Is it ActiveX that is the problem?

re: Is it ActiveX that is the problem?

Jo — Sat, 29 Aug 2009 11:32:57 GMT

How many ActiveX controls are by default enabled in IE and how man plug-ins are by default enabled in Firefox?

re: Is it ActiveX that is the problem?

Terry Walker — Tue, 25 Aug 2009 12:20:53 GMT

Wow, I never knew that Is it ActiveX that is the problem?. That's pretty interesting...

re: Is it ActiveX that is the problem?

Harry Johnston, MVP — Mon, 10 Aug 2009 22:42:39 GMT

I don't agree with Nathan's comments, but I have to say I've been recommending against using IE for general-purpose web browsing for years now, mostly because of the large number of ActiveX vulnerabilities. The IT group I work in also recommends that our staff use Firefox instead of IE.

As I see it, the problem with ActiveX is that, for whatever reason, it is too easy to accidentally create a browser plug-in that you never intended to. Many of the vulnerabilities discovered are in controls that weren't meant for use in IE in the first place. At least with Firefox, if you're writing a browser plug-in or extension you know that you're doing it!

Since we're still running Windows XP, by the way, we don't benefit from Low Rights. I'm not entirely convinced that is an adequate protection in any case, mind you, since it is not intended to provide a security boundary.

Granted, IE has improved since the early days, and I may reconsider my position in due course ... but not so long as we're still getting a new killbit once a month or more on average. :-)

re: Is it ActiveX that is the problem?

Dvader — Mon, 10 Aug 2009 10:14:50 GMT

Correct me if I am wrong but Chrome on Vista is running in low integrity mode. So what's the difference with IE?

re: Is it ActiveX that is the problem?

wampir — Mon, 10 Aug 2009 06:13:07 GMT

As far as I know there is some kind of sandbox in Chrome.

blog.chromium.org/.../new-approach-to-browser-security-google.html

dev.chromium.org/.../sandbox