full-disclosure - RIP: ActiveX controls in Internet Explorer?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <004301c36e4a$6787e3a0$550ffea9@rms>
From: rms at computerbytesman.com (Richard M. Smith)
Subject: RIP: ActiveX controls in Internet Explorer?

Hi,

As everyone knows, ActiveX controls and the <OBJECT> tag has been a big
source of security holes in Internet Explorer.  However, it looks like
support for ActiveX controls is going to be removed from Internet
Explorer.  A small company called Eolas recently won a $521 million
judgment against Microsoft for patent infringement.  The Eolas patent
covers plugins in Web pages to show multimedia content.  

The $521 million payment covers past infringement.  Because Bill Gates
loathes to pay per-copy royalties, it looks like Microsoft is going to
either partially or completely remove support for ActiveX controls in
Internet Explorer rather than pay Eolas any more money.  

This Internetnews.com article talks about the fallout from the Eolas
victory:

   http://www.internetnews.com/dev-news/article.php/3070591

Here's the Eolas patent:

http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PALL
&p=1&u=/netahtml/srchnum.htm&r=1&f=G&l=50&s1=5,838,906.WKU.&OS=PN/5,838,
906&RS=PN/5,838,906

(This URL will probably requiring copying and pasting into your browser
since it wraps to 2 or 3 lines.)

The W3C has set up a discussion list to talk about replacements for
ActiveX in Internet Explorer:

   http://www.w3.org/2003/08/patent

I hope that security people also join this list.  This redesign of the
Internet Explorer browser looks like the perfect time to put pressure on
Microsoft to put in place a proper security system for browser add-ins. 

Thanks,
Richard M. Smith
http://www.ComputerBytesMan.com