Grok the Web

A Programmer's Guide to the New Software Development Paradigm

by Andrew Schulman

Chapter 10

"Activate the Internet"?

Last revised: April 29, 1997

Cover Netscape plug-ins here too?

See "Hell's Kitchen" article for WebReview

Interesting experiment: WebTechniques, May 1997, back cover has full-page ad for ActiveX, featuring 27-year-old web (hip, goatee) designer wearing T-shirt "With ActiveX I can harvest Corn Pops, wing nuts and Detroit steel. What can you do?" Lists his "Magnum Opii": www.giantstep.com, www.cornpops.com, www.truevalue.com, www.oldsmobile.com. Presumably these good demo for ActiveX. Need to look at with MSIE, obviously. But need Macromedia Shockwave for Corn Pops site, Oldsmobile seems to use CGI, the GiantStep site is just animated GIFs (that take too long to download!)?? Pp. 48-9 of same issue have 2-page ad, 29 year old web designer (also hip, black waffle stompers), Magnum Opii: www.aptfone.com, www.sunnyd.com, www.bluemarble.com. Take these ads seriously as demos of ActiveX: what really do? Sites take a long time to load! Frivolous! Same sort of designers that use too many typefaces, gimmicks? Strange, aptfone.com is running WebSitePro/1.1h, and SunnyD is running Netscape-Commerce/1.12. Both Oldsmobile and TrueValue redirect to index.cgi; Oldsmobile has CGI-based monthly payment calculators; TrueValue has CGI-based message board. Well, maybe looks different with MSIE? No, same: CGI

Fairly impressive demo of Shockwave Flash (streaming animation) at http://www.macromedia.com/shockzone/; this frames; had to use geturl to figure out that actual page is http://www.macromedia.com/shockzone/00_shockmain.html. Contains following code (Netscape plug-in EMBED inside ActiveX OBJECT):

<OBJECT 
classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" 
codebase="http://active.macromedia.com/flash/cabs/FSPLASH.CAB"  
width=90% height=90% 
   pluginspage="/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash"> 
<param NAME="type" VALUE="application/futuresplash"> 
<param NAME="Movie" VALUE="movies/tagline.spl">
<param NAME="Quality" VALUE="best">
<param NAME="Loop" VALUE="false">
<embed SRC="movies/tagline.spl" type=application/futuresplash 
   width=100% height=15%  loop=false quality=best>
</OBJECT>

ActiveX ad says "Visit Giant Step's web site and you'll see several client logos literally take root and sprout across their homepage. It's just one of several cool controls Adam [Heneghan] whipped up late one night in his Chicago design studio with the help of ActiveX." I don't see anything quite like this, but there is some stuff (not client logos) sprouting and taking root. Problem is, it's just animated GIFs.

Go to Kellogg's Corn Pops site, play game "Keep the Pops from Granny" (http://www.cornpops.com/granny/granny.asp). Fun games! Ah, and page has OBJECT tag, hmm, but with EMBED tag. No special control: just Macromedia Shockwave file, pops.dcr. Presumably works same in Netscape, with plug-in?

Other ad has slogan "With ActiveX I can make you feel at home in Hell's Kitchen," referring to www.aptfone.com, Apartment Fone Online, a NYC real-estate guide. Sure enough, http://www.aptfone.com uses ActiveX. Get Authenticode notice about Internet Timer Control:

<OBJECT CLASSID="CLSID:812AE312-8B8E-11CF-93C8-00AA00C08FDF"
ID="index_alx" height=0 width=0 STYLE="LEFT:0;TOP:0">
<PARAM NAME="ALXPATH" REF VALUE="aptfone.alx">
<IMG SRC="./images/indexbar.gif" ALT="Clickable Image Map" HSPACE=0 VSPACE=0 ALIGN=top 
   WIDTH="128" HEIGHT="411" BORDER="0" usemap="#menu" ISMAP>
</OBJECT>

I wonder if these ActiveX ads reflect nothing more than Site Builder Network (SBN) requirements that have page that uses ActiveX somewhere? See http://www.microsoft.com/sbnmember/levels/qualify3.asp, http://www.microsoft.com/sbnmember/levels/qualify2.asp.

Couldn't get a lot to work at www.aptfone.com, with either MSIE or Netscape, but looking at source, finally found my way to http://www.aptfone.com/rentmn.htm, to rent in Manhattan. From here can select neighborhood, price range, etc., and, indeed, neighborhood can include Hell's Kitchen. Funny thing is, it's an HTML form, and ACTION is a Win-CGI app! Looking at form, found that Hell's Kitchen is aptrenthood=5118, so:

geturl -post command=SearchListings&type=11&borough=5&aptrenthood=5118 \
   http://www.aptfone.com/cgi-win/AptFoneClient.exe

{{Text of email to Tim, RMS, Bob Denny, Ron. Maybe do WebReview article??}}

The latest issue of "WebTechniques" magazine (May 1997) has a back-cover ad for ActiveX, featuring a 27 year old web designer named Adam Heneghan, from a company named Giant Step. He's standing in a pile of Kellogg's Corn Pops, wearing a t-shirt that says "With ActiveX I can harvest Corn Pops, wing nuts and Detroit Steel. What can you do?" It explains that his "Magnum Opii" include the sites www.giantstep.com, www.cornpops.com, www.truevalue.com, and www.oldsmobile.com.

(I think maybe MS got the Corn Pops idea from an old ad for the Pick database system that had Dick Pick standing in a pile of CornNuts, saying "Every day I pass 2 million pounds of CornNuts through my system"...)

Similarly, on pp. 48-49 there's a two-page ad featuring a 29 year old web designer named Kevin Drew Davis, from Blue Marble. His "Magnum Opii" include www.aptfone.com, www.sunnyd.com, and www.bluemarble.com. He's sitting in a bunch of barrels, with fire coming out of them. One of the barrels has stencilled on it "With ActiveX I can make you feel at home in Hell's Kitchen. What can you do?" It took me a while to figure this out, but www.aptfone.com is a real-estate site for NY City, where one of the neighborhoods of course is "Hell's Kitchen."

Anyway, I decided to make this a little case study for chapter 10 of my book ("Activate the Internet?", about what role there is ActiveX, Java, and plug ins). I figured these would be ideal sites to show off ActiveX in the best possible light.

Well, the weird thing is, most of these sites don't seem to use ActiveX at all! For example, from what I can tell, the Oldsmobile and True Value sites are heavily CGI-based. Indeed, both immediately redirect to index.cgi files. There seems to be some use of active server pages (ASP), but no ActiveX controls.

The ActiveX ad says "Visit Giant Step's web site and you'll see several client logos literally take root and sprout across their homepage. It's just one of several cool controls Adam whipped up late one night in his Chicago design studio with the help of ActiveX." When I go to their site, with either MSIE or Netscape, I see sprouting and rooting (though not of company logos), but it seems all done with animated GIFs.

The Corn Pops site has a bunch of very funny games you can play, such as "Keep the Corn Pops away from grandma" (this will make sense to anyone with small children and/or who watches commercials on kids' television). And the web page, sure enough, has an OBJECT tag. But within the OBJECT tag is an EMBED tag: it's not any sort of custom ActiveX control at all: just the Macromedia Shockwave player which he appears to be using to do all the cool animation.

The strangest one is that NY apartment finder, www.aptfone.com: first of all, they're running WebSite Pro/1.1h. Now, sure enough, there's an OBJECT tag, and in MSIE you get an Authenticode notice about downloading the Internet Timer Control. It turns out they have a (slightly) animated image map. If you examine it in Netscape, you get the same image map, but without the rather minimal animation.

That seems to be the sole use of ActiveX. Hardly justification for the ad's claim that, with ActiveX, this guy has made apartment hunting in NY fun.

The use of ActiveX is so minimal that I wonder if these ActiveX ads reflect nothing more than MS's Site Builder Network (SBN) requirements that SBN members have a page that uses ActiveX somewhere, anywhere, no matter how unnecessary, trivial, purely cosmetic, or tangential to the site's purpose.

Here's the funny part: if you go to http://www.aptfone.com/rentmn.htm, for renting an apartment in Manhattan, sure enough you can select "Hell's Kitchen" as the neighborhood, just as you would think from the ad. But it's an HTML form. And the FORM ACTION= points to a Win-CGI app!: http://www.aptfone.com/cgi-win/AptFoneClient.exe.

Now, in fact, they didn't have any listings available in Hell's Kitchen right now. But if this thing did help anyone find an apartment in Hell's Kitchen, it would be because of Win-CGI, not ActiveX. The use of ActiveX is purely cosmetic. Win-CGI is what does the actual work.

Of course, these are advertisements, and no one over the age of about 9 or 10 expects ads to be truthful. But I think it's an interesting exercise to take these ads at face value, and see what they can tell us about ActiveX and its real-world uses.

{{end of letter}}

List of Level 3 members at http://www.microsoft.com/sbnmember/showcase/default.asp, though oddly neither Blue Marble nor Giant Step listed. Case studies at http://www.microsoft.com/sitebuilder/webadvantage/default.asp does list Hallmark web site, created by Giant Step. See http://www.microsoft.com/sitebuilder/webadvantage/Hallmark.asp. This perhaps should be case study for ActiveX, rather than ads??? See especially http://www.microsoft.com/sitebuilder/webadvantage/hallmarktechnical.asp, with quotes from Adam Heneghan, on moving from Unix to Windows.

www.hallmark.com: Clever little thing, click on "OVER" button to see Hallmark logo on "back" of web page: http://www.hallmark.com/over.cgi.

Hell's Kitchen, or Potemkin Village?

Hallmark Nice-O-Meter is also CGI based: http://www.hallmark.com/niceometer/survey.asp?ans1=2&ans2=2&ans3=2&ans4=4&ans5=5&ans6=2&ans7=2&ans8=1&ans9=2&ans10=3

Has reminder service at www.hallmarkreminder.com, but server (Netscape-Enterprise/2.01) down for a few days. Maybe switching to IIS???

"Seasons and Reasons" message board is CGI based, e.g., http://www.hallmark.com/Message_Board/Topics/sharingMb/comments.cgi?thread=00003

Store selector: http://206.126.161.4/scripts/dealer.idc?userzip=95404 (works like CGI, but what is IDC??).

Hallmark Connections Electronic Greetings at http://www.hallmark.com/connections_bin/egreet/egreet.html. E.g., http://www.hallmark.com/connections_bin/egreet/egreet.cgi?PICTNAME=10 is animated GIF (http://www.hallmark.com/connections_bin/egreet/gifs/Pict10.gif) with message "Hope you laugh until cake and ice cream come out your nose!" Result: sent email msg that tells you to go to this URL: http://www.hallmark.com/eg/parse.cgi?/egreets/0315971/861086739.eg Well, this clearly is CGI.

Is there *any* ActiveX at this site? Maybe do batch file to check (look for clsid rather than object, since "HTTP/1.0 404 Object Not Found"):

geturl -split http://www.hallmark.com > h1.lst
grep -i clsid h1.lst
grep -i href h1.lst | sort | uniq | geturl -split -stdin -base http://www.hallmark.com > h2.lst
grep -i clsid h2.lst
grep -i href h2.lst | sort | uniq | geturl -split -stdin -base http://www.hallmark.com > h3.lst
grep -i clsid h3.lst

http://www.shoebox.com ("A tiny little division of Hallmark") has rejects: http://www.shoebox.com/funny/card.asp?date=041497&card=2. {{letter on ActiveX Control Pad; see also chapter 2 sidebar on "Microsoft's 'Vision' for the Web: CLSIDs"}}

So I finally broke down and decided to learn a little bit about ActiveX. I bought something called 10 Minute Guide to ActiveX Control Pad (it's a little book of 19 10-minute lessons), read that, downloaded MS's ActiveX Control Pad, and created an HTML page that uses their silly Label Control. Silly because many of the MS ActiveX controls seem to just duplicate HTML or JavaScript functionality, simply giving it a slightly more Windows "look and feel."

Anyway, I could see Control Pad create a nice <OBJECT> tag for me, with one of those CLSID things. I've realized that those in truth are MS's alternative to URLs!! CLSIDs are the glue that holds everything together for MS, just as URLs are the glue that holds together the web.

I looked at CLSIDs when I was editing Ron Petrusha's book on the Win95 registry. It turns out that they're just UUIDs, which first made their appearance in the OSF DCE RPC system. One of the O'Reilly DCE or RPC books has a really good explanation. There's a complicated algorithm by which the uuidgen utility generates what is supposed to be a globally unique number string.

The HTML generated by Control Pad (I will say that Control Pad is a great way to start learning about ActiveX!) looked like this:

<OBJECT ID="Label1" WIDTH=264 HEIGHT=132
 CLASSID="CLSID:978C9E23-D4B0-11CE-BF2D-00AA003F40D0">
    <PARAM NAME="Caption" VALUE="ActiveX seems like a waste of time to me.">
    <PARAM NAME="Size" VALUE="6985;3493">
    <PARAM NAME="FontName" VALUE="Lucida Handwriting">
    <PARAM NAME="FontHeight" VALUE="480">
    <PARAM NAME="FontCharSet" VALUE="0">
    <PARAM NAME="FontPitchAndFamily" VALUE="2">
    <PARAM NAME="FontWeight" VALUE="0">
</OBJECT>

I ran by regdump utility from the disk that comes with Ron's book, and searched for the screwy-looking CLSID. Here 'tis:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\
 {978C9E23-D4B0-11CE-BF2D-00AA003F40D0} -> "Microsoft Forms 2.0 Label"
   Control -> ""
   MiscStatus -> "2761105"
   DefaultIcon -> "C:\WINDOWS\SYSTEM\FM20.DLL,0"
   InprocServer32 -> "C:\WINDOWS\SYSTEM\FM20.DLL"
	 ThreadingModel="Apartment"
   ToolboxBitmap32 -> "C:\WINDOWS\SYSTEM\FM20.DLL, 95"
   ProgID -> "Forms.Label.1"
   TypeLib -> {0D452EE1-E08F-101A-852E-02608C4D0BB4}
   Version -> "2.0"
   Implemented Categories
	 {7DD95801-9882-11CF-9FA9-00AA006C42C4}
	 {7DD95802-9882-11CF-9FA9-00AA006C42C4}

So here's where things get frightening: whatever security they think they have in place about downloading ActiveX controls, the fact is that the sole mechanism they have for loading the controls is keying off the CLSID entry in the registry.

If you change the entry in the registry to point to a different DLL, they try to load it!

So how could the registry entry get changed? Well, a silly user could do it with regedit, of course.

But the interesting question is: do ActiveX controls have the ability to change the registry? Could a malicious ActiveX control get in and re-route all your CLSIDs to point to different DLLs.

Unfortunately, yes. To confirm that ActiveX controls do have access to the registry, I ran link /dumpbin /imports on this FM20.DLL thing and, sure enough, it imports numerous functions from ADVAPI32.DLL, including RegSetValue, RegCreateKey, RegDeleteKey, etc. Oddly enough, from KERNEL.DLL it imports (among many other functions) WriteFile, _lwrite, OpenFile. Why?!

Particularly frightening because these things are scriptable. Can MS (or any ActiveX author) say with any certainty that there are no paths from the scriptable interface to the control, to the code in their control that mucks with the registry or the local file system? I doubt it.

There's certainly nothing to prevent someone from writing an ActiveX control that provides general-purpose access to the registry or file system, then providing a scriptable interface. Or even simpler, an interface via the <PARAM> tag.

{{end of letter on ActiveX Control Pad}}

{{beginning of possible article?}}

Anyone who is even remotely familiar with the process by which advertising is created knows that, by the end of the process, there is usually only the slimmest, most tangential, connection between the resulting ad and the product that it ostensibly describes. This disparity is almost guaranteed by the division of labor between product creation on the one hand and sales and marketing on the other. Advertisers and markets, in case the point needs to be underlined, are often remarkably ignorant of the products they devote so many hours to pushing.

This is common knowledge. So much so that, surprisingly, it is often forgotten. Even those who most claim to despise ads may be swayed by them. Nowhere is this more true than in software advertising. Vendors even play on this anti-advertising prejudice by hosting conferences in which the absence of "suits" is highlighted.

What then are we to make of ads in publications aimed at software developers? The average software developer will tell you that he "doesn't pay any attention" to the ads. Yet the ads are the entire purpose of the publication, the articles of course being mere bait. If software developers really pay no attention to ads, why do the magazines exist? Why do vendors advertise?

Because, clearly, even software developers who think themselves above all this "hype" are nonetheless swayed by it. It pays, therefore, to take technical advertising at face value -- at least occassionally -- are see what it tells us.

Case in point: Microsoft's recent ActiveX advertising in Web Techniques, Web Developer, and its own Microsoft Interactive Developer.

{{end of possible article opening}}

Also do something on "ActiveX for Dummies"?

No one using ActiveX (RMS on AV object:* count) right now, not clear what would use it for (solution in search of a problem?), clear that MS came up with ActiveX not as solution to a problem, but merely as technology they could throw at web in response to Rick Sherlund, etc. Ask average developer what their problems are, what percentage of these problems solved by ActiveX, or even Java? Maybe 5%?

On the other hand, RMS says e.g. he wants to be able to plot data. Instead of shipping GIF, wants to ship data, and tell something in browser to plot it. Yes, browser should have built-in, but next year it will be different need. So browsers clearly need *some* extension mechanism. But Java, ActiveX controls, and plug-ins all feel wrong, not in spirit of HTML. JS on the other hand is in spirit. So what kind of solution?

Browser should have API like GDI, extensions can access that, period?

Do app based on geturl: do AltaVista search for object:*, applet:*, embed:* (see http://www.altavista.digital.com/cgi-bin/query?pg=ah), get first 200 entries, short-form; then go to each entry, total up uses of different ActiveX controls, plug-ins, Java applets. Look ActiveX controls up in list (CLSID -> name, dll). Start with http://www.altavista.digital.com/cgi-bin/query?pg=aq&fmt=c&q=object%3a%2a&text=yes; with all AV apps, use &text=yes. Any way to get more entries per page?

Hell's Kitchen: see http://www.hellskitchen.net/ (Hell's Kitchen Online, running Apache/1.1.1), novel by Lorenzo Carcaterra, movie Sleepers (http://www.sleepers.com/cmp/hellstoday.html; WB 1996 movie, Barry Levinson, site running Netscape-Enterprise 2.01; has film clips via ???), also http://www.broadway-web.com/hell/index.html ("We're the neighborhood your Grandmother warned you about."), angry response to novel Sleepers at http://www.catholic.net/RCC/Periodicals/OSV/osv0114.html. Page on "Sleepers controversy": http://members.aol.com/Dimplesj/sleepers.html

Potemkin Village: see MS's online encyclopedia, Encarta. Uses CGI! http://www.encarta.cognito.com/cgi-bin/cgi_appl.cgi/9/7/26779/4?xrn_2 (transient URL), from Columbia Encyclopedia: "Potemkin played an important part in the annexation (1783) of the Crimea, for which he was created prince. As governor of the new province, he organized Catherine's fabulous Crimean tour of 1787. The allegation that he had sham villages (Potemkin villages) built along her route is, at best, an extreme exaggeration, for Potemkin was in fact an able administrator, and he did much to develop the Crimea."

At Encyclopedia Britannica (Netscape-Enterprise/2.0a, http://www.eb.com:195/cgi-bin/g?DocF=micro/478/16.html&bold=on&sw=potemkin&sw=village&DBase=Articles&hits=40&context=all&pt=1&keywords=potemkin%20AND%20village#first_hit), "Catherine's tour of the south in 1787 was a triumph for Potemkin, for he disguised all the weak points of his administration--hence the apocryphal tale of his erecting artificial villages to be seen by the Empress in passing. ("Potemkin village" came to denote any pretentious facade designed to cover up a shabby or undesirable condition.)" How much MS sites rely on CGI? Do as they do, not as they say.

MS Cinemania on Sleepers? http://www.cinemania.com/Movie?MovieID=70060, has stills and AVI clips. Any benefits viewing site in MSIE rather than Netscape?

Internet Movie Database (permanent URL): http://us.imdb.com/M/title-exact?Sleepers%20%281996%29

Other real-estate sites for NY? http://www.yahoo.com/Regional/U_S__States/New_York/Cities/New_York_City/Real_Estate/. HomeLine, http://www.220home.com/ (Netscape-Enterprise 2.0a), http://web1.mlx.com/homeline/dynamic/prospectsearch.cfm (running MIIS 1.0!)

What's at http://www.activex.com/?news.activex (c|net)? Using "Smart Controls". But running Netscape-Communications/1.12! Has "cascading menu control," enclosing very large amount of "alternate HTML." So using the ActiveX control looks like preferred solution. But after download control, how much save? (One-time operation; ActiveX control sort of like style sheet/macro for HTML.) How does same page look in Netscape?

Well, www.ora.com isn't running WebSite, either. (WebReview running Apache/1.1.3.) But how much ActiveX used at www.activex.com? (Get quote from Dorothy Sayers, "Murder Must Advertise" about how advertisers don't use their own products.)

See http://www.activex.com/PC/Result/MostPopular/0,14,0-0,00.html for most popular ActiveX controls. Most of what's on page isn't ActiveX controls at all: MSIE versions, patches, etc. Most popular control seems to be "ActiveX Content Navigator Tab & Tree," which "maps and renders a Web site's entire content into a familiar Windows 95-style set of tabs and an Explorer-like directory tree." Also plug-ins for different media types.

www.activex.com list of controls: "Online Applications" 16, mostly games. Cool, can sort list by # downloads. How do it? See cnet_ax.html: looks like VBScript. What happens if Netscape? Gratuitous use of VBScript? Anyway, most popular non-game, non-plugin control here is "ActiveX Stock Graph with Technical Analysis" from Telescan. Another popular one on "Browser Enhancements" page (has 26 controls) is "Carbon Copy/Net ActiveX Control" from Micro Computer Resources: "ActiveX control for Internet Explorer that gives you remote control of another PC over the Internet. It's ideal for remote access, support, collaboration, and remote software demonstrations." Another is Citrix WinFrame: "Enable Windows Application Launching and Embedding across the Web." Hmm, sounds like my two-line CMD thingy! Maybe show how to do this stuff with MIME types!

MS trying to expand meaning of "ActiveX" beyond ActiveX controls, so that anything "active" on web seen to be part of ActiveX. But web was active long before MS came along (despite its "Active the Internet" slogan), and most of this dynamic content done with CGI, animated GIFs, etc. Even MS's own stuff! Of course, MS at server end but that little effect on client: invisible plumbing.

That would be good section too: what MS itself doing with ActiveX controls? How much use CGI or not? Note difference client-side and server-side. Do what they do, not what they say.

"Components" never really worked even on single-machine Windows; DLL versionitis; etc. Now supposed to believe that people who put together this system can tackle worldwide distributed components? Dvorak has funny article on DLLs: "I can name program after program that won't run because of some missing DLL or other. It seems to me that scattering files all over the disk so a program can run is pure lunacy. The original idea behind Windows was to provide a common set of drivers for common devices to take the burden of writing them off third-party developers. But the coders have developed competing DLLs and now can't code a program that just runs. Instead it is tied into the OS in such convoluted ways that it's a miracle that it works when installed." (http://www.pcmag.com/insites/dvorak/jd.htm, permanent URL is http://www.pcmag.com/insites/dvorak/jd970421.htm).

MS anal approach vs. what made web successful (Tim B-L's main innovation: links can break). Cf. Dvorak on error 404: http://www.pcmag.com/insites/dvorak/jd970224.htm. But web scales precisely because no guarantee!

DiLascia and Stone article on Sweeper: "Amidst all the commotion, Microsoft has been quietly developing its own info-vision. Codenamed Sweeper and recently renamed the Active Internet Platform or AIP (we use both terms interchangeably here), this stuff will blow your socks off. Sweeper is to the current state of the Internet what Windows® 3.1 was to MS-DOS®." (http://www.microsoft.com/mind/0396/sweeper/sweeper.htm). Ah, so that's the MS argument: current Internet is like DOS, MS will come in and window-ize it.

But what MS offering the web relates to MS-DOS in same way that OS/2 did! A lot of extra complexity, without many tangible benefits to show for it.

Decent looking article on Java app size bloat: http://www5.zdnet.com/zdnn/content/zdnn/0425/zdnn0015.html

Ultimate threat to MS isn't Java (http://www.pcweek.com/opinion/0428/28week.html), it's HTML.