Re: It's COBOL, Jim, but not as we know it...

On Thu, 11 Dec 2008 13:05:53 +1300, "Pete Dashwood"
<dashwood@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:

Howard Brazee wrote:
On Wed, 10 Dec 2008 10:55:51 +1300, "Pete Dashwood"
<dashwood@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:

The model is evolving. It is no more "wrong" than any other model
would have been. Investment of many millions has been made into
improving it. Judging today's model by what was true yesterday, is
simply misleading.

But customers do this all the time (check out why people choose their
new automobiles). So if we want them to use our web application, we
have a choice - either force them to change, be willing to lose them
as customers, or make our application work with more universally
accepted technologies than just Active-X.

Or educate and encourage them to think about the real implications of
computer security and not just decide that somethng is "blanket bad" because
some journalist said it was.

There is a difference between forcing people to chage and persuading them
to. Willing to lose them as customers? Having been customer and service
focused all my life, this is harder, but if I have to redevelop something
that may have taken years of thought and effort to build, because some peole
don't like the technology I used, and can't be persuaded by facts and demos,
then I'd reluctantly have to write them off. As for using different
technologies, technology is a rapidly evolving thing. The main alternative
to ActiveX would be Java Beans which are fine and I DO use them sometimes.
In a MicroSoft environment ActiveX/COM is the preferred technology for this
kind of application, so that is what I use.

By developing for only Microsoft/Active X you are automatically
eliminating those who use Mac, Linux or means of access that have even
less of a market share. Also if the customer is the person at home,
most haven't the training, the mindset or the system knowledge to do a
good security model. As someone who did systems programming and
applications technical support for over 20 years, I don't feel that I
know enough to do a good job. I do keep up with some newsgroups but I
am well aware of my lack of knowledge. Now is it reasonable to expect
someone who gets a computer to do various tasks and who may be really
skilled at using Photoshop for editing and managing their photographs
to also be a systems programmer / administrator and be informed on
security? I use Zone Alarm Internet Security Suite, Noscript with
Firefox and Secunia PSI to check for obsolete code vulnerabilities. My
wife really doesn't want to have to put up with a lot of prompts that
aren't completely clear in her uses of the computer. How do we make a
general use tool safe when there are malicious people out there, both
vandals and thieves?

ActiveX/COM is a very powerful, useful, proven, and safe technology. So is
dynamite if you use it for quarrying and mining (where people understand how
to deal with it.)

Michael W put his finger right on it in his latest post. People need to
think about their own personal security model, and the level of "threat" or
risk they can tolerate. In order to make those decisions they should be
informed, and understand what is going on. It isn't really about technology,
it is about personal decisions, which should be based on informed
choice.Otherwise a knee jerk reaction to "not allow anything" simply denies
them a lot of useful functionality.

My contention is that on a modern system, properly administered, (I'm not
talking about pre-NT), there is no more risk attached to this particular
component technology than there is attached to any other scripting.

Millions of people who use it every day implicitly agree with me; millions
of people who only know what they saw a while back in computer press, or
have a raging distrust of anything MicroSoft, do not.

There is little point in companies improving security if no-one gives them
any credit for doing so and continues to believe what was true before they
made the improvements.

As I cannot personally do anything about what people believe, other than
spell out my case, I don't worry about it. But I wont stop using a
technology because of the ignorance of some potential clients.(I will take
every opportunity they allow me to show that what I am proposing is safe...)

I haven't checked the cobdata logins database so I don't know whether you
have downloaded and tried the component, Howard.

If you did, you would know that it is perfectly safe and your computer has
not been damaged or hindered in any way by this particular example of
ActiveX technology. A blanket conclusion that all ActiveX is bad, is
therefore not a tenable position.

Pete.
.

Relevant Pages

  • Re: Embedding Simple MFC GUI app into website
    ... particular technology is "evil" goes beyond common sense and increases ... his denouncement of ActiveX and Java (and Flash, ... ActiveX, in particular, is an antipattern for security. ... Since you must obtain a certificate for code signing from the trusted ...
    (microsoft.public.vc.mfc)
  • Re: Embedding Simple MFC GUI app into website
    ... particular technology is "evil" goes beyond common sense and increases the ... permission or control. ... I suggest that you try to download an ActiveX control from the Microsoft web ... I have said for years the problems with OS security is that we are doing ...
    (microsoft.public.vc.mfc)
  • Re: They will protect me (wont they?)
    ... is an important aspect of their business because their customers don't ... from a security technology vendor "We don't perform regular penetration ... service why would it be the vendors obligation. ... We encountered them during a penetration test that we were doing for a bank that was using their technology. ...
    (Pen-Test)
  • Re: Its COBOL, Jim, but not as we know it...
    ... But customers do this all the time (check out why people choose their ... technology is a rapidly evolving thing. ... to ActiveX would be Java Beans which are fine and I DO use them sometimes. ... There is little point in companies improving security if no-one gives them ...
    (comp.lang.cobol)
  • Re: what is ActiveX?
    ... Internet security zone set to prompt or deny before an activex control ... anonymous activex technology is an abomination. ... Microsoft MVP for Windows Security ...
    (microsoft.public.windowsxp.security_admin)