Microsoft Internet Explorer ActiveX Update Can Break Internet Applications

If you use the Internet Explorer browser, and in fact, even if you just use Microsoft Windows, your favorite websites, business applications, and toolbars could stop working beginning April 11th when a non-security update is installed. Then again, Microsoft has announced a two-month reprieve because no one paid attention and they need more time.

The story behind this significant change dates back to 2004 when Microsoft lost a lawsuit to Eolas Technologies, who holds the patent for (Filed Nov 17, 1998) In simple terms, that is the patent for how ActiveX, Quicktime, Flash, the Sun Java runtime, Adobe, RealPlayer, and other such controls are displayed in a browser.

To address this, Microsoft released an ActiveX Update that prevents the user from automatically interacting with an embedded object like a Flash movie or a toolbar. The user needs to manually activate the object first, either clicking the object or using the TAB+Enter keys. The movie will still play, but interactive effects, such as clicks and mouseOver events will require you to explicitly activate or accept the warning. Thus an embedded movie or music will play, but the buttons to control the movie will be inactive. Anything within the APPLET, EMBED, or OBJECT HTML tags will now require manual activation.

This patch has been around under various forms since January, but it will be deployed to all Windows machines with Automatic Update turned on from April 11, 2006. The problem is that it breaks almost every Flash, ActiveX, and media-rich webpage out there, and most people don't really know what to do to fix the problem. This includes products like Siebel, the Google Toolbar, and product tours like Apple's Quicktime-based pages. Various workarounds are available and Microsoft provided a technical guide on using external Javascript references to invoke the embedded content, which is not covered by the patent. There is one problem even with this approach, however. According to the details for the ActiveX Update, KB912945,

External script technique does not work when the "Disable Script Debugging (Internet Explorer)" check box is cleared

All is not lost — yet. Microsoft will be simultaneously releasing a Compatibility Update that will reset the ActiveX handling changes to their original mode for another two months.

Although most Internet sites have already prepared for the changes in the way that Internet Explorer handles some ActiveX controls, some enterprise customers have given feedback that more time is needed to ensure that corporate line-of-business applications are compatible with this change to Internet Explorer.

To help enterprise customers who need more time to prepare for the update, Microsoft will be releasing a Compatibility Patch. This Compatibility Patch will be available the same day as the next Internet Explorer Security Update. As soon as it is deployed, the Compatibility Patch will temporarily return Internet Explorer to the previous functionality for handling ActiveX controls. This Compatibility Patch will function until an Internet Explorer update is released as part of the June update cycle, at which time the changes to the way Internet Explorer handles ActiveX controls will be permanent.

The real solution, and perhaps a long overdue one, is to make Flash, QuickTime, ActiveX, and embedded object handling as integral functions of the browser, thereby negating the need to embed objects and avoiding the patent, but that plays into concerns over bundling, compatibility and complexity. At this point, this will be nothing less than a retrograde step for the Internet. Poorly handled, it could be a mini-Y2K.