ActiveX Security

ActiveX Security

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
ActiveX Security ehausig 03-22-2006
Posted by on March 22, 2006, 3:35 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Does anyone know of some good articles or websites that I could use for
material to prove to my institution that using ActiveX controls on ASP
pages and client-side scripting is an outdated approach towards web
application design?

We have a web application at my institution that has a lot of sensitive
information and it has, what I consider to be, a very antiquated
architecture: It is using ASP with all ActiveX controls on the "web
forms" and heavy client-side vb scripting. (For example, if you View
Page Source you can see all the CreateObject code, login and password
variable declares, etc.)

I think we should rewrite the application in ASP.NET or J2EE.

Any comments or help is greatly appreciated.

Thanks,

Eric


Posted by Phillip Windell on March 22, 2006, 4:09 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
> Does anyone know of some good articles or websites that I could use for
> material to prove to my institution that using ActiveX controls on ASP
> pages and client-side scripting is an outdated approach towards web
> application design?

You can't prove it,....because it isn't true.

There is no such thing as an ActiveX Control on an ASP page because the ASP
page is Server-side and the ActiveX is Client-side.

ASP.net and J2EE still do the same thing they just wrap it into a different
looking package. It is all still ultimately goes back to the statelessness
of HTTP and all they are doing is comming up with "colorfull" way of hiding
that.

ASP.net and J2EE still have just as much (if not more) Client-side
Script,...you just don't see it because it is automatically generated by the
Server-side code. Just go to any advanced, complex, ASP.net Site,...open a
page and do a View Source then try to prove that it isn't mostly Client-side
JScript with a little HTML sprinkled in.

ASP Classic also has the advantage that it is just text and all you need is
Notpad to write it. ASP.net makes you have to run out and buy ($$$$$$)
Visual Studio and have to have the Programming skills of an experienced
Desktop Application Developer,...just to,...in the end,...accomplish pretty
much the same thing you could do with ASP Classic and ActiveX Controls or
Java Applets. Then the Web Server has to also be ASP.net capable and run
the same version of the .Net Framework that you developed with.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com



Similar ThreadsPosted
ActiveX control security mechanisms in IE 6.0 vs IE 7.0 September 15, 2006, 7:21 pm
Unlock activeX February 15, 2006, 6:53 am
ActiveX needs to be enabled April 28, 2006, 8:23 am
ActiveX Problems June 11, 2006, 8:39 am
activex controls prohibited September 27, 2005, 6:36 pm
ActiveX controls not downloading over SSL August 28, 2006, 1:02 pm
ActiveX controlls blocked on IE August 15, 2007, 9:02 pm
ActiveX Control Vulnerability December 26, 2007, 10:22 am
ActiveX object fetching new dll's November 1, 2005, 11:22 am
ActiveX Control To Read Certificate (ASP.Net app) November 3, 2005, 4:40 am

The site map in XML format XML site map

Contact Us | Privacy Policy