For anyone who might be interested (and for those who aren’t ) I’m running a half marathon on October 12th. Its not my first - I did that a couple of months ago, baulking at the idea of sponsorship in case I didn’t finish. Which I did. So, this one is the Royal Parks Run in London. I’ve decided to run for UNICEF, what a fine bunch of people, and I quote, “working for children and their rights.” I would very much appreciate any sponsorship, as of course would they - I want to raise a thousand quid so the way I see it, that’s only 200 kindly souls donating a fiver. How hard can that be?

So, if you do feel like splashing out five pounds (but of course , don’t feel limited by that!), you can donate here. Thanks for all your support, and for reading!

Just got an email through from those nice folks at RSA Conference Europe. Here’s the skinny:

Session Track: Business of Security

Session ID: BUS-207

Scheduled Date: Tuesday 28th October

Scheduled Time: 16:05 - 17:05 hrs

Session Title: Software and Security as a Service: the risks and the rewards

Session Classification: Strategic

Session Abstract: There is much buzz in the IT industry at present around Software as a Service (SaaS). As with any new trend in IT, there are a number of potential risks which need to be considered when looking at SaaS solutions – but things don’t stop there. At the same time, certain security services can also be delivered using the “as-a-service” model. This panel of security vendors and consultants considers both the risks and rewards of SaaS and security as a service, and delivers practical advice on what organizations should be thinking about today.

Moderator(s):

Jon Collins, Analyst, Freeform Dynamics

Panelist(s):

Gerhard Eschelbeck, CTO, Webroot

Eldar Tuvey, CEO, ScanSafe

David Stanley, MD EMEA, Proofpoint

Because its having a distorting effect on the rest of the industry. I’m afraid I don’t buy the argument (nor would I have to, but you get what I mean) that all software should be free, as Richard Stallmann would so dearly like. Any more than I would agree that all music should be free, or indeed that my plumber should pop round tomorrow and fix the dripping bath tap. It’s a laudable goal of course, as is world peace and the nirvanic state where everyone just gets on. But its just not going to happen, because various elements of human nature - good and bad - won’t let it.

To me, and unlike what the “try the latest distro” Linux User cover disk would suggest, open source is far more about commoditisation than diversification. I find it hard to believe that there is a place for new operating systems which try to compete on features - as long as we build systems around the Von Neumann architecture, there have been operating system constructs around since 1969 (that’s Unix, folks) and indeed before to support them. I don’t want to ignore z/OS on the mainframe - but let’s remember its precisely because the engineers of a few decades ago got so much right that they are so full of themselves now. Windows is also fine - its an OS which cuts the mustard, both on the desktop and on the server. Bt half the reason I believe that Vista tripped up, was that it did not offer anything sufficiently compelling to the majority, even if its security and manageability features far surpassed those of Windows XP. Didn’t anybody tell Microsoft how hard it is to make a business case for security and manageability?

So, open source offers a commoditisation route: if something is algorithmically so straightforward now, and its a question of evolving it in line with the hardware, then open source offers the answer. No point in paying for something that is already done. There are several advantages: the source is openly readable, which makes it potentially more future safe than anything proprietary. Development continues, in an evolutionary manner, and is funded and resourced across the community, which also provides a proactive support base. Its a model which gives us the LAMP stack - thats Linux, Apache, MySQL and which every programming language you can think of that starts with P. And there is money to be made - but out of services, not so much the software licensing.

And here’s the kicker. When it was realised that the real money was to be made out of services, that’s what had the biggest impact on the rest of the industry. Red Hat started to rake it in due to the fact that corporations wanted to know they had the same levels of support as with their proprietary application base - a fact which triggered Microsoft’s ill-advised “Get the Facts” campaign. IBM started to recognise the role of F/OSS (free and open source software) as on-ramps onto what were at the time more enterprise-ready platforms - Linux to AIX, MySQL to DB2 and so on. And Oracle just started to buy everybody it could get away with, as it always does.

Meanwhile we have Sun, which came surprisingly late to the party. Sun’s going through an open source epiphany at the moment, which is just dandy - though I’ve been spending a lot of time thinking about just how successful they will be. Sun’s heritage with software has been dodgy to say the least - it had a good start with the Catalyst catalogue and a pretty healthy software channel back in the Eighties, but that was in the days when the hardware manufacturers called the shots. Things started going a bit ropey in the early Nineties, when a number of big software plays (developer tools and network management) started to wither on the vine. Java came and should have been Sun’s big success, but the Internet came next and took all the attention away. While Sun was being the dot in dot-com, it forgot to be anything else.

It could be argued, quite successfully I am sure (though I will not try to here), that Sun has turned to Open Source for two reasons. First, it had no other choice, as it was no longer seen as a credible player in the world of proprietary software and it had burned its bridges with the flat-rate licensing deals brought in earlier this millennium. Second, one place Sun does have a growing reputation among its own customers is in services. Today’s open source models are all about building a services revenue stream, and I wish Sun success in that.

In doing so, Sun, IBM and indeed Oracle have embraced open source and integrated it into their business models. There’s one last area of course that open source can be used, and that’s as a competitive weapon - the only major company which is yet to embrace open source in the same way is Microsoft, preferring still to approach open source from the point of view of interoperability, not as an integral part of its software platform. Personally I think this is a mistake, but - let’s be frank, what the bloody hell do I know. Microsoft’s ultimate responsibility is to maximise its shareholder value, just as the rest of the majors. I have no doubt that they have done the maths, just as the others will have done.

Which comes back to the first point. If all software should be free then that’s great, but I don’t see IBM , SAP, Oracle or HP open sourcing any of its core moneymaking platforms. With good reason, from their perspective - its not in their commercial interests to do so. However it is in the commercial interests of some players to knock the competition for being proprietary, even while being quite happy to retain a significant proportion of the proprietary software market for themselves. Its a dangerous strategy - ask any of the bigger companies how they see the impact of open source on their own software base in a few years time, and they’d be hard pushed to give a straight answer. Fortunate for them that this industry has a very short memory, nobody will notice when they change their minds.

It’s all good fun isn’t it. Perhaps that’s the biggest reason why I’m interested in open source: it’s not the software itself, though that appeals to my geeky side; nor particularly wanting to consider the community driven development process, though that is a phenomenon in itself and worthy of attention. Nah - its watching the big guys duke it out in what is in fact a global game of paintball, with all the ducking and diving, short-lived alliances and backstabbings, and where the nature of the code maters little more than the colour of the paint.

This must be desktop operating system geek heaven - but even as I say that I realise ‘m missing out on a whole bunch of ‘em. To the point, I have recently come into the possession of a MacBook Pro, which is running OSX 10.4. With that, I’ve got XP running in a (donated, thanks) VMware Fusion virtual machine - which runs like it’s native. Meanwhile, on my old Samsung laptop I’ve gone for a dual boot with Ubuntu Hardy Heron on one partition, and (also donated, thanks too) Windows Vista on the other. What of Solaris or indeed OS/2, I hear you cry.

Its an interesting set-up. A key question is interoperability - which I define as, “Being able to do whatever I want on any platform, without seeing the joins.” I think that’s a bit different to the interoperability Microsoft keeps banging on about, which sometimes seems more about keeping the more evangelical chatterati at bay (incidentally, my suggestion was to ask the silent majority what they thought - I believe there’s far less anti-Microsoft sentiment out there than some bloggers might imply). But the world of Mac interoperability is questionable - iTunes will only recognise iPods for example. Is it a problem? I honestly don’t know - the slickness that the fanboys love so much is a consequence of a tighter control over hardware, and no doubt software specs. Balancing such usability with interoperability is an issue we see in the large in corporate IT shops, and it is no coincidence that CIOs often talk in terms of “One throat to choke.” Thinking out loud: would ‘proprietary’ be such a bad thing, if it just worked?

But I digress. Just one last thing to do is to re-install Lilo, then I’m done.

I was recently asked for some examples of events I have spoken at, so for the record this is what I’ve participated in so for this year:

Taking back control of IT, Webinar, 28 February 2008 (video stream - registration required)

Improving business productivity through effective content management, Webinar, 4 March 2008 (video stream - registration required)

Governance in virtual worlds, Pisa, Italy, 13-14 March 2008 (slides)

Which is more Important – Compliance, Security or Operability? (Panel Chair) - Infosec Europe, London, UK, 22-24 April 2008 (podcast)

Progressive IT, Sourcing and Architecture, Microsoft Architect Insight Conference - Windsor, UK, 28-29 April 2008 (slides/video stream - requires Windows Media Player)

How to sell virtualisation (Panel Chair), Channel Expo, Birmingham, UK, 22 May 2008

IBM Optim Internal Data Threat event, London, UK, 29 May 2008 (slides)

If you need any more information please do get in touch.

It’s been a couple of months since I jumped on a plane back from IBM’s SOA Impact conference in Las Vegas. For those in the know, this conference is a re-named evolution of the IBM’s WebSphere conference series, and for those less so, WebSphere is IBM’s brand associated with its enterprise scale application server software and assorted gubbins to support transaction management, asynchronous messaging and so on – the “platform” elements of corporate applications. The 5,000 attendees comprised a fair whack of WebSphere developers and architects, and suitably impressive numbers of CIOs and other IT executives.

Why the conference is called “SOA Impact” and not anything to do with WebSphere is of course as much to do with marketing as anything. IBM has been quite forthright in pushing its SOA message, and even the very name of the conference offers one such opportunity to put SOA into the spotlight. The million dollar question is, is it right for IBM to do so? Before arriving at the answer (which, for all you skim-readers is yes, absolutely), it is probably worth a bit of background in SOA.

In this hype-ridden industry, the real trends can often be hidden underneath the layers of hype. One such trend has been the nature of software applications. For the 20-odd years I have been working in this business as a developer, quality manager, IT director, consultant and (only latterly) industry analyst software has been moving inexorably towards a distributed model. In such a model, chunks of software (note the avoidance of buzzwords here) do what they do well, and communicate with other chunks of software as, when and however necessary.

This is a very familiar scenario to anybody that ha been involved in IT over the past couple of decades. For years, organisations have been integrating their legacy systems, packaged applications, databases, rules engines, process control systems and so on using various forms of integration software. And it all works, after a fashion.

Not all of it is how we would like it to be, had we the opportunity to start afresh And this is where the evolution comes in. All those years of deploying and integrating applications have resulted in a pretty good understanding of how things should best be done. The first, most important and blatantly obvious aspect is that things should be planned out in advance, as an architecture rather than piecemeal components. That’s not rocket science, its common sense.

The second aspect concerns how the software elements – the applications and packages, or other discrete units of functionality – should communicate. In this there is an element of rocket science, in that many different mechanisms have been tried over the years. The branch that has developed most strongly has its origins in “object oriented” software design techniques, which begat component based development. It doesn’t matter so much what these things are; more important is the fact that they have evolved over many years before revealing the fundamental truth at their heart: that the best way to consider the interfaces between the software elements, is in terms of the services offered each element.

And so, we have an architecture which is service oriented: SOA. Do you see what I did there? At the risk of sounding like a broken record, this is not some invention of software vendors’ marketing departments, but a consequence of how things have happened in the past.

All of which has been seen as a bit of a conundrum in this fashion industry we call IT. One of the biggest issues IT vendors have had with SOA is that it is an approach, not a product: in other words, there’s nothing to sell. SOA has been confused with Web Services, and has suffered the indignity of being nothing more than a ploy to sell Enterprise Service Bus (ESB) software. But still, SOA is an inevitability – as sure as buildings need architecture, so does software.

Back at SOA Impact, then, IBM is indeed correct in promoting the architecture rather than any particular product line. However, IBM has possibly created a it of a hurdle for itself. Were this any other industry, SOA would be taken as timeless wisdom and we would all be free to get on with more current things. But this is the industry of the new – over-hyped promises of something far better than what went before are what sell technology. Can IBM really afford to stick with SOA in the long term?

The answer is, I blooming hope so.

In marketing and PR departments and among some IT journalists, I have heard more than once the idea that SOA is in some way defunct and we need to move on (indeed, we saw this with SOA 2.0 a couple of years ago, which prompted my esteemed partner at MWD Neil Ward-Dutton to implore that we stopped the madness). Such a standpoint is doomed however, as we are dealing with evolution not revolution: while the detail of SOA may not yet be ironed out, the concept is as sound as anything honed over the decades can be.

It does leave IBM with a bit of a conundrum, however. The company currently has its work cut out, and plenty of services upside, from promoting the SOA message. However, at its heart SOA is not particularly sexy and indeed, the better received it is, the less sexy it becomes as it ends up as part of the fabric. That doesn’t leave marketing much to play with.

All the same, the worst thing IBM could do is look for an alternative to SOA. Build on it by all means – with the caveat that it is early days, so it is important not to outpace what is still a fledgling audience. Perhaps one day SOA will become so well accepted that we shall stop talking about it. In the meantime however, of all the concepts that have been touted by this industry, SOA deserves to remain in the spotlight for some time yet.

One of the most fun debates I have had in recent times was with a couple of execs from IBM and Cognos, and with a senior analyst from IDC, at last week’s Information On Demand event in The Hague. The question was innocuous enough - “what do you think is the addressable market for Business Process Management?” “That’s tricky,” I replied, “as I don’t believe that there exists a BPM market, as such.”

There followed a great deal of debate, at the end of which I remained to be convinced that there was such a thing right now as a BPM market. That’s not to say that BPM doesn’t exist - far from it, it is an essential facet of many technical capabilities. However it is exactly this factor that makes it very difficult to define BPM as a market.

Where can we see BPM? The ability to capture business activities and use them as a template for service delivery exists in many technologies, as indeed it has done for some time. We have for example:

• Within content management and collaboration tools, BPM is becoming an accepted term for that element of the software that manages the flow of content across different business roles.
• Within enterprise application integration, there is a clear need to understand how applications and dataflows map onto business activities. Initial releases of Microsoft Biztalk, for example, came unstuck until they built in this element.
• Within software development, a logical extension of modelling business processes as part of requirements capture, is to the use the models to support solution delivery.
• Enterprise applications such as SAP have long been delivered through customisable workflows, which require a level of management from a business process perspective.
• Also, BPM works hand in hand with IT and business service management from an operational perspective, such that service delivery can be monitored and supported appropriately post-deployment.

BPM is clearly a highly valued element of IT. But can it really be considered a market - and if so, how should it be defined? Should it consist of the superset of all of the above, or just the BPM element, if indeed it can be separated out in any useful way? Or should it consist only of the “pure play” BPM vendors, those which have a heritage in one of the areas above but are positioning themselves by leading with BPM?

My debating stance, which happens to still match with my opinion, is, “none of the above.” We discussed the comparison with the transport industry - throwing a car, a tank and a plane into a (figurative) bucket just because they all require an engine does not mean we can define the “engine” market. So, as with BPM, there isn’t a coherent enough boundary to frame a market space.

The debate did not result in any shared epiphanies between the participants (though its always nice when analysts from different firms agree). For me, the thought processes didn’t stop there: a few nights’ sleep allowed things to ferment, alongside all those other things I picked up at IoD, not least a slightly flummoxed acknowledgement about the value of Master Data Management. Absolutely nothing wrong with MDM per se, but I still find it quite surprising that it took the industry so long to work out it would be useful to have a single, shared, defining structure for structured information assets.

To whit: following other conversations it occurred to me that the real pain with BPM remained how views of business activities could be shared across tools. IBM claim export/import capabilities between tools such as InfoSphere and Lotus, for example. But what lacks is the knowledge of which is the “master” view - an issue exacerbated when we consider how such information is distributed (and worse, locked in) to applications and software tools across the organisation.

Perhaps what we need, like with MDM, is Master Process Management - tools that enable representations of business activities to be catalogued independently of any application, and then translated between one application and another. The sign-off of a form in the content management system may also signal the acceptance of a new customer in the CRM system, but such information is stored in the heads of those using the tools, and delivered as a point-to-point linkage. How useful it would (and I’m speaking from experience, having been involved in several such activities) to capture such information and relationships once, and use the “single view of business processes” to feed all of the above applications, if not more.

But let’s be clear. Apart from a couple of obscure vendors (pipe up, if you’re out there), such capabilities do not currently exist. There’s no MPM Gartner Magic Quadrant or Forrester Wave, and even if there were, few if any vendors would appear at all. All the same, if we did have MPM tools, I have no doubt that plenty of end-user organisations out there would be much better off. And indeed, we would have an addressable market.

I can’t remember who said that to me a couple of weeks ago, but its one of my favourite phrases at the moment - it applies so well to so many things we’re dealing with right now: SOA, Identity Management, Information Management, BPM. Give it a go, and se where it sticks.

It always seems quite ironic to me when I read how industry analysts are accused of ‘bigging up’ vendor offerings, when I and my peers seem to spend so much of our time resetting the expectations of over-optimistic marketeers. Indeed, without such a position, we would offer a far less useful service - on occasion I have been positively surprised that certain companies have wanted to work with us at all, given the utter trouncing we have given their products or how they are taking them, like Beanstalk Jack and his cow, ‘to market’. I should perhaps apologise (and I frequently do) for being so direct - we want people to get the best out of your technology, we really do, so we’d rather be straight with you.

As such, it can be quite a relief when something comes along that is so clearly, obviously useful to so many organisations. Like Internet Protocol (IP) address management, for example. I can’t confess to know the whole space in technical detail, but here’s the skinny from my perspective. It is a well-known fact that the number of devices that need an IP address to connect to the enterprise network, or indeed the Internet has rapidly outstripped the original numbering standard, of 32-bit addresses enabling a potential four thousand million addressable devices. Such things as Network Address Translation (where a local router/address server allocates IP addresses on an as-needed basis using a local subnet, and then translates between local addresses and a reduced subset of externally-visible addresses) have helped reduce the burden somewhat; as of course has the arrival of IPV6, which extends the number of addressable devices to 2^128 (a very big number).

However, a remaining issue is how to manage said pool of addresses. These days the number of required devices has increased dramatically, notably with the arrival of Voice over IP (VoIP) handsets, which are replacing traditional, analogue telephones. From an address management perspective, the Domain Name Service (DNS) protocol is the standard for allocating specific address ranges to specific subnets, but some organisations are ending up with a large number of DNS servers, which themselves have to be managed. The original protocols were never conceived to manage the address allocation, deallocation and reallocation process on such a scale - and don’t facilitate the cataloguing of what address belongs to which department (Microsoft Excel is a more used, but still inadequate tool). Theoretically, organisations could of course allocate addresses statically, once and for all - but all it takes is an office move (requiring a number of devices to move from one subnet to another) and all hell breaks loose.

So - IP addresses need managing, and existing mechanisms aren’t cutting the mustard. This is the breach into which are stepping organisations like BlueCat Networks (who I have spoken to), and Alcatel-Lucent, BT-DiamondIP and Crypton Computers (who I haven’t - but these chaps have) - essentially delivering management tools and distribution mechanisms that really can cope with such huge numbers of addresses and offer quite some respite to those managing the IP network. It is notable that, when I asked BlueCat whether I could speak to a customer, they jumped at the chance and before long I was speaking with Investor AB, a Swedish organisation.

On the call I learned little that was unexpected: yes, the problem existed and was real; yes, it was for the reasons I understood; and yes, the deployment of BlueCat’s address management solution had been a great help. What’s there not to like, I said as we finished the call. And yet, I was left feeling a little puzzled at the end of the call. Notably, whether by agreeing with the problem and solution, I was in some way implicated in yet another attempt to foist unnecessary technology on an unsuspecting public. Particularly in this case - where the solution itself resolves an indisputably technical problem.

But however we might like things to look, the problem does exist and so does the solution. Just as the invention of carpets required the subsequent creation of carpet cleaners, so can today’s overstretched networks benefit from address management. This won’t be a panacea for all ills - it never is, and it should go without saying that technology can never be more than a crutch to poor operational processes or bad managers. I could add a string of caveats at this point but I won’t - rather, I will acknowledge the fact that most network managers do have their heads screwed on pretty well, and defer to their ability to decide whether this would be an appropriate technology for them.

Microsoft’s always going to have a hard time presenting a convincing green story for desktop computing. Its not that the story itself is un-sound: power-saving features are useful as far as they go, and Microsoft as a company is keen to be a good corporate citizen. The elephant in the room however may be summed up in a single, horrible word – bloat.

Microsoft’s story has been a fascinating one, one of the great success stories of the IT industry. There have been several key bets made along the way, which Messrs Gates and Ballmer have stuck to doggedly. This is not the place for a full précis of the Microsoft story, but it’s worth highlighting one of the bets: Moore’s Law, the principle (to paraphrase) that processor capabilities would continue to double ad infinitum.

In practice, this has been characterised by the long-standing truth well known by anyone who has spent the past couple of decades in the industry: that if you want to take advantage of the latest Microsoft software, you’ll have to upgrade your machine. The conversation has repeated with the same regularity as Moore’s Law itself – the bemoaning of how slow everything is running, and the wry nod from those who have seen it before.

Of course, this self-fulfilling prophecy has been of huge benefit to both Microsoft and its hardware partners – companies such as Intel. I very much doubt whether the Wintel alliance was deliberately stuffing software into the operating system just in order to shift more processor units, but one thing’s for sure – neither side was calling ‘stop’. We have also lived through the office bloatware wars, where Microsoft, Lotus and WordPerfect duked it out to see who could out-bloat the competition. (Microsoft won, as we all know)

The attitude throughout from Microsoft – and I know this very well, having asked them on various occasions – has been, “If you want to take advantage of the latest innovations, you’ll need to use the latest technology.” I remember a very public debate I had with Martin Taylor, Microsoft’s ill-fated “Get the Facts” General Manager where he told me that most desktop users wanted far more than just email and word processing. It wasn’t true then, and it isn’t true now.

And so, to Green. While Microsoft might not have been underhand in promoting the “new and improved” –  it’s a technology company, after all – neither can the company claim to being particularly green. Fundamental to this is the fact that the power consumption of a device is only a small percentage of its overall carbon footprint. Bottom line: replacing or upgrading a machine undermines any benefits that can be had from ‘new’ power saving features.

What can Microsoft do about it? Well, perhaps that operating system that has been derided as the most bloated of the lot – Windows Vista – could hold the key. At the heart of Windows Vista lies a perfectly sound operating system. There are two issues however – the first is in disk space taken up by installed, never to be used apps; and the second is in the memory requirements for unnecessary run-time services. It should not be beyond the ken of the bright sparks in Redmond to bring out their own tools to monitor what’s really necessary, and strip out anything that isn’t?

Sounds simple, doesn’t it? Trouble is, it goes right to the heart of Microsoft’s core philosophy, and fear – that people might stop buying its software if there is insufficient “new and improved” about it. That’s a fair worry – but it’s happening anyway, as we see Microsoft having to extend support (yet again, with hastily invented acronyms no less) for Windows XP. The same principles could be applied to Microsoft Office – which has already seen a usability overhaul with 2007, now, how about a performance boost? What additional benefits can be achieved offloading tasks to Windows Live services? Etc, etc, the list goes on.

It’s a changing world we are in. While Moore’s Law may continue to apply, many organisations are finding they have more than enough processor power on their desktops to do their day to day work. If Microsoft is really serious about greening the desktop, it has an opportunity to use its position to drive some fundamental changes. The question is, does it have the strength of character to do so? The alternative may be business as usual for Microsoft, but it certainly won’t be green.