The IE team has announced some more about ActiveX improvements in Internet Explorer 8.

Some of the blog is about old features, but there are some new ones: Per-User (Non-Admin) ActiveX, available only on Vista, means that it's possible for users to install an ActiveX control only for their own user context, not for the machine. It sounds like this will be on by default, but administrators can turn it off through Group Policy. You can already see from the comments to the blog entry that some people wanted this, and I guess it's a good thing.

Through Per-Site ActiveX a control may be restricted to use only in the context of specific sites. If a control is run by a site not in the list, the user gets an information bar asking whether they want to allow it to run in that context. Administrators can control all of this, including pre-populating a list of controls and permitted sites.

That's it for the really new stuff, although the blog reiterates some other powerful security features. For instance, MS already announced that IE8 will have DEP on by default, which will defeat a huge proportion of vulnerabilities.