So I tried at home on my favourite Windows XP VM and it installed fine. Fine is of course subjective because it required three restarts to actually install itself (one for .Net 4.0, one for Windows Installer 4.5 and the final for Visual Studio Web Developer Express) – I’m not quite sure why these couldn’t have been bundled together into one restart (which is reasonable) or even what VS Web Dev Express was doing to require a restart. But I’ll live. I fired it up and did a Joomla! install and everything worked nicely. I tried the VS Web Dev integration and found it loaded everything up except that Web Dev doesn’t do PHP – back to the drawing board. As an aside why Microsoft doesn’t support PHP in VS Web Dev directly is a wonder – PHP as a language appears to be more popular than either of Microsoft’s according to langpop.com’s view of the world. To be fair, langpop.com is a mildly biased view towards open source areas (Google Code, Slashdot, IRC, Ohloh, Freshmeat) which would explain the dominance of languages such as PHP or Python. In any case, it worked and it had a funky editor with highlighting and not a lot else as well as a database editor that handled MySQL – and all in one package.

So I try to install it at work. First hurdle: I need Windows XP SP3. Ok, bummer. File a job, wait for ICT Service Delivery (yes that is their real department name) to get back and install SP3. They call me back in a week and say “when do you want this? is now a good time?” and I say sure. A few hours later and 64+ updates my computer has SP3 on it. Let’s try Web PI 3 beta again and see how we go. Much better, we’re off installing WebMatrix and all sorts of shiny. I ticked the Joomla! box as well and that is also installing. Everyone is happy. It then goes to try and configure IIS on my XP box. It pops up a component install view window and eventually gets to the point of asking me for an XP install CD. Except this is a corporate box and I don’t have one. I don’t have an i386 directory handy to just copy files from. I have local admin so installing stuff isn’t an issue but I don’t have those files. Bummer. I go hunting for them and I can’t readily find them locally and I don’t even know where to find them on the network. Sheepishly I hit cancel and WebPI keeps installing without configuring IIS 5 on my local machine. I thought I’d selected to use the WebMatrix server so I’m not entirely sure what is going on anyway. .Net 4.0 installs uneventfully (no restart this time) and Windows Installer 4.5 requires a restart. This time I’m not installing Web Dev so I don’t need to restart for that, yay! The rest went relatively smoothly which is good however at the end it complained IIS5.1 failed thus items dependent upon it (e.g. FastCGI for IIS5.1, PHP5.2.13, WinCache 1.1 for PHP 5.2) failed to install. MySQL Windows Essential 5.1 didn’t work because a service entry couldn’t be created, possibly because a MySQL service entry already exists. Joomla! didn’t work either but since both IIS 5.1 and MySQL failed to work I’ve got a selection of options.

Curiously I had an XAMPP install of MySQL set up and WebPI didn’t detect this properly opting to install its own version, perhaps a check on port 3306 to see if something speaks MySQL would be more appropriate to check. Improvements for next time.

So I fire up WebMatrix Beta and use its installer to install Joomla!. This one works better. It presents me with the same dialogue and insists I can’t have a blank password (my insecure XAMPP MySQL install insists otherwise but I secure it and both my security office and WebMatrix are happy). Joomla! appears to install perfectly fine now. Go figure. It also appears to have used the XAMPP MySQL install which is nice.

So some quirks in no particular order:

• Requests has an images filter which is nice but if you enable it, go from requests into something else and back again the filter button is depressed but the list isn’t filtered. Clicking on it filters the requests but messes up the state.
• Requests has an images filter which is a good start but no JS filter or CSS filter.
• The built in DB tool connects to MySQL fine however if you try to create a table with a column as both an “identity” (Microsoft SQL Server version of “auto_increment”) and a “primary key” it complains about multiple keys. Setting the field to just be identity appears to resolve the issue
• Perhaps most annoyingly the font choice is harsh, at least for me. Compared to Monaco on my Mac, it just looks disgusting. Unfortunately there doesn’t appear to be a way to change it either. After coding for half the morning in Smultron whilst my desktop was updating, WebMatrix was just garish and jutting in comparison.
• Whilst there is no autocomplete for the PHP as far as I could see, it would be nice to include a reasonable formatter. At least something that fixed indentation by default. Mind you, Smultron doesn’t have this but I do miss it at times.

I also at one point managed to get WebMatrix to terminate however you need to remember that WebMatrix is still in beta as a product so it is understandable that there might be some issues that will hopefully get fixed. All in all it looks like a good tool. As a cut down editor it seems to fit the bill quite nicely as well as being one of the easier ways to get up and running on Windows with a web development environment and PHP.

The article in question is entitled “Understanding Windows NTFS Permissions” and covers the basics of permissions for NTFS. It covers the fact you have read which is really made up of List Folder/Read Data, Read Attributes, Read Extended Attributes and Read Permissions. It also covers that NTFS permits permissions to be inherited but appears to miss the distinction of “This folder, subfolders and files”, “This folder only”, “Subfolders and files only”, “This folder only” when applied to permissions. Each of these actually impacts how permissions are inherited and applied, surely if you’re trying to understand this then explaining the distinctions here would be great and how they apply. He finishes with an interesting observation on the “precedence” of permissions. Now I find this curious because this is something I’ve been looking at late and I’ve been trying to find something that adequately explains it. Perhaps the author of the particular article is dumbing it down for his readers but it just strikes me as wrong. The author comments the following:

The scenario proves that there is a hierarchy of permissions for NTFS 5.0 resources. The hierarchy of precedence for the permissions can be summarized as follows, with the higher precedence permissions listed at the top of the list:

Explicit Deny
Explicit Allow
Inherited Deny
Inherited Allow

Ok, so its an interesting way of explaining it, but to mimic an annoying kid: why? Microsoft says in a dialog just previous that deny overrules allow so why would they so blatantly change the mind? To do so would mean that you would have to understand how NTFS evaluates permissions and calculates the permissions – but weren’t we reading an article about understanding?

This is the core of my gripe, the article doesn’t particularly give you a depth of insight or understanding in permissions that you couldn’t get by clicking things on and off to observe their behaviour. It treats one mildly non-obvious behaviour but doesn’t explain why NTFS would do this. To be honest I stumbled across this behaviour on another web site which had run into the pitfall of believing that deny overruled everything and was trying to understand why his security model was broken. His article hypothesised something much simpler: the algorithm finds the first explicit permission and uses it, if both are set then use the deny. No complex precedence model, something quite simple. And as Ockham’s Razor goes “the simplest answer is often the best”. But interestingly this also fits into the way NTFS appears to have been designed. For container objects, a permission can be set at a level and it can be determined just how deep it should apply: should it apply to just this container, just to subfolders or just to files? Or should it apply to a combination of those?

Interestingly I’m on the hunt for something that formally explains how NTFS permission inheritance works, I had thought this article would tell me but it doesn’t. It tells me a lot of what I know already but doesn’t actually enhance my understanding. I had read an article a while back that informed me of this ‘quirk’ in the behaviour but at the time didn’t think much of bookmarking it – and it is in fact this article that I’m looking for, and thankfully I just found it.

The article in question is “How IT works: NTFS Permissions” from the November/December 2005 issue of TechNet Magazine. It introduces the concept of “discretionary access control lists” (DACL) and also explains how they work. It explains that the DACL is checked in order until a match is found with the DACL created with denies first, then allows starting with the object and then incrementally for each item it looks for a match until it gets to the end at which point it denies. The single article just cleared up exactly how it worked, why it works and how it behaves explaining the behaviour. At this point I understand how and why it works, not just know that it works in a particular way – this is the difference between understanding and knowing.

But if you look at an old Gizmodo article you’ll see that Apple have been cheeky for a long time now, even suggesting two years before Vista’s release date that Tiger was it. Funnily enough by the time that Microsoft got around to releasing Vista for retail in early 2007, Apple had already released Tiger in April 2005 and was on its way to Leopard already releasing a beta of it at WWDC2006 and a feature complete edition for WWDC2007, releasing later in 2007. Apple haven’t stopped there and are already releasing betas of Snow Leopard at WWDC2008 with new and interesting features, some of which copied themselves and some interesting approaches at doing things as well as interoperability features including primitive Exchange support.

And now we’re seeing Microsoft push forward their plans for “Windows 7″ which from all accounts appears to internally think that its Windows 6.1 (you can Google for comments on the general confusion on which Microsoft appears to determine that this is version “7″ of their product as well as people doing the maths and not finding ’7′ as the number). With any luck we’ll see Snow Leopard and Windows 7 come out at around the same time and we can do a comparison between the two without much difficulty.