Microsoft's Urgent Patch Precedes Black Hat Session 232
Julie188 writes "Mystery solved! Microsoft's latest emergency out-of-band patch was weird beyond belief. A notice was sent to journalists and researchers late Friday evening that the patch was coming Tuesday, but Microsoft refused to explain the flaw and even put a cone of silence around researchers who would have otherwise talked about it. But finally, one researcher broke ranks and explained that the patch was caused by a flaw introduced in Microsoft's own development tools. This flaw was also the source of the emergency ActiveX patch, which took about 18 months to complete and which supposedly fixed the problem by turning off ActiveX (setting a 'killbit' on the control). Researchers at Black Hat on Wednesday will be demonstrating how to override the killbit controls and get access to vulnerabilities supposedly stopped with a killbit. What's really scary is that Microsoft has issued 175 killbits fixes so far."
Imagine. (Score:5, Interesting)
Re: (Score:2)
Its not?
It has a cool name...I've been tricked!
Re: (Score:3, Informative)
I would upgrade to a Macintosh and abandon the Microsoft/ActiveX/Exploder trojanware completely, but Mac has its own undesirable flaws. Namely - A $100 fee every year to upgrade from 10.4, to 10.5, to 10.6, and so on.
i.e. Macs are expensive to maintain. In contrast I bought a Mickeysoft XP PC in 2002 and haven't spent a dime since then for OS updates. i.e. Cheap.
(And Linux won't install my Netscape ISP's Web Accelerator software - so that's not an option either.)
Re:Imagine. (Score:5, Insightful)
So you're contrasting OS upgrade fees for OS X... versus not upgrading Windows.
Guess what? There are upgrade fees to go from XP to Vista to 7, too.
Re: (Score:3, Informative)
Except Windows apps from today still run on a 10-year old Windows 2000 machine, for the most part.
Mac apps are, like their makers, excessively trendy so whenever a new OS X build is released, the great majority of developers "embrace" the new features and it seems very few are committed to backward compatibility. This much is true of both big-name vendors and homebrew/shareware authors ("Free" isn't so big yet in that sphere).
Re: (Score:3, Insightful)
>>>Except Windows apps from today still run on a 10-year old Windows 2000 machine, for the most part.
Precisely. With Windows you don't have to upgrade because it has a relatively long support cycle, and as you pointed-out you can continue using Win2000 (or even Win98) without problem. In contrast my Mac 10.4 which is not that old, refuses to run anything because virtually all the software requires 10.5 or higher.
And thus we're back to my point - "A $100 fee every year to upgrade from 10.4, to 10.
Re: (Score:2)
Re: (Score:2)
It's the other way around.
The OS is backward compatible with older programs.
The program is forward compatible with features in the upcoming version of the OS.
Comment removed (Score:5, Insightful)
Re:Imagine. (Score:4, Interesting)
Not to mention the required hardware upgrades... (Score:2)
Re: (Score:2)
Yeah. I'm pissed off because my 4-or-so-year-old dual 2.7Ghz G5 tower is becoming less and less viable - even though it's still a fast, powerful machine, even by today's standards.
Re: (Score:2)
I've not found the upgrades to be necessary for compatibility reasons, though we did upgrade one of our older macs (a G5) to get the benefit of the performance boost. It had been running with the OS it came with for...I'm going to say about 4 years. I'm not sure why you feel that you'd be obligated to purchase upgrades, care to offer some insight?
Certainly if you feel that a point change in the OS X world is equivalent to a service pack, I can see how you might be put out by having to pay for one. But I th
Re: (Score:2)
Re: (Score:2)
But you need Leopard to use it... So $130 for those who had the nerve to not upgrade.
Re: (Score:2, Insightful)
I would upgrade to a Macintosh and abandon the Microsoft/ActiveX/Exploder trojanware completely
Yeah, like if mac was better at security fixes [tuaw.com]...
Re:Imagine. (Score:5, Informative)
Namely - A $100 fee every year to upgrade from 10.4, to 10.5, to 10.6, and so on
I don't like to contradict your wonderful hyperbole with mere facts, but the upgrade from 10.5 to 10.6 is going to cost $29 [apple.com], and comes two years after the release of 10.5, making the cost $14.50 per year, not $100. The upgrade from 10.4 to 10.5 cost $129 I believe (although it was $20 if you had bought 10.4 after 10.5 was announced) and was release 2.5 years after 10.4, making the cost per year $51.6. If you bought both of these upgrades, you will have spent $35.11 per year on upgrades.
Re:Imagine. (Score:4, Insightful)
If you bought both of these upgrades, you will have spent $35.11 per year on upgrades.
Which is close to the cost of an anti-virus subscription.
Re: (Score:2, Interesting)
Re: (Score:2)
Service Packs are collections of hotfixes with some new features added. New revisions of OS X include entire application suite upgrades, in addition to hundreds of new features at each rev.
Re: (Score:2)
Re: (Score:2)
If $100/year to not have to deal with Windows' virus/trojan/takeover bullshit is a lot for you then you might want to consider finding a job that pays more than minimum wage.
Re: (Score:3, Interesting)
i.e. Macs are expensive to maintain. In contrast I bought a Mickeysoft XP PC in 2002 and haven't spent a dime since then for OS updates. i.e. Cheap.
And I bought a Mac with 10.4 and haven't spend a dime since then for OS updates. i.e. Cheap.
And, just for those who are complaining about software - all my software works, still, on that version of the OS. Everything I have wanted to get has happened to work on that version of the OS.
Maybe it's because I'm boring, and don't want or need all new shiney software every ten seconds, but there it is - I have had no reason to upgrade.
So much for anecdotes, you have one, so do I.
Re: (Score:3, Funny)
> a dime since then for OS updates. i.e. Cheap.
Alright, I am now officially tired of this "whose upgrades are cheaper" argument between the Mac and Windows folks, so listen up:
I got a CheapBytes Debian CD in 1998, and updates are always free. That makes my total cost something like six bucks, including shipping, in eleven and a half years, which averages out to fifty-some cents per year.
So everyone who spends more than a dollar a year on software can just S
Re: (Score:2)
Linux has traffic shaping software that is far superior to your ISP's "Web Accelerator" software. I would be willing to bet that Mac has the same features.
Web accelerators are for dialup connections, primarily. You only get ~48k on that connection, no matter what. The pages can't be fed to you any faster than 56k, period, and quality and length of wire between you and the ISP will decrease that. Wondershaper or Firestarter can ensure that QOS rules are followed, and that interactive web apps (such as yo
Re: (Score:2, Interesting)
No, Netscape's Web Accelerator connects to a compressing proxy server for their dialup service. It recompresses images to lower quality and makes all pages gzipped. That's it. I'm not even sure it does any caching.
I'm fairly confused as to how this doesn't work on Linux, as it's a browser proxy, but don't care enough to actually look into it.
Which means all this talk about switching OSes is nonsense. He's someone using a $6.99 a month dialup internet connection, he can't afford a new computer!
Of course,
Re: (Score:2)
Durrrr.
Wrong.
Typically they also compress images, have a local (at the ISP) cache of popular sites, and if you're lucky, block some "content" (lol ads) from loading.
It's the commonality. (Score:5, Informative)
The thing about Active X is that is just a way to put an object oriented wrapper around a DLL. So really, its just a DLL.
The problem with DLLs is that they are good for process re-use on a desktop but not the kind of thing you want to be shoving into a browser. However, if Microsoft closed off Active X entirely in browsers, they would break Flash and third party OpenGL and movie plugins... and probably would wind up getting ripped for it.
The thing to keep in mind is that Firefox and other browsers that allow for DLLs to be loaded as plugins are going to have these problems as well. It's just that, there are less firefox plugins than there are activex controls out there, so the universe of the problem is smaller.
Re: (Score:3, Insightful)
Re:It's the commonality. (Score:5, Insightful)
Strictly speaking, the GP is right. The reason that ActiveX is more vulnerable than Firefox is there are a lot more ActiveX controls than Firefox plugins. (Not to be confused with Firefox Addons, which seem to be fairly secure, and are pieces of javascript. Firefox plugins are things like the PDF viewer that Acrobat installs, etc.)
However, the reason there are a lot more ActiveX controls is a, tada, bad design. It's because ActiveX fundamentally lets you embed all sorts of stuff that came with the operating system and random applications and were not designed to be controlled by a web page. Stuff around from before web browsers!
So Microsoft has to kill each of these, one at a time. That's what the '175 killbits' is talking about....something like 125 of those were on things that it should not have been possible to load in a web browser anyway, but Microsoft decided it would be great fun if you could load all those fancy new signed-DLLs-under-another-name in a web browser. And companies that had been putting out ActiveX controls and had never had to worry about security before, because they were selling a PDF rendering control to software developers to embed in their app, suddenly found out how insecure they were.
Aka, is your car secure, right now? Yes? Alright, let's transport these dangerous criminals in it. What do you mean, it's not secure from that direction?
And this isn't helped by the fact that ActiveX controls are so easy to install. I'm not talking about malicious ones, those are easy also, but legitimate good ActiveX controls, which are signed by a legit company and everything.
And they work for two years, and web design moves on...and eventually a hole is discovered in them...and crackers download that version, put it up on their web site, and wait for people to click Yes to install this clearly legit control, signed by Macromedia or whatever, so they can buffer overflow it.
Oh, look. Have to issue a killbit for that also.
The large proliferation of ActiveX controls vs. the small proliferation of Netscapian plugins is why ActiveX is so vulnerable, but the first is entirely due to a rather stupid design decision at the start of IE that let web page designers use random ActiveX controls (Which everyone forgets were not invented for web browsers, but existed before as DLLs with well defined embedding mechanisms.) in a web browser
Comment removed (Score:5, Funny)
Re: (Score:2)
The thing to keep in mind is that Firefox and other browsers that allow for DLLs to be loaded as plugins are going to have these problems as well. It's just that, there are less firefox plugins than there are activex controls out there, so the universe of the problem is smaller.
Well, part of the problem is that ActiveX isn't just used for browser plugins, so there are a huge number of ActiveX controls out there that can be loaded into a browser but really weren't meant for this purpose. Unless the control is marked "safe for scripting", Javascript can't interact with it directly, but it's still loaded.
Re:It's the commonality. (Score:5, Informative)
There is truth in your argument that third party additions to a browser pose a security problem, but you are comparing coffee and fish.
Plugins pose a security risk because you are running software from unknown sources as part of your browser. However, you don't need to install the plugins in order to enjoy the browser functionality.
Active X on the other hand was always intended to be integrate with web pages, which means that in many cases you would not even have been able to view the content without downloading a COM object of dubious origin. Fortunately this has largely failed, and most web content is still accessible without it (though there are a number of commercial services on the other hand that require Active X to work).
The better comparison with Active X is other dynamic web code, such as scripting languages like javascript, and of course Java, which have been used for similar purposes. There are clear differences, because Active X is running native code, and so is notoriously difficult to sandbox effectively. It is obviously a matter of degree; no system is fully secure. But whereas exploits of Active X tend to often be total (access to the host machine), exploits of systems such as javascript often revolve around more subtle issues such as masquerading.
I actually think there is merit in having internet distributable native code. But having said that, there are multiple issues. I don't think the solution is merely to improve the containment of the downloaded code (indeed, that only makes it harder for the plugin to do anything useful). The problem is one of trust: how do I know if the binary code is trustworthy (Microsoft rubberstamp certification just doesn't do it for me!); and why do most sites need Active X at all (shouldn't we just be trying to agree on some browser standards like video formats so that typical functionality can be built into the browser!).
Re: (Score:2)
you are comparing coffee and fish
- gag reflex -
Re: (Score:3, Informative)
he thing to keep in mind is that Firefox and other browsers that allow for DLLs to be loaded as plugins are going to have these problems as well
People tend to like to forget about that. ActiveX is no more or less unsafe than FF plugins [mozilla.org]. Executable code running on the client machine, non-sandboxed. Both FF and IE will prompt you before installing such things, and that's the extent of the protection you get from them. Both can be very easily abused by a malicious creator - all you have to do is get people to install it (bunnies!); or install it yourself as part of another application.
NSAPI is a DLL interface (Score:2)
Plugins are DLLs... NSAPI I though was for servers side DLLs, like ISAPI is sort of a clone of... in any case, here's the mozilla doc for the plug in run time model.
https://developer.mozilla.org/en/Gecko_Plugin_API_Reference/Plug-in_Basics#Understanding_the_Runtime_Model [mozilla.org]
Note that a plug in is a DLL that uses the same thread as the browser... just like Active X.
Re: (Score:2)
Confusing summary. Will Wednesday's demo show how to exploit ActiveX even after the patch is applied or not?
Re: (Score:3, Insightful)
Somehow people think it's normal to embed in webpages stuff that is executable code for a particular operating system and processor architecture. WTF?!?
This is soooo fucking stupid I almost can't believe it. I've tried for years to convince people of that but they look at me as if I'm an alien.
It was a tremendous lock-in strategy for Micro$oft, though. They're still cashing in on it. Fortunately, the tide is changing, but it will take a long, long time until this ActiveX shit is gone.
Re: (Score:2, Informative)
An ActiveX Control is a Plugin for your browser. The browser is also bound to an particular operating system and processor architecture!
Re: (Score:2)
Well, nobody said it was a good gift. :-P
sensationalist much? (Score:5, Insightful)
damned if they do damned if they dont?
Re: (Score:2)
Re: (Score:2)
Patching a security hole ASAP is a good thing. But it's still unusual behavior from Microsoft. One would expect them to wait 2 weeks for the normal Patch Tuesday.
Re: (Score:3, Insightful)
Patching a security hole ASAP is a good thing. But it's still unusual behavior from Microsoft. One would expect them to wait 2 weeks for the normal Patch Tuesday.
You mean you would expect them to wait 18 months and two weeks? That's absolutely ridiculous! The only reason to release now is that it's being exploited in the wild. Do you really think they would have fixed it on patch Tuesday if they hadn't done so in 18 months?
Re: (Score:2)
You mean you would expect them to wait 18 months and two weeks? That's absolutely ridiculous! The only reason to release now is that it's being exploited in the wild. Do you really think they would have fixed it on patch Tuesday if they hadn't done so in 18 months?
Nope, what's your point? I made it very clear. I'm only referring to the isolated action of patching something asap. I'm not defending nor attacking MSs methods. Please read the posts more thoroughly when you reply to them.
Re: (Score:2)
Please read the posts more thoroughly when you reply to them.
Now that was embarassingly ironic. I apologise sincerely.
Re:sensationalist much? (Score:4, Informative)
I thought the weridness came from using a "killbit" solution. Any spybot programmer will easily be able to override that.
Re: (Score:2)
How, pray tell?
Re:sensationalist much? (Score:4, Funny)
Sure, it's easy to disable killbits if you have the ability to run code on a windows system. But if you've already reached the point of running arbitrary code on a windows system, why would you go through the trouble of disabling a kill bit and then hope that the ActiveX control gets exploited so that you can... run code on a windows system? Think about it.
Re: (Score:2)
It's not an issue exactly, but I can't off the top of my head recall a time that MS has released an out of schedule patch that wasn't to fix a problem already well known and being actively exploited.
Re: (Score:2)
It's not an issue exactly, but I can't off the top of my head recall a time that MS has released an out of schedule patch that wasn't to fix a problem already well known and being actively exploited.
Me neither, but it's still a good thing. Perhaps there should be Black Hat sessions every week? ;-)
Re:sensationalist much? (Score:5, Informative)
You missed the part where they knew about the flaw 18 months ago. That's just... sad.
Re:sensationalist much? (Score:4, Insightful)
"Sad" isn't the word for it. Evil comes close, though. The fact that the flaw was introduced by their own development tools is what's sad. The people who get exploited by this flaw will be sad.
Re:sensationalist much? (Score:4, Funny)
yes activex sucks, anyone who doesn't know this already has rocks in their head, but calling a patch "weird beyond belief"? MS gets wind of security hole that might be really bad, patches it urgently.
Not only that but they patch it urgently for the 175th time. If that isn't urgent I don't know what is.
I don't know of any other OS company that's that focused on security that it patches the same kind of thing that many times : "We have to make sure, the security of our users is important to us !".
Now that's dedication !
Re: (Score:2)
Not only that but they patch it urgently for the 175th time.
MS haven't patched this vulnerability 175 times. They've issued 175 patches that have made use of the ActiveX killbit mechanism to disable various old controls, as opposed to patching the vulnerability in those controls.
Cone of Silence? (Score:5, Funny)
Microsoft refused to explain the flaw and even put a cone of silence around researchers
Those suck. My dog had to wear one of them for a week. Didn't shut him up but it sure stopped him from licking what used to be his balls.
Re: (Score:2)
i don't think it means [wikipedia.org] what you think it means [wikipedia.org].
Re: (Score:2)
Oh the poor dog then... apparently he can only lick what "used to be his balls"...
It took 18 months... (Score:2, Funny)
Re: (Score:2)
To make a patch that simply turned off ActiveX? I better be misreading this...
Not only that, but it forced a reboot. Why do you need a reboot to turn off a service?
In other news, why was my machine set to install automatically... and reboot automatically... Gah! What a stupid setting!
Re: (Score:2)
To make a patch that simply turned off ActiveX? I better be misreading this...
Not only that, but it forced a reboot. Why do you need a reboot to turn off a service?
Welcome to the best feature of Windows 7: turning off/on processes on demand, including IE!
Re: (Score:2)
Not only that, but it forced a reboot.
Woke up this am to find my token Winders box had rebooted overnight. Luckily I only use it as a weather station. I would have been pissed to wake up and find a work environment automatically rebooted. I save my work but sometimes I'll be in the middle of a project and it takes a lot of time to restore the workspace.
ActiveX is from the devil.
Re: (Score:2)
Re: (Score:3, Insightful)
I'd suspect the vulnerability and solution was such a cluster frak, that it took that long to work it out without royally fraking everything else up.
Re: (Score:3, Informative)
The ActiveX killbits weren't the only thing updated. Microsoft also updated Visual Studio 2003 SP1, 2005 SP1, 2008, and 2008 SP1; along with their respective runtimes.
Re: (Score:2, Insightful)
Re: (Score:2)
I'm calling Windows 7 - "Windows Vista 6.1" or "Windows NT 6.1". The truth must be told.
Actually:
Vista/NT 6.0 ain't that bad if you upgrade your RAM to 16 gigabytes. Then it runs just as well as my XP PC with only 1/4 gig.
Re: (Score:2)
PHYSICAL processors.
You can have 16 cores show up in task manager (and be used) in XP if you get a dual socket system (2) with two quad core (4) core i7s running HT (2).
2*4*2 = 16.
Re: (Score:2)
It's almost as if MS wasn't taking security seriously and was instead wasting time on search engines, game consoles, media players, picking retail store locations and repackaging Vista as Win 7
Yes, because Microsoft is actually just ONE extremely busy person! Either that, or you believe the guy who publishes Xbox Live games is the same guy who patches security holes in Windows and Visual Studio.
I mean, I agree with your point, it did take too long. But your complaint here is simply retarded. Microsoft has 7
Standard Operating Procedure (Score:5, Insightful)
1. Be told of critical flaw by multiple, repeatable accounts and deny everything as a "paranoid fantasy"
2. Secretly prepare emergency patch and bury it in driver update patches
3. ???
4. PROFIT!!!
Re: (Score:3, Insightful)
I believe step 3 here is
3. Maintain that Windows is more secure then other operating systems because bugs are fixed really quick.
Re: (Score:3, Funny)
*Haxx0r ur world con 2009*
Today I will demonstrate on this stage a vulnerability that MS have known about for a year! I will show off an attack that will give me control of any system!
*opens IE and visits the site with his exploit*
*nothing happens*
*becomes aware of the sound of crickets and 2000 people in the audience*
Re: (Score:2)
Basically the pain has been transferred from Microsoft and consumers onto the developers of those products; they are the ones who have to tr
Killbits, Killbill ... (Score:2, Funny)
You DO NOT have to reboot if you install manually (Score:4, Informative)
WindowsXP-KB972260-x86-ENU.exe
That is the one for XP with IE6, the filenames are different for the other flavors. The list of all of the different patches is at:
http://www.microsoft.com/technet/security/bulletin/ms09-034.mspx/ [microsoft.com]
Re: (Score:2)
Re: (Score:2)
I just installed using the automatic updates thing (prompt before install) and I was not asked to reboot.
How many kb is that? (Score:3, Funny)
Microsoft has issued 175 killbits fixes so far.
So, how many kilobytes of killbits is that?
Re:The real mystery (Score:5, Interesting)
I also didn't like how ActiveX morphed from a special browser-only technology into a synonym for COM and then into a replacement for OLE. At least now we've got .NET which promises to rid us of C++ once and for all.
ActiveX was designed to replace the overly complex COM way of building components. It was added to the browser later to provide a richer browser experience. I'm not sure I see C++ going anywhere, and you can build ActiveX components using C#.
Whoever thought making C/C++ an implementation language for anything as complicated as an OS ought to be shot. The number of possible vulnerabilities is through the roof, as this latest patch shows.
C was used because it was more productive then assembler, but still performed very well. Of course being so close to the metal means that its easier for programmers to screw up... but I'm not sure C# will be used to build the base of an OS anytime soon. You'd almost have to make the CLR the OS... which while an interesting idea not one I think we'd see soon.
Re: (Score:2)
Whoever thought making C/C++ an implementation language for anything as complicated as an OS ought to be shot. The number of possible vulnerabilities is through the roof, as this latest patch shows.
C was used because it was more productive then assembler, but still performed very well. Of course being so close to the metal means that its easier for programmers to screw up... but I'm not sure C# will be used to build the base of an OS anytime soon. You'd almost have to make the CLR the OS... which while an interesting idea not one I think we'd see soon.
I thought Vista was supposed to be built with .NET, only to have those plans scrapped. If MS isn't building their OS with C# and .NET, there must be a reason.
Re:The real mystery (Score:5, Informative)
I think you're confusing Vista with Singularity [microsoft.com].
Re:The real mystery (Score:4, Informative)
No, significant parts of Vista were supposed to be rewritten in C# but due to performance(or other) reasons, the plan was ditched in 2003/2004 and a normal C++ upgrade to XP was started. This was one of the big factors in the delay of Vista's release.
Re: (Score:3, Informative)
Currently there can only one version of the CLR be loaded into a process. The CLR version of the first
This is also the reason why you should not make shell extensions in
If a Programm delay loads the CLR a simple call to the Open File Dialog would cause the
Re: (Score:2, Informative)
Wasn't that the promise of Longhorn? (Score:2)
Of course being so close to the metal means that its easier for programmers to screw up... but I'm not sure C# will be used to build the base of an OS anytime soon. You'd almost have to make the CLR the OS... which while an interesting idea not one I think we'd see soon.
Wasn't Longhorn (Vista) supposed to more or less be this?
Re: (Score:2)
ActiveX was designed to replace the overly complex COM way of building components.
What? Any ActiveX control is a COM component, by definition. ActiveX is a techology to build reusable and embeddable visual components, built on COM - that's all there is to it. It's was never designed to reduce COM complexity - heck, if anything, building an ActiveX control is much more complex than building a plain COM component.
And you can build ActiveX components using C#.
Have you ever tried? I mean, yes, technically you can do that, but you cannot use either WinForms or WPF for that purpose (it might look like it's sort of working, but you'll star
Re: (Score:2)
Re:The real mystery (Score:4, Informative)
>>>Whoever thought making C/C++ an implementation language for anything as complicated as an OS ought to be shot.
In the 1980s the C language was the best option. There wasn't anything better. And since Windows/DOS and Windows/NT were developed during the 80s, we still live with the legacy. Simple as that.
Re: (Score:3, Insightful)
And we still don't have anything better.
Re:The real mystery (Score:5, Funny)
I've always been baffled by Microsoft marketing's insistence that ActiveX is pronouced "active" with the "X" silent. I've never met anyone who didn't pronounce the technology "Active-X".
Considering all the exploits it's made possible, I call it hActive-X.
Re: (Score:3, Insightful)
I do not think that the problem lies in use of C/C++, but in the horrible way of using it. From what I've gathered around the Internet "why win32 is great" is that they lacked any kind of stable way of creating their (old?) APIs; everyone just created a new standard for return values and parameter handling. And on top of that some crazy macros that make Symbian code look readable in comparison.
I mean, I've only learned how to program in C/C++ (at university) but been working as a Java dev for quite some
Re: (Score:2)
Ken Thompson & Dennis Ritchie (Unix), Andrew Tanenbaum (Minix), Richard Stallman (Hurd), Linus Torvalds (Linux) - You really think those guys ought to be shot? ;)
don't even know where to start, mouth gaping (Score:3, Interesting)
You can't be serious - nearly every OS these days is written in C (with a few bits of assembler at the core). And the one viable alternative, C++, was pretty much confined to BeOS. Do think everyone just left their thinking caps at home the day they decided which language to write in? Fair swig of the whiskey. C was pretty much invented as a means of writing systems software. And you do realize that .NET is really just ActiveX by another name, smelling just as 'sweet'...
Re: (Score:3, Informative)
I also didn't like how ActiveX morphed from a special browser-only technology into a synonym for COM and then into a replacement for OLE.
ActiveX was never a browser-only technology. It was just they referred to the embedding of COM controls in web pages as ActiveX, and eventually started renaming everything 'ActiveX'.
For people who don't know what we're talking about: COM started as a way to embed DLLs that provided specific functional in programs, essentially, 'plugins' that program builders could use
Re: (Score:2)
I pronounce it Active-ex, or when using local Slavic pronouncement "modifications", Active-eeks. In fact, the latter is quite common in my country.
Re: (Score:2)
Re: (Score:2)
So in this case the "band" is simply the normal monthly patch-tuesday update. Being outside that makes it out-of-band. Why does a band have to mean an entirely different medium of communication?
In any case, you can't fight it. I've heard this usage enough that it's part of standard techno-babble.
Re:Kill ActiveX (Score:5, Insightful)
Doesn't Windows Update (via the webpage) use ActiveX?
Re: (Score:2)
Yes, Im waiting to read about it being subverted by some malware or virus, its just a matter of time.
Re: (Score:2)
So, kill Windows Update(via the webpage). Release a native, stand alone update tool.