for the best. That is unacceptable. There needs to be an option C) run it in a sandbox, and don't let it read my files, or overwrite anything. I mean this is not brain surgery here. Java can do it, and Sun does not have the OS code.
Parent
PS... (Score:4, Funny)
You seem to have misspelled "horribly horribly worse" as "better" there. Hope that helps. Have a nice day.
Parent