Thursday, June 08, 2006
Study Finds Windows Server More Reliable Than Linux InternetNews - 6/8/2006 A study by the Yankee Group has found that Windows Server 2003 had nearly 20 percent more annual uptime in similar deployment scenarios over Linux. http://www.internetnews.com/stats/article.php/3611926
Thursday, June 08, 2006 6:57:21 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
Wednesday, May 31, 2006
This podcast in the ASP.net Podcast show series by Wally McClure features an interview with Thomas Deml and Chris Adams from the IIS team and myself. Thomas is a group program manager on the team which means he manages a few other program mangaers. Chris is the community program manager and I'm a technical evangelist that has a "dotted line" connection to the team, but work actually for the LongHorn Server evangelism group in DPE (Developer and Platform Evangelism). -brett Check it out: http://aspnetpodcast.com/CS11/blogs/asp.net_podcast/archive/2006/05/30/329.aspx
Wednesday, May 31, 2006 5:27:17 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
Thursday, May 25, 2006
If you're intrested in being a Technical Evangelist for Longhorn Server, High Availability, or other Microsoft technology see http://blogs.msdn.com/neilhut/default.aspx for details. If you have to work for a company, Microsoft is about as good as it gets. -brett
Thursday, May 25, 2006 10:44:38 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
Wednesday, May 24, 2006
Bill has done a really cool thing. He's installed IIS 7 on his MAC, and posted the vearious IIS 7 wallpapers he's created over the last year. Aside from running the team that delivers IIS, he's a solid photographer and graphic designer. http://blogs.iis.net/bills/default.aspx
Wednesday, May 24, 2006 8:55:56 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
Tuesday, May 23, 2006
OMG! Microsoft released 3 betas today. Beta 2 if Vista, and Longhorn Server, both with IIS7 - and Office. In addition the IIS team opened www.iis.net to the public. The team has been working major hours to get the iis.net ready for general public. For those of you waiting for the nitty gritty details on IIS7 - the wait is over. One of the very coolest features of this site is the virtual labs. You can test drive IIS 7 labs in your browser! Very nice. I'll be frequenting the forums there so check it out. -brett
Tuesday, May 23, 2006 6:34:07 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
Thursday, March 09, 2006

Ever wonder what Microsoft.com with their IIS 6 servers to deliver all of Microsoft.com to the world? I've heard people say all kinds for things like they don't really use IIS (they do), or that they use customized, private builds of IIS 6 not available to the rest of the world (they don't). They've put together some papers to tell all about how they do what they do and hopefully this will be of use to you.

 

http://www.microsoft.com/technet/itsolutions/msit/deploy/mscomserverconfig_note.mspx

 

 

  Microsoft.com Moves to x64 Version of Windows

http://www.microsoft.com/technet/itsolutions/msit/operations/mscom64bitarchi.mspx

 

·         Optimizing Storage Management at Microsoft

http://www.microsoft.com/technet/itsolutions/msit/operations/storageutility.mspx

 

·         Monitoring and Troubleshooting Microsoft.com

http://www.microsoft.com/technet/itsolutions/msit/operations/mscomtroubleshoot.mspx

 

Also, this series of upcoming webcasts promises to be AMAZING

 

·         TechNet Webcast: Microsoft.com Operations Introduces Real World Debugging: Determining When You Have a Problem and Beginning the Initial Debugging (Level 300)

·         TechNet Webcast: Microsoft.com Operations Introduces Real World Debugging: Determining When You Have a Problem and Beginning the Initial Debugging (Level 300)

·         TechNet Webcast: Microsoft.com Operations Introduces Real World Debugging: Determining When You Have a Problem and Beginning the Initial Debugging (Level 300)

·         TechNet Webcast: Microsoft.com Operations Introduces Real World Debugging: Determining When You Have a Problem and Beginning the Initial Debugging (Level 300)

·         TechNet Webcast: Microsoft.com Operations Introduces Real World Debugging: Determining When You Have a Problem and Beginning the Initial Debugging (Level 300)

 

Thursday, March 09, 2006 11:56:19 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
Friday, January 27, 2006

David is the IIS ubergeek of all time. Check out his blog at http://blogs.msdn.com/david.wang/default.aspx

Friday, January 27, 2006 2:42:33 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
Friday, January 13, 2006

So part of my team here are Microsoft is producing a new Microsoft event called Mix. This is going to a very different kind of Microsoft event. Much more feedback, interaction, and a lot of presentations by non-MS thought leaders. You might be intrested so check it out:

---------------------------

Microsoft invites you to MIX, our 72 hour conversation live in Vegas, to discuss with industry leaders such as yourself high-fidelity commerce, media, services and security for the World Wide Web.  Join Bill Gates of Microsoft, Amazon, and web thought leaders such as Tim O’Reilly on March 20-22 at the Venetian hotel in Las Vegas to learn about the web’s next generation of content and commerce, plus the customer experience that is beyond the browser.  Registration is open!  www.mix06.com

 

The MIX conference is a LIVE conversation between web developers, designers and business leaders who create consumer-oriented web sites. Why is it called MIX?  The event is not only a place where you can Meet, Interact, and eXplore with Microsoft and others about the web, but we are MIXing things up by having a conference for tech geeks as well as business professionals who help make decisions about technologies and strategies for your company’s customer facing web sites.  When you attend MIX you’ll hear about Microsoft’s roadmap for the web, and learn the latest about IE7, Windows Media, Windows Live!, as well as “Atlas”, Microsoft’s new AJAX framework.  Register today and take advantage of the low price of $995, as well as the discounted conference hotel rate.

 

At MIX: 

 

Developers can dive deep into the latest Microsoft web technologies, including Internet Explorer 7, Atlas/AJAX, ASP.NET, InfoCard, the Windows Presentation Foundation, Windows Media and others. Want to learn how to code pages for IE7 that render properly in other popular browsers? Interested in building AJAX sites quickly and efficiently?

 

Designers can learn how Microsoft’s platform technologies will allow them to create rich experiences that incorporate video, advanced typography, vector graphics, and 3D graphics. Explore new ways to differentiate your sites from those of your competitors, learn how to streamline the designer-developer pipeline and discuss strategies for improving your site’s usability.

 

Business Decision Makers will get a solid overview of how Windows Vista and the Internet Explorer roadmap can boost site revenues and unlock new business opportunities. Get the latest Vista and IE7 forecasts from Microsoft, discuss the business implications of RSS and pick up insights on how to better monetize your offerings.

 

What kind of content will be offered at MIX?  Sessions at MIX will be focused on two main scenarios that will help you stay on the cutting edge of technology, while at the same time enable you to further monetize your web offerings! 

 

Next Generation Content & Commerce

 

A plain old HTML experience is no longer good enough for your most frequent (and most valuable) users—AJAX is setting new standards for responsiveness and usability, visitors are expecting increasingly-sophisticated customization and personalization options, and rich media integration is unlocking new revenue streams. But building these richer sites can be difficult and expensive.

 

Microsoft’s Dean Hachamovitch (General Manager, Internet Explorer team) hosts this exploration of how technologies like IE7, “Atlas” (Microsoft’s new AJAX framework), Windows Live!, the Windows Presentation Foundation and InfoCard can take your browser-based content and commerce experiences to another level and increase earnings, while minimizing development and maintenance costs.

 

User Experience Beyond the Browser

 

As web-based content and services become increasingly indispensable, users are expecting to interact with your offerings in new ways and in new locations.

 

Microsoft’s Joe Belfiore (Vice President, eHome division) hosts this overview of your options for boosting revenues by building “sticky” experiences that follow the user outside the browser, into the living room and on the go. Some of the specific technologies that will be discussed include: RSS, the Windows Sidebar, Office 12, Windows Mobile and Windows Media Center/Xbox 360.

 

You can view the MIX agenda and top session list at www.mix06.com.  You can also subscribe to the MIX blog to get our regular updates and find out what is new and hot with MIX. 

 

The MIX conference is $995 and registration is open – be sure to sign up today to take advantage of the low hotel conference rate at the Venetian hotel in Las Vegas.

 

See you in March in Vegas! 

www.mix06.com

Friday, January 13, 2006 9:25:23 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
Monday, October 24, 2005

The second edition is online that's an interview with Rick Strahl. He had just seen IIS 7 and responds to the cool things you can do with modules!

http://channel9.msdn.com/ShowPost.aspx?PostID=128639#128639

-brett

Monday, October 24, 2005 5:57:54 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
Saturday, October 08, 2005

So now I'm doing "The IIS Show".

It's a podcast. For me that means I walk in with some rough idea of what I want to talk about and just talk. I love that. You gotta know that I talk about IIS all day. In detail. So the notion of doing this is way fun. I'm going to interview some very cool people in the show like Scott Gutherie, Bill Staples, Eric Deily and other Program Managers on the IIS team you don't normally hear from.

I want to let you meet the people I meet, the faces and personalities behind the product and and at the same time showcase the new stuff that is going to change the IIS world.

So, check it out.

http://channel9.msdn.com/Showpost.aspx?postid=124807

Feedback appreciated.

Brett

 

 

Friday, October 07, 2005 11:26:30 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
Sunday, October 02, 2005

If you think you've got what it takes to drive messaging and build excitment about developer oppotuntites for Longhorn Server, check this out:

http://members.microsoft.com/careers/search/details.aspx?JobID=38221e32-5dc9-455c-b53d-4ad72c8dd9fe

I work on a really great team with some extremely smart and capable folks. Despite rumors to the contrary, Microsoft is one of the great places in the world to work.

-brett

 

Saturday, October 01, 2005 11:43:54 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
Thursday, September 15, 2005

IIS 7.0 Operations Guide: http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/iis7/Ops/9a90c800-3f09-4a3f-87b0-caae34076aca.mspx

 
 
 
 
FAQ: IIS 7 is only available on Longhorn Server or Vista Beta 2. You need to be in one of these Beta programs to get a copy at this point. Betas will be more open as time goes on. Those who attended PDC have IIS 7 on Disc 6 of the DVD set they received.
Thursday, September 15, 2005 1:28:27 AM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
Tuesday, September 06, 2005

Expect to see serveral very intresting presentations at PDC regarding IIS 7! In fact, those attending PDC will be receiving a copy of Longhorn Server that has IIS 7 on it. Also, I'll be presenting an IIS 7 preview at Windows Connections in San Diego on Nov. 1st.http://www.winconnections.com/default.asp. See ya there or at PDC!

 

 

 

Tuesday, September 06, 2005 6:02:04 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
Monday, July 25, 2005

Just in case you are suffering from the delusion that Apache admins live in happyland, here's a very intresting thread.

http://apache.slashdot.org/apache/05/07/22/2159253.shtml?tid=133&tid=2

 

-brett

 

Monday, July 25, 2005 4:36:17 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
Saturday, July 23, 2005

http://www.w2knews.com/index.cfm?id=535

A new survey commissioned published by Sunbelt Software of Linux and Microsoft servers has some intresting comments. Most notably:

  • Windows usage remains high: 55% of the respondents noted that 80% to 100% of their servers are running Windows. Only three percent of respondents said they had no Windows installed.
  • Linux deployments also remain healthy: 38% of the respondents reported that up to 20% of their servers were running Linux, while only 28% said they did not have any Linux installed.
  • However the number of vociferous and strident complaints regarding the performance of Windows has diminished considerably compared with earlier Yankee/Sunbelt surveys. In fact, many respondents noted the vast performance and reliability improvement from the legacy Windows NT 4 platform to the current Windows Server 2003 release
  • One of the things I've said for a long time about Microsoft is that they are learning more and more about how to make better operating systems. Each release has in fact been better then the previous, with the exception of Windows ME. But from NT-2000-2003 you see a clear evolution. And the view from here is that this evolution is not ending anytime soon.

     

    -brett

     

    Friday, July 22, 2005 11:04:25 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
    Wednesday, July 20, 2005

    Be sure to visit all the options under "Configuration" in the Admin Menu Bar above. There are 16 themes to choose from, and you can also create your own.

     

    Wednesday, July 20, 2005 7:00:00 AM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
    Wednesday, July 13, 2005

    Having come from an IT Pro/administrative focus the last few years, I was expecting that IIS 7 would be more of the same great goodness we got from IIS 6. IIS 6 was a gigantic step from IIS 5 and offered a great deal more for admins in terms of reliability, security, and performance. IIS 7 does indeed have improvements in administration, but the underlying architecture regarding working processes/application pools and http.sys doesn't change much. This design has proven itself in the field to be more than capable in the most loaded, attacked, stressed, hi-availability sites in the world.

    However, if you want to modify the capabilities of IIS 6 to do things it doesn't do, that was tricky. ISAPI filters are ideally placed in the architecture for adding capabilities but are tricky to write and have limitations Also, if you want to do forms based authentication for non-asp.net applications - well, sorry, you have to write your own. All of that changes in IIS 7.

    In IIS 6, the design philosophy is - start the server and enable only the features you require. Most are disabled by default but the code for those disabled features is loaded nonetheless. In IIS 7, the design philosophy is start the server and load only the features you require, the rest are NOT PRESENT. If you only want static content and a basic authentication, you list the required modules in applicaitonhost.config for those functions. You want compression? Load the module. You want to write your own authentication? Write your own - managed or native code - and load it. Goodby Isapi Filters!

    This is major bigness and is only one of the many new major bignesses in IIS 7. There are big stories around  administration, integration with .net, tracing and diagnostics, WMI, and just about evey other area. Here's a pointer for admins - start now getting familiar with web.config files in asp.net. Even if you aren't deploying asp.net on IIS 5 or 6, IIS 7 will be using .config files instead of the metabase as it's configuration store. You will be able to mange it from the new Web Manager, but it's helpful to have some notion about how .config works before you get into IIS 7. In particular, for administrators, is the use of the LOCATION tag.

    For developers, consider what you can do with IIS 7 by extending the capabilities of the server to interact with your application and infrastructure in ways never before possible. By creating a module and loading it as part of IIS 7 itself - you can add capabilities to the server specific to your business requirements or application.  In addition, the APIs to manage the configuration will all be fully public and part of .net. And, it’s designed with to support xcopy deployment.

    More to follow

    -brett

     

     

     

    Wednesday, July 13, 2005 6:04:59 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
    Monday, July 11, 2005
    Friday, July 08, 2005

    I get asked a lot, "what the heck is Evangelism at Microsoft?". Having given quite a few answers, I still don't like any of them in terms of what it communicates. Here's really good, short interview with Steve B at Microsoft who is asked the question "Why is there evangelism at Microsoft?"

    http://channel9.msdn.com/ShowPost.aspx?PostID=85529#85529

    Friday, July 08, 2005 5:51:05 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
    Wednesday, June 29, 2005

    If you want a look at the future, hang out at Microsoft for a while.  You are quickly inundated with programs, projects, and products under development – some of which won’t be used by people for years.

    What’s interesting is the effect this has on people here.  Imagine for a moment that everyone you worked with was working on a project all year, for a product that has another year to go before people see it. All you think about, all your time, all your creative work is going into unreleased, improved technology. By the time this gets to the public, while wholly new to the world, it’s seems been around for years to the authors. Uptake rates kick in and by the time the product is widely adopted, the authors are 4-5 years ahead of that curve.

    That’s a pretty serious discontinuity and I see it all the time. I edited a powerpoint deck last week on Longhorn installation processes that referred to current technology as the “old” way. Another example, this week a presenter asked the audience how many were running IIS 6 and about ¼ of the room raised their hands, much to the surprise of the presenter (and this was an IIS 7 presentation!).

    The risk here is that new technologies and organizations that create them become over time more and more distanced from the current experience of the customers. Eventually, technologies are released that improve on technologies that haven’t yet been widely adopted. At this point, companies that create these technologies run the risk of simply running too far ahead of the customer and eventually leaving the realm of dealing with their significant day to day realities. Yes the new stuff is way cool and really does have a lot to offer, but adoption rates do not keep pace with the torrent of new technologies, and this gap has got to have larger and larger impact over time.

     

    Wednesday, June 29, 2005 8:20:02 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
    Friday, June 03, 2005

    The HackIIS6.com contest has ended. Penton publishing, the sponsors of the event - [as in NOT MICROSOFT], heard the many posts and comments publicly and privately that contests like this don't actually prove anything.

    So Penton decided to end the contest early and I think rightly so.  They simply turned the site off for a few days while they crafted a message about the changeup. It would have been best if they hadn't done things quite in that order, but that's what happend. The site was not hacked nor did it suffer a DoS attack.

    I agree with Penton on this. This contest and others like it don't prove anything. If you want to show that IIS 6 is secure (or visa versa) do it with a record based on real world implementations, not unrealistic short term "hack me" events.

    IIS 6 has already passed the most rigerous testing on the planet. The results are in and they come from the best lab in the world - live servers running mission critical applications with billions of dollars at stake on public networks. You cannot contrive an enviroment more severe. How did it go?

    1. IIS runs 53% of the Fortune 1000 as shown at http://www.port80software.com/surveys/top1000webservers/.
    Yes, I know that Netcraft surverys shows a big dominance by Apache but those numbers include all domains known to man. The problem with that strategy is that it overvalues the impact of web hosters. If a web hoster puts up a 10,000 websites on an OS, that's 10,000 apache servers counted but in fact is only a couple of servers. If they move that machine to another platform, there are big shifts in the numbers for "domains hosted by X" but in reality, only 1 web hoster made a decision to change a platform on a few servers. Why should this count 10,000 times but if when another company changes from one platform to another, that counts as 1. This is not at all to devalue Netcraft’s work, just to point out that Netcraft has its own unique scope and biases (and I mean biases in the scientific sense here, not a sinister one). 

    Now maybe you don't believe the 53% number because the survey was done by Port80 who writes components for IIS. So, do it yourself! A friend of mine created a tool to just that and it validates these results. We're going to use it for some further study. You could to.

    If 53% of the US's largest corporations are running on IIS -  that has some meaning cause they have choices.

    2. Show me any reputable list of Apache vs IIS 6 hotfixes. What do you see? Try this one as an example: http://secunia.com/product/1438/ (3 for IIS 6 ) vs. http://secunia.com/product/73/ (24 for Apache 2.0.x). Be sure to compare apples to apples. In other words, if you count every Windows 2003 problem as an IIS problem, you also have to count any other OS's problems against its web server. No matter what list you use here, IIS 6's record is impressive.

    3. Remember years ago when Gartner report that said you should remove IIS? Of course you do. Everyone remembers that. But how about this Gartner report from 2004, “IIS No Longer the Problem in Web Server Security"? Why is that most people I meet have not seem to heard about Gartner coming out with paper saying that IIS security is a not an issue. I can't post the paper here as it's copyright Gartner, but the title says it all.

    4. Security Innovations made this report http://www.microsoft.com/windowsserversystem/facts/analyses/secinnovation.mspx  that shows Windows Server 2003 has a lower "days of risk" factor than Red Hat/Apache.

    5. Five of the top 10 most available hosters in May 2005 run Windows according the Netcraft.

    There is far more, but that should server to make my point.

    If I sound like an evangelist for IIS, that's a good thing. I came to be one not because Microsoft offered me the job, but because simply reporting the facts about IIS 6 creates a complelling story that is persusive based on technical merits.

    I have personally talked to many IIS administrators (hundreds) responsible for tens of thousands of IIS servers in the largest companies in the world. Not to mention that many hundreds of people managing small businesses that have their own severs that have contacted me via email or at presentations. Billions of dollars flow through these servers. Unthinkable quantities of data per minute collectively pass through all the IIS servers in the world every moment. What do managers of these server's tell me? Sounds like this:  "We love IIS 6", "It's so much better than what we were doing", "Our uptime doubled!” Here's what I was told recently by a server administrator for one of the undisputed largest .com's on the planet: (not Microsoft) "We have virtually no problems with our IIS servers". Are there problems? Of course - but security is not at the top of the list. (BTW, the list is operational in nature "how do I troubelshoot "x". How do I manage "y").

    My point is simple. If you want to implent a web server other than IIS, fine with me - but do so for good reasons. If you choose to avoid IIS because you're concerned about IIS security, check out the above links and information. I'll be posting some more on this later.

    - brett

     

    Friday, June 03, 2005 12:22:29 AM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
    Wednesday, May 25, 2005

    My house is like hell in some ways, or so I'm guessing.

    We paid too much for it when we moved to Redmond from a very fine house in Boulder, Colorado. While there is a great view from our back yard/deck (a deck that quickly changed color after the first rain from what appeard to be an well maintained wood, to a deck badly in need of sealing), the interior is, well, a disaster. Now, I don't mind that some things need a little work, but this is absurd. As soon as we moved in there were problems. Ants. Next, we discover that a lot of the things in house are more or less thrown together, some without even so much as a screw. For example, the plate covering the 220 V plug for the dryer was just sitting on the wall - no screws at all. Of course when the plug was pulled out, the metal plate fell on the plug which then arc'd and blew the circuit. Melted parts of the plate. No one was injured. Does that count as a near death experience?

    Of course, we were removing the drier so we could pull down pieces of the ceiling where our bathroom shower was leaking through to the bottom floor from every seam. Both showers. $3000 later we find they are still leaking elsewhere up in the wall. The previoius owner installed a bunch of upgrades himself and didn't know how to do it. Of course, no inspector is going to find this stuff. 

    Did I mention the floors? There was supposed to be good wood floors under the carpet (which had to go). They are wood allright, but they didn't bother to cover them when the house was painted so they are litterally covered with paint blobs. That helps to obscure the large nails driven into the floor 10-12 at a time. Of course, the water stains are a great touch.

    So, right now, I'm wishing for my little house back in Boulder that was very neatly, and correctly upgraded over the years to be quite comfortable. Oh well. 

     

    Wednesday, May 25, 2005 9:42:29 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
    Tuesday, May 10, 2005

    Here's a decent hardening guide for IIS 6 I ran across.

    http://www.shebeen.com/win2003/

     

    Tuesday, May 10, 2005 1:39:21 AM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
    Wednesday, May 04, 2005

    I met Roger Grimes through Windows IT Pro magazine conferences and events. He's a great guy with whom I have a lot in common. Trainer, speaker, author kinda guy. You don't meet many people can talk well about technology, that can also teach, that can also write - but he's good at all of that. So I was intrested in his idea of creating an IIS 6 server and inviting the world to hack it. Like me, he's really tired of the myth that IIS is an insecure platform. People who know me know that I would be one of the first to say if this was otherwise, LOUD and clear, but it ain't so. So I say loud and clear, IIS is secure platform. Debnunking IIS mythology is one of the things I love to do - inside and outside Microsoft. For example, it's a myth that scripts need Execute permission. There's a lot of IIS documentation that says it does - but it doesn't. Ditto for the IUSR account requiring Log on Local rights - never has required that but it is a persistent myth. I've done presentations galore on these myths, but none is more persisten than IIS is insecure.

    Now to be sure, IIS 5 gold out of the box is highly insecure. Those days are gone and a properly hardened IIS 5 server is very secure indeed. Believe it or not, You may not believe it, but there are thousands upon thousands of IIS 5 servers out there with mission critical, publicly assccessible web applications that have never seen succesful breach. IIS 6 SP1 out of the box is a secure installation and I challenge anyone who says otherwise.

    In fact, if you can find a security hotfix for IIS 6 - let me know. That means a critical security update to IIS 6 binaries not services that IIS 6 uses such as asp.net. People never seem to blame Apache for problems with PHP, but an asp.net issue somehow gets lumped in as an IIS issue. To be fair, asp.net runs exclusively on IIS and they are both Microsoft products so there is a big bucket called "Microsoft web delivered applications" that you can point at as cumulative indicator for security issues and get bigger numbers than zero - however just do the same on Apache/*nix and compare. Apples to apples as it were.

    So Roger is putting up the server and we'll see what happens! Hackiis6.com.

    -brett

    Wednesday, May 04, 2005 5:40:30 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
    Tuesday, May 03, 2005

    It's a bit strange working at Microsoft at times. It's challening since I have a crystalline notion of what Microsoft needs and what customers want - yet navigating this big ship is not something you do quickly. This is a big, I mean GIGANTIC change from my entepreneurial past My inclinations are to do things myself and that has worked very well for me in the past.

    From a customer perspective, people want Microsoft to be responsive and to be able to have a voice - impact the product, documentation and training. They want Microsoft to be proactive to tell them about known problems so you don't have to discover them from an obscure KB article, to let you know when a new IIS tool comes out rather than having to dig out of microsoft.com/downloads or finding out on forum. They want to know where and how to get peer support and elevate issue to Microsoft. They want EXPERT information on a continual basis as well as introductory material that gets people into the the technology.

    Funny thing is, that's what Microsoft wants too. So why aren't we doing a better job of it? That is what I'm trying to find out and solve. Werid things like there's no IIS logo or exam are indicators of the issues here. But I am working diligently on behalf of the IIS community as best I can. If it ever seems otherwise, please let me know. If this goes well, it will be great for us all.

    - brett

     

    Tuesday, May 03, 2005 5:27:22 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
    Monday, May 02, 2005

    One of the things that Microsoft is doing is trying make writing code more accessible to many. There are quite a few "express" products in beta right now that I think you'll find quite useful. Check out:

    · Visual Web Developer 2005 Express Edition for developing web applications with ASP.NET 2.0

    · Visual Basic 2005 Express Edition for developing smart clients with VB

    · Visual C# 2005 Express Edition for developing smart clients with C#

    · Visual C++ 2005 Express Edition for developing smart clients with C++

    · Visual J# 2005 Edition for developing smart clients with the Java language

    · SQL Server 2005 Express Edition for using local data from windows and web applications.

     

    As a non-developer myself, I like tools that make the entry price low (how about free!) for getting my hands on tools that let me explore new techologies. In particular the web developer stuff is cool

     

    Monday, May 02, 2005 4:41:02 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
    Sunday, May 01, 2005

    Hi,

    Some of you have wondered what has become of me since I started Microsoft. My posting activity on iislists.com has dropped significantly - not due to lack of interest, but due to working massively on new tasks. When I took this job as Server Evangelist at Microsoft specilazing in IIS, I knew they wanted me to hit the ground running, but it was more like hitting the ground in the Indy 500. Day 1 was like "by the way - we have 5 events that you're responsible for ogranizing and the first one is in 6 weeks".

    One thing at Microsoft is that people are generally quite helpful but you are on your own a lot to figure out things. I thrive in that kind of environment, but it can be daunting. For example, to pay for some stuff at the events I am managing, like in any company, you have to open a PO. People that have been here can do that in a minute - for me, it's all day task! You have to take a training on how to do it, then figure out what accounting details, etc. Newbie stuff like that can really slow you up.

    Muddling through that kind of thing can take - oh, a couple years.

    The events I'm working are IIS 7 Technical Previews. Very cool stuff. One thing for real - the IIS team rocks. I kid with people (half kidding), that evanglising IIS 7 is like selling a new Maserati. Just take the cover off and show the car. People go wild then "great job Brett, taking the cover off like that".

    While there's a lot more to it than that, it's not entirely untrue. My bias has alwasy been that you let the technology talk, rather than try to overwork the language into marketing blurbs. Techno types spot the hype a mile away. We all just want to know how to works better to solve our problems, what new possibilties it creates, and does it work with what I have. The good news is that IIS 7 has a great story with all of these things.

    More great news, Microsoft is a great company to work for.

    Later,
    Brett

    Sunday, May 01, 2005 7:54:43 AM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com

    Theme design by Jelle Druyts