Thanks.

What is SCORM Cheatlet?
I coined “cheatlet” as a portmanteau of cheat and bookmarklet (itself a portmanteau of bookmark and applet). A bookmarklet is a browser bookmark that uses the javascript: protocol prefix instead of the typical http: prefix used for web pages. This allows one to create a bookmark that runs JavaScript code in the browser.

I dove into bookmarklets when developing my iPastelet utility for iPhone in the summer of 2008. It immediately occurred to me that this technique could be an interesting way to hack/cheat the SCORM JavaScript API. Thus was born my implementation of the cheatlet. It worked easily and nearly immediately. By clicking a bookmark, I could send a score to an LMS. I tuned it to send a time, a status, and in a sinister turn, close and then nullify the API object handle to prevent any legitimate data from overwriting the hacked score.

Cheatlet Concept goes Public
In late August 2008, with a working demo of this code in hand, I sent it to major players in the SCORM world, including a major ADL contract agency, major LMS vendors, SCORM code suppliers of various types, and tool vendors. Many vendors responded that it was simply an instantiation of a hack to a known issue. One indicated they were well aware of this and raised the issue early on to discourage the AICC from deprecating HACP for the JavaScript API, that vendor was Questionmark (Disclosure, I started work for Questionmark in January 2009).

I seemed to be more concerned than others. In late August, I submitted a paper on the issue to the LETSI SCORM 2.0 Workshop, without disclosing precisely how to implement or code the exploit. The paper, Security Before Features was discussed online and at the Pensacola meeting in October 2008, but little seemed to happen as a result. Work continued on SCORM 2004 4th Edition without any API changes.

Cheatlet Example/Running Code Goes Public
Flash forward to a few weeks ago. Working completely independently, Phillip Hutchison had a similar moment of inspiration and crafts his own SCORM “cheatlet” bookmark. The big difference was this included a working cheat as a link right in the blog post (chealet linked since removed, but code is still available by request to Phillip). Soon this issue received broader attention. Reaction and opinions flew about the internet. Plateau proactively sent a letter to its US government LMS customers about this issue to help calms their fears. Ironically, I think this also drew further attention and discussion.

Defense Approaches, Work-arounds, Opinions
Soon after the example code hit the internet, opinions flew between experts on twitter, email and blogs. I posted a overview of the issues on the Questionmark blog, along with a follow-up post on general defensive strategies, including some specific solutions to support those approaches.

• The Importance of Security and Integrity of Performance Data
• Defense in Depth: Security for SCORM and Beyond

The ADL posted workarounds for some aspects of the vulnerability. Both are more clearly aimed and HTML/JavaScript coders, but that may be exactly who read this blog.

• SCORM Content Vulnerability Workarounds by Jonathan Poltrack
• Securing Your Assessments, Excerpt from Carnegie Mellon Best Practices Guide for the Design and Development of SCORM Assessments (means to make “View source” more challenging)

Some feel quite strongly that SCORM has never been suited for more than the lowest-stakes elearning events. I feel that stakes must always be viewed as a continuum. Furthermore, I believe it is far easier to consider the high stakes end of the spectrum first and back-down as necessary. In any environment, is incredibly difficult to start with little or no security and patch your way up to a secure system.

Others may see it differently. I’m sure there will be plenty of opinions. I’d say my views on this issue tend to align with Phillip Hutchison (whom I’ve never met, but respect) more than Mike Rustici (whom I’ve known & respected for many years). I’ll come back and update this post as they emerge. Other opinions include:

• SCORM security (two kinds of SCORM people), Phillip Hutchison, Pipwerks
• SCORM Security – Some Perspective, Mike Rustici, Rustici Software

Claude Ostyn made great contributions to elearning, always showing diligence, dedication and great passion in learning technology, as well as all of his other interests. He was a vigorous and active participant in the work of AICC, ADL SCORM, IEEE LTSC and IMS– you’ll find his name as a contributor and reviewer on countless documents & whitepapers, throughout the support forums, and on delightfully precise ballot comments. The Reusable Competencies Definition group is currently working on dedicating a specification to his memory.

Will elearning standards and specifications be the same without Claude Ostyn?

Basically, in effect, No.

When the FTP box is checked, Captivate 2 makes invalid SCORM 1.2 and invalid SCORM 2004 packages. Under these conditions Captivate 2 puts the required zip-archive root-level files like "imsmanifest.xml" down in a directory structure 4-5 levels deep.

   Captivate 2 Elearning Output published with FTP


   Captivate 2 Elearning Output published locally

This means that when FTP is used, the resulting zip file that gets transferred to the server is NOT valid, whether it is SCORM 1.2 or SCORM 2004. Adobe was notified of this issue last Fall and confirmed the problem. At the time of this post I can not find a tech note about this issue.

The workaround is to not use the built-in FTP. Instead, use the Publish Dialog to publish for Flash (SWF), select the "Output Options" to Zip files and under "Project Information" select the desired eLearning output format for your package. Finally, after Captivate publishes the zip package locally, use a third party FTP tool or other LMS import capabilities to transfer the valid SCORM package to the LMS. This will give you a better shot at having the package import into your LMS (or LCMS).

   Captivate 2 Publish Dialog settings for local publishing of packages

Two final notes on this topic. First, this bug means PENS doesn’t really work. The work around there is to "trick" Captivate 2 by publishing to one FTP address, and then configuring the Captivate PENS settings to use an alternate URL that has a valid package staged by other means. For anything other than testing the capabilities of an LMS server, I wouldn’t bother with this approach– it sort of defeats the intended simplicity of PENS to manually FTP and publish twice to order to get a single package to an LCMS/LMS.

The second note is that there may be other issues with Captivate content communicating to an LMS. I’ve received private email from one content developer about some issues and heard from another contact that other settings may not work as intended/advertised. I’ve yet to verify these, but will post more information once this can be confirmed or denied.

This is a significant achievement. It indicates the maturity and stability of SCORM, yet also recognizes the criticality of on-going maintenance and refinement. The SCORM 2004 specification is also being formally submitted to ISO, where the technical committees will review it and allow member nations to vote on it. In 2007 we will see more SCORM work being done within other standards work groups and organizations.

The February IMS meeting in San Francisco is an important transition as SCORM moves into this new phase. On February 7 there will be a workshop that is open to the public for discussion of IMS-related work with SCORM. ADL representatives will be presenting and facilitating discussions on how the groups can work together, and on content packaging, a key technical component shared between the organizations. Content packaging includes the organizational and metadata "wrappers" for shareable content objects and is a critical feature for supporting reusable learning object strategies. The ADL will also present information on CORDRA, an architecture for structuring searches and sharing across repositories, and Simple Sequencing and Navigation within courses. See the IMS website for the agenda information, IMS membership is not required, but there is a meeting fee for attendees.

During March there will be a kick-off meeting for a new stewardship organization to coordinate SCORM evolution and maintenances. The meeting will be held in conjunction with the ISO/IEC JTC1 SC36 meetings in London. This meeting about the stewardship organization is preliminary. An official charter and transition is likely to take until the Spring of 2008. Those interested in participating in this meeting or the stewardship organization committee in general can directly contact the ADL or request that I forward information.

In the book, Larry and the gang take on a bunch of lies and myths, sometimes alternating sides, but always making strong statements. For example, Murray Christensen on Personalization: Learners Are Essentially the Same. Heresy you say? Last year, I saw a few presentations from Will Thalheimer on use of learning styles (or the "lie" about learning styles), and I have to agree, though I am not as courageous as Dr. Thalheimer with his $1000 USD challenge to the first person to demonstrate meaningful benefits from using learning styles in an instructional design.

Back to the book- I’ve lived and seen some other favorite lies from both the side of the consulting/vendor organization and the customer side of the fence, like:

• This is the team that will work with you on this project (at an early sales meeting; who know where these people will be staffed then).
• (All) the content and materials will be custom built for you.
• … and from the client side, We have full support for this project and our SMEs will be available whenever you need them.

What about you? Are your pants on fire? Is your nose as long as a telephone wire?

To hear, discuss and share more lies… and how to actually learn from them, check out the free seminar on Lies About Learning this Friday, January 19.

Lies About Learning January 19, 1:00PM Eastern [GMT -05:00] Register here

The seminar looks like it will be a good discussion of some key topics. You can also get the book from Amazon- Lies About Learning. Note that is not an Amazon Associate link so I get squat for the referral, other than karma.

Currently, the Reload Editor is available as a download on the Joint ADL Co-Lab site- Reload Editor 2004 v.1.3.2 beta 2. It looks like it was last updated in late October of last year, but it should still do the trick for most of your SCORM metadata editing needs.

CORDRA (Content Object Repository Discovery and Registration Architecture) is an architecture and specification for registering content in a repository, and being able to do searches across repositories. CORDRA leverages The Handle System to resolve unique, persistent resource identifiers, to handle authentication and more. The simplest explanation I’ve heard of Handle is that it is "A better DNS system than DNS." The Handle System is being handled by CNRI and is funded by DARPA, the good folks that brought you things like the internet

.

Last month, I bashed a few LMS vendors about not caring about certification for SCORM and AICC (or the glaring lack of certification).

Kudos to Saba for stepping up and getting Saba Enterprise Learning Suite 5.3 certified for SCORM 2004 2nd Edition (Test Suite 1.3.3) in April. Now all Saba is missing is a current AICC certification.

Hopefully, we’ll see some other vendors step up to the plate soon for AICC, and/or at least announce a position regarding SCORM 2004 certification (e.g., are they waiting for 3rd Edition?). I’d still love to see a current certification for Oracle, SAP, or SumTotal.

Hmm, sorta makes you wonder why companies have problems integrating their content with their LMS.

Not that the issue is entirely on the LMS side. I don’t see many content vendors with current AICC Certification either though. No current AICC certification for Articulate, DazzlerMax, Lectora Publisher, and ToolBook to name a few. There are quite a few I didn’t name too.

Content tools fare much better with SCORM 2004 certification , where you will see that Adobe Breeze, Adobe Captivate, Articulate Presenter, EEDO ForceTen, OutStart Evolution and ToolBook are all listed.

Time to run off to Masie’s LMS 2006 Users Group that is running right now. It is no wonder that this event sold out.

PS- Plateau has both AICC certification and SCORM 2004 certification currently. The only one out there as far as I can tell.

I recall a cross-product/platform strategy like this from Wicat that was referred to as "Nemesis". The idea was that a database (or in the S2PE case, XML) contains the guts of a the elearning presentation. Then an "engine" reads that data and renders the elearning.

In the Wicat case, this provided flexibility to deliver training in a customer’s preferred format– they could write an engine in Authorware, IconAuthor, ToolBook, or virtually anything that coul "play" the presentation database.

The challenge with a presentation engine approach is that you lose many of the benefits of the host system or language– Director Lingo or ActionScript idioms and optimizations are often lost in the database representation, and an individual developer’s proficiency becomes less valuable. Conversely, that de-valuing of AS or Lingo expertise, can make it much easier to do automation, mass production, or farm things out to non-experts. Ironically, it can also make things much harder for a host system expert who comes in to a project later; their hands are tied to the data structures in what seems like unexpected ways.