Thursday, October 29, 2009

In the rush to commercialize cloud computing, is security getting overlooked?

The promising technology of Cloud computing recently suffered its first serious bout of growing pains when Microsoft/Danger, which provides cloud computing services crashed and lost all of T-Mobile Sidekick customers’ mobile phone information on their servers and back-up. That has to have cast a pall of concern over corporate customers evaluating the wisdom of outsourcing their relationship with their customers to a third party. Microsoft was at fault, but T-Mobile gets the blame. The other reasoning that has to be running through customers’ mind is that with an emerging technology, what can go wrong will. Anyone who has experienced Microsoft’s blue screen of death can attest to this.

The other vulnerability cloud computing customers face is security. Imagine if the T-Mobile Sidekick disaster had been a raid by hackers instead of a server farm and back-up meltdown. In a world of computer hackers that have become expert at finding the flaws in each new release of software, cloud computing has to offer an appealing target. And it’s not only financial records. Cracking into a server farm is the equivalent of breaking into the vault of a Swiss bank: personal records in the millions and not just one credit card company but charge accounts for them all. All of these problems will get solved in time as vulnerabilities get identified and fixes are implemented. The question for anyone contemplating being an early adopter is “do I want to be the guinea pig that finds the bug?” like T-Mobile.

Perhaps the greatest vulnerability is the lack of a single point of contact ensuring the security of the cloud computing solution. If a client buys the computing resource and storage capacity from Amazon, Microsoft, Google, or another cloud supplier; he purchases middleware from one or more third parties; and he gets applications software from someone else, the only one that has a vested interest in security across these different vendors is the client buying the service. If a break-in occurs finger pointing ensues. More importantly, hackers understand this vulnerability and seek out the weakest link in the collection of elements comprising a solution for any given client. For example, they might find the back door in a middleware program that can be used to gain entry into the main database.

Google’s cloud computing solution is called the Google App Engine. When asked after his introductory remarks at the Google Internet Summit May 5 and 6, 2009, in Mountain View, California to comment of security not being built into the architecture for cloud computing, Google CEO Eric Schmidt made the following statement. “The answer to your question depends upon where you think security should lie. Do you think it should be at the application layer? Or do you think it should be at some middleware layer... I think it’s too early to really know. It’s very strategic for us that people build—think of them as Ajax applications, Ajax++ (see note) with all the extensions—because that displaces the traditional PC dedicated client architecture… I don’t know how security will play out. I’m not aware within Google of a lot of activity at the applications level in security because the kinds of questions that are asked are still relatively early. Maybe we should fix that.”

Cloud computing is relearning all the security lessons that previous computing generation—the early mainframes, the minicomputers, and the PCs—already experienced. For those not familiar with them, the book “Cyberpunk” by Katie Hafner and John Markoff is an entertaining and informative place to start. You’ll follow the exploits of, among others, Kevin Mitnick who exploited the lax security that protected most minicomputer systems 30 years ago. In 1979, Mitnick gained unauthorized access to Ark, the computer system Digital Equipment Corp. (now part of Hewlett Packard) and stole DEC’s next generation RSTS/E operating system software—then in development, a crime for which he was charged and convicted in 1988.

Maybe security should be given more consideration in the development of cloud computing architectures.

Note: according to Wikipedia, Ajax (asynchronous JavaScript + XML) is a group of interrelated web development techniques used on the client-side to create interactive web applications. With Ajax, web applications can retrieve data from the server asynchronously in the background without interfering with the display and behavior of the existing page. The use of Ajax techniques has led to an increase in interactive or dynamic interfaces on web page and better quality of Web services due to the asynchronous mode. Data is usually retrieved using the XMLHttpRequest object.

Thursday, October 22, 2009

Computing in the Cloud: Re-Emergence of the Mainframe

Waking at 5:30 in the morning on Thursday August 13th hoping to beat the rush of commuters, I got dress and on the road to San Francisco from San Jose to attend the 2009 OpenSource World, Next Generation Data Center and CloudWorld conference at Moscone Center. It is a shadow of the O’Reilly OSCON event in San Jose from July 20th to 24th, I overheard a fellow Open Source attendee say as we waited for the first keynote of the morning from Lew Tucker, VP and CTO at Sun’s Cloud Computing operation. (Without his aviator frame glasses, Tucker bears a resemblance to the actor Steve Buscemi—the talkative kidnapper in the movie “Fargo.”)

After a welcome and introduction from Jeff Kaplan, THINKstrategies and CloudWorld Conference Chair, Tucker took the stage to began his keynote “If Cloud Computing is the Answer, What is the Question?” Tucker comes with the right credentials for discussing the topic. He started out as director of advanced development at Thinking Machines Corp.—the massively parallel processor (MPP) company founded in Waltham, Massachusetts in 1982; their bankrupt assets acquired by Sun in 1994. MPP was one of parallel processing various schools, containing the symmetric multiprocessor branch—today found in its simplest form in the dual core processor in PCs and Macs—and the massively parallel branch—found now in the blade servers of the large-scale compute farms populating the Internet.

The blade server MPP architecture is the workhorse of Internet commerce. Every time a user logs onto Amazon.com and places an order, he’s talking to one of the e-tailer’s several geographically dispersed compute farms. The large-scale deployment of these computing resources is reducing the cost of computing to on the order of 10 cents per CPU hour, according to Tucker. This economic reality is making cloud computing attractive to Fortune 1000 companies looking to reduce their IT costs, by adopting a “pay as you go model” rather than the large upfront equipment investment amortized over time. Ironically, in the early days of computing, the high cost of computers made it manditory to centralize the computing resource and make it available by remote terminals. Today, the opposite is true, the low-cost of computing is making it more practical to distribute low-cost cloud computing via remote terminals. (See afterword below.)

Tucker stated that the ubiquitous availability of broadband is the other factor contributing to the desirability of cloud computing. The widespread adoption of self-service e-commerce and the large accumulation of data on the web have also combined to validate the cloud-computing model. Tucker sees this only increasing with the expansion of machine-to-machine communications—On-Star calling in upon detecting air bag deploying, vending machines reporting low inventory, a building computer system monitoring and reporting on equipment operation, energy use and maintenance requirements, and the list goes on. This availability Tucker said is tempting large corporations to consider renting cloud computing resources rather than building the capacity in house. He points to Amazon’s success with SmugMug as evidence for cloud computing.

Started three years ago, SmugMug is a photo-sharing site that hosts the photos of professional photographers (they looked professional to me). The company of 50 employees uses Amazon S3 (Simple Storage Service) cloud solution to store its 686,256,409 photos (adding at a rate of 10 terabytes of new images each month). According to Amazon, the company has saved roughly $500,000 in storage expenditures and cut its disk storage array costs in half—all with no increase in staff or datacenter space. A most high profile example is salesforce.com, which offers a cloud platform that customer develops applications on. Adtran Inc., for example, created an app for mobile devices that allowed its sales force to access customer information. The crown jewels of a corporation—its sales information—residing in the cloud.

To listen to Tucker, you begin to see information technology as a set of Lego blocks that anyone with software expertise to provide the connection can put together to achieve a desired solution. The server farms provide the physical plant. A data center OS deals with this physical plant and an applications OS deals with the software plant. For example, Google’s cloud computing platform, Google App Engine, is essentially, “HTML 5, web browser applications, with a back-end server that uses TCP/IP and RPC (Remote Procedure Call (RPC),” according to Google CEO Schmidt. Developers create applications on Google’s infrastructure free up to a point.

Information technology development is a continuous work in progress and cloud computing is the latest incarnation. Its greatest adherents are companies—salesforce.com—emerging to serve new needs (increasing the productivity of sales teams) that didn’t exist before. When and if mainstream enterprises decide to follow suit en masse is anyone’s guess, but I suspect it’s not a matter of if but only when if history is any indication.

Afterword:

Mainframe time-sharing found its first commercial success at Dartmouth College in 1964 in the form of DTSS (Dartmouth Time Sharing System). Students submitting programs to be run on the college mainframe, a GE-235, could enter the program using a Teletype (TTY) machine (an electro-mechanical printer and keyboard that had a communications facility to talk to other TTYs. The DTSS system used another mainframe, a GE DN-30 (Datanet-30) to handle communications to and from the TTYs. It was a one to many architecture with the TTYs at the ends and the mainframes, emulating a TTY machine in the center. DTSS was the creation of Tom Kurtz and John Kemeny. The web site http://www.dtss.org/ has been set up to recreate the first DTSS for those interested in seeing what the precursor to cloud computing was like in the early 1970s. The site offers web-based emulators for both Mac and Windows.

Plus ça change, plus c'est la même chose.

Saturday, October 17, 2009

Brainstorming at the Elephant Bar in Campbell

I had lunch recently at the Elephant Bar in Campbell, CA with Tom Miller who is the executive director at the Society For Information Display. In the few minutes I spent waiting for Tom, the lunch crowd I noticed was a mixed demographic: middle-aged businessmen strategizing, retirees getting together to catch up on family and friends, soccer moms treating themselves to a Friday lunch. Tom and I fit into the first group. He was on the editorial advisory board when I worked at ISD Magazine in the late 90s. Tom is a great source of information on a wide range of technology areas from displays to web ventures he’s come across in his consulting work. After we were shown to a booth with seats so close to the table they resembled coach class on an airplane—Tom’s analogy, the young waitress asked us for drink orders—diet coke for Tom, sparkling water for me.

The last time we got together, he and I spoke about Emagin, a display company that makes an OLED (optical light emitting diode) array built into military near-eye helmet-mounted display applications. I mentioned that the company had turned a profit and we got into a discussion on commercial application of the technology—watching video, video gamers (especially combat games), etc. He brought up the drawback for consumers. Being so near the eye the display can cause motion sickness and dizziness. The problems have been solved for military applications, Emagin’s target market—a $1B-oportunity last year and tripling by 2012 says the McLaughlin Consulting Group. Producing a cost effective consumer offering is yet to happen, though there was buzz last year that Apple and Sony were developing navigation/video sunglasses, apparently overzealous speculation.

The waitress took our order: soup and salad for me and a chicken salad for Tom. From displays we got onto the topic of print publications and their plight as advertising abandons print for on-line; the reality made plain by the Conde Nast’s closure earlier this month of “Gourmet,” “Cookie,” and “Modern Bride” on the advice of McKensey & Company. The “New York Times” reported that the publishing company had lost 8000 ad pages. Assuming a modest ad page rate of $3k to $5k that’s $24M to $30M in lost revenue.

The alternatives to save print magazines we discussed ranged from taking the loss in the print publication and generating revenue elsewhere—in-person conferences—and selling conference proceedings afterwards, selling e-mail lists, fee-based on-line activity such as webinars, marketing surveys, social networking communities. The print edition would serve as outbound communications vehicle that hits subscribers’ desks every month to build readership loyalty.

Tom mentioned an effort at Stanford University being led by government and major publishing companies to improve the efficiency of the business model for print media. On the expense side of the ledger, besides the variable expenditure for paper, there’s the large fixed cost in administrative and editorial labor, postage for distribution, and the printing plant. There has to be enough advertising revenue to cover these outlays. Government incentives can help—postage for example. Revenue has to cover the rest and here too government incentives could help—e.g. tax breaks for running print ads.

The waitress interrupted us with our orders and refreshed our drinks as Tom and I got onto the topic of the free business model of the web. He asked if I had heard of changethis.com. I hadn’t. It’s a site that publishes manifestos. Later in the day, I downloaded "Your Butt’s in the Wrong Seat, A Manifesto for Public Transportation," a 12-page piece by Ryan Barton making a case for using public transit. The model looks very labor intensive Tom said. You submit your manifesto to an editorial evaluation and only those that pass muster gets published (perhaps a staff of volunteers that administer and edit?). The site is owned by 800ceoread.com, which publishes business books, presumably with some success to afford changethiscom, (which could potentially find book authors for its parent).

Tom brought up another site with a free model, AnchorFree.com founded in 2005 by Silicon Valley entrepreneurs, David Gorodyansky and Eugene Malobrodsky. Their goal was to impact user privacy on the Internet by putting users in control of their data while online. Tom described the software you download for free as enabling browsing through a VPN, thus keeping your activity on the web private. With some venture funding the founders are now looking to monetize the site’s 300 million downloads (!) by offering ad space within the VPN. You would think this a no brainer. I suggested monetizing AnchorFree by soliciting donations from users. With that many download, asking for a dollar donation each and getting a 10 percent return would pay the bills for a while.

We finished our meals and the waitress returned to bus the table. All in all the meal had been most enjoyable and informative. Tom picked up the tab—thanks Tom—and we headed out into a bright, warm and humid Santa Clara Autumn afternoon.

Tuesday, October 6, 2009

Trapped in a enclosed space at Stanford Radiology MRI Lab for 90 minutes

It’s Monday morning, October 5, 2009 and I’m being shot up with gadolinium in my left arm as I lay strapped onto a sliding table the width of my shoulders and over seven feet long. I’m in the home stretch of a procedure that will eventually run for around 90 minutes. Having arrived here at 7:00 o’clock this morning and voluntarily submitted to this procedure, I’m in a room that reminds me of the sterile inside of a UFO as abductees describe it. Set to accommodate the huge white General Electric MRI machine, the temperature makes me feel chilly, dressed as I am in flannel one-size fits all open-front hospital gown and baggy pants. The long table I’m on is at the mouth of a tunnel that is three-feet in diameter. (Freud would have a field day.)

I began the day at 5:30 this morning, outside still dark with the temperature in the low 50s Fahrenheit. It’s the ideal coolness for my morning run that I’m delaying to drive to Stanford Medical Center in Palo Alto for an MRI of my heart my doctor has ordered. I have a heart muscle that has shown signs of wall thickening as a result of 30 years of daily running. Though this occurs in everyone who regularly exercises vigorously, doctors are looking at heart wall thickening as a possible cause of athletes, who appear perfectly normal, keeling over from heart failure. This can occur for a whole host of reasons: leaking heart valve, undetected heart damage from disease or injury or a genetic heart defect, among others. Considering the over-60,000 miles I’ve put on my heart over the years, I’m expecting this MRI angiography to eliminate all of these culprits.

The drive north from San Jose to Palo Alto retraces my commute in past years, having worked in offices at Waverly and Lytton and Emerson near Hamilton: North on Monterey Highway to just past East Alma Avenue, there a right turn and then left onto Third, north to East Reed Street and right for a block and right again on South Fourth Street and the on-ramp to Interstate 280. On 280 west for less than a quarter mile, a San Jose Police Cruiser merging into the lane just ahead of me as we both begin the 50-MPH right curve atop the elevated on-ramp from 280 to Highway 87, the Discovery Museum barely visible off to our right and on our left two separate lines of headlights streaming to confluence with us at the San Carlos Street off ramp from 87. Cars from the two left lanes wanting over to the right; most of the cars in our lane wanting over to the left to avoid having to exit the freeway. Finally, the police cruiser—on its way to the police garage‎ on North San Pedro Street at the end of its shift—and I merge into the slow lane of 87 and begin the northward run to Highway 101. All of us spend our lives going somewhere, the stream of traffic on the main arteries a metaphor for the flow of blood racing through our veins.

The MRI procedure began with me getting out of my civilian clothes and donning hospital attire. I’m told to use the facilities before we begin because it will be a long time before I get another chance. I take the point. Pattering into the sterile room in white running socks, I’m struck by the size of the MRI machine, how white it is, and the size of the tunnel I will be rolled into. The attractive lady lab technician asks if I’m claustrophobic. I gulp, smile, and answer that I didn’t think so. As I lay on the table, my legs extending into the machine’s open mouth, she explains the drill I’ll be required to perform during the time I’m in the tunnel.

On her command, I’m to take in a breath, let it out and refrain from taking a breath until she says inhale—15 to 20 seconds tops, she says. She asks if I want a blanket and I quickly accept—I’m chilled by the air conditioning set to cool the equipment. After placing four electrodes on my chest in the general area of my heart, she straps me onto the table, wraps another sensor around by diaphragm—to monitor my breathing. Because the machine is imaging a moving object, instead of a relatively static one such as the brain or a knee joint, it needs to compensate for breathing and heart movement to create the 3-D image. The final apparatus is a curved plastic breastplate—I’m told it helps align the image—which she straps across my chest before we begin.

The drive north on Highway 101 from the Highway 87 on-ramp in San Jose to the Embarcadero Road exit in Palo Alto moved at the limit this morning, just before the full stream of northbound commuters floods the artery. Like my own arteries, the asphalt and concrete thoroughfare bearing the load of 101 traffic has deteriorated over the past 30 years, the analogy not lost on me as I travel toward the MRI that will reveal how well mine have fared over the same number of years.

One last thing, she says, stuffing my ears with plugs. You’ll need these as it gets noisy inside the machine. I’m not to be alarmed as it’s the sound the machine makes as it pulses a magnetic field through me to first align then flip the magnetic orientation of hydrogen atom protons in the water, comprising 75 percent of lean muscle in the heart. The protons’ rotation produces a miniscule magnetic flux that the MRI detects, thus creating a three-dimensional picture of the heart. Incidentally, these machines exert a magnetic force around 60,000 times the earth's own magnetic field effects—though nothing to be concerned about as magnetic flux produces no ill affects in tissue and cells.

A few seconds after she leaves the room, I hear her disembodied voice from speakers inside the dimly lit tunnel, that I now find myself in, and quickly close my eyes realizing I am going to freak if I keep them open. Just as I get my momentary panic under control and my breathing less labored, she asks if I’m comfortable and I say I am—liar, but I can’t admit to being a wimp. She says if I’m ready we would begin. I prepare for the sound and as soon as it starts that labored breathing returns. The sound is the shrill alarm of a truck backing up, but at a faster rate, two or three pulses a second it seems, and a different pitch. The sound reminds me of the staccato screeches accompanying the shower scene in “Psycho”—that rhythmic intensity but at a different pitch. I resist the flight response the sound invokes in me and will myself to relax. She’s no doubt aware of how I’m reacting to the machine. My breathing slowly becomes normal as I become accustomed to the sound.

When we begin the breathing drill, the tempo of the machine’s sound changes: same staccato beat, but slower. I count 15 to 16 repetitions as I hold my breath and wait for her to allow me to inhale again. Then she periodically changes the routine, telling me that the next time I must hold my breath longer and I count 20 repetitions before I breath again.

When I’m pulled out of the tunnel halfway through the procedure, I open my eyes and take in the bright light and expanded space of the larger room. She asks for my left arm for the gadolinium injection. According to Wikipedia, solutions of organic gadolinium—symbol Gd and atomic number 64 in the periodic table of the elements—are the most popular intravenous MRI contrast agents to enhance images. However, for anyone with impaired kidneys gadolinium side affects include hard, shiny, darkened skin that tightens and becomes extremely painful, joint inflexibility, loss of movement, yellow-colored eyes, painful joints, and lung, heart and organ damage. My kidneys are pretty healthy so I’m not concerned though I should have been informed rather than finding out from a google search.

Sliding back into the tunnel the second time was a piece of cake. I had become accustomed to the confined space. We finished the series of breathing drills and concluded with the same sequence of loud staccato pulses that began the procedure. And then like every event in life it’s over and I look forward to the prospect of caffeine, something I’d been denied for 24 hours before the procedure. As she removes my constraints and unhooks the electrodes, I ask her how long before the results are in and she says my doctor will have them within the week. I thank her for getting me through the process and return to claim my civilian clothes and start my day. It’s 9:00 o’clock on a beautiful October morn. What could be better than that?