Information Gift

Have you looked at any Flash Player detection scripts? I've been testing swfobject in IE7 regularly, and haven't seen anything like this yet... Is this something new that they just changed?

Hey Geoff, no, this doesn't affect Flash detection, only QuickTime and WMP 6.4, and any stats package that also uses plug-in detection for those types to gather metrics on visitor capabilities.

Hi Lewis... "The core problem is a security change to IE 7 that deprecate formerly recognized ActiveX controls as 'safe' to use"... this sounds like it might be binary signatures on controls... older ActiveX Controls, without this new identification scheme, might be the ones affected.

I just tried to research but couldn't find a hit (and it's a Saturday morning and sunny outside ;-) but if this is the issue I think it is, then both Shockwave and Flash made the change about two years back. I tried searching on terms like "signed binary" and "digital signature" but didn't find docs yet... the two sets of Player Release Notes might be the place.

Thanks for posting the observation, I want to check more into this later.

Hi John,

I installed the latest version of QuickTime on my XP VM, hoping that this was the issue; sadly, no love.

Appears that not only is simple detection waylaid by the security alert, but QT content, itself. IOW, the potential of running QT via detection scripts, which may or may not result in presenting QT content (detection/degradation or metrics strategies), trigger the alert as well as actual presentation of QT content. It's a one-two punch for our clients.

This issue can be tracked both on Microsoft's Connect and AWStats bug tracking sites.

I found the reference I was remembering... Google term "'internet explorer' 'unsigned activex'" pulls it up:
"Changes to Functionality in Microsoft Windows XP Service Pack 2, Part 5: Enhanced Browsing Security"
http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2brows.mspx

Do a text search on "unsigned activex" in this page to find the section. The documentation is worded vaguely, though, and I'm not positive this is the new restriction I recall.

...hmm, I tried more searches, and there's this line in the following document, which uses a different descriptor: "Shockwave Player version 10.1 is the latest update of the Player. It includes fixes for issues identified since the release of Shockwave Player version 10.0, signed components for Microsoft Windows XP SP2 compatibility...."
http://www.adobe.com/cfusion/knowledgebase/index.cfm?id=tn_15508

Flash and Shockwave got this "signed binary installation" in autumn 2004, after Win XP SP2 hit, but I'm not sure whether QuickTime did... search terms like "site:apple.com "service pack 2" quicktime" turn up mailing lists on the first page of hits, not technotes. I don't know what its expected behavior is, and trying to decrypt the Microsoft docs to see changes is not what I'd like to do while watching the Mets and the Dodgers.... ;-)

Can you copy down some of the unique text you see in the alert dialog, and search on that string? This might turn up a more direct reference.

I searched for "this website wants to run the following add-on" and found many issues, often related to ad-serving applications that use detection as a precursor to deploying rich media adverts.

From Microsoft's ActiveX Security: Improvements and Best Practices:

Some ActiveX controls will not be disabled by ActiveX Opt-In.

Controls that are commonly used and that were designed with security scrutiny will not be disabled. These controls will appear on a pre-approved list.

Controls which were used in IE before upgrading to IE7.

Controls which the user downloads through IE7 will be automatically enabled during the download and install process.

Controls which are on the pre-approved list will run without the Opt-In prompt; however, if a control is pre-approved but is not installed on the machine, the user will have to go through the existing XPSP2 download behavior to get the control.

It's beginning to look like there will be no completely transparent solution to detecting the presence of QuickTime in IE 7.

I'll test to see if IE 7 still complains when on an upgraded system that already has had QuickTime installed -- my tests were on a virgin IE 7 /Win XP SP2 install.

Ok, so on a XP SP2 system that already had QuickTime installed (QT6.5), IE7 RC1 allows embedded QuickTime content to play w/o the security prompt, BUT still prompts for the QuickTime detection attempts. Same behavior if QT 7.1.3 is installed and run in IE 6 before an upgrade to IE 7RC1.

Looks like the fix for QuickTime detection might be to replace:

"QuickTimeCheckObject.QuickTimeCheck.1"

with

"Quicktime.Quicktime"

I still need to do more testing, but so far this seems to work on systems that already have QuickTime installed.

There appears to be a slight problem with "QuickTime.QuickTime" also. If you install QuickTime 7.1.3 and then UNINSTALL it, the "QuickTime.QuickTime" will erroneously tell you that QuickTime is still present. This appears to be a bug with the uninstaller.

Hey Eric, 'QuickTime.QuickTime' works for me after uninstall of QT 7.1.3 via Add/Remove Programs; tested with XPsp2, IE 6 and IE 7. Did you uninstall using QuickTime's provided uninstaller or also via Window's Add/Remove Programs?

I used the Windows Add/Remove Programs.

I guess I'll have to keep trying to see what is happening.

I can't remember -- does Add/Remove Programs automatically close IE when you uninstall QuickTime? If not, then IE might think the control is still present, or might even prevent the control from being removed properly. Fwiw.

I never have IE open while installing or uninstalling plugins.

I did some more testing, and I get similar results, but ONLY for QuickTime 7.1.3.100

For QuickTime 7.0.2 and 7.1, when I uninstall QuickTime then ActiveXObject("QuickTime.QuickTime" ) is undefined - as expected.

For QuickTime 7.1.3.100, when I uninstall I get ActiveXObject("QuickTime.QuickTime") is an object.
Same for "QuickTime.QuickTime.4"

What can I say.
WinXP SP2, IE7

Same build here, works fine on two WinXP SP2 / IE 7 installs with my modified awstats_misc_tracker.js tracking code.

Weird -- let me know if you figure out the problem; I'm using similar code for several clients.

I have tested virtually every QuickTime installer from version 5.0.2 to 7.1.3. Every one of them behaves as expected when I uninstall - except for 7.1.3. For that version, I still get "QuickTime.QuickTime" and "QuickTime.QuickTime.4" as objects even after the uninstall. I even went so far as to download the 7.1.3 from 2 different websites, one from Apple's, and the other from oldversion.com. Same result for both.

As a side note, there is a little other info that might be of some interest.

For QuickTime < version 5, then is no "QuickTime.QuickTime" ActiveXObject

For QuickTime 5.0.2 - 5.0.5, we have "QuickTime.QuickTime" and "QuickTime.QuickTime.1"

For QuickTime 6.0.2 - 6.1, we have "QuickTime.QuickTime" and "QuickTime.QuickTime.3"

For QuickTime 6.3 or higher, we have "QuickTime.QuickTime" and "QuickTime.QuickTime.4"

Hey Eric, are you seeing this problem on more than one machine? As I wrote earlier, we're using this IE 7-safe detection for many of our clients, + it will be used in the next version of AWStats -- I'm hoping that this is limited to your particular configuration. ;)

Btw, the very first QuickTime ActiveX control was released after QT 5.0.2 in response to Microsoft deprecating support for Netscape-stye plug-ins.

Only on one machine. I hope no one else sees this issue.

The older Quicktime Plugin .ocx could cause a problem with the newer IE7, thus the dreaded "IE needs to shut down" warning appears

The solution is to download the latest version of Quicktime, which contains a fix for the Quicktime Plugin .ocx for IE7.

It seems Microsoft didn't include Apple in it's list of compatable plugins for Internet Explorer.

Download the latest Quicktime 7.1.3 for Windows, and your problems should be over.
http://www.apple.com/quicktime/download/win.html

With or without Itunes. I choose without, as I don't use Itunes, otherwise it's a waste of resourses

"Appears that not only is simple detection waylaid by the security alert, but QT content, itself. IOW, the potential of running QT via detection scripts, which may or may not result in presenting QT content (detection/degradation or metrics strategies), trigger the alert as well as actual presentation of QT content. It's a one-two punch for our clients."

I'm not sure that I can believe that. QuickTime is supposedly pre-approved for use in IE 7.
The list of pre-approved controls are shown in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved

I deleted the registry entry for QuickTime from the 'PreApproved' registry key, and also uninstalled QuickTime. When I uninstalled IE 7, and then reinstalled IE 7, the entry for QuickTime reappeared in that registry key. So, the IE 7 installer appears to add certain plugins to the pre-approved list.

Of course, I am referring to the final release of IE 7, not some beta version of IE 7. Perhaps you were testing a beta version or release candidate of IE 7?

Eric,

Just checked with the shipping version of IE 7 and used the QT 7.1.6 install; found the following behavior:

- Loading a page with embedded QuickTime content triggered the IE 7 Information Bar.

- Loading a page using the older "QuickTimeCheckObject.QuickTimeCheck.1" detection method resulted in same.

- Loading a page that tested for the presence of QuickTime using the "Quicktime.Quicktime" method did not trigger the Information Bar.

That's odd indeed. I decided to test with a clean slate. I created a blank disk in Virtual PC and installed Win XP (Home Edition) on it. Updated to SP2, and then installed IE 7.

The IE 7 installation creates a Registry key at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved

Within that key are subkeys with classid for 02BF25D5...(ie. QuickTime Object) and for 4063BE15...(ie. "QuickTime.QuickTime").
These subkeys tell me that the object tag for QuickTime should not cause an info popup in IE 7, and neither should ActiveXObject("QuickTime.QuickTime").

I installed QuickTime 7.1.6.200.

My result is that ActiveXObject("QuickTimeCheckObject.QuickTimeCheck.1") gives an info bar popup, as expected since it is not a pre-approved control.

On the other hand, ActiveXObject("QuickTime.QuickTime") does NOT give any yellow bar info alert. Again, this is expected since it is a pre-approved control.

And here is where we diverge...when I use an external javascript to embed QuickTime content into a web page, there is no info bar popup. None.
Again, I expected this because QuickTime with classid=02BF25D5... is a pre-approved control.

On the other hand, my previous complaint about QuickTime not completely uninstalling does not occur in my fresh Win XP install in Virtual PC. When I uninstall, "QuickTime.QuickTime" no longer instantiates. Just as expected.

I then installed QuickTime 6. The results were the same as for QuickTime 7.1.6.

So, I cannot really understand why you are getting a popup when you embed QuickTime content into a page. I have not heard of anyone else having that specific issue.

Hey Eric,

My first test was flawed -- to respond, I had hastily chosen a page for testing that I thought was a simple .js embeding w/o detection, but in fact was using the old, now broken method of QuickTime detection.

I created an object/embed pair static test page tonight and was able to present QuickTime content w/o triggering the Information Bar in IE7.

I no longer remember what caused me to state that simple presentation of QuickTime content triggered the Info Bar in the IE7 beta, but at the very least, it isn't a problem in the shipping version, and our experience is no longer divergent. ;)

Thanks for keeping me honest!

Could you test this site, and let me know if IE 7 gives you any popups or yellow alert bars?

http://www.pinlady.net/test/PluginDetect.htm

No complaints from my copy of IE 7.

Is that for WinXP SP2 or Vista?

Also, do you get a plugin version for each plugin, even QuickTime/Java?

Does the page fully load?

I'm trying to see if there are any ways to get plugin versions without any popups in IE 7. But I don't know if this can be done reliably yet.

That's IE 7 on XPsp2. Eric, drop me a line at lewis at lewisfrancis dot com so we can continue this offsite -- there are some issues you should be aware of with some of the detection methods that are not IE 7-related.

The plugin detection script has now been moved here:

http://www.pinlady.net/PluginDetect/

It seems to work well.

Guys it looks like you may have some help for a lot of people who have downloaded Quicktime 7.3 and now receive a error 46 can't find or load Quicktime activeX control. This is in a Vista box which has IE7. It appears Apple will not help at all even if you purchased the Quicktime 7. pro. Do any of you know of a way to fix this problem??

Michael, I've not run into this problem but a Google search turned up a lot of hits! It also turned up this potential solution, so, fwiw: http://fantazm.blogspot.com/2007/10/quicktime-7x-problems-under-vista-error.html