Hotel del Coronado LinuxCon event

Hotel del Coronado LinuxCon event
Originally uploaded by ghaff

This was taken at a Hawaii-themed party at LinuxCon/CloudOpen a couple of weeks back. The whole conference was fun and it was great to catch up with various folks.

Brute force computing doesn't replace models

Writing in The New York Times' Bits blog, Quentin Hardy notes that:

The brute force computing model is changing a lot of fields, with more to follow. It makes sense, in a world where more data is available than ever before, and even more is coming online, from a connected, sensor-laden world where data storage and server computing cycles cost almost nothing. In a sense, it is becoming a modification of the old “theorize-model-test-conclude” scientific method. Now the condition is to create and collect a lot of data, look for patterns amid the trash, and try to exploit the best ones.

I rather like the term "brute force computing."

On the one hand, it generalizes beyond Big Data to Big Compute as well. The common thread is that bits of storage and cycles of computing are cheap enough that they don't need to be applied judiciously. The article offers an example from Autodesk. "The idea is to try thousands of different conditions, like temperature, humidity, tensile strength or shape, in just a few seconds. Most of the outcomes will be lousy, a couple of them will probably affirm what a designer thought to begin with, and a few might deliver surprising insights no one had considered."

In another respect, "brute force computing" is a narrower term than Big Data, which really talks to the speed and size of the data rather than the sophistication applied to its analysis. The application of sophisticated models to large realtime data streams may fall under Big Data--but it would be hard to call such merely brute force. That there's such demand for data scientist skills is but one indicator that there's a lot more to data analytics than having a big server farm. Rather, the idea that useful results can fall out when lots of CPUs crank on lots of bytes is more akin to an idea that Wired's Chris Anderson popularized in his provocative 2008 article "The End of Theory: The Data Deluge Makes the Scientific Method Obsolete."

And that's where I'd have liked to see a bit more counterpoint in Hardy's article. It's not that lots of compute plus lots of data can't yield interesting results. But as repeatedly discussed at conferences such as O'Reilly's Stata, it isn't that simple. The numbers often don't just speak for themselves. The right questions have to be asked and the right models, however refined and tested by data and compute, developed. "Brute force computing" has a place but it's got an even larger place when augmented with intelligence.

Links for 09-11-2012

• Cheat Sheets - good coders code, great reuse
• Geography Strikes Back - WSJ.com
• Untitled (https://plus.google.com/107543171463418626606/posts/RQM2cEyziVm) - Seamless device integration /connectivity has been one of the great failures of consumer IT/electronics

Links for 09-10-2012

• Marketing Is Dead - Bill Lee - Harvard Business Review - "First, buyers are no longer paying much attention. Several studies have confirmed that in the "buyer's decision journey," traditional marketing communications just aren't relevant. Buyers are checking out product and service information in their own way, often through the Internet, and often from sources outside the firm such as word-of-mouth or customer reviews."
• 18 Solid Justifications for Cloud Computing -- and 10 Situations Where It Doesn't Work - Forbes - Joe was a great MC at GigaOm Structure back in June.
• As Heroku Boss Flees to Olive Farm, Where's the Platform Cloud Going? | Wired Enterprise | Wired.com
• Cooking isn't fun, but you should do it anyway. - Slate Magazine - RT @asymmetricinfo: This sort of article is always a little bit shocking to me. What do people eat?
• What users are saying about open clouds | The Pervasive Data Center - CNET News - RT @amcpherson: What users are saying about open clouds. Good write up by @ghaff on cnet #cloudopen
• Oracle’s Historical Fiction « benchmarkingblog - RT @ibmperformance: Oracle's Historical Fiction
• The CIO as the (IT) supply chain manager — Cloud Computing News - RT @sbils: The end game for #cloud and the role of the #CIO? IT supply chain master #gom
• Modernism in literature: Rumble and roar | The Economist - Jeff hart was a professor if mine at Dartmouth. New book on 20th century writers
• Backblaze Blog » Price gap: Storage vs Bandwidth - Rt @backblaze: @ghaff We certainly agree! -- nice infographic.
• Podcast: John Mark Walker talks Gluster | The Cloud Evangelist - RT @RedHatStorage: Podcast: John Mark Walker talks Gluster via @EMEACloudGuy
• Untitled (https://plus.google.com/110195292458741862277/posts/Bd7nqq76kGm) - Video on setting up Katello (upstream for app mgmt component of CloudForms)
• The Cheapest Generation - Derek Thompson and Jordan Weissmann - The Atlantic - "Zipcar gives drivers access to cars they don’t have to own. Car ownership, meanwhile, has slipped down the hierarchy of status goods for many young adults. “Zipcar conducted a survey of Millennials,” Mark Norman, the company’s president and chief operating officer, told us. “And this generation said, ‘We don’t care about owning a car.’ Cars used to be what people aspired to own. Now it’s the smartphone.”"

Podcast: Cloud Security with Ellen Newlands

Ellen Newlands is the product manager for Red Hat's cloud security productds. This dicussion covers some of the ways that the "cloud"--large-scale network-connected computing really--introduce new challenges for IT security. Topics include:

• What makes the cloud secure or not?
• What new challenges the cloud brings
• Social engineering and security
• Two factor authentication
• Why open source and hybrid clouds are important

Listen to MP3 (0:18:20)
Listen to OGG (0:18:20)

------------------
[TRANSCRIPT]

Gordon Haff:  Hello everyone. This is Gordon Hat, Cloud Evangelist with Red Hat, and I'm sitting here with Ellen Newlands who is the product manager for our Cloud security offerings. Welcome, Ellen.

Ellen Newlands:  Welcome, Gordon.

Gordon:  Although there are still headlines every now and then about the Cloud being insecure as some macro thing, most observers at this point realize that these blanket statements really don't have any meat to them.

Ellen:  Gordon, I completely agree with you on that score. Whether the Cloud is secure or insecure depends on a number of things. It depends on what kind of Cloud computing you choose, whether you go with public or private or a combination of the two, hybrid Cloud, who you choose for your Cloud provider, what kind of technology you pick, what is your use case, and how carefully you have set up and thought out what information you are putting in the Cloud and how best to secure that as you move to Cloud computing. There are a number of factors to consider with what you call or we call Cloud secure computing. One of the first things I think that we really ought to think about is going into the Cloud, public Cloud, for example, can actually make you more secure depending on the level of expertise and the kind of programs you had for security on premise in your enterprise or your agency.

You can find that there are public Cloud providers who can give you a more holistic view of security and provide you with even better security than you might previously have had. And, of course, as we see from the number of break‑ins, the opposite can also be true.

Gordon:  One of the things that I think is often overlooked is that people raise various types of issues related to public cloud providers, whether it's security or really more commonly it's outages of various types. Obviously, we conflate things like social networks into there. There's lots of questions and issues around privacy and so forth, also. I think often that discussion takes place in a way that ignores the fact that particularly when you're talking smaller businesses, in many cases businesses that don't have full time IT staff. Those types of businesses haven't historically had very good security backup or really IT practices in general.

Ellen:  I think that that is actually true, especially now, IT security expertise is scarce and expensive and in great demand. Setting up your own internal secure software network, bringing in those people, can be expensive and that's very, very hard to judge. I think that security as provided by a knowledgeable public cloud provider can, in many cases, up your security rather than reduce it.

Another thing that I think I've found very interesting is you still read about security breaches in the public cloud. It is interesting to me that many of the breaches that you read about in the public cloud have nothing to do with public cloud computing and are the same old scams that we have always seen on premise and now just move, perhaps, to cloud providers.

One of the ones I think is very interesting recently was a fellow who writes for many of the security journals. He had his account hacked and lost information at Google and Amazon, et cetera because somebody called up the support services and talked them into giving out the password. Same old same old, same old wetware.

Gordon:  Social engineering plays a huge part in those break‑ins. I think this does reveal, though, some of the tension that you have here because, in the case that you mentioned involving Apple and Amazon, social engineering a password. Of course, one approach that those types of companies can take is to simply say, "Well, if you have lost the key, so to speak, to your account, that's just too bad because...So that we don't risk exposing someone else's through social engineering."

It is somewhat of a trade‑off that the easier you make it for someone to recover an account of theirs, for example, the harder you make it for somebody who has a legitimate need to recover an account, which is frankly probably the more common instance, at least with consumer services.

Ellen:  As you know, one of the things that we're seeing used in public cloud or even in enterprise security is identity management. Two of the areas that are very common now are what we call two factor authentication, sometimes known as something you have and something you know.

Gordon:  If you haven't turned on two factor authentication for your Google account, finish listening to this podcast but then go off and do that right away.

Ellen:  Let's say it's something you have and something you know, traditionally. It's something that you have like a token, et cetera and something that you know like your own PIN. If you lose one, you still know the other. Both are "secrets," and the combination is what unlocks your account. You find the two factor authentication is far more secure and you can recover one without the other without jeopardizing the private account.

The other thing that we see a lot of now, as you may know, are the security questions where you fill out the forms in advance with information theoretically known only to you, although, I personally believe everybody's first pet was named "Sam." This set of what I'm going to call "20 questions" is also a way to identify you.

Gordon:  So many of those questions are terrible, though, because so many of them are either things that someone who has any appreciable information about you they do know or can easily find out, or they're questions like, "What's your favorite color?" which may vary from one day to the next.

Ellen:  Absolutely. And remembering your own information sometimes can be a little bit difficult.

Gordon:  Let's switch gears here maybe a little bit. I think, hopefully, we've made the case that security in some macro sense isn't worse in the cloud than anything else, even in the public cloud. But I think we can still say that some security concerns are somewhat different in the cloud, especially with public cloud, but even in private cloud resources. What are some of those that security's different?

Ellen:  Well, security is different when you move from your traditional way of managing IT into the cloud. Again, as you point out, whether that is a public or a private cloud. One of the things that's different is, on average, you'll have more servers on the Internet when you're in a cloud architecture. The more servers you have on the Internet, the more exposed, frankly, you are. When you have moved from using VPN technology to allowing access to all users with certain credentials, the more entry points you have given to malicious users to hack into your larger network.

A second area where cloud computing is quite different, especially with public cloud computers, is the concept of what we call "multi‑tenancy." A public cloud offers space‑‑think of it like the apartments in a large apartment building. Each area that the public cloud provides, each container, is assigned to one account, one company, whatever.

In a multi‑tenancy area, you don't want one "tenant" to get out of their container and start wreaking havoc in the others, either by design or by accident.

One of the things to really consider is making sure that the containers in a multi‑tenant environment have fairly secure walls. Again, an analogy would be you don't want to make it real easy for malicious neighbors to just wander into your own apartment in an apartment complex.

Gordon:  Yes, I think I'd probably take a couple of things away there. The first is that you assume that everything is on the network, and that there are bad people out there who are constantly probing everything that is on the network. So, it's really important to have security.

If you have a PC‑‑by way of analogy‑‑sitting at home 15, 20 years ago, not connected to a network or dialup modem, if you weren't 100 percent up to date with everything, maybe you'd get a virus or something, but by and large, it really wasn't that big a deal if you hadn't updated your security stuff in a while.

If you're in a computer that's constantly connected to a public network, whether we're talking about client or a server device, bad stuff can happen very quickly.

Ellen:  I think, of course, that's absolutely true. When you say you must assume that there are bad people out there probing, increasingly, of course, bad people are frankly bad corporations. There are businesses run nine to five whose sole purpose is to find and exploit any weaknesses in security and take whatever can make them a profit. As such, that's one of the reasons why in theory moving into a public cloud can be safer because public clouds from reputable vendors are updated. They are patched consistently on time and quite thoroughly.

Gordon:  You also mention multi‑tenancy, and, obviously, you get multi‑tenancy on premise or multi‑tenancy in a public cloud. But multi‑tenancy is pretty fundamental to how and what public clouds operate. So, I think it's fair to say that a reputable public cloud is using technology such as Security‑Enhanced Linux, for example, that has some really good mechanisms to provide that additional level at process level for security for multi‑tenant environments. Now configuring SELinux isn't necessarily the easiest thing in the world. So, again, going back to how secure is a public cloud versus a SMB. Well, it's quite fair to say that most SMBs aren’t properly exploiting SELinux whereas that, along with other techniques and other technologies, large reputable Cloud providers certainly are.

Ellen:  That's a very good point, Gordon. The Red Hat Enterprise operating system is foundational and is used in the largest number of available public Clouds and SaaS offerings today. It's very well installed. Part of the reason for that is because it does have the security features that allow for more secure multi‑tenancy, more secure virtualization. For example, the SE Linux that you mentioned, the fact that the operating system itself is common criteria certified.

One of the things I think to bring into focus, too, is that open source software means that it's been peer group reviewed. It's transparent. It's open to the sunshine. Errors are found. Bugs are found and patched relatively rapidly.

You do find that these fundamental, base level layers that underpin a public Cloud can be very useful in providing security.

Gordon:  It's actually a little ironic when you go back to early days of open source becoming really mainstream. By way of analogy, [a lot of people back then thought] even if you thought you had a good alarm system, you wouldn't put the schematics on your door for a potential burglar to see. For a lot of people, who weren't necessarily in the security industry, didn't understand how exploits happen. They just assumed open source must be less secure because that the people could see the code. Write exploits because they can see the code. Of course, that's not how most exploits happen.

Ellen:  No, as a matter of fact, it's not at all. The fact that you can see the code, that it is transparent, that there is a large international group that uses the code, that inspects the code, means that it becomes more secure rather than less so.

Gordon:  Thanks for spending some time with me today. I think, hopefully, doing a little bit more on our part to show there's nothing inherently insecure about the cloud, whether we're talking public clouds or private clouds. At the same time, educating people about things that they need to think about. I'm not sure it's so much the cloud, but simply a world in which increasingly everything is network connected, and there are bad actors trying to take advantage of that fact.

Ellen:  I agree. I think that the one thing to always bear in mind is that your data, your information can be lost, can be stolen, can be compromised, whether you're using public cloud, private cloud or a hybrid, is to take whatever steps are necessary to layer on the security that gives you the protection at the level of the value of the information you're protecting.

Gordon:  That's a good point. Everything, at the end of the day, is about mitigation. There's no such thing as a 100 percent elimination of risk, 100 percent security. If you're talking nuclear launch codes, that is probably a little different from pictures of your cat. Basically, as you say, the backup procedures, encryption, whatever, the cost in both dollar cost and time and effort on your part, shouldn't be out of whack with the value of the data and the privacy associated with that data.

Ellen:  It does seem that a lot of companies now, things that they choose to run in the public Cloud are the things that are, perhaps, consumer based where the security capabilities match the value of the information. Some things that are extremely proprietary are kept in the private Cloud. The combination makes for great flexibility, faster deployments, and very reasonable economics.

Gordon:  That also speaks to why hybrid is a big deal and why Red Hat is making a lot of noise around opening hybrid because it really is a mixed world.

Ellen:  As you say, just as Cloud computing is neither secure nor insecure, public and private Clouds are neither the right choice nor the wrong choice. It's nice to have a little of both.

Gordon:  Great. Thank you very much.

Links for 08-22-2012

• Big Data, Virtualization are Emerging Technologies - Gartner Hype Cycle for Cloud Computing | CloudTimes
• How Paperbacks Transformed the Way Americans Read - Mental Floss
• (404) http://t.co/2Akev - RT @OpenKVM: "OVA efforts..paying off…OVA put KVM in the news..and..we've seen KVM usage rates increase significantly" ...
• Letters of Note: The morning mail is my enemy
• Introduction: Mobile security survey 2012 audio slideshow - Mobile security survey 2012 audio slideshow - Interesting data in this TechTarget mobile security survey (note: weighted towards finance/gov)

Links for 08-20-2012

• BYOD gaining ground as employees increasingly need mobile access - ""What has happened is everyone started building castles around your data and assumed that the data was going to be contained within the network. …Then it became very apparent that that's not going to be a solution for the long term. Now we need to protect the data wherever it is," said Andrew Storms, director of security operations at nCircle Network Security, a San Francisco-based security auditing firm."
• Judge: Google didn't comply with blogger disclosure order in Oracle trial | ZDNet - "Google suggests that it has paid so many commenters that it will be impossible to list them all. Please simply do your best but the impossible is not required."
• Beyond Open Source in the Cloud teaser - YouTube - Teaser video for my Beyond Open Source in the Cloud talk at #cloudopen
• Rational Survivability » Incomplete Thought: Virtual/Cloud Security and The Potemkin Village Syndrome - "First, the trust models, architecture and operational models surrounding how we’ve “done” security simply are not designed to absorb this much disruption so quickly.  The fact that we’ve relied on physical segregation, static policies that combine locality and service definition, mobility and the (now) highly dynamic application deployment options means that we’re simply disconnected."
• Podcast: Jon Masters talks Hyperscale | The Cloud Evangelist - .@EMEACloudGuy interviews Red Hat's Jon Masters about ARM-powered servers and more
• NASA Pulls Off 350-Million-Mile Software Patch | Wired Enterprise | Wired.com - This is pretty awesome.

Beyond Open Source in the Cloud

I'm wrapping up the week putting the final touches on my Beyond Open Source in the Cloud presentation for CloudOpen week after next. The next week is going to be crazy;  I need to get everything ready for VMworld and CloudOpen and then vacation in the Sierras the week after that.

As for the topic at hand, through, here's the description from the program:

Openness doesn’t stop and end with the submission of some format to a standards body or with the announcement of partners endorsing some specific technology platform. It doesn’t stop and end with open source either. An open cloud isn’t about having some singular feature. It’s about maximizing a wide range of characteristics that push the needle from closed to truly open. These include open source and open standards for sure. But they also include portability of applications and data, viable and independent communities, freedom from IP encumbrances, and APIs that are independent of specific implementations.

I've previously given a "lightning" version of this presentation at CloudCamp and some of the material is touched on during my broader cloud presentations. However, for this event, I've fleshed out my discussion of the various aspects of openness. The whole topic is very timely.

One need only look to Twitter API Apocalypse version 2,654 this past week to see just how timely. (And the fact that there's a story about APIs on CBS says something about just how important APIs--and, by extension other aspects of openness--to the modern computing world even for those who have never written a line of code in their lives. 

My paper: Why the Future of the Cloud is Open

I'm on Wednesday, August 29 right after the keynotes. Come to San Diego and join us!

Links for 08-16-2012

• GOP Senate Hopeful Helped Found Controversial Dartmouth Newspaper - Ah, the delights of being quoted completely out of context. (In an interview requested under pretty much false pretenses.)
• Hipsters stunned as vintage cameras fail to make them professional photographers - Hayibo | Hayibo - RT @stephstad: Hipsters stunned as vintage cameras fail to make them professional photographers: ” -- Funny!
• CloudOpen 2012: Beyond Open Source in the Cloud - Gordon... - Today am busy working on my presentation for the CloudOpen conference in San Diego

Halema'uma'u Crater at Night

Halema'uma'u Crater at Night
Originally uploaded by ghaff

My Hawaii pix are up on Flickr: http://www.flickr.com/photos/bitmason/tags/hawaii/

Links for 08-15-2012

• Cloud APIs: It’s the Architecture that Matters | RightScale Blog
• The Problem with Airlines and Checked Baggage: On the Case : Expert Travel Tips : Condé Nast Traveler
• Corporate Open Source Anti-patterns
• Red Hat CEO: The nuts and bolts of open source | ITworld - "Specifically, Whitehurst described the invention of the auto lathe in 1810 by Henry Maudslay, which enabled the mass production of standardized hardware, such as nuts and bolts. It would be the availability of such standardized components, approximately 60 years into the Industrial Age, that would spawn a massive explosion of innovation around industrial products."
• Untitled (http://www.myoops.org/ans7870/11/11.001j/f01/lectureimages/2/image24.html) - RT @bostonography: "MIT Beaver, 1916 Crossing of Charles to found new campus." And to absolutely terrify you.
• The Julia Child Recipes Home Cooks Still Make - NYTimes.com
• Data Center Dialog: The 110-year-old light bulb is a little too much like today’s IT - You have to manage risk but sometimes it is better to start fresh.
• IBM - The Palace Museum (08/30/2010) - RT @linux_at_ibm: Fun case study: Forbidden City in Beijing uses #BladeCenter running #Linux --runs RHEL on BladeCenter
• Magazines Don’t Have a Digital Problem, They Have a Bundling Problem | PandoDaily - "We will always need editors to commission and shape strong stories, but we don’t need them so much to bundle disparate pieces of content into one immutable chunk. Instead, many of the most savvy readers prefer to consume magazine journalism piece by piece, taking note of the source from which it sprung, but not necessarily paying heed to whatever else happened to be placed alongside it in that source that particular week or month. "
• A VC: Open Protocols - RT @mathewi: "I believe in open protocols and open APIs. That is what the web was built on" -- Fred Wilson <
• Software lives forever | The Pervasive Data Center - CNET News - .@jayfry3 @johnrrymer This story I wrote a couple of years back have fave example re: software living forever
• United Airlines Lost My Friend's 10 Year Old Daughter And Didn't Care - Bob Sutton - Horrible United story.

Links for 08-14-2012

• The Real Time Myth - Input Output - "How fast data is delivered is usually a function of necessity, cost, and benefit." -- Good reality check.
• Federal Cloud and the Reactionary Skeptic | a technology job is no excuse - "The trouble with the Reactionary Skeptic is that it’s a bloodless position. There’s no vision. The article is filled with warnings without a single suggestion for improving the situation. Altogether, the message being communicated to government is: Be Afraid. This kind of article encourages a fearful conservatism, which is the most toxic trait in government managers today."
• The 2nd Tenet of Open Source: Bet on the Community, Not the Current State of Technology | tentenet.net - RT @bryanwche: The 2nd Tenet of Open Source: Bet on the Community, Not the Current State of Technology
• Doubling SaaS Revenue By Changing The Pricing Model | Kalzumeus Software
• OpenStack dons a Red Hat • The Register
• East Coast VS West Coast PaaS Psychology - Apprenda
• From the archive: Parkinson's Law | The Economist
• Fear of flying: Welcome aboard | The Economist
• Uber runs afoul of Massachusetts regulators - District of DeBonis - The Washington Post - RT @rlove: Via @washingtonpost, incumbents and their captured regulators try to shutdown @Uber_BOS.
• Journey Into Space (Dec. 8, 1952) | TIME and Space: A Lofty History of Space Exploration on TIME Magazine’s Covers | NewsFeed | TIME.com
• Drinking at work: The boredom of boozeless business | The Economist - RT @cote: "Today, it seems that the battle is over and the killjoys have won." << V different since I started working
• A Candid Interview with Mitt Romney : The New Yorker

How Red Hat's Cloud Portfolio Fits Together

As part of Red Hat's announcement of an OpenStack technology preview today, I wrote a blog that provides some additional background. Here, I'm going to delve a bit more deeply into one of the topics that I cover in that blog--namely, how do the different pieces of Red Hat's open hybrid cloud portfolio fit together? I'll be referring to the below diagram throughout this discussion.

From Blog

First, there is the infrastructure layer. This typically [1] consists of a hypervisor, its associated infrastructure management stack, and APIs providing the ability to control that management stack programmatically.

This is where OpenStack plays. OpenStack is an IaaS solution that manages a hypervisor and provides cloud services to users through self-service. (The OpenStack project supports a variety of hypervisors to various degrees; Red Hat is focused on KVM--the hypervisor used by Red Hat Enterprise Virtualization--which is part of Linux and has become pretty much the default open source hypervisor.) Perhaps the easier way to think of OpenStack, however, is that it lets an IT organization stand up a cloud that looks and acts like a cloud at a service provider. That OpenStack is focused on this public cloud-like use case shouldn't be surprising; service provider Rackspace has been an important member of OpenStack and uses code from the project for its own public cloud offering.

This IaaS approach differs from the virtualization management offered by Red Hat Enterprise Virtualization, which is more focused on what you can think of as an enterprise use case. In other words, Red Hat Enterprise Virtualization supports typical enterprise hardware such as storage area networks and handles common enterprise virtualization feature requirements such as live migration. Both OpenStack and Red Hat Enterprise Virtualization may manage hypervisors and offer self-service—among other features—but they're doing so in service of different models of IT architecture and service provisioning.

Alternatively, the self-service infrastructure may be at a public cloud provider such as Amazon Web Services or Rackspace. Ultimately the goal is to make the underlying infrastructure decisions largely transparent to the consumer of the resources, such as a developer. Of course, where the resources are located, how they are managed, and what types of hardware functions they expose make a big different to the ops team. But they're deliberately abstracted from those developing and using applications.

Then there is open, hybrid cloud management of those “cloud providers.” These providers can consist of the various types of infrastructure just described:  on-premise IaaS like OpenStack, public IaaS clouds, and virtualization platforms (not just a hypervisor) like Red Hat Enterprise Virtualization or VMware vSphere. This is where Red Hat CloudForms comes in. CloudForms allows you to build a hybrid cloud that spans those disparate resources. It lets you build a "cloud of clouds" in a sense. 

However, equally important, is that CloudForms provides the lifecycle management of the content and images that will run across the hybrid cloud infrastructure. For example, CloudForms lets you specify content repositories which feed the construction and ongoing management of single- and multi-tier applications through Application Blueprints created by IT administrators. These Application Blueprints also embed policy. When a user chooses an available application environment through the self-service interface, it can only be deployed to a location enabled by policy. For example, development environments may be deployed to a public cloud while production applications may be deployed to an on-premise virtualization platform.

Platform-as-a-Service (PaaS) is delivered by Red Hat OpenShift PaaS. PaaS is perhaps best thought of as an abstraction focused on the typical concerns of developers. Thus, instead of an operating system image-centric view (as an IaaS provides), PaaS is more oriented to a view that revolves around pushing and pulling code into and from repositories;  the operation of the software needed to run that code is largely kept in the background. 

Unlike a PaaS that is limited to a specific provider, OpenShift PaaS can run on top of any appropriately provisioned infrastructure whether in a hosted or on-premise environment. It then provides application multi-tenancy within the operating system images that make up the infrastructure. It does so using a combination of Linux Containers, SELinux for security isolation, and other Linux features. Red Hat's Matt Hicks spoke with me about some of these technologies in an interview a while back (podcast and transcript).

This approach allows organizations to not only choose to develop using the languages and frameworks of their choice but to also select the IT operational model that is most appropriate to their needs. The provisioning and ongoing management of the underlying infrastructure on which OpenShift PaaS runs is where virtualization, IaaS, and cloud management solutions come in. (After all, someone needs to operate the PaaS infrastructure whether it's on-premise or at a cloud provider.)

Nor does Red Hat Cloud end with "cloud products." For example, Red Hat Enterprise Linux--in addition to providing features used by offerings such as OpenShift--also provides a consistent and reliable runtime for applications as they move across different environments such as on-premise and public clouds. Red Hat Storage (from our Gluster acquisition) provides a distributed, scalable, software-only filesystem that will be an important part of data portability across clouds.

Sound complicated? It is a bit, I guess. But when you're talking about such a big change in the way that IT systems are operated and applications are consumed, some complexity is unavoidable. (Which is one reason we're so focused on solutions. But that's a topic for another day and another blog post.)

 -------------------

[1] In a future version, CloudForms will be able to provision "bare metal" physical servers using Foreman/Puppet components. In this respect, CloudForms includes the ability to build an IaaS. However, for our purposes here, I'm going to focus on how CloudForms builds hybrid cloud resource pools on top of IaaS and virtualization management products and manages the applications running in those pools.

Links for 08-10-2012

• Discussion on Cloud computing: What does it really mean for IT jobs? | TechRepublic
• Stage Marathon: Is Seven Hours of The Great Gatsby Too Much? - TIME - I really enjoyed watching Gatz.
• Review: ‘Total Recall’ Remake Is Totally Forgettable | Entertainment | TIME.com - "The new PG-13 movie is a fairly close adaptation of the Verhoeven one and lacks not just the earlier film’s newness but also its vigor, density, humor and R-rated juice. It’s like the dinner-theater revival of a classic play, whose single asset is to remind those present how good the original was."
• Amazon Web Services Blog: The AWS Report - Sharon Chiarella, Amazon Mechanical Turk - transcription, writing, data cleansing, sentiment analysis, and moderation.
• How to be a tech blogger – Ezra Butler – The Kernel

Links for 08-09-2012

• Evgeny Morozov: The Naked And The TED | The New Republic - What a takedown review. Love it!
• Jonah Lehrer, TED, and the narrative dark arts | Felix Salmon - "And here’s the thing: for all that Jonah Lehrer ultimately wound up blogging for the New Yorker, he has always been a creature of TED much more than he has been a creature of journalism.* Check out Seth Mnookin’s post, today, on Jonah Lehrer’s missing compass: the way that Lehrer remixed facts in service of narrative is very TED"
• Letters of Note: I am a lousy copywriter - From David Ogilvy.
• The Cloud: A Clear Choice - Not a bad infographic.
• Olympic Bodies: They Just Don't Make Them Like They Used To : Shots - Health Blog : NPR
• Pasta Carbonara
• The Soylent Green of “Epic Hacks” – It’s Made of PEOPLE!
• The IT world’s love-hate relationship with OpenStack
• Survivor: CIO Edition – Will Cloud Computing Kill The CIO Role? | Andi Mann – Ubergeek
• (403) http://www.yelp.com/biz/Nk2mnfoiSbM85iW0cAFpsw?pt=check_in&ref=twitter&v=4b - I checked in at Bonefish Grill on #Yelp
• Boston Food Bloggers | BostInno

A mostly positive take on OpenStack from GigaOm

Derrick Harris at GigaOm has a piece up about the "IT world's love-hate relationship" with OpenStack. It seems a balanced piece overall even if a lot of "Why the hate" either boils down to pre-foundation governance issues or generalized "concerns." The cynical might be inclined to label some of this as FUD coming from those with commercial interests opposed to OpenStack. If you attended GigaOm's Structure 2012 conference, you saw some of this dynamic in play in the debate over APIs. In a nutshell, does a popular de facto API like AWS trump APIs that are actually open? Contrary to the fervent denials one hears, from where I sit, there is very much an anti-OpenStack camp. 

On the "love" side described by Harris, I'd add that, in addition to the "mega-vendor" and large end-user backers, there's also huge breadth of participation; April's OpenStack Conference in San Francisco had over 1,000 people registered. It's hard to argue against the proposition that OpenStack has a lot of momentum going for it.

Leaving aside the pro/con snippets though, Harris' overall conclusion strikes me as fair. Whether or not you agree that all the knocks on OpenStack that Harris details are truly newsworthy, his overall conclusion is pretty positive.

Perhaps it’s just par for the course that any project with so much hype, representing such a lucrative opportunity, and comprised of big egos all around is going to be a hotbed of in-fighting and allegations. But if the companies involved can hold OpenStack together enough to keep everyone headed in the same direction, it’s hard to see how it won’t be a major factor in the cloud space for a long time to come.

My employer, Red Hat, is a platinum member of the OpenStack Foundation.

Links for 08-08-2012

• Google and Oracle ordered to disclose bloggers and journalists they paid to influence coverage (update) | The Verge - Headline bit inflammatory. But the judge's disclosure order wrt bloggers, journalists, etc. in Google-Oracle seems big
• Inside NASA’s Curiosity: It’s an Apple Airport Extreme… with wheels | ExtremeTech - RT @Krewell: If you're interested in the Mars Curiosity's engineering, this is a good read:
• Challenges of Getting to Mars: Curiosity's Seven Minutes of Terror - YouTube - Pretty amazing video of the Curiosity landing sequence.
• Apache Deltacloud Hits Open Source Cloud Server Milestone - RT @TechJournalist: Apache Deltacloud Hits Open Source Cloud Server Milestone - Server Watch
• What Happened To the Long Tail? - "For Shanks, the loss of physical shelf space, the proliferation of titles online, and growth of e-books sales means the promise of the long tail for print books has been permanently altered. “There is a long tail, but it is so long the units are small.”"
• Red Hat | The Deltacloud Project Reaches 1.0 - Apache Deltacloud Project reaches 1.0. By me.
• NoiseTrade | Thousands of Albums. Completely Free. Completely Legal.
• Connections: Mobile ticketing. Good news but better have good IT. - Mobile ticketing. Good news but better have good IT.
• The Many Mysteries of The Dark Knight Rises - Howzzit? - SPOILERS. The only piece I've read which makes me (slightly) doubt the majority opinion about what happened.

Mobile ticketing. Good news but better have good IT.

From Mobile Commerce Daily:

Following a successful test on five routes, Amtrak is expanding a digital ticketing program to all trains, enabling passengers to use their smartphones to present tickets to the conductor...

Passengers using a smartphone or other mobile device can present the eTicket to the conductor by opening the document from the email.

ETickets can also be printed from any printer, including at Amtrak ticket offices and Quik-Trak kiosks.

Additionally, passengers can also buy tickets and display eTicket bar codes with the Amtrak mobile application.

With the eTicket program, passengers can also easily change reservations and lost or misplaced tickets can be easily reprinted.

Following a successful test on five routes, Amtrak is expanding a digital ticketing program to all trains, enabling passengers to use their smartphones to present tickets to the conductor.

Nice. I actually don't find mobile tickets all that big a win with the airlines most of the time; it's just not usually that big a deal to get a boarding pass from an airport kiosk. (Although I typically print out my outbound boarding pass at home when I remember.)

But I use Amtrak, most often from Boston to New York, differently than I use planes. The timing of my outbound leg is pretty set--way too early in the morning. But, for my return, I'm usually in the position of guessing how an event or set of meetings is going to play out and taking a stab at a return time that may or may not turn out to make a lot of sense. 

The problem is that, although you can change train ticket times without penalties, in practice dealing with lines at Penn Station and dealing with call queues with reservations can make changing a ticket more hassle than it's worth. If mobile tickets make the process a lot more streamlines, that's a big win.

Another mentioned advantage is that current Amtrak tickets, once issued, are essentially just like cash--as I know from experience--and are very hard to get refunded/replaced just as airline tickets once were.

For most purposes, this shift away from significant value being embedded in arbitrary bits of paper is a welcome one--but it does raise the stakes on back-end infrastructure. It has to be resilient and scalable. The network pipes going in and out have to be solid. It also potentially creates complications if always-connected mobile devices aren't, in fact, always connected (although mobile apps that store past transactions can help). 

Because, increasingly, there just won't be a good manual fall-back if the digital systems don't work.

Links for 08-02-2012

• Source Sans Pro: Adobe’s first open source type family « Typblography
• Oracle Loses HP Itanium Court Battle - Hardware - Processors - Informationweek
• Badminton, taxes, regulation …. and the people’s justice — Crooked Timber - IMO, it depends on the context. For example, I'm not convinced there is some moral imperative to follow the "spirit of the law" wrt taxes.
• Why iPads Are the Future of In-Flight Entertainment - I'm suspect that the logistics of implementing such a system would ar outweigh any benefits given the bring-your-own option.
• Jonathan Schwartz: Oracle bungled its chance at mobile Java | Internet & Media - CNET News
• How low (power) can you go? - Charlie's Diary
• Aeolus Project Blog - RT @aeolusproject: Just launched our blog -- -- hosted by @openshift and WordPress. Check it out!
• My Top Five Sessions at the CloudOpen Conference | The Linux Foundation - "Beyond Open Source in the Cloud - Gordon Haff, Red Hat. Openness doesn’t stop and end with the submission of some format to a standards body or with the announcement of partners endorsing some specific technology platform. It doesn’t stop and end with open source either. An open cloud isn’t about having some singular feature. It’s about maximizing a wide range of characteristics that push the needle from closed to truly open. These include open source and open standards for sure. But they also include portability of applications and data, viable and independent communities, freedom from IP encumbrances, and APIs that are independent of specific implementations."
• Lessons Learned from a Bring Your Own Device Project › Avema Mobile Device Management - Interesting post I ran across "Lessons Learned from a Bring Your Own Device Project" #BYOD
• With 'bring your own,' a PC isn't just another device | The Pervasive Data Center - CNET News - Don't confuse BYOD with BYOPC by me
• Linux Hater's Blog: Your free software website, for dummies - Your free software website for dummies :-)

Links for 07-31-2012

• (160/1) What are the best blogs about data? Why? - Quora
• Buckyballs | Buckycubes | The Amazing Magnetic Desktoy You Can't Put Down - The Consumer Product Safety Commission is trying to ban Buckyballs. (Ordered mine.)
• » Solving the Pioneer Anomaly With Magnetic Tapes and Punch Cards - Blog of the Long Now - Fascinating piece about reading old data from the Pioneer probes

Links for 07-27-2012

• Presentation Zen: Tips on how to be more creative by John Cleese
• Podcast – London OpenStack Meetup | The Cloud Evangelist - Daniel Berrange's talk from the London OpenStack meetup via @EMEACloudGuy
• Shapeshift Your Horizon | Maps and the City
• Fritinancy: Bad Sports - I must say that I hadn't really looked at the Olympic logo. It is quite horrible.
• The 8 Worst Fonts In The World | Co.Design: business + innovation + design - Can't really agree with a lot of the least favorites list. Some of it (e.g. Souvenir) reads more like a used to be trendy and we got tired of it.
• Business travelers ditch the BlackBerry - The Business Journals - "It's time to admit the painfully obvious: At least from the business traveler's perspective, the BlackBerry is history. It is swiftly going the way of paper airplane tickets, fax machines, dual-time watches, world-band radios and dozens of other tools and tricks that once seemed an integral part life on the road."
• Amazon opens up about its cloud security practices, joins CSA registry | Security - InfoWorld
• Three Key Cloud Questions for ISVs | Ferris f(x) - Three Key Cloud Questions for ISVs via @mikeferris
• Are LXC containers enough? | Matt on Cloud - Are LXC containers enough? via @matthicksj
• State Street Private Cloud Geared to Make Money, CIO Says - The CIO Report - WSJ - Focus seems to be on centralized and standardized IT. (Doesn't give a lot more detail on what makes it "cloudy."

State Street's Cloud: It's about going faster

Although it doesn't get into a lot of "cloudy" details, the Wall Street Journal blog "State Street Private Cloud Geared to Make Money, CIO Says" by Clint Boulton gives some good insight into their motivations and overall process.

First, the motivations.

[CIO Chris] Perretta declined to say how much money moving to this cloud would save State Street, though the comprehensive operations and IT overhaul announced in 2010 is expected to deliver “pre-tax, run-rate” savings of between $575 million to $625 million by the end of 2014.  The savings are significant, but Perretta says he is most interested in how quickly and efficiently his staff can move legacy applications to the company’s cloud. “If every CIO in the country asked the CFO what they think about IT, they would say you spend too much money,” Perretta told CIO Journal. “If you ask everyone else in the business, it would be ‘go faster’.”

Sure, money always plays a role. No IT organization doesn't feel cost pressure. Of course, how many groups within an enterprise don't feel that they're under cost pressure? 

But it's noteworthy that the big impetus here was speed--"business agility" to use the marketing-ism. 

This is wholly consistent with what I hear almost every day. Efficiency is important. But cloud is really about opening up new possibilities. This makes it quite unlike many previous technology waves, such as virtualization (at least as first), which primarily lived or died primarily because of the cost efficiencies they supposedly provided. (Whether or not they actually did.)

Centralization, standardization, and rationalization of their infrastructure helped to unperpin the move.

To craft its private cloud, State Street is gradually replacing older computer systems with smaller computers that were bought “bare metal,” which is industry parlance for computers that come without an operating system preloaded. State Street loaded Linux software on the computers, and Windows on others, and began migrating the company’s programs for business analytics, asset servicing and management to the cloud. Once on the cloud, the machines and applications are automated through open source virtualization software, said Sullivan. “We couldn’t turn on a dime the way we needed to, so we wanted to get the cloud platform built, then migrate old applications to cloud,” he said.

At Red Hat, the open, hybrid approach that we've taken with CloudForms helps organizations extend cloud management to legacy infrastructure. But moving from virtualization to cloud nonetheless benefits greatly from process and planning. (We ran a four-part webinar series on the topic together with Kurt Milne of the IT Process Institute.) And, as in the case of State Street, many organizations find that standardizing new deployments on modern volume infrastructure such as Linux on x86 servers is a great first step. 

Social media and contacting me update

It's been a while, so here's a refresh on my social media outlets and inlets together with some other details about contacting me.

Blogging:

I have two primary blogs.

Connections is my "personal" blog. It's mostly (75%+) devoted to topics that fall generally under the umbrella of "tech." I generally keep the blog going with short link-comments when I'm not pushing out anything longer. In addition to more general tech topics, my Red Hat-related content also goes here (other than that which gets pushed out through official channels such as the Red Hat press blog). The opinions expressed on this blog are mine alone and the content, including Red Hat-related content, is solely under my control.

The Pervasive Datacenter is my CNET Blog Network blog. I typically publish once or twice a month on technology topics, nominally with an emphasis on enterprise IT although I do posts on photography and other consumer tech of interest from time to time. I am especially careful about topics that could be perceived as in any way a conflict of interest because of my day job at Red Hat and therefore mostly avoid getting into individual companies, strategies, and products.

Social Networks:

I am active on twitter as @ghaff. As with my blogs, I concentrate on tech topics but no guarantees that I won't get into other topics from time to time.

I mostly view LinkedIn as a sort of professional rolodex. If I've met you and you send me a LinkedIn invite, I'll probably accept though it might help to remind me who you are. I'm most likely to ignore you if you appear to be someone just building up a big network for spammy purposes or I otherwise have no idea who you are or are trying to connect with me.

I'm a pretty casual user of Facebook and I limit it to friend friends. That's not to say that some of them aren't professional acquaintances as well. But if you just met me at a conference somewhere and want to friend me, please understand if I ignore you.

I use Google+ primarily as an additional channel to draw attention to blogs and other material that I have created. I also participate in various conversations there. As with twitter, technology topics predominate on my Google+ stream.

I use flickr extensively for personal photography.

PR pitches, etc:

Lord, do I get a lot of crap sent my way. The redeeming aspect of this is that I periodically get some gem that gives the PR group at Red Hat a chuckle (after any embargo is off of course). If you work for a Red Hat competitor or their agency, you might also want to think twice about offering to pre-brief me on some new announcement.

With that out of the way, I'm interested in a wide variety of tech topics. However, for obvious reasons, I tend to avoid writing about specific companies that closely intersect with my day job whether as competitors or partners. It's also a matter of my bandwidth. I have less time for blogging than when I was an analyst but if I write about one company in a space, it's not really fair to turn down all the inevitable requests that come in from other companies doing something similar.

Bottom line: I'm unlikely to take a briefing, but if you have an interesting report, book, study, or whatever, feel free to send it my way and I may look at and write about it--especially if it's about something broader than an individual company. I'm also open to attending (typically local) conferences and events if I seem likely to learn something useful.

Links for 07-25-2012

• Personal Privacy Is a Top BYOD Fear - Latest News - "nearly nine in 10 (88 percent) of respondents said their companies had some form of BYOD, whether sanctioned or not."
• Why Every Social Media Manager Should Be Under 25 - NextGen Journal - NextGen Journal - This is worth saving only because it's such a classic "I'm a twenty-something and only I know EVERYTHING."
• Sorkin cleaning the "Newsroom" - The Daily - RT @JournalistsLike: Sorkin fires most of "The Newsroom" writing staff Guess Sorkin really wants the show to be mo ...
• How Youth Sports Encourages Kids To Be Dullards - Forbes - RT @nearwalden: Good article: How Youth Sports Encourages Kids To Be Dullards
• Podcast – Malcolm Herbert talks Cloud | The Cloud Evangelist - RT @EMEACloudGuy: Podcast - Malcolm Herbert talks Cloud

Links for 07-12-2012

• Amazon same-day delivery: How the e-commerce giant will destroy local retail. - Slate Magazine
• Economically Healthy 'Daily Planet' Now Most Unrealistic Part Of Superman Universe | The Onion - America's Finest News Source - ""I can totally buy into an epic battle in which Superman claps his hands and creates a sonic boom that sends Darkseid flying through 50 buildings," lifelong reader Richard Taft said. "But as soon as people start lining up at newsstands to read about it in The Daily Planet, I think, 'Doesn't anyone have a computer at work? Are there no smartphones?' Before I know it, I'm suddenly aware I'm reading a fictional comic book, and the spell's totally broken.""
• Don't Mean To Be Alarmist, But The TV Business May Be Starting To Collapse - Business Insider - I know I'm very near to canceling all but very basic cable.
• Getting Started with OpenShift Origin Security in the Cloud | OpenShift by Red Hat - RT @emorisse: #PaaS security in depth
• Is There Big Money in Big Data? - Technology Review - Nice dose of Big Data skepticism from Wharton's Peter Fader in @techreview
• Crossdressing, Compression and Colliders: The First Photo on the Web | Motherboard
• Steven J. Vaughan-Nichols: The perils of BYOD - Computerworld - I don't agree with all of this, but some of the concerns are legit.
• Relativistic Baseball
• submarine-cable-map-2012.telegeography.com
• Twitter cuts off service to LinkedIn, API changes draw ire - Tech Talk - CBS News - re: Twitter/LinkedIn API service stuff--can't say I'm much of a fan of auto cross-posting generally
• CERN scientists inexplicably present Higgs boson findings in Comic Sans | The Verge - RT @MargaretWallace: RT @brainpicker: Science nerds vs. type nerds, go: #higgsbosoncomicsansgodlessness << ROFL
• The Photographic Periodic Table of the Elements
• Instagram - Cloud section of #redhat booth
• Instagram - Checked in for #redhat Summit
• Pricing | OpenShift by Red Hat - #redhat #openshift pricing announced!
• O Fortuna misheard lyrics. [VIDEO] - For any Carmina Burana fans
• Windows 8's downfall still doesn't give Linux a chance | ZDNet - "Off-the-record discussions I’ve had with my contacts inside some of the world’s largest hardware OEMs suggest that there’s an incredible amount of apprehension over how Windows 8 will be received, and what effect this will have on their bottom line."
• Getting Away with It by Paul Krugman and Robin Wells | The New York Review of Books