Setting the Kill Bit on ActiveX Controls

Q: Every month, Microsoft security vulnerabilities are discovered in ActiveX controls in Microsoft Internet Explorer (IE). It seems like there should be a strategic way to deal with these vulnerabilities rather than deploying patches, especially for organizations like mine that resist installing updates that could threaten stability. Why doesn’t Microsoft do something about these vulnerabilities? What measures do you suggest our organization take?

A: You're right, the current situation seems crazy. Every month, Microsoft releases security patches that correct some buffer overflow in an ActiveX control and set the kill bit on the control to prevent IE from loading it. You'd think that Microsoft could just set the kill bit in all ActiveX controls that the company doesn't think should be loaded in IE in the first place.

Microsoft claims to have solved this problem in IE 7.0 by disabling all ActiveX controls by default. You can approve a control for loading by clicking the little yellow bar that appears under the toolbar when a page tries to load a control. However, the problem isn’t really solved because all the user has to do is let the control be loaded. How many users can determine whether a given control should be loaded by a Web page? Most users will let the control be loaded without a second thought. . . .