Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I created a vbs file and tried to run it and got the silly warning a bit like

enter image description here

I see there are a few solutions to it. One is mentioned here

In IE- tools..internet options..security tab..custom level.."Launching applications and unsafe files" Enabled (as opposed to prompt).

and start...run..gpedit.msc administrative templates..windows components..internet explorer.."Turn off the security settings check feature) Enabled that.

I would like to know how insecure that option is. Is it totally safe? (By that I mean, is it going to cause IE to do something stupid like download a file automatically without asking me? or run something without asking me - something I didn't double click on).

i.e. is it something that me or pretty much any reasonably technical person would be well advised to do?

I don't want IE to automatically download something without a prompt(which IE maybe used to do like pre Win XP Sp2!) If I double click an executable file or script, I don't want a warning by virtue of it being an executable or script. (I know it is and I double clicked it to run it, and i'm aware of the nature of these things). I just don't want IE doing something stupid and insecure. But I don't want IE or Windows trying to be clever and being a nuisance.

I notice there are other ways too like this involving the registry here and i'd be interested to know how they compare from a security standpoint. (no doubt the least intrusive is using sysinternals streams on the file or folder of files but i'm interested in the security of the method I mentioned compared to the one involving the registry.

share|improve this question
    
no, disabling this check is utter folly. much better to unblock the file in its properties -> Advanced -> unblock. also I'd advise you to run your script at the command line with 'cscript path'. technet.microsoft.com/en-us/library/bb490887.aspx –  Frank Thomas Oct 21 '13 at 1:19
    
@FrankThomas care to state what bad thing it'd cause to disable the "check"? btw there's nothing wrong with wscript, i'm using for a case where I don't want to run something from the cmd prompt. so, no cmd window pops up. –  barlop Oct 21 '13 at 1:24
    
it would allow any server you contact online to load and execute a script file within your browser session. keep in mind, the issue is not your particular script, but your environments configuration. thats why I suggest you unblock the specific script, rather than allowing all scripts to execute regardless of their origin. –  Frank Thomas Oct 21 '13 at 1:30
    
@FrankThomas Even before the change, just given the default windows and IE settings, I have never been stopped from running something like this christersvensson.com/calculator (an online javascript calculator), it runs by default, so what do you mean- can you give an example? –  barlop Oct 21 '13 at 1:50
    
javascript uses a differant mechnaism called the same-origin policy to determine when scripts execute. javascript uses the browsers built in built in engine, and executes within a sandbox. activex and vbs however execute via an client-side external runtime. Instead IE determines what to do by security zone, which is what you are considering configuring. COM and MS scripting gets far more access to your local system than javascript and is a lot more dangerous. that combined with being IE only, are pretty much why legit sites don't use it anymore. en.wikipedia.org/wiki/Same-origin_policy –  Frank Thomas Oct 21 '13 at 1:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.