[Previous] [Next] [Index]
[Thread]
Re: ActiveX security hole reported.
I appreciate the points that Stephen Cobb raised.
What I was alluding to was that untrusted ActiveX software will never
be secure enough for some, but that it has more appropriate applications.
HTTP, HTML, Java and ActiveX program ever more powerful virtual machines.
As long as the browsers allow the information consumers to draw the line
somewhere, are shipped in a secure state, and the vendors don't stack
their home pages with temptations to change that state, then I have no
problem with any of the above technologies.
Unlike gunpowder technology, these WWW technologies can require the
recipient to agree to be damaged. This seems to make them secure enough.
The hole in this, as Stephen has implied, is that the compliant recipient
may be an individual, while the damage is done to a corporation.
This should be avoidable using corporate proxy-servers and filtering
routers.
One improvement I would like to see in browsers is the capability of
enabling cookie/Java/JavaScript/ActiveX features by domain names.
- G.
References: