Yes, I love Twitter; and you’re certainly right about the nitpicky corrections, thanks

Extended ACLs are extended attributes (permissions) that can be applied to most POSIX file systems. NFSv4 ACLs are a whole different beast, and the two don’t always jive. Say you have an NFS server running Solaris and files with extended ACLs. Linux will not see those at all. NFSv4 server to NFSv4 client (if they are all Linux) works, but that’s the extent last I checked.

Real world: say I want to give a friend/coworker access to a file. I either open it up to the world or must be in the same group as him. With setfacl, you can just grant him read access to that file or directory. Also, default ACLs are super handy. Instead of hoping collaborators understand umask, you can enforce a mask that ensures files written to a shared directory are group-writable. I wrote an article about group collaboration (but focused on Samba), here:
http://www.linuxplanet.com/linuxplanet/tutorials/6844/1/

In Linux/Solaris, see: setfacl(1), getfacl(1)
(if Ubuntu, you must have the ‘acl’ package installed)

Sorry, I don’t know anything about VMS.

And while we’re being all nitpicky here, it’s “octal” not “decimal” and “mnemonic” not “pneumonic.”

The stuff about 4000/2000/1000 bits was enlightening. I admit that I’ve limited my application of permissions to the 777 discussed in the first half of this article.

The sentence “Often the extended attributes aren’t necessary, and ACLs likely won’t work over NFS if you’re using Linux” raised a few questions in my head, to wit: 1) What are some useful use cases and real-world purposes for the extended attributes? 2) What’s an ACL? 2a) Are they similar/different to the Access Control List concept in OpenVMS? 2b) While we’re on VMS, why is there no “D”elete bit in the Unix permissions and what’s the use of it in OpenVMS when a user with “W”rite can simply truncate a file, effectively erasing it? 3) What (typically) goes wrong with ACLs via nfs?

That said, I tend to run Linux on personal machines, in developer environments where everybody on the box has sudoer access, or where files are all buried beneath a tangled web of network application software, so it might as well be like DOS permissions for all the practical good it does me.