elemental links

Cloud Watching Pick: Vint Cerf on Cloud Computing and the Internet

If you haven’t seen it yet, Vint Cerf published a thoughtful piece on Cloud Computing and the Internet on the Google Research blog.  In the post, Cerf compares the current stage of cloud computing "Each cloud is a system unto itself” to the state of networking in the 1960’s that led to his and Robert Kahn’s work to interconnect proprietary networks and form the internet.

While the entire post is excellent, and well worth the read, I wanted to call out the questions Cerf raises in respect to connecting the clouds, or as some refer to it, the inter-cloud.  Because as every architect knows, the right answers only arise from asking the right questions.

First, the problem as Cerf describes it:

“Cloud computing is at the same stage. Each cloud is a system unto itself. There is no way to express the idea of exchanging information between distinct computing clouds because there is no way to express the idea of “another cloud.” Nor is there any way to describe the information that is to be exchanged. Moreover, if the information contained in one computing cloud is protected from access by any but authorized users, there is no way to express how that protection is provided and how information about it should be propagated to another cloud when the data is transferred.”

Now, Cerf’s questions:

“There are many unanswered questions that can be posed about this new problem. How should one reference another cloud system? What functions can one ask another cloud system to perform? How can one move data from one cloud to another? Can one request that two or more cloud systems carry out a series of transactions? If a laptop is interacting with multiple clouds, does the laptop become a sort of “cloudlet”? Could the laptop become an unintended channel of information exchange between two clouds? If we implement an inter-cloud system of computing, what abuses may arise? How will information be protected within a cloud and when transferred between clouds. How will we refer to the identity of authorized users of cloud systems? What strong authentication methods will be adequate to implement data access controls?”

Instead of answers, Cerf closes by encouraging exploration and creation:

“Because the Internet is primarily a software artifact, there seems to be no end to its possibilities. It is an endless frontier, open to exploration by virtually anyone. I cannot guess what will be discovered in these explorations but I am sure that we will continue to be surprised by the richness of the Internet’s undiscovered territory in the decades ahead.”

Check out his full post.

Sandy Carter on Smart SOA in Tough Economic Climate (+ “mollusc-driven architecture”)

The SOA Consortium just published the second podcast from our March meeting.  This one features IBM’s Sandy Carter talking about Smart SOA^(tm) in a Tough Economic Climate.  Per usual, Sandy’s talk was full of customer anecdotes, my favorite was from StatOilHydro.  Concerned with the environmental and revenue impacts of leaks during oil drilling, StatOil sought an innovative and automated way to detect leaks.  They wanted to replace a manual process that included deep sea drivers.  StatOil’s innovation, they attached RFID tags to the shells of blue mussels.  When the blue mussels sense an oil leak, they close which prompts the RFID tags to emit closure events.  In response to the events, the drilling line is automatically stopped.  And, in case you are wondering, this is of no harm to the blue mussels.  I tweeted this example during the session, and Richard Veryard quickly and cleverly coined “mollusc-driven architecture”.

To listen to an audio recording of Sandy’s presentation and view the slides go here.  The full write-up of the session, pulled from my SOA Consortium Insights post, follows:

“Sandy Carter, IBM VP, SOA, BPM and WebSphere, spoke on the importance of taking a Smart SOA^(tm) approach in a Tough Economic Climate, at the March 2009 meeting of the SOA Consortium in Washington DC.

Carter began by sharing that customers are asking about, and employing, service-orientation and business process management not only to survive the economic crisis, but also to thrive and become more successful when the economic crisis ends.  To this point, CEOs are equally concerned with cost optimization and agility.  Carter was careful to distinguish cost optimization – re-using services, optimizing processes – from non-sustainable cost cutting.

In addition to the economic climate, Carter spoke of marketplace changes based on technology location and proliferation. There are one billion transistors for each person on earth. One trillion things connected to the Internet. And, by 2010, there will be 30 billion RFID tags embedded into our world. This pervasive connectivity and instrumentation provides innumerable opportunities to smarten our companies, countries and environment.

Interestingly, in each of the Smarter Planet examples Carter cited, such as StatOil’s RFID tagging of blue mussels to quickly identify and stop leaks during oil drilling, the solutions all had SOA at the core. When an attendee called out this theme, Carter shared that SOA has become control point of competitive advantage for companies. If you haven’t deployed yet, now is the time.  If you have, now is the time to take your SOA to the next level.

To listen to an audio recording of Carter’s presentation and view the slides go here.

Following her presentation, Carter signed copies of her latest book,  The New Language of Marketing 2.0, How to use ANGELS to Energize your Market.”

Cloud Slam: Rod Boothby, Joyent, The Vanishing Enterprise

[updated 4.22.2009 6:28 pm, had an extraneous "a" in "Boothby", apologies to Rod.]

Session Abstract: “It used to be that you could see the business, touch the bricks, sample the product and the biggest problem with holding a meeting was finding a free boardroom. The first decade of the 21st century has been about enterprises dissipating, virtualizing and breaking into widely spread parts. As the enterprise fragmented geographically (even into the home) the first parts of traditional operations that vanished were the face-to-face meetings and the printed, hand delivered memos. The tools that supported this first step mainly dealt with the small, seemingly unimportant parts of an enterprise’s operations that nobody really noticed going away. As we move to the next decade, the big things are disappearing. A data-center is not a rounding error in a budget -- it can now be removed from the balance sheet entirely. Cloud IT infrastructure now can take on many forms - internal clouds, public clouds and hybrid clouds. Companies like Joyent are enabling this second was wave of enterprise virtualization and making all three cloud scenarios a reality! Over the next ?? minutes we will explain what is making this flexibility possible and how you can leverage this evolution to gain agility, flexibility and capability in an open, loving cloud.”

Rod Boothby is VP of Business Development for Joyent.  Joyent has a public cloud offering, joyent.com as well as software (cloud control) for organizations to manage private clouds.

This afternoon, I attended Rod Boothby’s session.  True to his session abstract, Rod opened by discussing how business has changed over time from large organizations that owned and managed every aspect of a customer value chain (manufacturing to customer delivery) to ecosystems, retaining control over core value chain activities, and contracting out non-core activities, such as shipping and package delivery to trusted providers. 

From here, Rod spoke of organizations applying the same principles to information technology resources and solutions.  CIOs are looking at their portfolios, budgets and backlogs and are making investment and deployment (on-premise, private cloud, public cloud) decisions that factor in cost, risk and time.  Projects that are non-core, or even experimental, are being implemented in the public cloud.  Core projects that can benefit from cloud resource utilization and automation, such as retail websites, are being implemented in private clouds.

Joyent’s business is Infrastructure-as-a-Service, so that was the focus of Rod’s talk.  During the talk, Rod shared some customer examples – Gilt, LinkedIn, walked through getting started with Joyent’s cloud, and showed the administration tool.  In lieu of recapping the entire talk, I wanted to highlight a few points that are important for enterprises to consider. 

First, scaling.  Because cloud computing offers “scale on demand” or “elasticity” people sometimes mistake that for “and then magic happens”.  Certainly, in a PaaS environment like Google App Engine, auto-scaling is built-in.  But, the tradeoff is portability.  You can’t just deploy an existing application to AppEngine, you need to re-write it.  As well, you can’t just export an AppEngine application to another environment, you need to re-write it.

In a IaaS environment, you have code portability, but you need to do the work for scaling.  Not at the physical layer, but you do need to think through your scaling concerns and configure your application components / tiers correctly.  From Rod’s slide, these scaling concerns are:

- Traffic Management

- Caching

- Silos

--- WWW –> Horizontal

--- statics –> Nginx + Horizontal

--- admin

- Caching –> memecached

- Read / Write Traffic Management

- DB Clustering

Next, Security. Rod points out that Security is not single point of concern, nor is there a single solution.  Security concerns:

- Network

- Storage

- OS / Virtualization

- Application

- Physical (Hardware)

- Interface

Similar to Michael Berman of Catbird, Rod points out that security is a joint responsibility between the cloud operator (provider) and cloud application developer (consumer).  The cloud application developer needs to protect sensitive data (encryption) and provide appropriate application level security.  Essentially, similar concerns and precautions to in-house hosted solutions.

On the OS / Virtualization point, Rod pointed out that Joyent doesn’t use virtualization, uses compartmentalization based on Solaris; this prevents security issues from co-located server tenants.  For more rigorous requirements, Joyent offers  dedicated servers.

Lastly, Rod spoke to cloud recovery.  If something goes wrong with your virtual instance, will you need to simply reboot, or rebuild?  Definitely a question that should be on any cloud computing checklist.  Rod pointed out the Amazon EC2 alone, without Rightscale add-on, would require rebuild.  Joyent, reboot.

When I was at the Cloud Computing Expo in NY, Rod gave me a briefing and live tour of Joyent.  At the time, I noted the customer account total of 24,200. 

Cloud Slam: Tom Lounibos, SOASTA, Cloud Testing: Reliability as a Service

Abstract: “We all saw the recent headline: “Obama Inauguration Brings BBC and CNN to a standstill”.  In these hard economic times companies are increasingly relying on the Web as their main sales channel. Its use has moved from a convenient option to something endemic. Expectations for reliability (availability & speed) have become much higher. We want the latest updates and headlines, the best sources, and the most answers in the shortest time possible, and with the least amount effort and constraint. Amazon recently estimated that 100ms of latency cost them 1% of their book sales. As such, Web performance has become the new customer service.

Understanding what the user experience will be before you "go live" is more and more critical. Performance or stress testing is no longer an option, it’s an imperative. In this session we will discuss the value of Cloud Testing and real world case studies of customers using it to ensure Web reliability and performance.”

Tom Lounibos is the President and CEO of SOASTA, the company behind CloudTest.

Tom is talking about consequences of reliability issues.  Interesting to note recent reports where latency is now being measured in lost sales:

• Amazon loses up to 1% of Sales with 100ms of latency on Site
• Google loses 20% Traffic with .5 second of Latency

Calls out recent crash headlines: 40 million users crash Tata Motors site, J. Crew Website Crashes due to people searching for Obama Items, 11-hour Netflix outage

Root Causes of Poor Performance: Application – Network – Environment:

- Sudden Increase in User Activity

- Sustained Increased in User Activity

- New Application Features

- Changes in your Deployment Environment

- Changes in your Application Software

- Changes in an External Component Used

Web Applications are Built Differently: internal & external components assembled into a highly scalable web service.  Tom gives example of an application tying in Facebook, PayPal, external content distribution network and internal database.

Traditional Approach – Internal Testing

- Limited ability to test at web scale

- limited ability to simulate real world user activity

- limited ability to test external components

- limited ability to test firewalls and load balancers

- incredibly expensive: hardware-software-people

- incredibly slow process: 8 week advance notice

Cloud Testing – externally load testing your web application and networks with real world user traffic; your web application (being tested) can be behind your firewall, at a managed hosting provider, or deployed in the cloud.  The “cloud testing” part is using the cloud to produce real world load (geographic and volume) against your web application.  The testers are virtual users running actual scenarios, not just hits.

Type of Cloud Tests:

- Stress Test – where will application break, find stress point

- Load Test

- Performance

- Latency Test

- Browser Performance

Cloud Testing is delivered on pay-per-use model, pay for test hours used

Tom did an admitted mini-commercial for SOASTA, his company.  Now, he’s giving customer case studies.  First customer, TurboTax to understand how the tax filing site would perform on tax day.  Spoke of issue a couple of years ago that resulted in the IRS extending tax filing deadline. 

I snapped some screen shots of the TurboTax case study slides:

Next example, Hallmark.com for the e-card superbowl, Valentine’s Day.  This test plan shows both ramp-up and ramp-down.  Can cause application problems if you ramp down too quickly.  Need to see how application responds.   Another example, QTRAX, a new online music service.  QTRAX test plan (and execution) went up to 500k concurrent users.

In closing, Tom asks and answers: Why Cloud Test?  Achieve Web Scale.  Real world test.  Easy-fast-affordable. 

[Disclosure: SOASTA has done business with my company, Elemental Links, but is not a current client.]

Cloud Slam: Jonathan Bryce, Rackspace Mosso, Cloud Standardization & Network Effect

Session Abstract: “Cloud computing has dramatically lowered the barriers to entry for new web entrepreneurs wanting to start innovative businesses. However, the lack of interoperability, consistency and security concerns across services keeps many businesses from adopting. There have been several calls for standards to help make services from different cloud providers interoperable and ultimately more useful and secure to enterprises.

Uncertainty abounds, with questions such as "Are standards really needed?" "Who should be involved?" “Can the cloud ever be secure?” and "What are potential consequences of working in the cloud?"

This talk will explore the pros and cons of standards, address myths surrounding security in the cloud, while also providing insight from customer feedback and what new cloud technology trends Mosso sees coming this year.”

Jonathan Bryce is a Rackspace Mosso Co-Founder. 

1. Cloud Standards: Who needs ‘em?

Types of Standards: Technology classifications, APIs, Pricing Mechanisms, Compliance

Technology Classifications – a little consensus and agreement is building on the three common layers:

SaaS

PaaS

IaaS

Inversion of Simplicity and Customization, Greater Simplicity at Top (SaaS), More Customization at Bottom (IaaS).  IaaS raw infrastructure power, IaaS consumer has increased responsibility: install, networking, security etc.

APIs to:

Provision and Manage cloud services: Storage, Compute, Network, Application Data

These are ripe for formal specification (standardization).  Basic things everyone needs to do: start/stop, add/remove etc.

Tools will provide portability between clouds, such as rightscale and eucalyptus (open source)

Pricing Mechanisms (Money, Money, Money):

Pricing complexity issues:

• Fewer Natural Limits – no physical boundary, such as physical  server, storage device
• Very Different Capabilities – what is offered, especially at PaaS layer; what is included, what needs to be priced a la carte (consider PaaS that offers auto-scale capability)
• Virtual Everything – not buying physical memory, but chunk of memory on server, buying & holding memory chunk, or receive only as needed
• Consistency or Capacity?

Standard Processing Calculation – there isn’t a standard processing calculation, adds to pricing issues; megacycle hours (Appengine) vs. compute cycle (Mosso); no raw metric, even GHz is problematic with multi-core processors

Compliant Clouds (Compliance)

Compliance is never a first offering in emerging technology.  But, is a critical offering for large business adoption.  Often requested: HIPAA, SAS70, PCI, Safe Harbor

Joint responsibilities of cloud provider and developer.  Cloud provider needs to provide safe platform, storage, auditing etc.  But developer needs to ensure application is designed with compliance in mind, such as HIPAA data access rules, PCI credit card encryption etc.

2. Why Does IT (Standards) Matter?

The Network Effect: interoperability, avoid lock-in (portability), RAIC (redundant arrays of inexpensive clouds), better tools for all, cloud bursting (internal infrastructure with load burst to cloud) & cloud native apps

3. Who and When?

You, me (Jonathan), Customers, Vendors, Partners

Now

Get Involved: Cloud computing interoperability groups, Cloud computing standards groups, easy to find and engage with online

Q&A

- Jonathan discusses interoperability vs. portability.  Tools exist to port an image from one cloud to another.  The bigger challenge, with no real tools or standards, is being able to use more than one cloud at the same time.

- Can you name specific groups: CCIF, unified cloud computing group, open cloud manifesto.  Speaks to the controversy around the open cloud manifesto, suggests people read the manifesto, interpret content as ideals (requirements), not standards.