Hacker News Reader

Comment by dheera | Hacker News Reader

10 years ago it would have been unimaginable, but 20 years ago you could have done all of this with ActiveX controls.

(Oh and yeah 20 years ago I had AJAJ by just loading the target URL in a hidden/offscreen iframe and reading its contents programmatically. Never mind the fact that I could also read contents from the user's hard drives ... although I didn't use it for this)

View on HN

Ah ActiveX -- a gold mine for malicious actors.

You say that like the web hasn't been. Hell, even if everything always worked properly, there were not XSS attacks, and users weren't easily fooled, the web would still be full of malicious actors in the form of tracking and advertisement.

Remember, we invented pop-up blockers because advertisers abused it, and we've been in an arms race with those assholes ever since. Tracking and ads in desktop apps came from the web ecosystem and now we're stuck with it.

I don’t think you can equate the two. ActiveX was barely sandboxed... in fact I’d like to say they were not sandboxed at all. They were native code running basically as root on your machine.

It was something that came back when Microsoft was still convinced the internet would be a fad. Those activeX things could do all sorts of fun exciting things on your computer.

Oh ActiveX was definitely worse, I should know since I was using the internet plenty when it was prominent. My point is, though, that malicious actors still basically control the web. They may not be executing native code without any controls, but that doesn't mean that the modern web isn't still their playground.

Oh yeah speaking of popups I once made a horrendous bouncing image script for IE 5.5 that allowed images to fly around your screen outside the browser window.

http://dynamicdrive.com/dynamicindex4/bounceimage2.htm

And JavaScript is just as bad as ActiveX was. The only difference is that you are expected to have JavaScript turned on.

There are many negative things that could correctly be said about Javascript.

But this? This comment is absolutely special.

ActiveX controls were native code, with full system access by design. Possibly even worse, it was an absolutely blatant attempt by Microsoft to monopolize the web and maintain Windows' and Internet Explorer's dominance, as the controls were of course (in practice) intimately tied to IE on Windows on x86.

Yet JavaScript is much more harmful than ActiveX ever was.

Flash was an abonimation, yet you could disable it with barely any consequences. Same with ActiveX.

It was incredibly common to see Windows installs utterly compromised by ActiveX controls doing god-knows-what, to both the infected computer and every other computer on the corporate network.

The damage to individuals and the economy in terms of lost productivity and compromised personal information directly attributable to ActiveX's "compromise my system by design" nature is incalculable.

To compare that to Javascript is rather spectacular.

If you want to argue that Javascript has been able to wreak more damage over time precisely because it's not as objectively insane and immediately destructive as ActiveX, well fine. It could be said that Javascript is Covid-19 to ActiveX's ebolavirus. Ebola is so wantonly destructive that it kills many of its victims before they have a chance to infect others, whereas Covid's less-awful nature has actually allowed it to harm more people over time and is now probably here to stay, like influenza.

    Flash was an abonimation, yet you could disable it with barely any consequences. Same with ActiveX.

This was very nearly not the case.

IE/Win had close to 100% market share at one point. We were a hair's breadth away from a future where you could, in fact, not disable ActiveX without shutting yourself off from much of the web, like Javascript today.

South Korea was actually there for a time. If you wanted to spend money online, various regulations meant running ActiveX was a requirement.

Not that common. A bigger plague (though somewhat later if my memory seves me right) was toolbars that was sneaked into every other application.

The power consumption alone of JavaScript easily shadows that. Pretty much no desktop computer in the world can go in lower sleep states because of javascript "idling" in the background. And a decent percentage of CPU cores are constantly pegged at 100%. Imagine the number of batteries that has prematurely died because of the stress of javascript - when all the user wanted was to read static text.

Enabling ActiveX for your bank site is hardly the same. The real issue was running it on another OS than windows. Happily trade it for what we have today though.

I miss the old internet too. But think about the way things were trending, and the way they have trended.

Online commerce, content delivery, and advertising are what, multiple trillions of dollars' worth of business?

Once the web/internet became established and began trending toward ubiquity, companies were clearly always going to invest a lot into vying for our dollars and eyeballs. Without viable competition in the form of web standards, Javascript, and operating systems besides Windows it's almost certain that the evolving web would have leaned into ActiveX and/or Flash and made them essentially a requirement in much the way that Javascript is currently a requirement today.

The timeline we're living in is not ideal, and I really dislike Javascript for a number of reasons, but it's also one of the primary reasons we're not living in an even worse timeline.

There was always going to be something like Facebook. Now imagine Facebook... except powered by ActiveX instead of Javascript. Apologies if you just vomited as violently as I did while typing that. But when you talk about gladly trading Javascript for ActiveX, that's the sort of absolutely ruined world you're pining for.

But ActiveX didn't die because of competition, it died because it was terrible. The same fate happened to java applets. There was no real mainstream momentum for either.

For sure things would have been different if Microsoft had really tried to exploit their monopoly. But they just left it there as if waiting for the competition to catch up and surpass.

Flash could have been it, not that flash was much better but at least you could read text without it.

It could be that anything would be made to suck. But it doesn't really follow that money means tracking to this extent and come with such poor user experience. With trillions of dollars on the line we make it so slow it is barely usable. Oftentimes there are many layers of popups and checkboxes just to get at the content. And somehow that is worth it? The incentives are insane. Tragedy of the commons is putting it kindly.

Dark patterns are at an all time high. The techniques in the nineties used by criminals to trick you into running that attached executable in outlook express are now finessed by the largest corporations to trick you into allowing them to track you even more. On top of that the monoculture situation is pretty terrifying.

I wouldn't bet on humanity not being able to make it worse but it is hard to accept the state that we are in.

> South Korea was actually there for a time. If you wanted to spend money online, various regulations meant running ActiveX was a requirement.

This playbook is happening again in China now. Not with ActiveX but with WeChat and AliPay. It's increasingly difficult to live there without either of the two apps and I think it does not bode well for the future for society to be reliant on two private corporation apps for basic needs, in the same way that it was not a good idea for the world to be dependent on ActiveX 20 years ago.

Tons of business apps were written in ways that required activeX. It was one of the main reasons so many companies held on to ancient versions of IE.

Sure you could disable activeX but in practice it would have been rare.

People bitch that sites don’t support people who disable JavaScript but it really isn’t worth catering to that type of person. I’ve been in multiple shops where we had the debate about how to handle non-JavaScript clients and every single time all the developers agreed it wasn’t worth the hassle.

This includes companies who had blind developers using screen readers and companies that had major legal liability if the site wasn’t accessible. The “screen readers don’t support JavaScript” argument has been dead for years now. The only people without JavaScript are those who intentionally disable it.

It’s just not worth building what is almost a second website for incredibly tiny amount of non-JavaScript viewers out there.

Yes, and that was for internal use on the intranet. And yes, it was a huge problem that they insisted on using such old versions of IE, but that was the issue - not ActiveX.

Perhaps the question should have been, why make a special version for the ones with javascript?

Reply on news.ycombinator.com