Microsoft ActiveX

» see microsoft.com as it lived, on the wayback machine

~ the obit ~

ActiveX shipped in March 1996 inside Internet Explorer 3.0, the same release that turned IE from a curiosity into a real browser. The pitch to developers was that COM, the component model that already ran half of Windows, could now be embedded in a web page. A control downloaded by the browser would execute as a normal Windows process, with whatever rights the user had, drawing into a frame on the page.

For corporate intranet teams this was the answer to every question. Stock tickers, sap front ends, dental record viewers, bank statement printers, anything that needed real Windows behavior shipped as an ActiveX control. For everyone else it was the most consistent malware vector in the history of personal computing. The 1990s and early 2000s drive-by-download economy was almost entirely activex.

i first met ActiveX through trumpet winsock era IE, on a 33.6k connection where the dialog asking you to install some random control was the loading screen of half the web. ttnet's bank portals all required it. the law office software my dad's accountant used required it. it was the layer of windows you could not turn off without breaking something important that month.

~ the rap sheet ~

~ the cracks ~

The security story was never repaired. Even after Microsoft added authenticode signing, kill bits, zone trust levels, and protected mode in IE 7, the basic premise was that a web page could ship a binary that ran with user rights. Every browser other than IE refused to implement the model. By the late 2000s most consumer sites had moved to flash and html, and ActiveX was already legacy enterprise territory.

Firefox never supported it. Chrome shipped in 2008 without it. By 2012 even Microsoft's own MSN.com no longer required it. The remaining install base was banking, government, internal corporate apps, and the lingering korean public-sector ecosystem that famously kept the technology alive for another decade through legal mandate.

~ what really happened ~

Microsoft Edge launched on 29 July 2015 alongside Windows 10. The new browser shipped without ActiveX, without BHO support, without any of the IE extension model. That was the moment Microsoft signaled the brand was retired at the consumer layer. Internet Explorer 11 kept shipping inside Windows for compatibility, and Edge later added IE Mode so enterprise customers could keep their old apps alive through at least 2029.

~ what got buried with it ~

ActiveX is the clearest example of what happens when a platform vendor builds the convenient thing and treats security as a property to be added later. The web ended up with a sandboxed, restricted, less-capable plugin model after watching ActiveX run for twenty years. Every modern browser permission prompt, every site-isolation boundary, every refusal to give javascript access to the filesystem traces back, at least partly, to the fact that Microsoft built the opposite first.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »