VK said the following on 5/12/2006 5:59 PM:[color=blue]
> Randy Webb wrote:[color=green]
>> Zif said the following on 5/11/2006 4:59 AM:[color=darkred]
>>> Randy Webb wrote:
>>>> VK said the following on 5/11/2006 2:18 AM:
>>>>
>>>> <snip>
>>>>
>>>>> <applet> tag is deprecated in favor of <object> From the other side
>>>>> <object> initialization is often disabled in IE6 because of a huge per
>>>>> design security hole: thusly I don't dare to insist.
>>>> "because of a huge per design security hole"? You are implying that MS
>>>> intentionally - per design - put a security hole in IE?
>>> Who knows what is implied? VK's answers are often so cryptic it's
>>> either impossible to decipher the meaning, or so many are possible that
>>> it's a lottery as to which was intended.[/color]
>> Hence my request for clarification.
>>[color=darkred]
>>>> And, what is that hole?
>>> Please don't offer encouragement! Perhaps your intention is to coax
>>> more howlers, but I think you'll find more satisfaction in a crossword
>>> puzzle or game of scrabble.[/color]
>> It was curiosity and nothing more.[/color]
>
> If you are curious about software security, it's OT to c.l.j. IMHO.
> slashdot.org and astalavista.com would be a place to start.[/color]
Software security is off topic to c.l.j when it deals directly with HTML
and JS? Your thought processes amuse me sometimes.
[color=blue]
> P.S. If you read ieblogs on MSDN, you may read out the main reason of
> IE7 having XMLHttpRequest instead of ActiveXObject is "the ability to
> use AJAX technics even with object activation disabled". I hope you
> didn't think that Microsoft does it just because W3C just made the
> first working draft of xmlhttp and they are in rush to compile with it?
> Of course you did not. :-)[/color]
IE disabled the object activation as a result of EOLAS, it had nothing
to do with XMLHTTPRequest object. And I would fathom a guess that the
real reason they made XMLHTTPRequest a native Object in IE7 was the
ActiveX warning and nothing more. It works without ActiveX which can not
be said for IE6 and below.
[color=blue]
> The question you may ask yourselve why does Microsoft care of <object>
> disabled customers. Is not it because there is too many of them? Yes it
> is. And why so many of them?[/color]
MS disabled the EMBED tag recently, but only for ActiveX objects. The
reason was EOLAS but you won't find that anywhere on the MS site. The
page that explains the disabling also has a link to a page that explains
how to "defeat that security fix". So no, I don't trust a whole lot I
read on the MS site without testing it myself.
[color=blue]
> To answer this question
> 1) get yourselve any Windows below XP SP2 with IE 5.x - 6.x installed.[/color]
Why would I want an outdated antiquated non-patched IE? It has enough
holes in it patched.
<quote cite="VK THIS thread">
<object> initialization is often disabled in IE6 because of a huge per
design security hole: thusly I don't dare to insist.
</quote>
To which I replied:
<quote cite="Randy Webb THIS thread">
"because of a huge per design security hole"? You are implying that MS
intentionally - per design - put a security hole in IE?
</quote>
Which implies, to me anyway, that the security hole was by design. And I
asked you to back up that assumption. And to date, you have not done
anything remotely close to that other than to give me some scenario
about an outdated unpatched IE. I want to know what the security hole is
in IE6 XP SP2 that you are referring to, and nothing more.
--
Randy
comp.lang.javascript FAQ -
http://jibbering.com/faq & newsgroup weekly
Javascript Best Practices -
http://www.JavascriptToolbox.com/bestpractices/ 
