For Web Interactivity, ActiveX Marks the Spot -- Love it or hate it, ActiveX is sure to have an impact on the future of distributed computing

By Richard Karpinski

Let's get one thing clear from the start:When it comes to ActiveX, Microsoft's platform for delivering active, executable content via the Internet and intranet, there tends to be no middle ground. Like Microsoft itself, ActiveX seems at times a lightning rod for controversy-and in some cases, confusion-that sends net-heads fleeing into rival camps.

In the anti-ActiveX camp, you hear Microsoft is using ActiveX to "take over" the Internet, making the net as Windows-centric as today's desktops. Furthermore, they say Microsoft's promise to make ActiveX an open, cross-platform, and cross-browser product is full of air. And to top it all, ActiveX also is being branded a Trojan horse that can sneak harmful code onto your system and wipe out your hard drive in the blink of an eye. A recent column on HotWired's Packet site sums up the fear and loathing succinctly:"Microsoft's ActiveX technology is the single greatest technological threat to the future of the World Wide Web," wrote columnist Simson Garfinkel.

The pro-ActiveX camp tries to cool the heat surrounding ActiveX, stating it's the most advanced component software platform around, based on five-plus years of work at Microsoft. They say thousands of developers already have created countless ActiveX programs, called controls, that can jump-start active Internet content, and that the ActiveX platform uses state-of-the-art digital authentication to add a level of security missing from the shareware and freeware software now ubiquitous on the Web.

Even for those without a political stake in the ground, it's not always clear exactly where ActiveX fits in the Internet landscape:Does it compete with, or complement, Sun Microsystems Inc.'s Java? When and how will Netscape ever embrace ActiveX? And even as Microsoft makes good on promises to turn ActiveX over to third-party groups and vendors, will non-Windows implementations really make a difference?

So let's hunt out the middle ground and search for some truths because-love it or hate it-users, webmasters, and Web developers need to come to terms with ActiveX and understand its impact on the future of distributed computing. The Internet and corporate intranets are clearly and quickly moving away from their roots as delivery platforms for relatively static HTML content toward active (Microsoft's name), live (Netscape's buzzword), distributed applications. And ActiveX-currently in a period of rapid development and great flux-looks certain to play a major role.

activeX roots

ActiveX officially arrived on the scene in December 1995, announced for the first time from the stage at Microsoft's now-famous "embrace-and-extend" Internet "D-Day" in Seattle. But the technology has deep roots.

In the purest sense, ActiveX is a set of technologies enabling interactive content over networks, including the Web. Active Web sites can include a variety of multimedia effects, enhanced page layouts, and executable applications, all of which are downloaded and run in real-time over the Internet. ActiveX coexists with and complements the core technologies of today's Web, including HTML, plug-ins, Java, and more. Perhaps most important, ActiveX is a fairly mature technology:According to Microsoft, more than 1,000 ActiveX controls already have been written for applications such as audio, video, and live chat.

ActiveX is based on two core Microsoft development technologies: OLE (Object Linking and Embedding) and COM (Component Object Model). While even Microsoft in some of its documentation calls ActiveX just a new name for OLE controls, there is a difference. OLE controls are focused on integrating desktop applications, and while they technically can be used as ActiveX controls on a Web site, they're typically too large to be downloaded over the Internet. To help speed the delivery of controls, Microsoft streamlined and simplified the definition of ActiveX to optimize delivery of controls over networks, especially over the relatively low bandwidths of today's Internet.

In its latest incarnation-and with all the latest jargon to go along with it-ActiveX consists of five elements spanning both the client and server:

ActiveX controls

Executable "applet-sized" objects that can be embedded in a Web page. Microsoft says there are more than 1,000 ActiveX controls on the market (many of which are former OLE controls). ActiveX controls can be built using a wide variety of tools and languages, including C/C++, Visual Basic, Delphi, and even Java. We'll discuss ActiveX development tools in more detail later.

ActiveX documents

The capability to view non-HTML documents, such as Word or Excel files, via a Web browser.

Active Scripting

Scripting languages-including VBScript, based on Visual Basic, and JScript, Microsoft's own implementation of JavaScript-that can bind together or integrate ActiveX controls or Java applets, both on the browser and server.

Java Virtual Machine

Microsoft has built its own software-based virtual machine that it says runs Java code better than VMs from Sun or Netscape. The Microsoft Java VM also enables the integration of ActiveX controls and Java applets.

ActiveX Server Framework

The server-side architecture that provides Web server-based functions such as security and database access.

Thus, while what most comes to mind when speaking of ActiveX is client-side ActiveX controls, the ActiveX platform is actually much broader than that. And while it extends beyond the scope of this article, it should be noted that ActiveX is just one part of the larger Active Platform, the still-evolving end-goal of Microsoft's Internet vision. With the Active Platform, Microsoft swallows up such "open" Internet technologies as TCP/IP, HTML, and Java, and marries them to its legacy desktop technologies to create a new network-centric development environment that does Windows extremely well, but promises not to ignore other operating systems and hardware, too.

The Active Platform-which encompasses Microsoft's Active Desktop, Active Server, and ActiveX technologies-already has begun to appear in pieces, and will come together on the desktop with the upcoming OS-integrated releases of Internet Explorer 4.0 and 5.0, both expected in some form this year.

To fuel the Active Platform's cross-platform goals, Microsoft recently began the process of moving control of core ActiveX technologies to a third party, The Open Group. In addition, Microsoft is working with Metrowerks Inc. and Macromedia Inc. to support ActiveX on the Macintosh platform (an early version of the ActiveX SDK for the Mac is available now). Microsoft also is working with Bristol Technology Inc. and Mainsoft Corp. to support it on Unix platforms. It remains to be seen, however, how successful and popular these non-Windows implementations of ActiveX will be.

Indeed, it will likely be the platform issue that dogs Microsoft and ActiveX the most. While Microsoft owns the PC user desktop with its Windows operating system, the dynamics of content and applications development are somewhat different on the Internet, where new technologies simply are not adopted if they're not broadly supported on the client side.

active web surfing

The best way to experience ActiveX on the Web today is with Microsoft's Internet Explorer 3.0 browser (Windows NT and 95 versions only for ActiveX support), available for free download from the Microsoft Web site (www.microsoft.com/ie). And while Netscape recently promised to support ActiveX in future products, Netscape users can experience ActiveX today using NCompass Labs Inc.'s ScriptActive plug-in. This slick plug-in adds native support for ActiveX controls and ActiveX documents to the Netscape browser. It's available for a free 30-day evaluation or $21 for a licensed single-user version from www.ncompasslabs.com.

What does ActiveX do for Web surfers? The most important thing is that it makes active content a much more seamless part of the Web than existing technologies, notably Netscape plug-ins. While plug-ins disrupt the Web experience by forcing users to download the .exe file, run the install program, and at times restart their computers, ActiveX controls (once they're accepted by users for download) are automatically installed in the background and are ready to be used immediately. Unlike Java applets, however, ActiveX controls are "persistent." The one disruption in this process is the Authenticode code-signing security process, which we'll discuss in more detail later. Once they're downloaded, the controls remain on users' hard drives and are always available to be used.

In rough terms, Web surfers will encounter two main types of ActiveX controls. The first type, which can best be described as a plug-in replacement, serves as an integrated media or content play-back engine. Users download the control and then are able to experience media types not natively supported within the browser, including audio, video, and chat. Most of the major Netscape plug-in vendors have by now released ActiveX control support with their products as well, including Adobe Systems Inc.'s Acrobat, Progressive Networks' RealAudio, and VDONet Corp.'s VDOLive.

The second major type of ActiveX control found on the Web affects the layout of Web pages. Active buttons, scrolling billboards, enhanced layout, drop menus, and much more are possible with ActiveX and help produce much-improved Web user interfaces. As a Web surfer, the installation of such controls is fairly seamless because they're small and quick to download. Internet Explorer 3.0 also comes with a small set of pre-installed controls-including Chart, Label, Preloader, and Timer-that Web authors can take advantage of right away.

The big issue for ActiveX from a user's perspective is security. It's here that ActiveX and Java differences are most pronounced. Java applets run within the Java Virtual Machine, a so-called "sandbox" that keeps the downloaded Java byte code from reaching other parts of your system. ActiveX doesn't use such an approach. ActiveX controls can access your hard drive and various system services, thus making it possible for a developer to release a control that by design could damage your system (see "ActiveX Danger?," facing page). Less ominously, but no less harmful, a developer could develop a buggy control that could inadvertently do some harm.

Advocates of ActiveX argue that only by letting downloaded software objects have access outside the sandbox, or by letting it interact with objects on other distributed servers, do you get really interesting Internet content-another thing Java in its early days doesn't allow. For instance, a game score or spreadsheet calculation can be written directly to applications on your hard drive. The trade-off is power vs. security. Indeed, most Java developers, as much as they give lip service to the importance of the sandbox, also say they feel constrained by the airtight Java security model.

Microsoft's answer to the inherent security problems with ActiveX has been to introduce a rather rigorous program of signed digital authentication of ActiveX controls, called Authenticode. While digital authentication provides probably a greater level of security than today's shrink-wrapped software, there's no way it can ensure that downloaded code is not buggy or in other ways harmful. Microsoft recommends that users download code from vendors they trust, and says makers of bad code will get singled out and blackballed. So in the end it's caveat emptor-buyer beware and good luck chasing down that control developer if a problem ever occurs.

Given its relatively small (but growing) market share and security concerns, ActiveX as an end-user technology has had a somewhat bumpy run in its early days on the Web. But the future looks brighter. Indeed, because Internet Explorer 3.0 has proved itself a viable alternative feature-for-feature to Netscape's Navigator, IE's ActiveX support, especially support for self-installing media controls, may make Internet Explorer the browser to beat on 32-bit Windows platforms-particularly for users who feel comfortable with digitally signed code.

webmasters and activeX

For webmasters who've already dabbled with Java applets, the basic concepts behind adding ActiveX to a Web page are very similar. But there are some new tricks to learn-and some new tools that will help you-before you can become fully adept with ActiveX.

The first thing webmasters need to do is find the controls they want to use. Like Java, ActiveX is not for the faint of heart. Don't plan on writing ActiveX controls if you're not a programmer, or at the very least conversant in higher-level programming environments like Visual Basic. But the real power of object technology like Java and ActiveX is that you don't need to write an applet or control to use it. You can reuse ones written by others-sometimes for free, other times for a fee.

Where do you find ActiveX controls? As we noted above, Internet Explorer 3.0 downloads with a number of controls already installed, so the savvy webmaster can start with those. But that's just the start. Microsoft estimates there are more than 1,000 ActiveX controls available today, and the numbers are growing. Check out the Web sites listed in the Reference Desk (at right) for listings of free and for-pay controls you can add to your Web site.

Once you have the binaries for the ActiveX control you want to use, you can add the control to a Web page using the HTMLtag, which also includes a set of parameters that affect the appearance and behavior of the control. While you can use any text or HTML editor to add ActiveX controls to a Web page, Microsoft has released the free ActiveX Control Pad. The Control Pad's point-and-click interface helps webmasters through some of the more esoteric HTML coding necessary to properly place a control on a page. It also can be used to add ActiveX scripting to Web pages, and, via the included HTML Layout Control, offers ActiveX authors more precise 2-D layout control of Web pages. For more information, the Microsoft Site Builder Workshop Web site includes a white paper and tutorial on the ActiveX Control Pad and Layout Control (www.microsoft.com/workshop)

The Control Pad consists of several elements, including a basic text editor for editing HTML source code, an object editor for placing ActiveX controls on a page and visually setting properties of the controls, and a Script Wizard for guiding non-programmers through the process of adding VBScript or JavaScript code to a page.

At the most utilitarian level, the ActiveX Control Pad hides from users some of the more unseemly elements of ActiveX. For instance, the tool makes it easier to customize a control by changing its parameters; the Script Wizard, meanwhile, attempts to automate the creation of scripts used to control the behavior of ActiveX controls. The wizard can be set to either "designer" or "developer" mode, depending on the experience level of the user.

The ActiveX Control Pad is an extremely interesting tool-among the first on the market that begins to show an inkling for where the Web may truly be headed. So far on the Web, authoring has consisted mainly of keeping up with a rapidly growing group of HTML improvements and extensions. The focus was on appearance, and stretching the limits of a markup language probably well beyond its original intentions.

With ActiveX-and also with Java and scripting languages like JavaScript and VBScript-page designers potentially have much more power in their hands. Anything that can be imagined can be created with these Web-ready programming languages. The key will be marrying the relative simplicity of HTML with the power-yet complexity-of Web programming languages in a single tool or authoring environment. Consider the ActiveX Control Pad a very early stab at just such a tool.

At its Site Builder Workshop site, Microsoft provides several examples of Active content created using the ActiveX Control Pad and HTML Layout Control.

developers and the intranet

The intranet in many ways may be the perfect setting for ActiveX. Intranets hide the platform's weaknesses, including the lack of a ubiquitous client base on the public Web and concerns about runaway code from untrusted developers, and plays to its strengths-bandwidth becomes less of an issue and most IT departments probably have some OLE controls lying around already built, as well as VB and C++ programmers ready to roll building new ones.

There are a variety of ways to write ActiveX controls, ranging from bare-bones C++ programming for long-time Windows developers to a new Visual Basic Control Creation Edition that lets relative newcomers visually build small, Web-optimized ActiveX controls. Tools for building ActiveX controls include Visual Basic, Visual C++, Borland Delphi, Borland C++, and a variety of emerging Java development environments. Java-built controls in the ActiveX environment have the added advantage of, in effect, being ActiveX controls themselves, able to fully integrate into the ActiveX platform.

Finally, just as important as ActiveX controls for corporate users may be ActiveX documents. Many corporations have standardized on Microsoft Office, and the ability to view Excel, Word, or PowerPoint documents within the Internet Explorer browser could greatly ease departmental content creation and viewing. Who needs to convert documents to HTML when everyone on site can view documents in their native form right within their Web browsers?

an active future?

ActiveX is in a period of great flux. It's developing quickly and spreading its reach just as aggressively. Some guideposts to monitor when tracking its development:

• Does The Open Group's stewardship of ActiveX come to fruition, or does it bog down in petty squabbling, infighting, and politics? And how much of ActiveX will Microsoft set free? Already competitors are complaining that Microsoft is holding on to key desktop application programming interfaces, such as Win32.
• Even if ActiveX does go cross-platform, does anyone in the Mac or Unix communities care? Or do competitive object environments like OpenDoc, Java Beans, and the CORBA-based Inter-ORB Protocol come on strong? And what will Netscape's implementation of ActiveX look like?
• Whose implementation of Java wins? If Microsoft does a killer job with the Windows implementation of Java-which, as part of its Java licensing agreement, it's in charge of-then almost by default ActiveX becomes a very important integration technology.
• Will users and developers feel comfortable with digital authentication as a process and "accountability" as a security policy? Or will more challenges come along and shake up user comfort with downloadable code playing outside the sandbox?

As Bill Gates said a year ago, Microsoft is undoubtedly "hardcore" about the Internet. And ActiveX and the emerging Active Platform are at the core of its Internet strategy. It'll be interesting to see how far the company can embrace core Internet technologies like HTML and Java while at the same time extending Microsoft platforms like ActiveX out to the Web.

Richard Karpinski (rkarpins@cmp.com) is an editor at large at NetGuide Magazine.

ActiveX Controls vs. Java Applets

Feature ACTIVEX

Security

Protability

Speed

Tools

Availability

Feature JAVA

Security

Portability

Speed

Tools

Availability

Note

Reference Desk

• AtOnce Software
• BrowserWatch ActiveX Arena
• C|Net's ActiveX.Com
• ComponentSource
• Gamelan
• InnoVision Development's ActiveX Resources
• Microsoft's ActiveX Resources
• Microsoft Site Builder Workshop
• NCompass Labs
• TechWeb's ActiveXpress
• VeriSign

Copyright R 1997 CMP Media You can reach this article directly.