Launching Active Content

Changes in the Internet security landscape in recent years have had an unanticipated impact on developers of content delivered via portable media such as CD-ROMs and flash drives. The problem is that many portable media applications launch in a browser, and Microsoft's Internet Explorer no longer trusts so-called 'active content' on a CD-ROM, flash drive, or even the user's hard disc. This has been the case since an update to IE when XP Service Pack 2 was introduced (in mid-2004).

So what is 'active content' and why is it a problem? According to Webopedia, active content refers to content that is either interactive or dynamic. Examples include JavaScript applications and presentations that rely on Windows Media and Flash player ActiveX objects to embed video in web pages. These are common in eLearning and corporate marketing presentations distributed on portable media. Active content could be a problem if used to transmit software viruses or worms.

Individual users can force their IE browser to allow active content by opening 'Tools, Internet Options', selecting the 'Advanced' tab and scrolling down to the tickbox for 'Allow active content to run files on my computer'. This solution is well-documented, relatively safe, and not very difficult for users.

But there are also some clever tricks that content developers can employ to enhance the user experience, and prevent users from seeing security warnings about untrusted active content. The method I use forces the content to load from a network path. The use of a network path tells IE that the content is on the Internet (rather than in the local file system), and that the content is therefore trustworthy. This is one of many possible workarounds, but I find it is the most elegant.

To implement the solution, I created a batch file which is invoked when the media autoplays. It is lengthy, but how it works is pretty simple. The script uses the command 'net share' to create a network sharename for the current folder (where the content is located). It then tries to open a designated HTML entry page using a UNC path (eg- '\\computername\sharename\index.htm'). If either of these fail, the script simply opens the entry page as a local file, and leaves it to the user to manage their security settings. Typically it would fail if the user does not have rights to create a network share, such as in a secure enterprise network. But in most cases with novice users, the presentation autoruns seamlessly.

Following Microsoft's release of XP SP2, Macromedia also decided that Flash content should not be trusted when run locally. So they implemented a security model that forces users to explicitly allow local Flash content. But there were several problems with the implementation, most notably that one needs an Internet connection to change the settings - a convenience that is not always available for users viewing content on portable media. And Flash developers using CDs to distribute content, such as those producing eLearning modules, were upset because the CDs no longer worked properly after their users upgraded the Flash Player (to version 8 or later).

To implement a solution for a presentation that includes Flash, I created another simple batch file which is invoked when the portable media autoplays. This script creates a 'trust file' containing an entry which states the location of the current folder (where the content is located). The trust file may also include other locations for portable media (eg- 'd' and 'e' drives). The trust file tells the Flash Player plugin that content in these locations and contained subdirectories can be trusted. Once this script executes, any Flash content in the presentation can play seamlessly when launched.

These two batch files have proved handy for me. Please feel free to use and share them, and do comment if you note any problems with the implementations.

[On 16 June 2008, I posted an update to my instructions on launching active content. This post explains how you can replace the Net-Share script with one I call IE-Fix, that directly modifies the registry to tweak IE settings. Please review that post.]