Microsoft may be pretty good in reacting to security issues, but many of the holes are results of mind-bogglingly stupid design decisions that are in a class of their own. ActiveX, anyone?