Microsoft released the June CTP for Windows Server 2008. Almost 1000 bugs have been fixed. Most notable is that Server Core includes IIS7 now. I've been blogging about it when MS announced that they are going to support IIS7 on Server Core. I want to take this opportunity to correct my earlier assessment regarding this move. I have serious doubts now that it makes much sense.
Latest posts by Michael Pietroforte (see all)
- Set Windows 10 Ethernet connection to metered with PowerShell - Tue, Sep 27 2016
- Disable updates in Windows 10 1607 (Anniversary Update) using Group Policy - Wed, Sep 21 2016
- Fundamentals of Azure, Second Edition - Get your head in the cloud - Tue, Sep 13 2016
My first thought was that it is really a great idea to run IIS7 on Server Core. The Web server is certainly the most endangered system. So if you run it on a server system with a reduced attack surface it should significantly decrease the risk of getting hacked.
However, a commentator on my blog post remarked that you can't use ASP.NET on Server Core since .NET is not supported at all on this special edition of Windows Server 2008. The question now is, what is the use of a Web server without a web application framework?
The strange thing is that Microsoft made this move due to customer demand. Does this mean that there are many companies using a Web server without an application framework? Or does it just mean that those people who wanted IIS7 support in Server Core were just not aware of the fact that Server Core doesn't support .NET?
I would go for the latter. I think someone who contacts Microsoft in the hope that they change something in a future product, doesn't have static HTML pages on his Web server, right? Maybe I am just missing something here. However, I think it is quite probable that Microsoft will offer .NET support for Server Core soon. It seems the .NET team is already working on it.
I am quite sure, though, that we won't use IIS7 on Server Core, anyway. Actually, we have just one IIS6 left where we host a self-developed ASP.NET application. We moved with the rest of our Web applications to Apache under Linux some years ago. I can't imagine changing this in the near future.
In my view, Microsoft made web application development too complicated with ASP.NET. Even though, I worked through a whole C# book, it would cost me quite some time to change something in our own ASP.NET application. However, I always find it quite easy to make changes in PHP apps, although I have never learned this language. The fact that programming in PHP is so easy is one of the reasons why there are so many great Open Source content management systems available. Why should I spend thousands of Euros for a commercial CMS running on a Windows box if I can have a better system for free under Linux?
So reduced attack surface or not, Microsoft's Web server probably won't have a future in my department, even though we are mostly a Windows shop.