Telematique, water and fire.

More on the Xen Cloud Platform

The Reg's Timothy Prickett Morgan has posted Xen packages build-your-own-cloud kit and it adds some needed clarity to the upcoming Xen/Citrix announcement.

Simon Crosby's quoted as stating the goal of delivering to market a standardized stack for a cloud-based deployment of the Xen hypervisor. Prickett Morgan makes the point that it's an open source vertical platform, but clearly should not be considered a turn-key solution.

The Xen Cloud Platform does not include tools for creating, provisioning, monitoring, or managing a cloud. Rather, it is a complete infrastructure virtualization stack that companies building clouds can standardize upon.

The article goes on to point out that it's not only 'free' but hackable open source. It brings up the issue that GPL-based open source licensed code has an interesting loophole ... Since a service vendor's revised/enhanced/hacked code is not being re-distributed (but used solely for the provision of services), the license does not require the licensee to return the enhancements to the open source community. What isn't clear from the article is the licensing regime under which XCP will be offered.

Another point of clarification is the distinction Citrix is making between XCP and the Citrix Cloud Center (C3).

And this future product will be distinct from the Citrix Cloud Center (C3), formerly known as XenServer Cloud Edition, that Citrix pitched last year and tweaked when it started giving away XenServer for free this past February. ...

The Xen Cloud Platform is not C3, but it will include some storage management, chargeback, and other features that Citrix created for C3 or the Essentials for XenServer tools that are necessary for cloud providers. The cloud stack includes the Xen hypervisor, with support for either Linux or Windows instances inside of its virtual machines. The stack also includes a domain 0 Linux installer for the Xen hypervisor that is pulled right from the kernel.org site where the Linux kernel lives. ... Citrix will open source storage features it has created to link into disk arrays to do volume management, snapshotting, cloning, and such, and chargeback and other features to cope with usage tracking will be added to the stack as well by Citrix.

Of major interest is the approach to a distributed virtual switch infrastructure. The article notes that XCP will include the Open vSwitch that's available under the Apache 2 license., and is supported by the Citrix XenServer 5.5 hypervisor. This is not yet a full OSS solution, and Citrix will be under pressure to either release to open source some of their virtual switch technology, or Open vSwitch will need to light a fire.

Finally, the support of DMTF's OVF is reiterated.

Cloud Computing

Battling for the Title of Cloud VME

According to eWeek and Shannon Snowden, Citrix Systems and Xen.org will be developing a 'full-blown cloud computing platform that will rival VMware's vCloud offering.' I'm not yet sure what this means, because there are still piece parts of VMware's vCloud (particularly the details of the vCloud API) that are yet to be revealed. That said, the interview on Snowden's Virtualization Information seemed to have the right elements: portability through support of OVF (YAY!!), commitment to DMTF standards, XenMotion workload migration between datacenters and clouds, extended virtual networking infrastructure, and cloud-scale virtual storage infrastructure.

We discussed the the expected impact to Citrix and XenServer. Both Simon and Ian (Pratt) think that having a bigger footprint of XenServer is good for Citrix and ISVs in general because the (Xen Cloud Platform) XCP won’t necessarily be focused on the management layer, but the foundational components to having a stable, functioning cloud platform. After all, Citrix is already providing XenServer for free.

In fact, the orchestration and management capabilities of open source projects Eucalyptus and OpenNebula.org as well as commercial offerings from vendors and cloud providers will integrate with XCP since these projects are Xen-based already.

Simon said the plan is for Citrix Essentials to work with XCP, so this makes business sense to me. Citrix gets more XenServer in organizations that already are running Xen to power their clouds and have an opportunity to sell more Citrix Essentials.

For me, the early prize in the contest between VMware and Citrix is the cloudbursting title. This would incorporate three elements:

1. The extended safety cordon required for expanding a private datacenter into the cloud of an IaaS, most likely based on a managed VPN like CohesiveFT's VPNCubed or Amazon's VPC
2. The ability to utilize hot migration -- vMotion or XenMotion -- as a basis for VM movement.
3. A coordinated data management facility -- almost a customer directed content management network -- for identifying, moving and then utilizing data at the most appropriate location as part of the workload migration control.

Cloud Computing

Dealing with Data During Cloudbursts

I enjoy reading Joe Weinman's posts. And today's post at GigaOM is no exception. He does a great job organizing the problem of data when considering the architecture of cloudbursting. Joe's post has prompted me to break my 'radio silence' of a few months.

In 4 1/2 Ways to Deal With Data During Cloudbursts, Joe calls out a number of architectures and discusses some of the considerations that impact the choice of a relevant scenario. I won't try to recreate the architectural strategies, but I was taken by how relevant these same constellations are when addressing some of the more advanced considerations of data clouds, peripatetic workloads and data governance.

1) Independent Clusters: This one is pretty straight forward and Joe's characterization of "minimal communication and data-sharing requirements between the application instances running in the enterprise and cloud data centers" makes sense. The data-specific considerations in using the cloud service resources tend mostly to center about providing the user with a uniform (or at least acceptable) standard of data security.

2) Remote Access to Consolidated Data: This strategy is called out for those situations in which application instances running in the cloud require access to a single-instance data store, or data store(s) which must for various reasons remain within the confines of the enterprise data center.

Notice my 'or' in the last sentence. Besides architectural requirements that require a single-instance data store, the reality of enterprise IT is that data stewardship requirements often require the authoritative datum to remain within the enterprise data center.

3) On-Demand Data Placement: Weinman points out that

...if I/O intensity and/or network latency are too high for remote access, then any needed data that isn’t already in the cloud must be placed there at the beginning of the cloudburst, and any changes must be consolidated in the enterprise store at the end of the cloudburst. The question is: “How much data needs to get where, and how quickly?”

This is clearly the right question to ask first. If a large data set is required to be in close proximity to the cloud service application instances, this may require enterprise IT to rely on a number of tactics to reduce delay in commencing cloud-based operation: large bandwidth networking services, possibly made available on-demand; advanced WAN optimization technologies (e.g. data deduplication).

As in my consideration of the remote access to consolidated data, on-demand data placement may imply a requirement for additional measures to deal with compliance and data stewardship, therefore calling on the purveyors of fast file transfer or on-demand, adjustable data transport services to offer a form of 'in-flight' data mediation services. Alternatively, the enterprise data center may be called on to implement dataset virtualization approaches or data masking systems in order to remain in compliance.

4) Pre-positioned Data Placement: He makes the point that pre-positioning "... adds additional costs as a full secondary storage environment and a metro or wide-area network must be deployed.'

4.5) BC/DR Plus Cloudbursting: This was the point at which I chortled with recognition.

Thanks, Joe! I've been looking for the context in which to make this point for years. This has been a soapbox of mine for a long time ... almost since the notion of utility computing (now 'cloud computing') started circulating as a meme.

In addition to using cloudbursting as the premise on which to incorporate business continuity and disaster recovery costs into calculation, I'd like to throw in at least one more, in hopes of getting this to 4 3/4 ways to deal with data + cloudbursts. Please bear with me... this is work in progress.

Data Governance, Data Stewardship and Data Residency:

Many of the issues relating to data in conjunction with cloudbursting are not new. When you stop to think about it, the 4 1/2 ways that Weinman outlines are variants of a generic data sharing problem across organizational boundaries. If we add any form of data sharing to the real cost of the enterprise data center, the issue we must address is that of Data Stewardship. It's been defined in various places, but here's one of my favorites since it places it in context with Data Governance.

Data Governance: The execution and enforcement of authority over the management of data assets and the performance of data functions.

Data Stewardship: The formalization of accountability for the management of data resources.

Data governance in the enterprise data center may require a 'complete' record to always be under the stewardship of the enterprise, and never at risk of being located in a different legal jurisdiction (e.g., the details of a financial transaction must remain in the immediate and direct control of the responsible financial institution). Examples abound, but one can point to financial and personal information which must, for compliance reasons, never leave the geographical borders of a country with stringent data protection regulation n (e.g., not in that cloud-resident datastore in India or Switzerland).

In these cases, the implications of cloud bursting on data may require the addition of data masking/data obfuscation, or applications which are demonstrably proven to operate on meta-data of other kinds without jeopardizing data stewardship compliance. This particular aspect of Data Stewardship is sometimes called the Data Residency Dilemma.

Getting to 4.75 - Data Governance Plus Cloudbursting: Even if, in addition to taking responsibility for data mirroring or replication to provide Business Continuity / Disaster Recovery, the enterprise is constrained from using Data + Cloudbursting because of the costs and constraints of data governance, the question arises: Are there services / technologies that can be provided by the *aaS supplier which can be brought to bear? To me, this appears to be a question of data center pragmatics rather than strictly an issue of recalculating the breakeven point.

There are many technologies for data sharing, some of which come into play for Data + Cloudbursting. When the solution requires extending the 'boundaries' of the enterprise in both the application and data domains (as we do with cloudbursting), the first question has usually been constructed as: Should the shared data reside inside or outside the firewall?

Elastic perimeter technologies: For cloudbursting with data 'leaving the building', elastic virtual private networks (such as CohesiveFT's VPN-Cubed , particularly their Data Center to EC2 version) address the underlying, network-oriented issues of wandering data.

Data masking & obfuscation: Conventional data encryption of "data at rest" does not satisfy the safety requirements of most enterprises when data is placed outside the corporate data center. Because the data must be decrypted when “in use” by a cloud-resident application image, conventional disk or file encryption does not protect against a compromise of or misuse by any systems processing the data. Suitably transformed portions (i.e. fields) can be used that provide integrity of the source data required for the application by means of data masking or obfuscation.

Meta-data & data virtualization: We're now starting to see, usually in conjunction with specific SaaS offers, data 'proxy' servers and other means that allow the enterprise to retain specific data elements 'locally resident' within the data center rather than residing 'in the clear' within a data cloud. What we can expect to see within the next year are solutions that provide this type of offer associated with Master Data Management technologies, or enhanced data-in-motion services provided by cloud service providers at all levels -- Iaas, PaaS and Saas. The most immediate utility of these offers will be for enterprises wishing to make real use of cloudbursting.

---

Joe Weinman broadened the definition of the real costs of an enterprise data center and has shown clearly how cloudbursting + pre-positioned data can contribute to addressing the BC/DR costs. Like BC/DR, the enterprise data center has to consider data governance in the context of interorganizational data sharing. Cloudbursting is just one form of data sharing, and presents the innovative cloud service an opportunity to provide generic solutions to data sharing governance for the enterprise.

Truth in advertising: In two of my recent entrepreneurial adventures (Univa and Safe Data Sharing) as well as two for whom I've acted as an advisor (Perspecsys and Replicus ), the problems of data stewardship and anticipatory data transport (e.g. moving/replicating the dataset well in advance) all come into play.

Attention Span 09.05.11

Citrix C3 - Where are the partners?

At its annual customer get together, Citrix Synergy 2009, the company fulfilled our prediction of the true value of its XenSource acquisition in 2007 – an enabling technology for Presentation Server (now XenApp) and its desktop virtualization efforts (now XenDesktop). By adding these capabilities to its C3 platform for Internet service providers (ISPs) it has significantly differentiated its Infrastructure as a Service (IaaS) play from VMware vCloud, 3Tera AppLogic, and the other platform efforts in the market today. Instead of an ISP getting a relatively generic IaaS platform, they now get a robust set of service offerings – IaaS, Windows application hosting (somewhat of a SaaS offering) and desktop as a service.

But the announcement left me a little concerned when it wasn’t coupled with a list of brand name ISPs who have signed on to deliver this service to enterprise customers. Anyone out there? Perusal of Citrix’ C3 web site and Citrix Service Provider partner pages offer no insights either (Ingram Micro? Softcat? ExpressData? Not exactly ISPs). The technology without the partners looks a little incomplete. Citrix has started a timeclock on the credibility of this effort that it will need to fulfill soon.

New rPath CEO Torto charged with growing company

Raleigh software maker rPath, which has raised $25.5 million since being started by two former Red Hat executives in 2005, has hired Michael Torto as CEO.

Torto brings a decade of CEO experience in the software industry to rPath, which downsized earlier this year at about the same time that company co-founder Billy Marshall stepped down as CEO.

Attention Span 2009.04.29

In case you're wondering, I've been experimenting with keeping a running post of things that I encounter during the day. I now believe that putting a little running commentary / reaction in addition to a salient quote is the best approach. With any luck, there are a few of these that may find their way into a full-blown post soon.

Here's what caught my eye.

Google's Take on Cloud Computing

There's quite a bit of talk these days about corporations building a "private cloud" with concepts like virtualization, and there can be significant benefits to this approach. But those advantages are amplified greatly when customers use applications in the scalable datacenters provided by companies like Google, Amazon, Salesforce.com and soon, Microsoft. In this model, customers can leverage hardware infrastructure, distributed software infrastructure, and applications that are built for the cloud, and let us run it for them. This offers them much lower cost applications, and removes the IT maintenance burden that can cripple many organizations today. It also allows customers to deliver innovation to their end users much more rapidly.

Security simplified

Let me propose a better way to approach security.   Start with three simple rules of security.

1. Good end point security assumes the network is hostile.

2. Good network security assumes the end point is hostile.

3. Good data security assumes the user is hostile.

Applying these simple concepts is a powerful way to direct security investments, product development, and ultimately achieve better security.

SolarWinds adds IP address management to Orion

SolarWinds hopes to provide another option for IT managers looking to optimize their IP address management (IPAM) processes. The company this week announced a new add-on module for its Orion management suite as well as a free tool customers can download to get started tracking IP addresses

Reliable messaging - 'feeds meet queues'

The BBC uses AMQP/RabbitMQ as the basis for Feeds Hub. 'Some of the more high level requirements we aim to solve with Feeds Hub include giving data source owners who register feeds proper usage statistics on how and where their data is used and how effective the feed is (stats on click-throughs). ...

Tier 1 Research: Higher Prices Ahead for Data Centers

This is an interesting turn of events. Particularly because the banks (and infrastructure providers) have long-enough memories to remember the collapse of Exodus and other capital-intensive co-lo facilities. If the hosting providers -> XaaS providers start looking too much like those companies, it will be NO surprise that the banks and suppliers who might otherwise be willing to put purchases on the tab, will make it MORE expensive for those companies that are supplying the Cloud and are, in fact, capital intensive.

Demand for data center services has declined only slightly, Golding says, while the amount of new supply has been constrained by the credit crunch. The tough economy has led many many providers to hold pricing steady, but that trend won’t hold as the supply-demand imbalance continues to deteriorate in major data center markets, particularly if the economy improves.

Wolfram|Alpha ... the time approaches

Still wanting to get behind the wheel of this puppy...

Stephen Wolfram, creator of the Wolfram/Alpha search engine, on Tuesday demonstrated his much ballyhooed “computational knowledge engine” at a talk at Harvard University. Wolfram likened his effort to reproducing a global reference library and said Wolfram/Alpha will launch in “a few weeks.”

IBM's Dynamic Infrastructure and Service Management Ctr for Cloud Computing

Hmm... despite protestations to the contrary, this still seems suspiciously similar to the SOSM (Same Ol' Systems Management) from Tivoli ...

IBM Service Management helps you manage the complexities of cloud computing by delivering visibility, control and automation across your dynamic, virtualized environment:

Visibility to respond faster and make better decisions, delivering improved visibility into the performance and availability of services that span heterogeneous and virtual environments.

Control to manage risk, compliance and shared costs, providing security management across shared infrastructures and applications. Also helps you monitor shared resource usage and cost in a virtualized environment.

Automation to lower costs and build agility into your operations, enabling you to leverage automation to address the operational complexities associated with managing virtual resources.

Cloud Computing, Attention Span

InterCloud Portability Reality Check

I noted the SD Times piece yesterday by David Worthington, and had something of a sinking feeling. Here was AMZN, HP, IBM, MSFT and CRM singing the cloudy version of the old Burger King spot - "Have it your way." ... "We are open and continue to be. Customer choice is our philosophy." Mmmm.   

So, with a hat tip to James Urquhart for pointing out this reality check, I want to thank William Vambenepe. What I appreciate about the discussion in this post is his willingness to distinguish what "portability" might mean when operating at the various levels of cloud service -- application, platform or infrastructure.

William is legitimately skeptical about the likelihood of "application portability across IaaS providers", though I don't think I'd buy his pessimistic prediction of 10 years to achieve it. There is certainly a challenge for workload mobility across "interoperable" IaaS providers. I'll be a bit more positive about the possibilities. I foresee a much quicker uptake on the requirements he sets out by the introduction of a new set of players or, if not new players, significantly new services offered. I think of them as the set of Core Service providers for the InterCloud.

• standards for key parts of the Cloud computing domain that Vambenepe lists (security, monitoring, provisioning, configuration, language runtime and/or OS, data storage/retrieval, network configuration, integration with local apps, metering/billing)
• the existence of the requisite set of third-party services to deliver the aforementioned services in a uniform, authoritative and trusted manner
• the availability of "RightScale-like tools" or the OA&M offerings of the Core Services providers to supply a lot of the heavy lifting required for discovering, mapping, hiding, transforming. (No... I didn't write this to introduce yet another acronym ... Cloud Management as a Service is too unwieldy.)
• certification of application platforms that support workload migration across major IaaS providers

I'm particularly taken with the notion of an industry segment made up of InterCloud Core Service providers. (Ask anyone who's been unfortunate enough to have me bend their ear for the past couple of months. It's definitely been on my list of speaking points.) I plan to put more emphasis on their identification and definition in posts over the course of the next few weeks.

Reality check on Cloud portability

...

Because the reality is that, Manifesto or no Manifesto, you are not going to get application portability across IaaS-type Cloud providers. At least for production applications. Sorry. As a consolation prize, you may get some runtime portability such that we’ll be shown nice demos of prototype apps moving from one provider to another (either as applications or as virtual machines). Clap clap until you realize that they left behind their monitoring capabilities, or that their configuration rules don’t validate anything anymore. And that your printer ran out of red ink when printing the latest compliance report. Oops

....

Standards are always supposed to prevent vendor lock-in. And there is a need for some of that, of course. But look at the track records. How many applications do you know that are certified and supported on any SQL database, any Unix operating system and any J2EE app server? And yet, standardizing queries on relational data and standardizing an enterprise-class runtime environment for one programming language are pretty constrained scopes in the grand scheme of things. At least compared to all the aspects that you need to standardize to provide real Cloud portability (security, monitoring, provisioning, configuration, language runtime and/or OS, data storage/retrieval, network configuration, integration with local apps, metering/billing, etc). And we’re supposed to put together a nice bundle of standards that will guarantee drag-and-drop portability accross all these concerns? In how many lifetimes?

Cloud Computing, cloud interoperability, InterCloud Core Services, UbuntuCloud

The Cloud's Kicking Mike D's Butt

Mike DiPetrillo took the job of global cloud architect at VMware in January, and has been pretty light on the blogging since then. I follow him and a group of virtualization-cloud-network-datacenter folks on Twitter, so there's not been a total loss of visibility. Today he's given voice to what many others are feeling.

• Cloud is (and I apologize) a nebulous concept.
• Because there's "something for everyone", everyone wants it (or a piece of it).
• All the providers and pundits are "Cloud" and have been Cloud since before there WAS a cloud. (We just called it something else.)
• What's REALLY important about Cloud is "up ahead."    

So, of course, we are all ignorant about Cloud. But the nature of the phenomenon is such that, in order to unwrap the gifts of Cloud, one pretty much has to wade in and participate. The Cloud is not meant to be a spectator sport, but you are obligated to watch what everyone is doing.

Mike D's Blog - The Cloud is Kicking My Butt

All of this leads me to the conclusion. I need to blog more. I need to share all of the details on what’s going on not only at VMware but with customers and service providers and standards and everything in between. I have a new mission in life and that’s to provide an inside look at what’s going on with cloud from the perspective of an engineer that’s helping enterprises and service providers build clouds on a daily basis. I guess I just need to cut out some of the 4 hours of sleep I’ve been getting in order to do all of this.

There’s a fair warning to all of this. Cloud is in flux. Standards don’t really exist. Everyone is labeling everything from toaster ovens to BMWs as “cloud enabled”. The information I share can and will change. Some of it will become obsolete. Some of it may seem very scary like no one has their act together. That’s just the nature of cloud at the moment. Everyone in the industry is stumbling through this together. In the end it’s all going to be worth it. For now though sit back, keep reading the posts, and prepare to get your butt kicked by the cloud.

PCI DSS 1.2 and the On-going Conversation about Virtualization

While cruising through the feed-reader, I came upon Eric Sieberts recent post regarding the release of the Payment Card Industry’s Data Security Standard (PCI-DSS), version 1.2.  Eric notes that "... the specification dictates what must be done to secure a server that may store or process cardholder data, but if that server happened to be a virtual guest the host server would not be considered in the scope of the specification."  He then wonders (out loud) what could be the cause for this lack of attention (see quote below). 

This post reminded me of a conversation I had in August with Scott Loftesness of Glenbrook Partners, who arguably knows more about technology and the payment card industry than any five persons on the face of the planet.  He pointed me to this article as to why failure of PCI DSS 1.2 to address virtualization won't matter.  The author, David Taylor, is certainly no slacker.  He's the VP Data Security Strategies at Protegrity, as well as the founder of the PCI Knowledge Base, Research Director of the PCI Alliance, and a former E-Commerce & Security analyst with Gartner.  He takes a pragmatic approach, urging the reader to not wait for standards, and is pretty clear that he's a believer in the value of virtualization.  But there still seems to be some "buck passing."  He seems to be saying to the merchants who are subject to the PCI DSS standards:

• You need to prove to prove to an assessor that virtualization is secure enough to pass PCI audits.
• You need to cost-justify the amount of money required to do so.
• You need to push on your application software vendors to warrant the security and functionality of their products in virtualized environments ... something they, apparently, are often unwilling to do.

To the first point, it seems to me that best practices, standards and compliance tools or other means by which assessors can address the issue with uniformity are necessary.  There are a number of security specifications for virtual hosts (one of which Eric Siebert references in his post), which, if adopted, would be a reasonably objective basis for the standards and best practices.

With these standards in place, there seems little reason why the application vendors could not address the issues of security with respect to the use of virtualized infrastructure (the hosts and networks) as well as the virtualization of the applications themselves. 

This same tale is going to be told multiple times.  It's not just about PCI, but also will impact a standards and regulations like Sarbanes-Oxley, as well as (here it comes) the standards for data security and processing security in SaaS and IaaS environments ... Yes, I mean "cloud computing."  The PCI industry has a chance to do this right up front, without the buck passing.  I think I'm with Eric on this one.

Update:

Seems that while I was heads-down with Replicate's product launch, I missed Christofer Hoff's post on PCI, virtualization and clouds.  Once I get out from under, I'll get caught up and join the fray. 

Just to be clear -- I agree with most of the points that David Taylor has made, but to follow along with this reference to the OSI standards vs the TCP/IP development of standards ... what we're missing today is the moral equivalent of the TCP/IP definitions of best practice and standard.  If the PCI DSS folks won't step up to it, let's figure out who will.

PCI Data Security Standard updated, but still does not address virtualization — Server Virtualization Blog

I am puzzled as to why they would continue to ignore virtualization. After all, isn’t just about every company virtualizing in some fashion these days? Are the people that write the specification parameters just ignorant of what virtualization is, and that it has a direct impact on their regulations? Or are they just trusting that we are all securing our virtual hosts properly and there is no need to address them? If that’s the case then they have misplaced a critical amount of trust as I am sure there are a great many virtual environments that are not properly secured. Likewise, ignoring virtualization completely greatly reduces the effectiveness of their efforts to secure environments that deal with cardholder data. It’s essentially fortifying everything within a castle, but leaving the front gate open.

StorefrontBacktalk - Why PCI 1.2 Ignoring Virtualization Won't Matter

... The issue is more than just PCI compliance. It's about reliability, performance and data integrity. The point is that deciding whether to deploy virtualized servers broadly throughout the enterprise should not hinge on PCI compliance. Once the larger application and management issues are addressed to the satisfaction of the head of IT infrastructure, and the controls documentation is put in place, then PCI compliance becomes a minor issue by comparison.

Clouds and F/OSS

Stephen O'Grady, one of the indominable Redmonk analysts, has a great response to a recent interview of Richard Stallman as reported by the Guardian. 

Over the past few days, the noise generated by the interview, in which Stallman refers to cloud computing as "stupidity" and "marketing hype" has been reminiscent of religious arguments or ideological debates on free market economics in the US Congress. 

However, I'd really have to recommend O'Grady's thoughtful treatment of the issue, and his (deservedly respectful) response to David Berlind about Free Software / Open Source Software.  O'Grady correctly (IMHO) establishes the notion that F/OSS has a huge impact on SaaS, PaaS, and IaaS offerings.  In part, it's because the vendors of proprietary softare, platforms and infrastructure have been happily minting money based on a classic computing and product economy (vs. a service economy).  In part, it's because the F/OSS arguments really DO hold for technologies in which there exist reasonably well defined reference implementations ... operating systems, web servers, application platforms, data base management systems ... that lend themselves to standardized interfaces or by virtue of market dominance (like MSFT's Exchange) have become a de facto standard. 

I'd recommend watching the likely exchange between (and around) O'Grady and Berlind.   It's likely to be well worth the attention.

tecosystems » Is the Cloud Stupid?

All of which begs the question of whether or not cloud computing is a clear and present danger to either or both of the free software or open source movements. From his comments, it seems reasonable to deduce that Stallman does so regard it. As does one of the smarter journalists you’ll meet: one David Berlind.

Personally, I disagree. To quote Austin Milbarge, for once I am in complete agreement with my partner: far from marginalizing F/OSS, the cloud may well prove to be its most significant benefactor.

Consider, for a moment, that the F/OSS’s impact on the PC has been, desktop marketshare-wise, neglible. And that while successful in the server market, it is hardly dominant. Yet in the cloud, F/OSS is at present the rule, rather than the exception.

Amazon? Built on Xen, hosting only (to date) open source operating systems (Linux and, in alpha, OpenSolaris). Google App Engine? Only the folks in Moutain View what, precisely, it’s composed of, but there’s little question that the foundation is open source. The language (Python) and the primary framework (Django), meanwhile, are as well. And so on. Some of the success of F/OSS within the cloud is doubtless attributable to the specific players. By Ray Ozzie’s own admission, Amazon - a shop with deep experience in open source technologies - simply took the cloud market far more seriously than did Microsoft. If the roles were to be reversed, the makeup of the cloud might look radically different.

But the foundational role that F/OSS plays within the cloud ecosystem cannot be entirely attributed to the players. Licensing - or the lack thereof - played its part, as did the technology itself. For many would-be cloud providers, F/OSS is simply the best tool for the job.

Next Generation Infrastructure ... and its Management

Greg Ness is extending and enlarging his theme regarding the demands that next generation datacenters and cloud computing make on infrastructure... and particularly network infrastructure.  Notwithstanding the fact that he's now employed by a vendor of appliances and technologies that offers network services (like DNS, DHCP, IPAM, RADIUS, ...), the theme has merit -- it's not just a salespitch, folks.   So, while I might argue with his analysis of VMware's fortunes, the basic message ... new approaches to infrastructure for next generation IT ... is dead on, and with it the requisite new approaches to infrastructure management.

The Cloud will need Infrastructure 2.0 « ARCHIMEDIUS

... While many pundits have their heads in the clouds proclaiming the next big thing, there are a few issues that need to be resolved first. And those issues promise to fuel new demand for new types of networking solutions.

These new demands of scale and complexity and availability were beyond the wildest dreams of the creators of the core network services that support today’s increasingly strained network infrastructure. Many of these services, like DNS and DHCP are decades old. They were created in simpler days, usually in silos and with no concept of a need for interoperability between the protocols. Those days are now gone. DHCP servers, for example, now do dynamic DNS updates.