devopsy.kinsta.cloud

Author: Keith Pleas

  • Cloud or In-house with Chris Kinsman, Part 2

    Cloud or In-house with Chris Kinsman, Part 2

    I sat down last week with Chris Kinsman, Chief Architect at PushSpring and a 20+ year veteran of software development, to talk about the factors that go into deciding when to migrate to the cloud. In Part 2 of our conversation we talked about the resistance and arguments against moving to the cloud. Once again I’ll let Chris do most of the talking:

    “What I struggle with is those companies who are trying to decide whether they go to the cloud or not even attempt it. For someone starting out, I don’t think there’s any choice – unless there is one specific requirement that pushes you out of the cloud. Or, and this is a little different, they may be evaluating a new project in an existing company. If you’re an existing company that has in-house already – whether it’s co-location or your own data center and you’re already invested in servers and storage – then the default always seems to be continue as is.”

    Well, if the business has existing business with the in-house model, to the extent that they’re successful with that model they may be hesitant to impact that revenue stream.

    “Maybe or maybe not – it could be that you’re just selling a service and they don’t really care whether it’s your hardware or someone else’s. As an example, if you’re paying for a $50/month MailChimp subscription do you really care whose equipment it runs on? Because you’ve already bought into that whole idea of paying for a service and not really caring about what’s behind it. So if I already have in-house infrastructure, at what point do I transition to the cloud, and that might be a more gradual decision.

    One common justification for remaining in-house is avoiding any forced migration. While it’s true that the cloud can – and will! – upgrade your infrastructure, you can also use the cloud to run whatever you want to run.

    “As a consumer of a service bus, I don’t care if they’re running it on 2008 or 2012. As long as it provides the same service, I don’t care what they run under the covers and that’s the beauty of it. Because if I care, that means I have guys in my org who are worried about that that I’m paying to worry about that, and how to keep up with that schedule, and everything else.

    So let’s go back to machine instances. That’s where it’s now on me to maintain, care about migration. And that’s also a choice. There are services that allow me to run my service as service bus, i.e. if I’m running Azure websites, I’ve got a way to get deployed – I need to make sure that my code runs – but I shouldn’t care what server OS they’re running. So these machine instances, that’s the difference between Platform as a Service (PaaS) and Infrastructure as a Service (IaaS), and Infrastructure as a Service. A lot of folks gravitate towards IaaS because they give up LESS control – they haven’t totally abdicated. But the problem I’ve found is that while that’s an easy baby step to lift and step your infrastructure from your internal data center into the cloud, that’s not really taking advantage of the Cloud. That’s continuing to do the thing you’ve always done, just with a machine that’s somewhere else. And I would also argue that that’s not the way you’re going to realize cost savings by moving to the cloud – because you’re continuing to do things the same way you did them before.”

    So, what are the cases you’ve seen where someone should not be using the cloud?

    “This is controversial, but I can think of a few. Where technology is not their primary business. Where they are potentially in a declining market. Where they’re not rolling out new software, they’re not trying to gain new users. They’re just rolling something along to the end of its product cycle. They don’t need scalability – they just want the absolute lowest cost. They don’t even really care about the experience of the users. Then, absolutely find the lowest cost place to host your server. But when I look at people who are making their money off of software, who are trying to grow their customer base and get more users, it’s almost never the right decision.

    And that’s not just me saying that. I saw a stat the other day that 10 years ago, for an Internet startup 80% of their Series A money went to infrastructure. Today, if you tried to pitch a VC that 70-80 of their money would go to infrastructure they would never fund you. They fully expect that 70-80% of their investment will go to salaries for the individuals who are building the product.”

    How about a more mature operation already hosted in the cloud? Is there a point where, for cost or other reasons, it might make sense to move to an in-house model?

    “Even those middle stage startups, I’d say help me understand your case. Maybe their case is they’re doing real-time something and they’re very sensitive to latencies. But I’d say that even guys who are doing VOIP are starting to do more virtualization – and VOIP is about as latency-sensitive as you can get when you’re actively listening for any pauses. So what are those cases? Perhaps there are some out there, but I haven’t encountered them.

    Take telemetry, if you’re a company going out with an Internet of Things story – you’re the next FitBit, or a wearable, or put data collection of your car in the cloud – all of those business models are built on the cloud.”

    Well, you used to work for casinos. They have massive data, real-time needs, and obviously super-tight security. What about them?

    “There I can see a lot of resistance to moving to the Cloud. Legally there are some issues. They are very controlled by the gaming authorities – so maybe there are some barriers they have to push through. But I look at some of the challenges they also have – one of the things I thought was very interesting when I worked for them 10-15 years ago was progressive slots, which were one of the “big things” at that time. Where a bunch of machines were aggregated against a single jackpot. And this required dedicated T1 and T3 lines back to the slot manufacturers so they could do this real time aggregation of data and real-time payouts. That would obviously be so much easier if you could do it in the cloud. So the questions would be could you get this past the gaming commissions and could you make it secure enough. Well…Amazon right now is building a Cloud facility for the CIA, if they can convince the CIA to use the Cloud…”

    But you’ve seen the movies and read the stories – they make you think that the CIA is run by clowns. Of course the conspiracy side of that is they want you to underestimate them, but still it makes you wonder.

    “I go back to argument I made earlier. I have a hard time believing that an environment set up in the cloud is any less secure than your data center that’s connected to the Internet. In fact, it’s probably more secure.

    I think the thing that security guys are concerned with is their whole strategy in the past has been how do I wall everything off? How do I provide defense in layers? At the point where more of your infrastructure is shared, it becomes harder to know where those walls are being crossed, which makes them more and more uncomfortable. But the challenge is, what if a competitor figures out how to do a secure solution in the cloud? There’s a real possibility that they traditional technology folks may not be in business down the road because the costs of operating in the Cloud will be so much lower. And that’s what’s going to end up happening – those guys who are staying in-house, staying with their co-lo, and some point in time there’s going to be some startup that says “we’re going to be disruptive, we’re going to blow up this entire industry, we’re going to look at it differently, our cost basis is going to be so mucfh lower for providing this service that will out-compete them. And over time, that incumbent goes away.

    We’ve seen that again and again, where it isn’t even a brand new business. Heck, Amazon – selling books is not a brand new business – it’s a really, really old business. But they came in and did some pretty interesting things driving their costs way. And figuring out all those things they could do to bring on additional ancillary revenue. What happened to all those big booksellers?

    Or shipping. Look at Fedex, the whole concept that someone could build an airport outside a city in the Midwest…and now the Post Office is almost out of the business of delivering packages.”

    So if you are not actively and continuously thinking about how to use the advantages the cloud can provide, then you are living on borrow time.

    “Exactly”

  • Cloud or In-house with Chris Kinsman, Part 1

    Cloud or In-house with Chris Kinsman, Part 1

    I sat down last week with Chris Kinsman, Chief Architect at PushSpring and a 20+ year veteran of software development, to talk about the factors that go into deciding when to migrate to the cloud. In Part 1 we’ll talk about what factors into the business and technical cases, and in Part 2 well look at additional arguments against moving to the cloud – and even at what point it makes sense to scale back from the cloud to “in-house” operation. I’ll let Chris do most of the talking here:

    “My first question is always ‘what is the business case for in-house?’. Some companies like to say we’re not going to the cloud for privacy, or security which is closely related. And there are different reasons given by both business and IT.”

    Traditionally one of the biggest arguments for keeping operations in-house is the high quality of existing staff and operations – tied to the “unique” requirements of whatever the particular business is doing.

    “I think that is a fallacy. Look at the teams that Microsoft or Amazon has in place supporting their data centers – that’s way beyond what anyone else has. So that’ not the real argument – it’s more that they don’t want to give up control. And management plays along with that – I can’t yell at Amazon when there’s an outage, but I can yell at my guys.

    But business guys are different. Yes, there are potential concerns about privacy, and outages, but their biggest concerns are around cost. And the problem there is people tend to compare hardware, depreciated, versus payments to Amazon. But if all you’re doing is putting your hardware compared to your monthly fee, then you really aren’t accounting for all costs. And even if you add in your co-lo costs, there’s a lot of additional monitoring, headcount, et cetera that need to be included to make it a true comparison – and a lot of companies don’t do that.

    Another thing that companies do is assume a 3 to 5 year capitalization of the hardware. They then say the same machine from Amazon costs this amount. But Amazon keeps upgrading their machines and charging less. So a year in, you can get a better price than you did at year 1 and there’s no opportunity cost to switch it because there’s no sunk cost. So you could have relatively equal computer power on day 0, but get 10% more power after one year OR keep that power and pay less. So you have to look at historical pricing over the past few years. Azure and AWS have seen continued downward pressure.”

    Other than historical data for Amazon spot instances, it is surprisingly hard to get reliable and continuously updated figures on historical cloud computing costs – and even more difficult to predict how those costs might decline in the future. Compared to hardware prices that have historically followed Moore’s Law and declined 20 to 30 percent per year where data density doubles approximately every 18 months (and thus cost declines proportionately), cloud computing costs have generally fallen 6 to 8 percent per year.  Google made a strong statement about being more aggressive with price cuts with their 2014 announcements, but the industry has not fall in with Google’s “ongoing commitment to bringing Moore’s Law to the cloud”

    “The other thing that isn’t well evaluated is when trying to make an apples to apples comparison is that they think Azure virtual machines versus AWS EC2 – but they don’t adequately consider the other parts of the ecosystem that those guys bring to the story.

    For example, Azure storage and Amazon S3 are both block storage in the cloud that you don’t have to worry about provisioning as you grow. With bandwidth you don’t have to worry about provisioning as you grow. And that are fronted by a CDN that makes it super trivial to put it as close as possible to your users. You can do that in-house, but it’s something you have to build – or buy – and figure out how to scale it.

    And that’s just one example. Let’s take that out to more complicated application-level logic comparing Azure Service Bus or AWS Simple Queue Service (SQS). So now we’re talking about building a message bus – which is something that is non-trivial to set up and manage and you don’t want someone who doesn’t know what he’s doing to do it. Dirt cheap, but…”

    Well, this goes back to the scalability of – in this case – talent. It’s impossible for one individual to be a storage, cloud, and security expert. And it’s difficult to determine if you’re doing a thorough job in a particular area of expertise without first acquiring that expertise.

    And there are a lot of things you don’t want someone who’s not an expert doing, and building a message bus has to be pretty high on that list! SQS gives you the first 1 million requests (and a message can contain up to 10 message!) for free, which sounds like a lot of value until you know that at $.50 per million requests that’s just $1.

    “So a lot of guys just think about building what they have now and in my mind, that’s not taking advantage of the cloud. There are some guys who have to do that – they have “in-house” versions of their software as well as their cloud versions – they have a hard time deciding if they want to be a SaaS provider or sell on-premise software – so that’s a hard decision point for them, they can’t go all-in on cloud services which means that they’re not going to be as competitive against a pure-SaaS vendor. And that’s where the comparison becomes even more difficult. I don’t see them calculating what the costs are for building and maintaining these kinds of services.”

    And those higher-level services are built on other services – nobody is building anything from scratch. And every one of those services is going to have potential issues with migration and so on. So if you’re a messaging guy and you understand building and optimizing pipelines, then go for it. But most organizations are going to stumble on this.

    “SwiftType announced they were going to physical hardware. They were moving off of AWS EC2 and onto SoftLayer – which is excellent, I’ve used it previously – but SoftLayer was bought by IBM and their whole claim to fame is that they’re a “Cloud Provider” although they do not provide near the number of high order services of Amazon or Azure. They’re mainly a competitor to someone like RackSpace. But they’re physical hardware. You don’t own the hardware, it’s in a data center somewhere, and the attraction to that is that many folks are worried about the ‘noisy neighbor problem’.”

    Meaning you’ve got some guy using up a ton of bandwidth using up some part of the shared resources.  But there are many places where a bottleneck can occur.

    “Right, and there’s other ways to deal with it. You should be building redundancy anyway, so make sure you have good diversification there and it’s unlikely that you’re going to have the ‘noisy neighbor problem’. But then they’d argue back that’s going to cost more because you’re going to have to build out more redundancy and more infrastructure. And I would argue back that means that you’re way more resilient. For example, what if one of the data centers goes down.

    You have the sense of control, and to a certain point you do, but you’re not being realistic about your level of expertise or all of your investment.

    Take security as an example – do you have a guy you hired, who says he’s a security guy, or do you have a team of 50 guys like Steve Riley who’re thinking about security all the time. AWS and Microsoft have 50 guys – maybe more than that – and unless you’re huge, you simply won’t have that capability.”

    And in terms of resilience, if a security guy leaves one of the Cloud Providers they can handle that – if that’s your entire security department that just left you have a significant challenge. It all goes back to who do you trust. Do you trust your employee? High-power consultant? Or do you trust the providers to have the right people?

    “As with nuclear weapons, ‘Trust but verify’”

    About the Author/ Keith Pleas

    keithp-125x150Keith Pleas is the Organizer and Conference Chair for the annual ALM Forum, a software architect and one of the founders of Guided Design and has worked with the patterns & practices team for several years where he was the architect and subject matter expert for “Design for Operations”. Prior to that he worked for more than two years on the team developing the .NET Framework and Visual Studio .NET. Keith is an internationally known writer and speaker and past Editorial Chair for the VSLive conferences. He was also a founding Contributing Editor to “Visual Studio Magazine”, and a Contributing Editor to numerous other publications including “Windows NT Magazine”. Keith has developed several Microsoft Professional Certification Exams. Keith was a founding board member of INETA where he also created the INETA Speakers Bureau. You can reach Keith on Linked In.