Faced with the complexity of
OLE 2.0 and with poor support for COM in
MFC, Microsoft simplified the specification and rebranded the technology as ActiveX in 1996. Even after simplification, users still required controls to implement about six core interfaces. In response to this complexity, Microsoft produced
wizards,
ATL base classes,
macros and C++ language extensions to make it simpler to write controls. Starting with Internet Explorer 3.0 (1996), Microsoft added support to host ActiveX controls within HTML content. If the browser encountered a page specifying an ActiveX control via an OBJECT
tag (the OBJECT
tag was added to the
HTML 3.2 specification by
Charlie Kindel, the Microsoft representative to the
W3C at the time) it would automatically download and install the control with little or no user intervention. This made the web "richer" but provoked objections (since such controls, in practice, ran only on Windows, and separate controls were required for each supported platform: one for Windows 3.1/Windows NT 3.51, one for Windows NT/95, and one for Macintosh M68K/PowerPC.) and security risks (especially given the lack of user intervention). Microsoft subsequently introduced security measures to make browsing including ActiveX safer. For example: •
digital signing of installation packages (
Cabinet files and executables) • controls must explicitly declare themselves safe for scripting • increasingly stringent default security settings • Internet Explorer maintains a blacklist of bad controls ActiveX was controversial from the start; while Microsoft claimed programming ease and good performance compared to
Java applets in its marketing materials, critics of ActiveX were quick to point out security issues and lack of portability, making it impractical for use outside protected
intranets. The ActiveX security model relied almost entirely on identifying trusted component developers using a
code signing technology called
Authenticode. Developers had to register with
Verisign (US$20 per year for individuals, $400 for corporations) and sign a contract, promising not to develop
malware. Identified code would then run inside the web browser with full permissions, meaning that any
bug in the code was a potential security issue; this contrasts with the
sandboxing already used in Java at the time. ==Platform support==