Safe Beans

ActiveX has evolved from the relatively isolated environment of the desktop toward the networked computing model that includes the Internet. In a desktop computer system environment, users (or their support infrastructure) control what is installed on the systems. If it comes out of a shrink-wrapped box, then it's probably safe and trustworthy. But this is not always the model for today's computer networks.

With the advent of the Internet and corporate intranets, more of the software on users' systems is downloaded on demand from a corporat e network. The code is often embedded within the HTML content and arrives at the user's system unbidden. This software is almost never installed in a controlled manner and is usually intended to reside on the system only as long as the user accesses the containing page.

This model originated with Java, and, not surprisingly, the Java security model is designed for it. All Java code executes in a controlled environment called the Java sandbox. This sandbox fully controls what parts of a system are accessible. This is possible because the Java application can use only those facilities of class libraries that are loaded by a class loader that cooperates with the security mechanisms.

ActiveX has no equivalent to the sandbox. ActiveX components are compiled to hardware-specific instructions and use OS calls directly. An ActiveX component can do anything it likes to the user's system once it has been downloaded.

Microsoft has papered over this fundamental flaw b y using certificates. The idea of signing a piece of code so that a user can ensure it arrives undamaged and comes from a trustworthy source simply means that the user knows whom to blame when his or her system crashes; it does not stop it from crashing.