Identity is king

Many large distributed systems have on success criterion in common – identity (management). This is true for social networks (we all love to be part of), e-commerce platforms, systems operated in the clouds as well as for networks in the realm of automated demand/supply operation (aka Smart Grids). The requirements are not new at all: the identity of a large number of participants must be handled in a way that peers can trust each other based on one or more identity providers. Identity is needed for authentication in order to enforce access control to a resource (a website with profile information, a virtual shopping cart, a database table, a data point, whatever). It’s about the identity of the subject (the source) which has initiated the request to get access to a resource. Before the access rules can be applied (authorization), this authentication must be handled in a trustworthy way. This is complex to achieve, especially in case of multiple domains that operate their own realm of trust. This kind of trust is a precious thing that needs to be protected and maintained. Beside all theory and technical details, it (the precious thing of digital identities in an existing community) is an important asset. A social network identity could be used to get access granted to other resources like a virtual shopping mall or a booking engine for last minute flights. More scenarios are obvious ….

Security in Cloud Computing (Distributed Systems)

Security is one of the most important requirements to make a software system running in the cloud acceptable for the intended user community. This is especially true in times like this where people’s privacy is under attack on a daily basis. Just follow the news in Germany. It’s a big concern and not far fetched, not at all.
Computer security got a couple of basic pillars; Identity Management is one of them. In the new realm of cloud computing, this comes along with authentication and authorization in distributed systems. SAML (the SAML 2.0 protocol) and OpenID are more or less standards to support the implementation, also in terms of interoperability. Big vendor’s cloud architectures (just see the Geneva project as an example) do support these standards. This is not just a good approach in terms of interoperability; it also leads to a better understanding and visibility regarding the underlying implementation and infrastructure which probably leads to more trust and better acceptance.

ACID, BASE, CAP and the Clouds

This is not about chemistry, medication or transcendent music. But it is a fussy topic. I assume the ACID (Atomicity Consistency Isolation Durability) paradigm is well known and understood from working with databases or in the scope of transactional logic. But this is about to change in large distributed applications running in the clouds (of whatever flavor) with distributed data repositories (e.g.: partitioned databases on distributed nodes). Running in clouds implies the utilization of web services predominantly. This environment leads to the CAP theorem which is about Consistency, Availability and Partition Tolerance with the restriction that only two goals (of CAP) can be achieved in a real world implementation. So it is up to application development to decide between availability and consistency and to conceal this conflict by different means, for instance by using a smart user interface logic and design as well as sophisticated update and messaging strategies in order to achieve consistency in the second step. - I apologize for oversimplifying this whole topic for the sake of a concise post. – Anyhow, this is already in place in large online-stores. To bring the third acronym into the game, an approach to make this happen is called BASE. It stands for Basically Available, Soft state, Eventually consistent). An architecture based on decoupled subsystems is an important prerequisite to achieve this.
There is nothing new about these acronyms and the paradigm change. Great articles can be found on the web (for instance Werner Vogel’s “Eventually consistent”) or other stuff especially available at ACM QUEUE. I just wanted to emphasize the need to check on this from the architectural perspective in order to answer the question: Is this application the appropriate choice to be deployed in the clouds or not? Or say it the other way around: Is BASE good enough for you? Or, is ACID essential for your system and the underlying requirements that are basically quality attributes? For many systems in the industrial domain (where data integrity and consistency is king) the answer might be not (or probably not yet). To answer these question correctly in order to adhere to such paradigms (or not), is essential because the clouds are already on the horizon.

Surf Globally, Store Locally?

The era of clouds (see my post on that) comes along with a lot of options to outsource data processing, storage and integration. Well, using external processing power is definitely a good idea, and this service is already accepted and used. Also the integration scenarios offer a lot of chances (beyond the market place and b2b capabilities). But storing data on external machines is a different thing. Security (privacy) concerns exist and should be taken seriously. Incidents (just see what happened to customer data of a big German telecom / mobile phone company) are no exceptional cases and the most spectacular are probably just the tip of the iceberg. Bullet-proof security architecture does not come for free. It’s expensive and a never ending process. Richard Stallmann (RMS) published his concerns last week. He called cloud computing a trap. His view is more about the fact that user might loosing control when running there applications in the clouds. This implies the security aspect. So, should the slogan of the environmentalists “buy locally” a little bit adapted in order to recommend a “store locally” approach?

A Tribute to Jim Gray

acm queue has started to publish a series of articles about computer-pioneer Jim Gray with the May/June issue. In January 2007, Jim Gray left the Bay Area with his sailboat heading for Faralon Islands and was never seen again – a tragic incident. The articles are absolutely worth reading, describing his work and the extraordinary personality of this famous computer scientist.

Some sort of Indirection

There is a quotation from a British Computer Scientist, David John Wheeler, I do really like: “Any problem in computer science can be solved with another layer of indirection. But that usually will create another problem." I know, it is not new and we all know about the meaning behind it but it is still relevant today and tomorrow, and it describes the dilemma of many
“genericcontainerwrappingadaptergatewayframeworkolalasolutions” perfectly.

Off-line Web Applications

Many approaches for so-called “Off-line Web Applications” employ a bunch of vulnerable technologies running on the client. Sure, content must be cached and presented (in case of disconnection) and this needs two components: a database and a web server. In a scenario where a web server is running on each client in a network of Off-line Web Application, it needs strict rules in terms of configuration measurements. Honestly, who cares about this? Not even browsers are configured in a way to reach a decent state of security on the majority of desktop machines. This is another example how vulnerable many Web 2.0 approaches are, beside AJAX and the underlying excessive scripting model. Just check on the Black-Hat Sessions (and presentations) to read more about the risks and known weaknesses. It’s frightening …
Actually, I should add the keyword – Security – to the description of this blog. It turns out that this topic occupies more and more time of my daily work and research effort.

More Hot Technology Trends

I would like to rework (extend) my list of hot technology trends a little bit after having some interesting conversation. I definitely need to address:

• Concurrency in a multi-core computing environment. This is basically an area where relief is needed. Existing solutions, either implicit or explicit, are not sufficient from my point of view. Not sufficient because of the complexity and the resulting learning curve for developers. In today’s world of mainstream development, many underlying details pertaining to the processor architecture are hidden by abstraction layers and programming models. Handling lock-free programming is not a piece of cake. I would expect that chip maker and RAD/Compiler manufacturer come up with a smart approach to handle this. And I’m not talking about functional languages …No question that this is needed. A constant increase in computing power based on higher “GHz’s” is limited by physical barriers. More cache is no way out. Server applications will handle this by load balancing. But desktop applications are different. Graphical centered applications (picture, video) and other complex computing stuff will need a robust concurrency concept/framework on all these dual-core, quad-core boards soon.
  
• Sure, virtualization. Virtualization is basically everywhere, on the boards, within operating systems and as add-on products. The solutions are different in their concepts and the market is fragmented and sometimes confusing. But virtualization is a cool technology with a lot of promising use cases.
  
• RFID-Tags are sneaking into many areas - industry, retail, and simply into out privacy (à ID’s, passports). A critical success factor will be the security aspect of such solutions. People care about the privacy of their information which includes positioning and profiling.
  
• Widgets, Offline-Web-Apps, Local Web-Server (all this related to the Web-OS) – I will write about this in more detail soon.

Hi-Tech Search for Jim Gray

Hi-tech pioneer and veteran Jim Gray (some keywords: databases and transactions, linked to many icons from Google, Amazon, Microsoft, and others) is lost at sea. He left San Francisco Bay Area heading out for Farallon Island on Sunday, January 28, 2007. He and his boat, the fiberglass cruiser “Tenacious” vanished in the open ocean. A high-tech search started when it turned out that traditional search and rescue by the coast guard had been unsuccessfully. High-tech giants (mentioned above) worked together and created a quick, impressive combination of different technologies in order to find Jim. Unfortunately, this great thinker and engineer was nowhere to be found. Not even the tiniest remnant or debris of his boat could be detected. It sounds like a mystery and is a real tragedy for his family and friends. An excellent but also sad story was published in the wired magazine; August 2007 issue. We all hope that Jim will return. The efforts to find him, driven by Werner Vogels and other high-tech executives, is an impressive example how a great person can link very different people, interests, positions and companies in order to find a solution. Unfortunately, his accident was the trigger to make this happen.

My view on THE Web-OS

Many people are talking about a Web-OS. Just do a quick search via Google (one of the key player in this WebOS area). The results will be very different: some kind of decent information and ideas, some kind of rumors, all this stuff… I do believe in the idea of a Web Operating System which will be one of the top technology trends for 2008 or later. But I really miss a cool approach to bridge an existing gap. This is not about putting a web server on each client. This is about the technologies running in the browser which is still the one-and-only client for web applications. HTML is a markup language for documents, period. JavaScript is a scripting language, easy. Any combinations of both technologies might lead to more functionality and even to new trends like Web 2.0. But this comes with high complexity, security issues and huge problems to maintain code (and I’m not talking about debugging). My point is, HTML, JavaScript and AJAX are not the robust and durable building blocks to create a new operating system. This kind of homework must be done before establishing a new operating system; even it is “just” web. Disappointed?
___

Convergence of SOA and Software as a Service

People might argue that SOA is just another hype in software development. That is definitely true for many applications with the SOA Sticker on the box. There is also some kind of misconception of the underlying implementation techniques. For many “experts” is the web service technology the one and only choice (I can’t agree on this!). But the concept of SOA is especially helpful in the phase of mapping use cases (and work flows) to implemented functionalities in scenarios where the interaction (between the functionalities) is changing constantly. This flexibility is one reason to make SOA happen (but, please, not for all types of software applications). In addition, I do see a great opportunity to match the business scenario of – Software as a service – with the idea of a Service Oriented Architecture. I’m pretty sure that such companies got this already on the agenda. Me too.

Software Companies in the Media

There was a article about Google and Microsoft in the German Newspaper Welt last week. I have sent a comment which was not published. Here we go (I will translate later):

Leserbrief zu Wachablösung für Microsoft

Leider erfolgt die Darstellung der Firmen Microsoft und Google in den Medien oft sehr einseitig und voreingenommen. Beide Konzerne werden als bedrohlich dargestellt und manchmal regelrecht verteufelt. Dabei wird vollkommen ausgeblendet, welchen Beitrag beide Firmen für eine moderne und vernetzte Welt geleistet haben. Microsoft hat es geschafft, dass Millionen von Menschen auf der Grundlage eines Standards Dokumente austauschen können. Google wiederum erlaubt den sekundenschnellen Zugriff auf Informationen. Damit wurde der Fortschritt der Menschheit ohne Zweifel beschleunigt und neue Chancen für ein globales Wachstum eröffnet, von den vielen neuen Arbeitsplätzen einmal ganz abgesehen. Daran sollte vor allem die EU denken, wenn sie immer wieder neue Prozesse gegen Microsoft (uns sicher auch bald gegen Google) anstrengt, die oft jeder Grundlage entbehren.

Friday Nite Television

There was a film on German's ARTE "Wer hat Angst vor Google?" (Who is afraid of Google?) Friday nite. It was pretty decent stuff. It is amazing how fast this company is growing. It was also fascinating how Google defines CREATIVITY. No wonder that these guys are successful as they are. It was also interesting how the Google guys were fighting to keep their homepage as it ist, without any ads.

My critical view on today’s web client utilization

Using web clients (aka thin clients) comes with a lot of advantages. It’s cool, it’s deployable, it does juts depend on the web browser, not on the underlying operating system, and and and… There are a couple of other reasons why web applications are state of the art for many stake holders in today’s user interface development. I do support this; but not for all use cases. It’s for sure, e-commerce web sites have no other choice and this is cool and okay.But I would like to remind all the excited folks that web applications using a simple paradigm: web browser, DHTML (HTML, JavaScript) via HTTP and web server. The bottleneck from the technical perspective is HTML. HTML is basically a markup language for text, not for interaction and gimmicks. As a result, today’s web applications using frameworks based on script languages to recreate user interface behavior. The results are complex, hard to maintain and often not stable. And, I do believe that big player in this game are doing research for new concepts; especially regarding the logic on the client (which is basically JavaScript these days).

The beginning is the beginning ...

Hey, this block is about software; software architecture in general. My objective is to post information (based on some experience) on current topics. And, I dont wanna stress buzzwords. Everybody is excited about SOA, not me. I'm interested in good software. I know. It sounds simple. But it is hard work do develop decent code, not talking about big project and a crystal clear architecture. Well, let's go.