Secure your web app fluently

When building a big web application with ASP.NET MVC 3 I ran into a problem to secure my web application in a maintainable way. There are lots of examples with attributes, but this isn’t maintainable. So I started searching for other solutions, however most of the information is leaning on those un-maintainable attributes I finally found “Fluent Security“.

What does Fluent Security offer you?

Fluent Security provides a fluent interface for configuring security in ASP.NET MVC. No attributes or nasty xml, just pure love. Go get it on NuGet!

What does that mean?

Well it simply means you can bootstrap your security just from your Application_Start() and maintain it on a single place. Besides that you can easily unit test your security setup. So you can test if your security configuration matches the security setup you described in your unit tests. This is a huge advantage because you know for sure the controller actions are secured the way you like it without having the need to click through your complete web application. You can only fail when not defining your tests correctly. That’s not all… You can easily extend, modify etc. by adding your own implementations of the interfaces.

Let me start to show you some code so you see for yourself how easy it is! My example is based on a default MVC 3 application and I have added a CategoryController like below to have some extra actions for my example.

public class CategoryController
{
[HttpGet]
    public ActionResult AddNewCategory()
    {
        return View(new CategoryModel());
    }

[HttpPost]
    public ActionResult AddNewCategory(CategoryModel model)
    {
        if (!ModelState.IsValid) return View(model);
        //Save the data etc...
        return RedirectToAction("AddNewCategory");
    }

    //Other actions
}

First of all I create a static class for my bootstrap code! I leave the implementation blank because I will first implement some tests.

public static class SecurityBootstrapper
{
    public static void BootUp()
    {
        //Here we will configure our security later on...
    }
}

Then you start to write some tests for your security setup. I would advice you to be very explicit in your test setup although you won’t have to. This way you are 100% sure you secured it exactly the way you want and it is 100% transparent. So never write a test for your whole controller, but do it for every specific action.

[TestFixture]
public class FluenSecuritySetupTests
{
[SetUp]
    public void SetUp()
    {
        BootStrapper.ConfigureFluentSecurity();
    }

[Test]
    public void anonymous_access_should_be_allowed_for_the_logon_and_home_index_actions()
    {
        var results = SecurityConfiguration.Current.Verify(expectations =>
        {
            expectations.Expect<UserController>(c => c.LogOn(string.Empty)).Has<IgnorePolicy>();
            expectations.Expect<HomeController>(c => c.Index()).Has<IgnorePolicy>();
        });

        Assert.That(results.Valid(), results.ErrorMessages());
    }

[Test]
    public void adding_a_new_catogegory_requires_a_system_administrator_role()
    {
        var results = SecurityConfiguration.Current.Verify(expectations =>
        {
            expectations.Expect<CategoryController>(c => c.AddNewCategory()).Has(new RequireRolePolicy(AppRoles.SystemAdministrator));
            expectations.Expect<CategoryController>(c => c.AddNewCategory(null)).Has(new RequireRolePolicy(AppRoles.SystemAdministrator));
        });

        Assert.That(results.Valid(), results.ErrorMessages());
    }
}

After we have defined our tests for our security setup we can implement the actual setup.

public static class SecurityBootstrapper
{
    public static void BootUp()
    {
        SecurityConfigurator.Configure(configuration =>
        {
            configuration.ResolveServicesUsing(type => BootStrapper.Container.ResolveAll(type).Cast<object>());

            configuration.GetAuthenticationStatusFrom(() => HttpContext.Current.User.Identity.IsAuthenticated);
            configuration.GetRolesFrom(Roles.GetRolesForUser);

            configuration.ForAllControllersInAssembly(typeof(HomeController).Assembly).DenyAnonymousAccess();
            configuration.For<HomeController>(c => c.Index()).Ignore();
            configuration.For<UserController>(c => c.LogOn()).Ignore();
            configuration.For<UserController>(c => c.ResetPassword()).RequireRole(AppRoles.UserAdministrator);
            configuration.For<CategoryController>(c => c.AddNewCategory()).RequireRole(AppRoles.SystemAdministrator);
            configuration.For<CategoryController>(c => c.AddNewCategory(null)).RequireRole(AppRoles.SystemAdministrator);
        }
    }
}

As you probably have seen already we configure the security for both the get and post actions. Now we can run our tests to see if we implemented the security like we have defined them in our tests. When all your tests succeeded we are ready to enable it in our web application and define handlers for our policy violations.

public class MvcApplication : HttpApplication
{
    public static IWindsorContainer Container { get; private set; }

    protected void Application_Start()
    {
        SecurityBootstrapper.BootUp();

        Container = new WindsorContainer().Install(FromAssembly.This());

        AreaRegistration.RegisterAllAreas();
        RegisterGlobalFilters(GlobalFilters.Filters);
        RegisterRoutes(RouteTable.Routes);
    }

    //Other members left for brevity...
}

First of all we called our SecurityBootstrapper.BootUp() method in our global.asax to configure our security. Then I used Castle Windsor as dependency container to register my dependencies. Of course you can use your own favorite IoC container. Or plumb your own implementation. In order to install my Fluent Security dependencies I implemented a Windsor installer which takes care of registering the dependencies in the container.

public class WindsorInstaller : IWindsorInstaller
{
    public void Install(IWindsorContainer container, IConfigurationStore store)
    {
        container.Register(AllTypes.FromThisAssembly().BasedOn(typeof(IPolicyViolationHandler)).Configure(h => h.LifeStyle.Singleton));
    }
}

As you can see I install all PolicyViolationHandlers in my assembly. As an example I have added some implementations for a security policy violation handler.

public class DenyAnonymousAccessPolicyViolationHandler : IPolicyViolationHandler
{
    public ActionResult Handle(PolicyViolationException exception)
    {
        //Log the violation, send mail etc. etc.
        return new HttpUnauthorizedResult(exception.Message);
    }
}

public class RequireRolePolicyViolationHandler : IPolicyViolationHandler
{
    public ActionResult Handle(PolicyViolationException exception)
    {
        //Log the violation, send mail etc. etc.
        var rvd = new RouteValueDictionary(new
        {
            area = "",
            controller = "Error",
            action = "HttpForbidden",
            statusDescription = exception.Message
        });
        return new RedirectToRouteResult(rvd);
    }
}

These violation handlers are mapped by naming convention inside Fluent Security. So a RequireRolePolicy needs a RequireRolePolicyViolationHandler etc.

I think I gave you a good impression of the power of Fluent Security. There are lots of ways to make your own components for Fluent Security when the defaults don’t work for you. It is open source available on Github, so you can easily participate and improve Fluent Security. The documentation is pretty good and Kristoffer Ahl really helped me out with some small issues I had when trying it out first time. Please share the article if you liked it and you really should try it out. Have fun!

Sokoban 7

Sokoban 7 is a classic puzzle game, the first version of Sokoban was published in 1982. Now it is also available on Windows Phone. The game includes 50 levels and will gain periodic updates with new levels. The game uses your phones theme, this way you keep the look and feel you like. The trial version doesn’t has any limitations. If you prefer to play without ads, please consider purchasing the game. Please let me know any feedback so I can improve the game. If you like to provide me a translation in your own language, don’t hesitate to contact me, so I can add it. Thank you in advance and share it if you like it!

Download

Download sokoban 7 from the marketplace

Screenshots

Shortify for Windows Phone 7

Always wanted to easily share a link on multiple social platforms at once, or just by email or SMS. Then install Shortify for FREE on your Windows Phone and start sharing your favorite webpages with your friends immediately. The application takes full advantage of your personal theme configured on your Windows Phone. So you won’t lose the look and feel you’re happy with while sharing your favorite webpages. Just try it out and let me know what you think about it. Please give me feedback so I can improve the app for your own goodwill and experience. Thank you and please share it if you like it.

Download

Download shortify from the marketplace

Screenshots

Delegate your equality comparisons

When using Linq on your Entity Framework objects, you often need to distinct your query results. Therefore you need to implement an IEqualityComparer for the more advance scenario’s. For example if you want to distinct on a specific property, or maybe on multiple properties. However this forces you to write lots of infrastructure code to distinct each type.

You probably would end up with several equality compare classes like this.

public class ProductIdEqualityComparer : IEqualityComparer<Product>
{
    public bool Equals(Product x, Product y)
    {
        return x.Id == y.Id;
    }

    public int GetHashCode(Product obj)
    {
        return obj.Id.GetHashCode();
    }
}

public class ProductPriceEqualityComparer : IEqualityComparer<Product>
{
    public bool Equals(Product x, Product y)
    {
        return x.Price == y.Price;
    }

    public int GetHashCode(Product obj)
    {
        return obj.Price.GetHashCode();
    }
}

public class PersonLastNameEqualityComparer : IEqualityComparer<Person>
{
    public bool Equals(Person x, Person y)
    {
        return x.LastName == y.LastName;
    }

    public int GetHashCode(Person obj)
    {
        return obj.LastName.GetHashCode();
    }
}

However there is a solution which will save you the work to write all this classes. You will have to write only two classes. One will contain some extension methods, the other is a DelegateEqualityComparer.

public static class CompareExtensions
{
    public static IEnumerable<T> Distinct<T>(this IEnumerable<T> items, Func<T, T, bool> equals, Func<T, int> hashCode)
    {
        return items.Distinct(new DelegateEqualityComparer<T>(equals, hashCode));
    }

    public static IEnumerable<T> Distinct<T>(this IEnumerable<T> items, Func<T, T, bool> equals)
    {
        return items.Distinct(new DelegateEqualityComparer<T>(equals, null));
    }
}
public class DelegateEqualityComparer<T> : IEqualityComparer<T>
{
    private readonly Func<T, T, bool> _equals;
    private readonly Func<T, int> _hashCode;
    public DelegateEqualityComparer(Func<T, T, bool> equals, Func<T, int> hashCode)
    {
        _equals = equals;
        _hashCode = hashCode;
    }

    public bool Equals(T x, T y)
    {
        return _equals(x, y);
    }

    public int GetHashCode(T obj)
    {
        if (_hashCode != null)
            return _hashCode(obj);
        return obj.GetHashCode();
    }
}

Now you can simply distinct your query by providing a lambda. I tried it on IQueryable, but this doesn’t work. Linq will generate some SQL to do the actual query. We didn’t specified any code that can translate the equality comparer to SQL. If someone figures out how to make it work with IQueryable please let me know.

_products.Distinct((x, y) => x.Id == y.Id, x.Id.GetHashCode());
_products.Distinct((x, y) => x.Price == y.Price, x.Price.GetHashCode());
_persons.Distinct((x, y) => x.LastName == y.LastName, x.LastName.GetHashCode());
_persons.Distinct((x, y) => x.FirstName == y.FirstName, x.FirstName.GetHashCode());
_persons.Distinct((x, y) => x.Address.City == y.Address.City, x.Address.City.GetHashCode());

Share this article if you found it useful.

Minesweeper 7

Today will be again a milestone for me. Today my first Windows phone app “Minesweeper 7″ got certified. This app is just a port of a minesweeper version I made once with winforms. It is very basic and simple. I focused most on learning Windows phone, Silverlight and applying as much metro style as possible. The game is completely themed by your Windows phone settings, so you won’t lose the look and feel you like when opening the game. I included a full featured trial, without any limitations compared to the paid version. So you may be asking why making a trial version when there are no limitations. Well very simple, the trial version contains ads, the paid doesn’t. It is available in Dutch, English and German language. If you like to make a translation in your own language feel free to send it to me by mail and I will publish an update in the marketplace. The next update will include some visual improvements. Also highscores will be added in a future update.  So have a look at it and have fun! Ofcourse rate it so I can make improvements.

Download

Download minesweeper 7 from the marketplace

Screenshots





Install Windows 8 Consumer preview on vhd

In a previous blog post I explained to you how to install Windows 8 developer preview on vhd, so you can boot from your vhd. Since there have changed a few small things I just add an updated manual below. The installation will take about 30 minutes.

Step 0

Make sure you have at least 40 gig of free disk space for your vhd. Make sure you’re running Windows 7.

Step 1

Download the Windows 8 consumer preview.

Download the Windows 7 USB/DVD tool to make yourself a bootable usb stick.

Use the tool to install the iso to your usb. In Scott’s post you can find some screenshots if you really need them.

Step 2

Now you’re ready to reboot. Make sure the usb you created in previous step sticks in your computer and boot from the usb!

In the setup click install and use the following key to install your copy of Windows 8 consumer preview. DNJXJ-7XBW8-2378T-X22TX-BKG7J

Proceed to the step you have to choose a hard drive and immediately stop now and read following very careful.

First of all we need to create a vhd. So we hit shift+F10 to open the command prompt.

In the command prompt key in the following commands. Feel free to choose another file location, but make sure there is enough space on your harddrive.

X:\Sources> diskpart
DISKPART> create vdisk file="c:\VHD\Win8.vhd" type=expandable maximum=40000
DISKPART> select vdisk file="c:\VHD\Win8.vhd"
DISKPART> attach vdisk
DISKPART> create partition primary

TIP:

If you’re not sure which drive letter you need, just type in ‘dir’ to figure out which drive you have to choose for your vhd if you have multiple. This will enlist you all files and folders on this drive letter. If you are already in DISKPART, just type in ‘exit’. When you figured out the location for your vhd just type diskpart again and start over.

X:\Sources> dir c:

Now you’re ready to proceed the installation. So hit alt+tab and click refresh. Now your vhd should appear in the dialog. Select the vhd and just proceed the installation. Possibly you get a warning when selecting the vhd, saying your system possibly doesn’t support it… Just ignore this and click next and just finish the installation.

Note: Because we create an expandable vhd, we not claim the 40 gigs immediatly. Mine vhd was after installation only 7.68 gig. The vhd will grow to a max of 40GB.

Step 3

When your system reboots you will see a great graphical boot loader screen. You should have two options ‘Windows 8 consumer preview’ and your ‘Windows 7′. Select the ‘Windows 8 consumer preview’, the setup will finish some installation stuff and reboots for the last time. When it comes back just select the ‘Windows 8 consumer preview’ again and proceed with the following steps.

First you have to give your computer a nice name, for example: ‘Windows8Developement’. You can also choose a nice color theme. Of course we pick the pink color :p.

In the next step you have to configure your network. Just pick your wireless network, fill in your password and proceed to the next step.

In this step you can choose for the express settings, which I did, or choose for custom settings.

Then you have to fill in your email address, which should be a Windows Live Id. I filled in my Gmail address which is also my live account. Then you proceed to the next step, and if your email address is valid you can fill in your password, that belongs to your Live Id. The last step is to configure some password recovery option in the ‘Security verification info’ step. This is the last time you have to click next before Windows will prepare itself with the settings you specified.

Now you’re ready to go. The first thing that came up to me is the Start button completely disappeared. To learn how to use the new Windows 8 I advise you to read following guide. Please let me know if you miss things in this manual and as always share this article with your colleagues and friends if you find it useful.

Pitching equals invisible convincing

During the last year I learned and read a lot about convincing people. In this article I want to share some tricks to apply it yourself. Oh, its my first non technical article. So this will be a milestone for myself :D .

It isn’t always as easy to convince someone. Some people just manage to get more things done as others. A part of your skills to convince someone is in your own personality. To convince someone you have to be powerful, special and kind. This means you need to know where you’re talking about, you dare to show your ass off and show your interest to the other person.

Some people have to do their best to achieve this and others just don’t have to put energy in it.

In order to convince someone you can write your own elevator pitch. An elevator pitch is a small story about yourself, your skills and your ambitions. By writing it down you force yourself to actively think about it. Never try to memorize what you wrote down and exactly tell this story to somebody, because you’ll lose you text. Use it as the main theme for your story.

How to write your elevator pitch?

Think of you intent

When you’re pitching, it has to happen fast and clear. Building your pitch is important and consists four parts:

  1. Core sentence: I’m … who … (you’re unique, how you want to be remembered)
  2. Explanation: By … 1, 2, 3 … (your talents, skills, expertise etc.)
  3. Example: So I did … (concrete example, that another can imagine)
  4. Core: So if you are looking for someone who … (repetition of the core)

Credibility

You can tell you are good at everything , but this isn’t sympathetic and credible. So ask your friends and colleagues for your talents.  Use this talents to convince others. Example: “I’m happy with compliments from … (colleague’s, friends) about …”

Cliffhanger

Keep your story short and don’t explain everything. You will make the other person curious and enthusiastic by telling what you have to offer. End with a cliffhanger, and make your audience want to know a lot more about you. When you manage to do this, you are at 90 percent of convincing them.

Make the other important

Do some research on your audience. Tell / Write down why the other is important for you. For example his expertise, network, vision etc. and explain it with a good reason. Example: “I admire your expertise and knowledge about …”

Ask a ‘Yes’

It is easy to get a ‘No’, but with tactical questions, you can get a ‘Yes’. People like to advise. Try to use the inventiveness and the network of the other: Don’t ask for a job, ask for advice. Example:

  • Don’t: “I search for …, do you have this job for me?”
  • Do: “I search for …, can you advise me on this?”

Unique leads to interest

It’s important to tell about your unique selling point. When you don’t have lots of experience you probably have lots of ideas, friends/follower and energy. Don’t forget to think about your graduation, hobbies, missions, associations, memberships, innovation, vision and personal style.

Tell what makes you important

Translate your qualities to a form where you are telling what you can offer the other. You can for example tell someone ‘You are a specialist with design patterns and know how to apply them’, but it would be better if you tell someone ‘You are a specialist with design patterns and this gives a boost to the software quality and maintainability’.

Have guts

To pitch yourself you really need some guts. Pitching is all about congenial appearance and your individuality. Never about authority.

I hope you found this tips helpful. Please share this article with your friends and colleagues. Oh, and don’t hesitate to give me feedback of any kind on my article.

Writing modular JavaScript without polluting the global namespace

Most of you have already seen a lot of spaghetti JavaScript code. One of the reasons you are reading this article will probably be, you don’t want to make the same mistakes as others have done. So let’s make the next step and stop polluting the global JavaScript namespace.

Why is it bad to have all your script code available at global level?

First of all you can possibly get a lot of errors when using modules developed by others, because you used the same names for you variables etc.

The second reason is, this code can’t be minified as good as the code I will show you later.

The third reason is, you are not forcing yourself well enough to write some clean JavaScript.

If you think I’m talking bullshit, you can better stop reading this article and continue giving JavaScript a bad name and scare of other developers with spaghetti code.

First of all we need to learn to write a JavaScript module. There are a lot of examples how to achieve this. This article is a in-depth description of the module pattern. Another well know example is the object literal pattern.

In my example I will use a pattern like in the first article because it will allow me to control visibility.

var shoppingCart = (function() {
    var items = [];
    var priceTotal = 0;

    var addProduct = function(product) {
        items.push(product);
        updatePriceTotal();
    };

    var removeProduct = function(product) {
        //remove product from items
        updatePriceTotal();
    };

    var updatePriceTotal = function() {
        //logic to update the priceTotal
        //use public functions on product to get the price of products
    };
    
    return {
        addProduct: addProduct,
        removeProduct: removeProduct
    }
}());
var product = (function() {
    //an implementation like shoppingCart
}());
view raw product.js This Gist brought to you by GitHub.

As you can see I use a very bare example, which is just enough to show you my point. We see we put all our JavaScript modules into a seperate file, which is really helpful when you need to maintain them. In the shoppingCart I gave you an example how to control visibility. The ‘updatePriceTotal’ function will be private within the module.

This way of writing your code looks pretty much like writing your code in c# or Java, isn’t it (except from the syntax).

But we are still polluting the global namespace. Now there are only two variables, but think of it when you complete the code I started. How many modules would be added? How much more you will be polluting the global namespace?

When opening the developer tools in for example Chrome and hitting F12 and navigating to the console tab and you type ‘product’ or ‘shoppingCart’ and hit the enter key you can access the objects from the global namespace.

So how can we wrap these modules in our own namespace?

; (function(jsShop, window, document, undefined) {
    var product = jsShop.product;
    var shoppingCart = jsShop.shoppingCart = jsShop.shoppingCart || (function() {
        var items = [];
        var priceTotal = 0;
    
        var addProduct = function(product) {
            items.push(product);
            updatePriceTotal();
        };
    
        var removeProduct = function(product) {
            //remove product from items
            updatePriceTotal();
        };

        var updatePriceTotal = function() {
            //logic to update the priceTotal
            //use public functions on product to get the price of products
        };
        
        return {
            addProduct: addProduct,
            removeProduct: removeProduct
        }
    }());
}(window._jsShop = window._jsShop || {}, window, document));
; (function(jsShop, window, document, undefined) {
    var product = jsShop.product = jsShop.product || (function() {
        //an implementation like shoppingCart
    }());
}(window._jsShop = window._jsShop || {}, window, document));

As you can see we build a little wrapper around our modules. This wrapper is a self executing function which provides access to the elements from the global namespace. When calling this anonymous self executing function we provide our own namespace which we register at global level. We also provide window, document and undefined, because this gives advantages in performance and minification of your scripts. When you never use them in your script you don’t need to add them, but as a best practice I always add them so I will never forget them. Please note that the last parameter isn’t provided, so it is undefined.

Another best practice is to start each script with a semicolon, so you don’t have to bother about missing semicolons in other scripts. By starting with one at least this script file will not give errors on behalf of missing semicolons in other files. Issues most of the time occur when minifying your scripts.

Last but not least we have to register our module in our namespace. What we do is checking if the module already exists or else replace it with your module definition.

You may be asking, what if I want to use jQuery or whatever other script? Just add it to the wrapper so you can use it in you module.

; (function($, jsShop, window, document, undefined) {
    var yourModule = jsShop.yourModule = jsShop.yourModule || (function(){
        //your module code
        $('#shoppingCatTotalPrice').html('€ 8,75');
    }());
}(jQuery, window._jsShop = window._jsShop || {}, window, document));

Now we have achieved ‘product’ and ‘shoppingCart’ are not polluting the global namespace anymore. As you may already have noticed I used an _ in my namespace just to give a little bit more insurance it isn’t used by another external JavaScript. You can test this by opening the developer tools in for example Chrome and hitting F12. Try it out by typing   ‘_jsShop’ and hitting ‘enter’, you should see everything registered in the _jsShop namespace. Google Analytics for example uses the same naming conventions. They’re using the ‘_gac’ variable to provide you access to their api.

If you want to read more about JavaScript namespacing you should read this article. In this example I used one of the preferred patterns of Addy Osmani.

By writing your JavaScript like I described above, it will be very easy to use require.js to load your JavaScript dependencies asynchronously. For now see Addy Osmani’s article about AMD (Asynchronous Module Definition) to make the next step, until I finished my own, step by step article, which will proceed where I stopped in this article.

Also have a look at my jQuery events contributes to clean Javascript article, for a deeper dive into JavaScript modules working with events and jQuery. Note I didn’t use proper name-spacing here, but you know how to add it now.

Hope you enjoyed this article and we can build together on better JavaScript code. Share it with your friends and colleagues and give me some feedback so I can learn from you.

As a last advice…

Subscribe to Addy Osmani’s RSS Feed.

Auto retry concurrent commands with ncqrs

In a previous post I showed you some pseudo code Gregory Young mentioned in his DDD CQRS course I attended in Krakow, Poland. In this course Greg made clear to us locking of databases isn’t necessary. He showed us some pseudo code how to easily write a merge handler to handle all concurrency conflicts.

In my current project, based on the ncqrs-framework I implemented a simpler version of this merge handler which only retries each command if a ConcurrencyException occurs. To achieve this you can easily build a wrapper around the ncqrs commandservice.

public class SafeCommandService : CommandService
{
    public override void Execute(ICommand command)
    {
        try
        {
            base.Execute(command);
        }
        catch(ConcurrencyException ex)
        {
            Execute(command);
            //Log retry executed
        }
    }
}

You can choose to implement this in a WCF service or whatever you want. Every command that fails will be retried until it succeeds. I have tested this with hundred async JavaScript calls which send a real simple command (PrintLabelCommand). My domain only processes a LabelPrintedEvent. When sending these calls to the server my log tells me there are only 8 retries average. This is acceptable in our situation. If you have more complex scenario’s you will probably need a more advanced setup like the pseudocode in this blogpost shows you.

I’m still searching for a better name for my class, because SafeCommandExecutor isn’t the best name I think. So let me know if you have a better one. I hope this article will be useful for you guys. As always, please share…

If you improved my code let me know, so I can learn from it.

Install and boot Windows 8 from vhd

In a previous blog post I explained to you how to install Windows 8 in a virtual machine in VirtualBox. In VirtualBox I used 1 gig of memory and 2 of my cores and it performed quite good. However in the metro interface I had some issues with my mouse (scrolling, delays etc.) So yesterday I decided to install Windows 8 on a vhd and boot directly from it. To do so I followed Scott Hanselman’s blog post.

Below I placed a shorter summary for you guys:

Step 0

Make sure you have at least 40 gig of free disk space for your vhd. Make sure you’re running Windows 7.

Step 1

Download the Windows 8 developer preview.

Download the Windows 7 USB/DVD tool to make yourself a bootable usb stick.

Use the tool to install the iso to your usb. In Scott’s post you can find some screenshots if you really need them.

Step 2

Now you’re ready to reboot. Make sure the usb you created in previous step sticks in your computer and boot from the usb! In the setup click install and proceed to the step you have to choose a hard drive and immediately stop now and read following very carefull.

First of all we need to create a vhd. So we hit shift+F10 to open the command prompt.

In the command prompt key in the following commands. Feel free to choose another file location, but make sure there is enough space on your harddrive.

X:\Sources> diskpart
DISKPART> create vdisk file="c:\VHD\Win8.vhd" type=expandable maximum=40000
DISKPART> select vdisk file="c:\VHD\Win8.vhd"
DISKPART> attach vdisk
DISKPART> create partition primary

TIP:

If you’re not sure which drive letter you need, just type in ‘dir’ to figure out which drive you have to choose for your vhd if you have multiple. This will enlist you all files and folders on this drive letter. If you are already in DISKPART, just type in ‘exit’. When you figured out the location for your vhd just type diskpart again and start over.

X:\Sources> dir c:

Now you’re ready to proceed the installation. So hit alt+tab and click refresh. Now your vhd should appear in the dialog. Select the vhd and just proceed the installation. Possibly you get a warning when selecting the vhd, saying your system possibly doesn’t support it… Just ignore this and click next and just finish the installation.

When your system reboots you will see a great graphical boot loader screen. You should have two options ‘Windows developer preview’ and your ‘Windows 7′. Now you’re ready to go. Enjoy and share this manual if you think it’s useful.