Editing ActiveX (section)

==History==
Faced with the complexity of [[Object Linking and Embedding|OLE 2.0]] and with poor support for COM in [[Microsoft Foundation Classes|MFC]], Microsoft simplified the specification and rebranded the technology as ActiveX in 1996.<ref>{{cite web|url=http://zone.ni.com/devzone/cda/tut/p/id/4496 |title=Using ActiveX with LabVIEW – Examining Mission Editor Version 1.0 |access-date=12 March 2009 |date=13 August 2007 |work=NI Developer Zone |publisher=National Instruments |quote=The term ActiveX surfaced in the Microsoft world in early 1996. |url-status=dead |archive-url=https://web.archive.org/web/20080228174217/http://zone.ni.com/devzone/cda/tut/p/id/4496 |archive-date=28 February 2008 }}</ref><ref>{{cite web|url=https://news.microsoft.com/1996/03/12/microsoft-announces-activex-technologies/|title=Microsoft announces ActiveX Technologies|access-date=11 February 2017|date=12 March 1996|work=News Center|publisher=[[Microsoft]]|quote=Microsoft Corp. today announced ActiveX … Technologies, which make it easy for the broadest range of software developers and Web designers to build dynamic content for the Internet and the PC. … ActiveX Technologies form a robust framework for creating interactive content using software components, scripts and existing applications. Specifically, ActiveX Technologies enable developers to build Web content easily using ActiveX Controls (formerly OLE Controls), active scripts and active documents. … ActiveX Technologies are available in the form of the Microsoft ActiveX Development Kit, which is being distributed to more than 4,000 developers attending the Professional Developers Conference in San Francisco today.|url-status=live|archive-url=https://web.archive.org/web/20170212101109/https://news.microsoft.com/1996/03/12/microsoft-announces-activex-technologies/|archive-date=12 February 2017|df=dmy-all}}</ref> Even after simplification, users still required controls to implement about six core interfaces. In response to this complexity, Microsoft produced [[wizard (software)|wizards]], [[Active Template Library|ATL]] base classes, [[Macro (computer science)|macros]] and C++ language extensions to make it simpler to write controls.

Starting with Internet Explorer 3.0 (1996), Microsoft added support to host ActiveX controls within HTML content. If the browser encountered a page specifying an ActiveX control via an <code>OBJECT</code> [[HTML tag|tag]] (the <code>OBJECT</code> [[HTML tag|tag]] was added to the [[HTML|HTML 3.2]] specification by [[Charlie Kindel]], the Microsoft representative to the [[World Wide Web Consortium|W3C]] at the time<ref>{{Cite web|url=https://www.w3.org/People/Raggett/book4/ch02.html|title=Chapter 2|website=www.w3.org|access-date=2019-08-29}}</ref>) it would automatically download and install the control with little or no user intervention. This made the web "richer" but provoked objections (since such controls, in practice, ran only on Windows, and separate controls were required for each supported platform: one for Windows 3.1/Windows NT 3.51, one for Windows NT/95, and one for Macintosh M68K/PowerPC.) and security risks (especially given the lack of user intervention). Microsoft subsequently introduced security measures to make browsing including ActiveX safer.<ref>{{cite web |title=Activating ActiveX Controls |url=http://capitalhead.com/articles/activating-activex-controls.aspx |date=18 April 2006 |access-date=16 June 2009 |url-status=live |archive-url=http://archive.wikiwix.com/cache/20060419000000/http://capitalhead.com/articles/activating-activex-controls.aspx |archive-date=19 April 2006 |df=dmy-all }}</ref>

For example:

* [[digital signing]] of installation packages ([[Cabinet (file format)|Cabinet]] files and executables)
* controls must explicitly declare themselves safe for scripting
* increasingly stringent default security settings
* Internet Explorer maintains a blacklist of bad controls

ActiveX was controversial from the start; while Microsoft claimed programming ease and good performance compared to [[Java applet]]s in its marketing materials, critics of ActiveX were quick to point out security issues and lack of portability, making it impractical for use outside protected [[intranet]]s.<ref>{{cite news |title=ActiveX technology: You can't go there today |newspaper=[[InfoWorld]] |pages=90 ff |url=https://books.google.com/books?id=zDsEAAAAMBAJ&pg=PA90|year=1997}}</ref> The ActiveX security model relied almost entirely on identifying trusted component developers using a [[code signing]] technology called [[Code signing|Authenticode]]. Developers had to register with [[Verisign]] (US$20 per year for individuals, $400 for corporations) and sign a contract, promising not to develop [[malware]]. Identified code would then run inside the web browser with full permissions, meaning that any [[bug (software)|bug]] in the code was a potential security issue; this contrasts with the [[Sandbox (computer security)|sandboxing]] already used in Java at the time.<ref>{{cite news |title=Exposing the ActiveX security model |first=Sean |last=Dugan |newspaper=[[InfoWorld]] |date=19 May 1997 |page=98 |url=https://books.google.com/books?id=zDsEAAAAMBAJ&pg=PA98}}</ref>