Links for 09-19-2012

• The History of Digital Storage [INFOGRAPHIC]
• Another Big Fine After a Small Breach - GovInfoSecurity - "For the second time in three months, federal authorities have issued a hefty financial penalty stemming from a HIPAA compliance investigation after a relatively small breach."
• xkcd #1110- with Seadragon
• Daring Fireball: The iPhone 5 - I do plan to upgrade to an iPhone 5 from a 3GS. But Gruber has just been, well, drugged
• My dog: the paradox - The Oatmeal
• Can We Please Move Past Apple's Silly, Faux-Real UIs? | Co.Design: business + innovation + design
• Amazon's Renaissance Of Reading - "Another reason for Amazon's increasing book sales is that people are buying more books. In a Guardian article last month, Amazon.co.uk described this as a "renaissance of reading." Amazon claims this renaissance was ushered in by the Kindle. The UK arm of Amazon told the Guardian that "British Kindle users were buying four times as many books as they were prior to owning a Kindle." That statistic was repeated by Bezos today."
• The Living Room Candidate - RT @JamesPanero: Campaign commercials age poorly but there are still some greats ones here @MovingImageNYC
• Comcast to Replace Usage Cap With Improved Data Usage Management Approaches : Comcast Voices | The Official Comcast Blog - Comcast provided me with some more info about their temporary removal of data caps:

Podcast: Cloud Evangelist Chat: Talking Intel Developer Form

The Intel Developer Form, held the week of September 10 in San Francisco, is always a good opportunity to reflect on what's happening with hardware. That's what my fellow Red Hat Cloud Evangelist Richard Morrell and I do in this podcast. Did the cloud make it possible to keep delivering chip performance improvements? Did the cloud fundamentally cause the ongoing disruption in the client space from iPads to Android to ARM?

You can check out Richard's blog at cloudevangelist.org.

Listen to MP3 (0:24:46)
Listen to OGG (0:24:46)

Links for 09-13-2012

• Exadata, You Bully ! « benchmarkingblog - "Sort of like deciding to have a fistfight with your grandmother."
• Marketers Still Can't Tie Social to Bottom Line - eMarketer - "Econsultancy and Adobe found in August that 57% of companies around the world said the deepest level at which they could track the effectiveness of social media marketing was in terms of engagement, such as the number of followers, comments and time spent on social pages. Even more agencies said this was the deepest metric their clients could track."
• Getting Cloud Architecture Right the First Time Ver 2
• Why Cloud Computing Projects Fail
• Irving Wladawsky-Berger: Reflections on the Longevity of Mainframes

You can't just say no

This post by James Staten is a bit of an ad for some detailed Forrester reports, but in nonetheless offers solid succinct advice about how most organizations should approach a cloud use policy.

It's too late for your policy to say, "The use of cloud services is not allowed," so you need to start from an assumption that it is already happening — and that more of it is happening behind your back than in front of your nose. In fact, any policy that takes a draconianly negative tone probably won't go over very well (it might just be blatantly ignored).

A better approach is to actually encourage its use — in the right way. Your cloud policy needs to present IT as an assistant to the business in the use of cloud and as an advocate for cloud. This will ensure that IT isn't seen as the internal police that you need to hide your business-driven cloud use from. Because your policy should help bring cloud use into the light where it can be monitored, managed, and made better.

As Red Hat's CIO Lee Congdon put it in a webinar I did with him back in March: "Moving to cloud? Your business may have already beaten you to it." with "websites, social media presence, customer service, and CRM." 

The situation is similar to (and, in many respects, related to) Bring-Your-Own-Device. When I write about BYOD, I invariably get comments to the effect that it's a passing fad waiting for a disaster to strike and for IT to subsequently clamp down. This reader's response is fairly typical of such an attitude: 

Eventually when many of the younger crowd starts to understand why they can't find work, they will realize that employers call the shots. The BOYD trend was started by a small group of people who thought their devices manufacturer (I'll give you 3 guesses who the manufacture was, and the first two don't count) is so superior to other devices that they refused to work on anything else. I would happily wish those people well finding employment elsewhere and call for the next interviewee.

As Staten correctly notes, in most environments trying to roll back the clock will merely drive usage underground and beyond the ken of IT governance and policy--to say nothing of cutting off IT and line of business users from the genuine benefits of public cloud services.

The reality of cloud usage (in its various forms) is one reason why many users with whom I speak are intensely interested in topics such as hybrid clouds and application/portability. They realize that cloud is happening and they don't want to stop it. But they do want to bring it under an integrated management and policy framework that empowers users while protecting the company.

And this is why at Red Hat, everything we're doing in cloud from Red Hat CloudForms, to OpenShift to OpenStack to our Certified Cloud Provider Program is built around the twin concepts of open and hybrid.

Links for 09-12-2012

• DIY Book Scanning | A forum dedicated to book scanning, open source, DIY digitization.
• Fifty Years of Bond, James Bond: The Greatest Film Franchise’s Biggest Birthday | Vanity Fair
• The AGPL: Solution in Search of a Problem – tecosystems - "In my view, the AGPL is a solution in search of a problem. Worse, it is a potentially dangerous solution."
• Dear Help Desk: What's Safe to do in the Cloud? | Forrester Blogs - "It's too late for your policy to say, "The use of cloud services is not allowed," so you need to start from an assumption that it is already happening - and that more of it is happening behind your back than in front of your nose. In fact, any policy that takes a draconianly negative tone probably won't go over very well (it might just be blatantly ignored)."
• The Brute Force Computing Revolution - NYTimes.com - "The brute force computing model is changing a lot of fields, with more to follow. It makes sense, in a world where more data is available than ever before, and even more is coming online, from a connected, sensor-laden world where data storage and server computing cycles cost almost nothing. In a sense, it is becoming a modification of the old “theorize-model-test-conclude” scientific method. Now the condition is to create and collect a lot of data, look for patterns amid the trash, and try to exploit the best ones."
• Exclusive Interview with Mo Duffy, Red Hat IxDesigner - Core77
• Nipplegate: Why the New Yorker Cartoon Department Is About to Be Banned from Facebook : The New Yorker
• How Cloud Computing is Changing Many Job Descriptions - Forbes

I talk cloud on Silicon Angle's theCube

This video was shot back in June at Forecast 2012.

Hotel del Coronado LinuxCon event

Hotel del Coronado LinuxCon event
Originally uploaded by ghaff

This was taken at a Hawaii-themed party at LinuxCon/CloudOpen a couple of weeks back. The whole conference was fun and it was great to catch up with various folks.

Brute force computing doesn't replace models

Writing in The New York Times' Bits blog, Quentin Hardy notes that:

The brute force computing model is changing a lot of fields, with more to follow. It makes sense, in a world where more data is available than ever before, and even more is coming online, from a connected, sensor-laden world where data storage and server computing cycles cost almost nothing. In a sense, it is becoming a modification of the old “theorize-model-test-conclude” scientific method. Now the condition is to create and collect a lot of data, look for patterns amid the trash, and try to exploit the best ones.

I rather like the term "brute force computing."

On the one hand, it generalizes beyond Big Data to Big Compute as well. The common thread is that bits of storage and cycles of computing are cheap enough that they don't need to be applied judiciously. The article offers an example from Autodesk. "The idea is to try thousands of different conditions, like temperature, humidity, tensile strength or shape, in just a few seconds. Most of the outcomes will be lousy, a couple of them will probably affirm what a designer thought to begin with, and a few might deliver surprising insights no one had considered."

In another respect, "brute force computing" is a narrower term than Big Data, which really talks to the speed and size of the data rather than the sophistication applied to its analysis. The application of sophisticated models to large realtime data streams may fall under Big Data--but it would be hard to call such merely brute force. That there's such demand for data scientist skills is but one indicator that there's a lot more to data analytics than having a big server farm. Rather, the idea that useful results can fall out when lots of CPUs crank on lots of bytes is more akin to an idea that Wired's Chris Anderson popularized in his provocative 2008 article "The End of Theory: The Data Deluge Makes the Scientific Method Obsolete."

And that's where I'd have liked to see a bit more counterpoint in Hardy's article. It's not that lots of compute plus lots of data can't yield interesting results. But as repeatedly discussed at conferences such as O'Reilly's Stata, it isn't that simple. The numbers often don't just speak for themselves. The right questions have to be asked and the right models, however refined and tested by data and compute, developed. "Brute force computing" has a place but it's got an even larger place when augmented with intelligence.

Links for 09-11-2012

• Cheat Sheets - good coders code, great reuse
• Geography Strikes Back - WSJ.com
• Untitled (https://plus.google.com/107543171463418626606/posts/RQM2cEyziVm) - Seamless device integration /connectivity has been one of the great failures of consumer IT/electronics

Links for 09-10-2012

• Marketing Is Dead - Bill Lee - Harvard Business Review - "First, buyers are no longer paying much attention. Several studies have confirmed that in the "buyer's decision journey," traditional marketing communications just aren't relevant. Buyers are checking out product and service information in their own way, often through the Internet, and often from sources outside the firm such as word-of-mouth or customer reviews."
• 18 Solid Justifications for Cloud Computing -- and 10 Situations Where It Doesn't Work - Forbes - Joe was a great MC at GigaOm Structure back in June.
• As Heroku Boss Flees to Olive Farm, Where's the Platform Cloud Going? | Wired Enterprise | Wired.com
• Cooking isn't fun, but you should do it anyway. - Slate Magazine - RT @asymmetricinfo: This sort of article is always a little bit shocking to me. What do people eat?
• What users are saying about open clouds | The Pervasive Data Center - CNET News - RT @amcpherson: What users are saying about open clouds. Good write up by @ghaff on cnet #cloudopen
• Oracle’s Historical Fiction « benchmarkingblog - RT @ibmperformance: Oracle's Historical Fiction
• The CIO as the (IT) supply chain manager — Cloud Computing News - RT @sbils: The end game for #cloud and the role of the #CIO? IT supply chain master #gom
• Modernism in literature: Rumble and roar | The Economist - Jeff hart was a professor if mine at Dartmouth. New book on 20th century writers
• Backblaze Blog » Price gap: Storage vs Bandwidth - Rt @backblaze: @ghaff We certainly agree! -- nice infographic.
• Podcast: John Mark Walker talks Gluster | The Cloud Evangelist - RT @RedHatStorage: Podcast: John Mark Walker talks Gluster via @EMEACloudGuy
• Untitled (https://plus.google.com/110195292458741862277/posts/Bd7nqq76kGm) - Video on setting up Katello (upstream for app mgmt component of CloudForms)
• The Cheapest Generation - Derek Thompson and Jordan Weissmann - The Atlantic - "Zipcar gives drivers access to cars they don’t have to own. Car ownership, meanwhile, has slipped down the hierarchy of status goods for many young adults. “Zipcar conducted a survey of Millennials,” Mark Norman, the company’s president and chief operating officer, told us. “And this generation said, ‘We don’t care about owning a car.’ Cars used to be what people aspired to own. Now it’s the smartphone.”"

Podcast: Cloud Security with Ellen Newlands

Ellen Newlands is the product manager for Red Hat's cloud security productds. This dicussion covers some of the ways that the "cloud"--large-scale network-connected computing really--introduce new challenges for IT security. Topics include:

• What makes the cloud secure or not?
• What new challenges the cloud brings
• Social engineering and security
• Two factor authentication
• Why open source and hybrid clouds are important

Listen to MP3 (0:18:20)
Listen to OGG (0:18:20)

------------------
[TRANSCRIPT]

Gordon Haff:  Hello everyone. This is Gordon Hat, Cloud Evangelist with Red Hat, and I'm sitting here with Ellen Newlands who is the product manager for our Cloud security offerings. Welcome, Ellen.

Ellen Newlands:  Welcome, Gordon.

Gordon:  Although there are still headlines every now and then about the Cloud being insecure as some macro thing, most observers at this point realize that these blanket statements really don't have any meat to them.

Ellen:  Gordon, I completely agree with you on that score. Whether the Cloud is secure or insecure depends on a number of things. It depends on what kind of Cloud computing you choose, whether you go with public or private or a combination of the two, hybrid Cloud, who you choose for your Cloud provider, what kind of technology you pick, what is your use case, and how carefully you have set up and thought out what information you are putting in the Cloud and how best to secure that as you move to Cloud computing. There are a number of factors to consider with what you call or we call Cloud secure computing. One of the first things I think that we really ought to think about is going into the Cloud, public Cloud, for example, can actually make you more secure depending on the level of expertise and the kind of programs you had for security on premise in your enterprise or your agency.

You can find that there are public Cloud providers who can give you a more holistic view of security and provide you with even better security than you might previously have had. And, of course, as we see from the number of break‑ins, the opposite can also be true.

Gordon:  One of the things that I think is often overlooked is that people raise various types of issues related to public cloud providers, whether it's security or really more commonly it's outages of various types. Obviously, we conflate things like social networks into there. There's lots of questions and issues around privacy and so forth, also. I think often that discussion takes place in a way that ignores the fact that particularly when you're talking smaller businesses, in many cases businesses that don't have full time IT staff. Those types of businesses haven't historically had very good security backup or really IT practices in general.

Ellen:  I think that that is actually true, especially now, IT security expertise is scarce and expensive and in great demand. Setting up your own internal secure software network, bringing in those people, can be expensive and that's very, very hard to judge. I think that security as provided by a knowledgeable public cloud provider can, in many cases, up your security rather than reduce it.

Another thing that I think I've found very interesting is you still read about security breaches in the public cloud. It is interesting to me that many of the breaches that you read about in the public cloud have nothing to do with public cloud computing and are the same old scams that we have always seen on premise and now just move, perhaps, to cloud providers.

One of the ones I think is very interesting recently was a fellow who writes for many of the security journals. He had his account hacked and lost information at Google and Amazon, et cetera because somebody called up the support services and talked them into giving out the password. Same old same old, same old wetware.

Gordon:  Social engineering plays a huge part in those break‑ins. I think this does reveal, though, some of the tension that you have here because, in the case that you mentioned involving Apple and Amazon, social engineering a password. Of course, one approach that those types of companies can take is to simply say, "Well, if you have lost the key, so to speak, to your account, that's just too bad because...So that we don't risk exposing someone else's through social engineering."

It is somewhat of a trade‑off that the easier you make it for someone to recover an account of theirs, for example, the harder you make it for somebody who has a legitimate need to recover an account, which is frankly probably the more common instance, at least with consumer services.

Ellen:  As you know, one of the things that we're seeing used in public cloud or even in enterprise security is identity management. Two of the areas that are very common now are what we call two factor authentication, sometimes known as something you have and something you know.

Gordon:  If you haven't turned on two factor authentication for your Google account, finish listening to this podcast but then go off and do that right away.

Ellen:  Let's say it's something you have and something you know, traditionally. It's something that you have like a token, et cetera and something that you know like your own PIN. If you lose one, you still know the other. Both are "secrets," and the combination is what unlocks your account. You find the two factor authentication is far more secure and you can recover one without the other without jeopardizing the private account.

The other thing that we see a lot of now, as you may know, are the security questions where you fill out the forms in advance with information theoretically known only to you, although, I personally believe everybody's first pet was named "Sam." This set of what I'm going to call "20 questions" is also a way to identify you.

Gordon:  So many of those questions are terrible, though, because so many of them are either things that someone who has any appreciable information about you they do know or can easily find out, or they're questions like, "What's your favorite color?" which may vary from one day to the next.

Ellen:  Absolutely. And remembering your own information sometimes can be a little bit difficult.

Gordon:  Let's switch gears here maybe a little bit. I think, hopefully, we've made the case that security in some macro sense isn't worse in the cloud than anything else, even in the public cloud. But I think we can still say that some security concerns are somewhat different in the cloud, especially with public cloud, but even in private cloud resources. What are some of those that security's different?

Ellen:  Well, security is different when you move from your traditional way of managing IT into the cloud. Again, as you point out, whether that is a public or a private cloud. One of the things that's different is, on average, you'll have more servers on the Internet when you're in a cloud architecture. The more servers you have on the Internet, the more exposed, frankly, you are. When you have moved from using VPN technology to allowing access to all users with certain credentials, the more entry points you have given to malicious users to hack into your larger network.

A second area where cloud computing is quite different, especially with public cloud computers, is the concept of what we call "multi‑tenancy." A public cloud offers space‑‑think of it like the apartments in a large apartment building. Each area that the public cloud provides, each container, is assigned to one account, one company, whatever.

In a multi‑tenancy area, you don't want one "tenant" to get out of their container and start wreaking havoc in the others, either by design or by accident.

One of the things to really consider is making sure that the containers in a multi‑tenant environment have fairly secure walls. Again, an analogy would be you don't want to make it real easy for malicious neighbors to just wander into your own apartment in an apartment complex.

Gordon:  Yes, I think I'd probably take a couple of things away there. The first is that you assume that everything is on the network, and that there are bad people out there who are constantly probing everything that is on the network. So, it's really important to have security.

If you have a PC‑‑by way of analogy‑‑sitting at home 15, 20 years ago, not connected to a network or dialup modem, if you weren't 100 percent up to date with everything, maybe you'd get a virus or something, but by and large, it really wasn't that big a deal if you hadn't updated your security stuff in a while.

If you're in a computer that's constantly connected to a public network, whether we're talking about client or a server device, bad stuff can happen very quickly.

Ellen:  I think, of course, that's absolutely true. When you say you must assume that there are bad people out there probing, increasingly, of course, bad people are frankly bad corporations. There are businesses run nine to five whose sole purpose is to find and exploit any weaknesses in security and take whatever can make them a profit. As such, that's one of the reasons why in theory moving into a public cloud can be safer because public clouds from reputable vendors are updated. They are patched consistently on time and quite thoroughly.

Gordon:  You also mention multi‑tenancy, and, obviously, you get multi‑tenancy on premise or multi‑tenancy in a public cloud. But multi‑tenancy is pretty fundamental to how and what public clouds operate. So, I think it's fair to say that a reputable public cloud is using technology such as Security‑Enhanced Linux, for example, that has some really good mechanisms to provide that additional level at process level for security for multi‑tenant environments. Now configuring SELinux isn't necessarily the easiest thing in the world. So, again, going back to how secure is a public cloud versus a SMB. Well, it's quite fair to say that most SMBs aren’t properly exploiting SELinux whereas that, along with other techniques and other technologies, large reputable Cloud providers certainly are.

Ellen:  That's a very good point, Gordon. The Red Hat Enterprise operating system is foundational and is used in the largest number of available public Clouds and SaaS offerings today. It's very well installed. Part of the reason for that is because it does have the security features that allow for more secure multi‑tenancy, more secure virtualization. For example, the SE Linux that you mentioned, the fact that the operating system itself is common criteria certified.

One of the things I think to bring into focus, too, is that open source software means that it's been peer group reviewed. It's transparent. It's open to the sunshine. Errors are found. Bugs are found and patched relatively rapidly.

You do find that these fundamental, base level layers that underpin a public Cloud can be very useful in providing security.

Gordon:  It's actually a little ironic when you go back to early days of open source becoming really mainstream. By way of analogy, [a lot of people back then thought] even if you thought you had a good alarm system, you wouldn't put the schematics on your door for a potential burglar to see. For a lot of people, who weren't necessarily in the security industry, didn't understand how exploits happen. They just assumed open source must be less secure because that the people could see the code. Write exploits because they can see the code. Of course, that's not how most exploits happen.

Ellen:  No, as a matter of fact, it's not at all. The fact that you can see the code, that it is transparent, that there is a large international group that uses the code, that inspects the code, means that it becomes more secure rather than less so.

Gordon:  Thanks for spending some time with me today. I think, hopefully, doing a little bit more on our part to show there's nothing inherently insecure about the cloud, whether we're talking public clouds or private clouds. At the same time, educating people about things that they need to think about. I'm not sure it's so much the cloud, but simply a world in which increasingly everything is network connected, and there are bad actors trying to take advantage of that fact.

Ellen:  I agree. I think that the one thing to always bear in mind is that your data, your information can be lost, can be stolen, can be compromised, whether you're using public cloud, private cloud or a hybrid, is to take whatever steps are necessary to layer on the security that gives you the protection at the level of the value of the information you're protecting.

Gordon:  That's a good point. Everything, at the end of the day, is about mitigation. There's no such thing as a 100 percent elimination of risk, 100 percent security. If you're talking nuclear launch codes, that is probably a little different from pictures of your cat. Basically, as you say, the backup procedures, encryption, whatever, the cost in both dollar cost and time and effort on your part, shouldn't be out of whack with the value of the data and the privacy associated with that data.

Ellen:  It does seem that a lot of companies now, things that they choose to run in the public Cloud are the things that are, perhaps, consumer based where the security capabilities match the value of the information. Some things that are extremely proprietary are kept in the private Cloud. The combination makes for great flexibility, faster deployments, and very reasonable economics.

Gordon:  That also speaks to why hybrid is a big deal and why Red Hat is making a lot of noise around opening hybrid because it really is a mixed world.

Ellen:  As you say, just as Cloud computing is neither secure nor insecure, public and private Clouds are neither the right choice nor the wrong choice. It's nice to have a little of both.

Gordon:  Great. Thank you very much.

Links for 08-22-2012

• Big Data, Virtualization are Emerging Technologies - Gartner Hype Cycle for Cloud Computing | CloudTimes
• How Paperbacks Transformed the Way Americans Read - Mental Floss
• (404) http://t.co/2Akev - RT @OpenKVM: "OVA efforts..paying off…OVA put KVM in the news..and..we've seen KVM usage rates increase significantly" ...
• Letters of Note: The morning mail is my enemy
• Introduction: Mobile security survey 2012 audio slideshow - Mobile security survey 2012 audio slideshow - Interesting data in this TechTarget mobile security survey (note: weighted towards finance/gov)

Links for 08-20-2012

• BYOD gaining ground as employees increasingly need mobile access - ""What has happened is everyone started building castles around your data and assumed that the data was going to be contained within the network. …Then it became very apparent that that's not going to be a solution for the long term. Now we need to protect the data wherever it is," said Andrew Storms, director of security operations at nCircle Network Security, a San Francisco-based security auditing firm."
• Judge: Google didn't comply with blogger disclosure order in Oracle trial | ZDNet - "Google suggests that it has paid so many commenters that it will be impossible to list them all. Please simply do your best but the impossible is not required."
• Beyond Open Source in the Cloud teaser - YouTube - Teaser video for my Beyond Open Source in the Cloud talk at #cloudopen
• Rational Survivability » Incomplete Thought: Virtual/Cloud Security and The Potemkin Village Syndrome - "First, the trust models, architecture and operational models surrounding how we’ve “done” security simply are not designed to absorb this much disruption so quickly.  The fact that we’ve relied on physical segregation, static policies that combine locality and service definition, mobility and the (now) highly dynamic application deployment options means that we’re simply disconnected."
• Podcast: Jon Masters talks Hyperscale | The Cloud Evangelist - .@EMEACloudGuy interviews Red Hat's Jon Masters about ARM-powered servers and more
• NASA Pulls Off 350-Million-Mile Software Patch | Wired Enterprise | Wired.com - This is pretty awesome.

Beyond Open Source in the Cloud

I'm wrapping up the week putting the final touches on my Beyond Open Source in the Cloud presentation for CloudOpen week after next. The next week is going to be crazy;  I need to get everything ready for VMworld and CloudOpen and then vacation in the Sierras the week after that.

As for the topic at hand, through, here's the description from the program:

Openness doesn’t stop and end with the submission of some format to a standards body or with the announcement of partners endorsing some specific technology platform. It doesn’t stop and end with open source either. An open cloud isn’t about having some singular feature. It’s about maximizing a wide range of characteristics that push the needle from closed to truly open. These include open source and open standards for sure. But they also include portability of applications and data, viable and independent communities, freedom from IP encumbrances, and APIs that are independent of specific implementations.

I've previously given a "lightning" version of this presentation at CloudCamp and some of the material is touched on during my broader cloud presentations. However, for this event, I've fleshed out my discussion of the various aspects of openness. The whole topic is very timely.

One need only look to Twitter API Apocalypse version 2,654 this past week to see just how timely. (And the fact that there's a story about APIs on CBS says something about just how important APIs--and, by extension other aspects of openness--to the modern computing world even for those who have never written a line of code in their lives. 

My paper: Why the Future of the Cloud is Open

I'm on Wednesday, August 29 right after the keynotes. Come to San Diego and join us!

Links for 08-16-2012

• GOP Senate Hopeful Helped Found Controversial Dartmouth Newspaper - Ah, the delights of being quoted completely out of context. (In an interview requested under pretty much false pretenses.)
• Hipsters stunned as vintage cameras fail to make them professional photographers - Hayibo | Hayibo - RT @stephstad: Hipsters stunned as vintage cameras fail to make them professional photographers: ” -- Funny!
• CloudOpen 2012: Beyond Open Source in the Cloud - Gordon... - Today am busy working on my presentation for the CloudOpen conference in San Diego

Halema'uma'u Crater at Night

Halema'uma'u Crater at Night
Originally uploaded by ghaff

My Hawaii pix are up on Flickr: http://www.flickr.com/photos/bitmason/tags/hawaii/

Links for 08-15-2012

• Cloud APIs: It’s the Architecture that Matters | RightScale Blog
• The Problem with Airlines and Checked Baggage: On the Case : Expert Travel Tips : Condé Nast Traveler
• Corporate Open Source Anti-patterns
• Red Hat CEO: The nuts and bolts of open source | ITworld - "Specifically, Whitehurst described the invention of the auto lathe in 1810 by Henry Maudslay, which enabled the mass production of standardized hardware, such as nuts and bolts. It would be the availability of such standardized components, approximately 60 years into the Industrial Age, that would spawn a massive explosion of innovation around industrial products."
• Untitled (http://www.myoops.org/ans7870/11/11.001j/f01/lectureimages/2/image24.html) - RT @bostonography: "MIT Beaver, 1916 Crossing of Charles to found new campus." And to absolutely terrify you.
• The Julia Child Recipes Home Cooks Still Make - NYTimes.com
• Data Center Dialog: The 110-year-old light bulb is a little too much like today’s IT - You have to manage risk but sometimes it is better to start fresh.
• IBM - The Palace Museum (08/30/2010) - RT @linux_at_ibm: Fun case study: Forbidden City in Beijing uses #BladeCenter running #Linux --runs RHEL on BladeCenter
• Magazines Don’t Have a Digital Problem, They Have a Bundling Problem | PandoDaily - "We will always need editors to commission and shape strong stories, but we don’t need them so much to bundle disparate pieces of content into one immutable chunk. Instead, many of the most savvy readers prefer to consume magazine journalism piece by piece, taking note of the source from which it sprung, but not necessarily paying heed to whatever else happened to be placed alongside it in that source that particular week or month. "
• A VC: Open Protocols - RT @mathewi: "I believe in open protocols and open APIs. That is what the web was built on" -- Fred Wilson <
• Software lives forever | The Pervasive Data Center - CNET News - .@jayfry3 @johnrrymer This story I wrote a couple of years back have fave example re: software living forever
• United Airlines Lost My Friend's 10 Year Old Daughter And Didn't Care - Bob Sutton - Horrible United story.

Links for 08-14-2012

• The Real Time Myth - Input Output - "How fast data is delivered is usually a function of necessity, cost, and benefit." -- Good reality check.
• Federal Cloud and the Reactionary Skeptic | a technology job is no excuse - "The trouble with the Reactionary Skeptic is that it’s a bloodless position. There’s no vision. The article is filled with warnings without a single suggestion for improving the situation. Altogether, the message being communicated to government is: Be Afraid. This kind of article encourages a fearful conservatism, which is the most toxic trait in government managers today."
• The 2nd Tenet of Open Source: Bet on the Community, Not the Current State of Technology | tentenet.net - RT @bryanwche: The 2nd Tenet of Open Source: Bet on the Community, Not the Current State of Technology
• Doubling SaaS Revenue By Changing The Pricing Model | Kalzumeus Software
• OpenStack dons a Red Hat • The Register
• East Coast VS West Coast PaaS Psychology - Apprenda
• From the archive: Parkinson's Law | The Economist
• Fear of flying: Welcome aboard | The Economist
• Uber runs afoul of Massachusetts regulators - District of DeBonis - The Washington Post - RT @rlove: Via @washingtonpost, incumbents and their captured regulators try to shutdown @Uber_BOS.
• Journey Into Space (Dec. 8, 1952) | TIME and Space: A Lofty History of Space Exploration on TIME Magazine’s Covers | NewsFeed | TIME.com
• Drinking at work: The boredom of boozeless business | The Economist - RT @cote: "Today, it seems that the battle is over and the killjoys have won." << V different since I started working
• A Candid Interview with Mitt Romney : The New Yorker

How Red Hat's Cloud Portfolio Fits Together

As part of Red Hat's announcement of an OpenStack technology preview today, I wrote a blog that provides some additional background. Here, I'm going to delve a bit more deeply into one of the topics that I cover in that blog--namely, how do the different pieces of Red Hat's open hybrid cloud portfolio fit together? I'll be referring to the below diagram throughout this discussion.

From Blog

First, there is the infrastructure layer. This typically [1] consists of a hypervisor, its associated infrastructure management stack, and APIs providing the ability to control that management stack programmatically.

This is where OpenStack plays. OpenStack is an IaaS solution that manages a hypervisor and provides cloud services to users through self-service. (The OpenStack project supports a variety of hypervisors to various degrees; Red Hat is focused on KVM--the hypervisor used by Red Hat Enterprise Virtualization--which is part of Linux and has become pretty much the default open source hypervisor.) Perhaps the easier way to think of OpenStack, however, is that it lets an IT organization stand up a cloud that looks and acts like a cloud at a service provider. That OpenStack is focused on this public cloud-like use case shouldn't be surprising; service provider Rackspace has been an important member of OpenStack and uses code from the project for its own public cloud offering.

This IaaS approach differs from the virtualization management offered by Red Hat Enterprise Virtualization, which is more focused on what you can think of as an enterprise use case. In other words, Red Hat Enterprise Virtualization supports typical enterprise hardware such as storage area networks and handles common enterprise virtualization feature requirements such as live migration. Both OpenStack and Red Hat Enterprise Virtualization may manage hypervisors and offer self-service—among other features—but they're doing so in service of different models of IT architecture and service provisioning.

Alternatively, the self-service infrastructure may be at a public cloud provider such as Amazon Web Services or Rackspace. Ultimately the goal is to make the underlying infrastructure decisions largely transparent to the consumer of the resources, such as a developer. Of course, where the resources are located, how they are managed, and what types of hardware functions they expose make a big different to the ops team. But they're deliberately abstracted from those developing and using applications.

Then there is open, hybrid cloud management of those “cloud providers.” These providers can consist of the various types of infrastructure just described:  on-premise IaaS like OpenStack, public IaaS clouds, and virtualization platforms (not just a hypervisor) like Red Hat Enterprise Virtualization or VMware vSphere. This is where Red Hat CloudForms comes in. CloudForms allows you to build a hybrid cloud that spans those disparate resources. It lets you build a "cloud of clouds" in a sense. 

However, equally important, is that CloudForms provides the lifecycle management of the content and images that will run across the hybrid cloud infrastructure. For example, CloudForms lets you specify content repositories which feed the construction and ongoing management of single- and multi-tier applications through Application Blueprints created by IT administrators. These Application Blueprints also embed policy. When a user chooses an available application environment through the self-service interface, it can only be deployed to a location enabled by policy. For example, development environments may be deployed to a public cloud while production applications may be deployed to an on-premise virtualization platform.

Platform-as-a-Service (PaaS) is delivered by Red Hat OpenShift PaaS. PaaS is perhaps best thought of as an abstraction focused on the typical concerns of developers. Thus, instead of an operating system image-centric view (as an IaaS provides), PaaS is more oriented to a view that revolves around pushing and pulling code into and from repositories;  the operation of the software needed to run that code is largely kept in the background. 

Unlike a PaaS that is limited to a specific provider, OpenShift PaaS can run on top of any appropriately provisioned infrastructure whether in a hosted or on-premise environment. It then provides application multi-tenancy within the operating system images that make up the infrastructure. It does so using a combination of Linux Containers, SELinux for security isolation, and other Linux features. Red Hat's Matt Hicks spoke with me about some of these technologies in an interview a while back (podcast and transcript).

This approach allows organizations to not only choose to develop using the languages and frameworks of their choice but to also select the IT operational model that is most appropriate to their needs. The provisioning and ongoing management of the underlying infrastructure on which OpenShift PaaS runs is where virtualization, IaaS, and cloud management solutions come in. (After all, someone needs to operate the PaaS infrastructure whether it's on-premise or at a cloud provider.)

Nor does Red Hat Cloud end with "cloud products." For example, Red Hat Enterprise Linux--in addition to providing features used by offerings such as OpenShift--also provides a consistent and reliable runtime for applications as they move across different environments such as on-premise and public clouds. Red Hat Storage (from our Gluster acquisition) provides a distributed, scalable, software-only filesystem that will be an important part of data portability across clouds.

Sound complicated? It is a bit, I guess. But when you're talking about such a big change in the way that IT systems are operated and applications are consumed, some complexity is unavoidable. (Which is one reason we're so focused on solutions. But that's a topic for another day and another blog post.)

 -------------------

[1] In a future version, CloudForms will be able to provision "bare metal" physical servers using Foreman/Puppet components. In this respect, CloudForms includes the ability to build an IaaS. However, for our purposes here, I'm going to focus on how CloudForms builds hybrid cloud resource pools on top of IaaS and virtualization management products and manages the applications running in those pools.

Links for 08-10-2012

• Discussion on Cloud computing: What does it really mean for IT jobs? | TechRepublic
• Stage Marathon: Is Seven Hours of The Great Gatsby Too Much? - TIME - I really enjoyed watching Gatz.
• Review: ‘Total Recall’ Remake Is Totally Forgettable | Entertainment | TIME.com - "The new PG-13 movie is a fairly close adaptation of the Verhoeven one and lacks not just the earlier film’s newness but also its vigor, density, humor and R-rated juice. It’s like the dinner-theater revival of a classic play, whose single asset is to remind those present how good the original was."
• Amazon Web Services Blog: The AWS Report - Sharon Chiarella, Amazon Mechanical Turk - transcription, writing, data cleansing, sentiment analysis, and moderation.
• How to be a tech blogger – Ezra Butler – The Kernel

Links for 08-09-2012

• Evgeny Morozov: The Naked And The TED | The New Republic - What a takedown review. Love it!
• Jonah Lehrer, TED, and the narrative dark arts | Felix Salmon - "And here’s the thing: for all that Jonah Lehrer ultimately wound up blogging for the New Yorker, he has always been a creature of TED much more than he has been a creature of journalism.* Check out Seth Mnookin’s post, today, on Jonah Lehrer’s missing compass: the way that Lehrer remixed facts in service of narrative is very TED"
• Letters of Note: I am a lousy copywriter - From David Ogilvy.
• The Cloud: A Clear Choice - Not a bad infographic.
• Olympic Bodies: They Just Don't Make Them Like They Used To : Shots - Health Blog : NPR
• Pasta Carbonara
• The Soylent Green of “Epic Hacks” – It’s Made of PEOPLE!
• The IT world’s love-hate relationship with OpenStack
• Survivor: CIO Edition – Will Cloud Computing Kill The CIO Role? | Andi Mann – Ubergeek
• (403) http://www.yelp.com/biz/Nk2mnfoiSbM85iW0cAFpsw?pt=check_in&ref=twitter&v=4b - I checked in at Bonefish Grill on #Yelp
• Boston Food Bloggers | BostInno

A mostly positive take on OpenStack from GigaOm

Derrick Harris at GigaOm has a piece up about the "IT world's love-hate relationship" with OpenStack. It seems a balanced piece overall even if a lot of "Why the hate" either boils down to pre-foundation governance issues or generalized "concerns." The cynical might be inclined to label some of this as FUD coming from those with commercial interests opposed to OpenStack. If you attended GigaOm's Structure 2012 conference, you saw some of this dynamic in play in the debate over APIs. In a nutshell, does a popular de facto API like AWS trump APIs that are actually open? Contrary to the fervent denials one hears, from where I sit, there is very much an anti-OpenStack camp. 

On the "love" side described by Harris, I'd add that, in addition to the "mega-vendor" and large end-user backers, there's also huge breadth of participation; April's OpenStack Conference in San Francisco had over 1,000 people registered. It's hard to argue against the proposition that OpenStack has a lot of momentum going for it.

Leaving aside the pro/con snippets though, Harris' overall conclusion strikes me as fair. Whether or not you agree that all the knocks on OpenStack that Harris details are truly newsworthy, his overall conclusion is pretty positive.

Perhaps it’s just par for the course that any project with so much hype, representing such a lucrative opportunity, and comprised of big egos all around is going to be a hotbed of in-fighting and allegations. But if the companies involved can hold OpenStack together enough to keep everyone headed in the same direction, it’s hard to see how it won’t be a major factor in the cloud space for a long time to come.

My employer, Red Hat, is a platinum member of the OpenStack Foundation.

Links for 08-08-2012

• Google and Oracle ordered to disclose bloggers and journalists they paid to influence coverage (update) | The Verge - Headline bit inflammatory. But the judge's disclosure order wrt bloggers, journalists, etc. in Google-Oracle seems big
• Inside NASA’s Curiosity: It’s an Apple Airport Extreme… with wheels | ExtremeTech - RT @Krewell: If you're interested in the Mars Curiosity's engineering, this is a good read:
• Challenges of Getting to Mars: Curiosity's Seven Minutes of Terror - YouTube - Pretty amazing video of the Curiosity landing sequence.
• Apache Deltacloud Hits Open Source Cloud Server Milestone - RT @TechJournalist: Apache Deltacloud Hits Open Source Cloud Server Milestone - Server Watch
• What Happened To the Long Tail? - "For Shanks, the loss of physical shelf space, the proliferation of titles online, and growth of e-books sales means the promise of the long tail for print books has been permanently altered. “There is a long tail, but it is so long the units are small.”"
• Red Hat | The Deltacloud Project Reaches 1.0 - Apache Deltacloud Project reaches 1.0. By me.
• NoiseTrade | Thousands of Albums. Completely Free. Completely Legal.
• Connections: Mobile ticketing. Good news but better have good IT. - Mobile ticketing. Good news but better have good IT.
• The Many Mysteries of The Dark Knight Rises - Howzzit? - SPOILERS. The only piece I've read which makes me (slightly) doubt the majority opinion about what happened.

Mobile ticketing. Good news but better have good IT.

From Mobile Commerce Daily:

Following a successful test on five routes, Amtrak is expanding a digital ticketing program to all trains, enabling passengers to use their smartphones to present tickets to the conductor...

Passengers using a smartphone or other mobile device can present the eTicket to the conductor by opening the document from the email.

ETickets can also be printed from any printer, including at Amtrak ticket offices and Quik-Trak kiosks.

Additionally, passengers can also buy tickets and display eTicket bar codes with the Amtrak mobile application.

With the eTicket program, passengers can also easily change reservations and lost or misplaced tickets can be easily reprinted.

Following a successful test on five routes, Amtrak is expanding a digital ticketing program to all trains, enabling passengers to use their smartphones to present tickets to the conductor.

Nice. I actually don't find mobile tickets all that big a win with the airlines most of the time; it's just not usually that big a deal to get a boarding pass from an airport kiosk. (Although I typically print out my outbound boarding pass at home when I remember.)

But I use Amtrak, most often from Boston to New York, differently than I use planes. The timing of my outbound leg is pretty set--way too early in the morning. But, for my return, I'm usually in the position of guessing how an event or set of meetings is going to play out and taking a stab at a return time that may or may not turn out to make a lot of sense. 

The problem is that, although you can change train ticket times without penalties, in practice dealing with lines at Penn Station and dealing with call queues with reservations can make changing a ticket more hassle than it's worth. If mobile tickets make the process a lot more streamlines, that's a big win.

Another mentioned advantage is that current Amtrak tickets, once issued, are essentially just like cash--as I know from experience--and are very hard to get refunded/replaced just as airline tickets once were.

For most purposes, this shift away from significant value being embedded in arbitrary bits of paper is a welcome one--but it does raise the stakes on back-end infrastructure. It has to be resilient and scalable. The network pipes going in and out have to be solid. It also potentially creates complications if always-connected mobile devices aren't, in fact, always connected (although mobile apps that store past transactions can help). 

Because, increasingly, there just won't be a good manual fall-back if the digital systems don't work.

Links for 08-02-2012

• Source Sans Pro: Adobe’s first open source type family « Typblography
• Oracle Loses HP Itanium Court Battle - Hardware - Processors - Informationweek
• Badminton, taxes, regulation …. and the people’s justice — Crooked Timber - IMO, it depends on the context. For example, I'm not convinced there is some moral imperative to follow the "spirit of the law" wrt taxes.
• Why iPads Are the Future of In-Flight Entertainment - I'm suspect that the logistics of implementing such a system would ar outweigh any benefits given the bring-your-own option.
• Jonathan Schwartz: Oracle bungled its chance at mobile Java | Internet & Media - CNET News
• How low (power) can you go? - Charlie's Diary
• Aeolus Project Blog - RT @aeolusproject: Just launched our blog -- -- hosted by @openshift and WordPress. Check it out!
• My Top Five Sessions at the CloudOpen Conference | The Linux Foundation - "Beyond Open Source in the Cloud - Gordon Haff, Red Hat. Openness doesn’t stop and end with the submission of some format to a standards body or with the announcement of partners endorsing some specific technology platform. It doesn’t stop and end with open source either. An open cloud isn’t about having some singular feature. It’s about maximizing a wide range of characteristics that push the needle from closed to truly open. These include open source and open standards for sure. But they also include portability of applications and data, viable and independent communities, freedom from IP encumbrances, and APIs that are independent of specific implementations."
• Lessons Learned from a Bring Your Own Device Project › Avema Mobile Device Management - Interesting post I ran across "Lessons Learned from a Bring Your Own Device Project" #BYOD
• With 'bring your own,' a PC isn't just another device | The Pervasive Data Center - CNET News - Don't confuse BYOD with BYOPC by me
• Linux Hater's Blog: Your free software website, for dummies - Your free software website for dummies :-)