ActiveX controls, just like any other example of binary software, tend to evolve. This growth is of course intimately connected with updates introduced to either add new functionality or features, or simply to patch security vulnerabilities. Marc Silbey, IE Program Manager and Steve Herndon, Silverlight Lead Program Manager, have managed to come out with a three step guideline illustrating the best practices associated with ActiveX controls updating. It all starts with making detection logic an integer part of the ActiveX control. Additionally, developers also have to take into account the fact that IE7 in Vista runs by default in Protected Mode, and not automate the update to the point where the user is completely taken out of the equation.

"The best way to distribute an update is to have your ActiveX control download and install it. This update process should be kicked-off by checking the server for updates when your control is loaded in IE," revealed Silbey and Herndon. "Complete the server check on a worker thread instead of on IE's main UI thread, where your ActiveX control gets loaded. Following the same design principle, asynchronously check for updates quickly but not immediately. You might also want to check for the latest version only once a day or once a week instead of at every time your control gets loaded in IE."

IE7 Protect Mode in Windows Vista completely isolates the browser from the majority of locations in the file system and in the registry. Because it runs with the least amount of privileges possible, neither Internet Explorer 7 nor the ActiveX controls will be able to install upgrades. The two Microsoft Program managers stressed the importance of delivering a separate executable that will deal with downloading and installing the update.

"It's a good idea to notify users when updates are available, and let them choose to install them. Notifying users gives them more control over the update experience and also gives them context for the UAC dialog that will follow if they choose to install the update. Following the same principle of giving users control and context, it's not a good idea to automatically install updates or even give the user this option. Automatically installing updates doesn't give the user control and doesn't give them context for the UAC prompt as mentioned above," Silbey and Herndon added.