Slashdot Mirror
Applications Service Providers May Change Your Life
HWeissfield continues "I saw this as an unsurprising evolution of the way that the Internet is influencing our society today, but I question whether we can really leave critical applications and reports to someone other than ourselves. It may be common to use the terminal paradigm on mainframes where computing power is grandeur and reliable connections can be made, but what about the chaotic and unpredictable mass that is the Internet? Where could Linux fit into this structure that may be prevalent in the future?"
For one thing, it may mean "instant" commercial accounting and tax software for Linux, BSD, BeOS etc. without begging companies that publish such things for ports to your favorite OS. For example, Intuit, publisher of Quicken, Quickbooks, and TurboTax, is reportedly ready to roll out cross-platform, Web-based apps big-time. If they do this - and if their competitors follow them - it'll save a lot of small businesses, from the need to maintain a Windows or Mac box in a corner to run financial software after they've switched to Linux, *BSD or BeOS as their primary OS.
This is a "must read it all the way through" article. It's deep and thoughtful and (as HWeissfield points out) it raises many questions. Care to take a crack at answering some of them?
What a great article! It changed my life! It's a must-read!
Erm, where is it?
Dewey, what part of this looks like authorities should be involved?
From the source: http://www.zdnet.com/pcmag/stories/reviews/0,6755, 2348942,00.html
... with eskimo chains i tatto my brain all the way...
http://www.zdnet. com/pcmag/stories/reviews/0,6755,2344646,00.html
One problem, though - web-based applications are constrained by the limits of HTML as a presentation language. (Now, if web browsers also supported TeX, they'd be awesome! :) The fact is, whilst the web's presentation is inferior to that obtainable by a specialised, locally-running application, the local application will always be the program of choice for the majority of users.
Then, there's the degree of control you have. This affects "geeks" (read: computer hackers) more than "real users". Where's the benefit in supercooling, overclocking your 1GHz Alpha, running Journalled Reiserfs on your home-built RAID array, expanding up to 256 megs high-speed RAM, and running the very latest Enlightenment & Gnome on X11R6.4, if none of this gives you ANY benefit whatsoever? If the application is over the web, your computer is nothing more than a dumb terminal, no matter what you've done.
Lastly, there's a security issue, here. No ISP, AFAIK, is using IPSec, or ESN. No IPSec means no real security in any of your applications, or your data. No reliable authentication. Minimal encryption, if any. No ESN means that unstable applications or web-browsers can cause DoS. Automatic throttling of rogue processes is essential for something like this.
P.S. To those complaining about the lack of a link: If you're looking for a ZDNet article, you might find it best to start at ZDNet's web site, and use their search facility. It's not painful, I promise. And it means the rest of us can get on with discussing more important stuff.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
I am completely opposed to this approach for a variety of reasons. First off, cpu power is cheap. Period. Secondly, by centralizing such mundane tasks as word processing and office products (as Sun plans to do), the chances of needing to do a simple task and having it unavailable increases exponentially. Even the best ISPs have some downtime on services. Why should I use a centralized (or heaven forbid, web) interface if I just want to type up a report when I can get it done easily and safely on my own? This is a grotesque idea, and one for which there is no need for. Just because something can be done, does it really mean it should?
Interested in open source engine management for your Subaru?
ASPs are a good idea, but they won't kill off local applications completely. There are a number of reasons why:
The article claims that Microsoft is developing a version of Office that would work over the web. Suuuure. Microsoft always claims to have a version of its products in the pipeline that works with whatever the buzzword of the moment is (remember Windows for Pen Computing?). They do this to look like they're on top of developments in the industry and to scare off potential challengers, not to develop killer apps for new technologies. Besides, if all applications were Web-based, Microsoft's desktop monopoly would be meaningless, and we all know how seriously they take THAT.
So, maybe in a few years, when bandwidth improves and security improves and some other things improve, ASPs will be universal. But for now they're better for niche applications than they are for general use -- they're just not ready for prime time yet.
-- Jason A. Lefkowitz
Read my blog.
There are a few issues I'd demand to see addressed before I'd willingly switch to a remote application server:
Local: Oh, damn, I deleted September?!? Hey, Matt, could you pop the September end-of-month DAT in?
Remote: [hold music while my credit card charge for "advanced services" clears]
Maybe I'm wrong; I certainly hope so. But part of my paycheck derives from a healthy sense of paranoia. I just couldn't, in good faith, encourage my employer to jump on this particular bandwagon.
Dewey, what part of this looks like authorities should be involved?
It is worth noting that there are very different markets for software. For example, I expect server-based applications to be quite successful within the intranets of large and medium-sized corporations. There is plenty of bandwidth and control, no problems with trust and security (at least, no more than they already have), tech support becomes noticeably easier, and collaborative work could become easier. Not to forget about the eagerness with which the IT departments will jump on the opportunity to wrest control back from those pesky and unruly users.
However for outsourcing applications the case is completely different. I doubt we'll see many individuals or companies relying on their applications for external entities. There might be exceptions (e.g. for stuff like payroll and accounting), but basic stuff like word processing and spreadsheets will remain local for a loooong time.
To summarize, if you work for a big corporation, prepare to see your PC morph into a semi-dumb terminal. If not, don't worry, be happy.
Kaa
Kaa
Kaa's Law: In any sufficiently large group of people most are idiots.
All those apps will probably end up being IE-Only, using some proprietary Microsoft crap.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Microsoft (and others) have been trying to figure out a way to improve the revenue stream.
:-) ) You can see why, to developers, Microsoft is the company they love to hate. Note too, how among the Macintosh faithful, how the Mac OS allowed older code to run un-modified worked to the Mac's advantage.
The way the shrink-wrapped world most of us life in goes like this:
The package is sold (cash for producer)
You use the package.
Barring some lame file format changes, or an OS change, if the software worked for you in 1980, and your needs haven't changed, why would you help the software developers bottom line by buying a new version? (And it is possible to run that 3.3 copy of CP/M WordStar
The model of a limited time license you need to re-up doesn't work well on the shrink-wrapped PC platform. (Although Microsoft has that as a 2 year site license for businesses using Office 97/98)
The model of charging a yearly maintenance fee is tried by many shrink-wrapped vendors. But, this is used more as a warranty program. In exchange for money, (and evening out our cash flow) we will send you the new software when we make it.
If you try to follow the model of buying the features you need, then the maintenance model doesn't work. And how does the vendor get more money out the users.
Ok, how about the model of a yearly licensing fee? This has not worked, other companies rush in and take your customers, by pointing out how they have a lower cost of ownership. (assuming an infinite ownership time)
Now, what if you charged a company or person every time they used a service (Really, the software)? This model is:
Recession resistant. (if the business cycle takes a downturn, you can't sit out an upgrade cycle, now can you?)
Evens out the cash flow
Simpler to control the licenses and therefore the revenue stream. (harder to pirate)
Remember the stink about how Microsoft was going to rent software? And no one really wanted it? The ASP is just another form of rental.
And a way to provide steady and increased cash flow.
If it was said on slashdot, it MUST be true!
You seem to be under the impression that these ASP are subject to the kind of strict regulations that apply to banks and other financial institutions. I didn't see any evidence to support that belief.
Banks are generally not "fly-by-night" operations because there are fairly severe penalties for people who run their financial business in a casual anything goes manner. Since ASPs are so new, I doubt that there are any regulations. The individual ASPs will probably be making up their policies as they go along and doing whatever they can get away with.
Remember all the talk about how, if Linux loses the battle over browser compatibility, it loses the war for the desktop?
This, my friends, is a large reason why.
Only two things have prevented ASPs from becoming an integral part of the standard computing experience:
A) Lack of widespread high speed networking.
B) Immature tools for representing quality interfaces over HTML/Java/etc.
The judicious use of the extensions offered in Internet Explorer 5 arguably makes somewhat irrelevant the former(there's still the problem in that it's not particularly efficient or stable to have application functionality dependant upon a network connection; but then again it's arguable a server is much more likely to Autorecover much more reliably than a desktop OS) and almost totally obviates the latter.
The only thing preventing more applications from being designed in this manner is the fact that IE5 is nowhere near ubiquitous. Don't laugh--critical applications are already being designed according to Microsoft's master plan: Dialpad.Com, the surprisingly effective free Voice-Over-IP-To-Any-Landline-Telephone, is written in Java with some kind of Windows specific extensions.
Why? Two reasons: One, Sun has utterly bungled Java beyond belief when it comes to deploying new libraries, and two, Dialpad figures (witheringly reasonably) that the majority of their users can successfully *use* Windows specific extensions.
Of course, the fact that Dialpad apparently works successfully on Netscape for Windows hints at broken not-quite-cross-platform code somewhere in the pipeline. (Probably some native methods being used.) Either that, or the system's intentionally limited. I doubt that though--Dialpad actually added detailed Linux Masq instructions to their site. (Joy!)
Dialpad, incidentally, is a fascinating case study in how an ASP can operate. They are actually entirely standards-compliant, using H.323 to move their voicestreams around. However, they implemented a system they call Split-323(patent patending, which is slightly silly since the core concept is found all over the place) where most of the heavy H.323 lifting is done on the server side, with only the voice codec'ing remaining for the client to execute. Quite nifty, and is likely the general paradigm we're likely to see for systems that traditionally required binary application deployment--a small application, usually net-deployed, that executes whatever specifically requires a presence on the individual host(in this case, digital audio in, out, and compression) with the rest being left on some server out on the global Internet.
I said this is what we're likely to see. I didn't say it's the greatest idea known to man.
On the one hand, ASP style deployments work beautifully for applications that are inherently communication oriented. Dialpad is about connecting to other phone lines. MindTerm, the mind-bogglingly(sorry) cool Java deployed and amazingly full featured and GPL'd SSH client, brings high end communicative security in package that requires no installation beyond accessing a web page.
But do we really want non-communication based applications to require a network connection?
Pundits like to go on and on about how broadband is going to be all over the place in a few years. Bruce Schnier, author of Applied Cryptography and creator of the excellent Blowfish encryption algorithm, observed that while high end processing power will increase on and on ad infinitum, the low end never goes away--it just gets smaller, deployed for never-before imagined applications, etc. Smoothly scaling performance from the high end to the extremely low end is, therefore, a value. I posit that bandwidth is much the same way--maximum speeds will get higher and higher(indeed, in the course of the last 5 years I've gone from a 2400bit link to a 1,500,000bit link!), but there's always going to be something puttering along damn slowly and not entirely reliably. Look at the proliferation of wireless technologies proudly proclaiming speeds that are laughable in wired realm but are actually pretty cool once made wireless.
It's the wireless side, specifically laptops, that suffer the most from the ASP paradigm--wireless bandwidth is far more scarce, and many applications already deployed on them are intrinsically non-communication oriented. To force laptops to initiate connections whenever basic applications are to be used removes much of the freedom intrinsic in a battery powered, portable computing environment.
On the flip side, I'll be the first to admit that laptops have been made much less free by the degree to which communicative uses have taken over the actual applications people run. The concept that a laptop would become almost entirely useless, though, without Net.Mommy somehow being able to tunnel a link to it is rather bothersome nonetheless.
Security is a far more pressing concern. People fail to grasp the vast amount of security embedded in the simple fact that their files are located on their hard drives, in their homes, on a machine that is running no remote access services and is not permanently connected to the Internet. This security is eroded constantly by a disturbingly large number of intentional(in the RealNetworks fiasco) and unintentional(insert browser vulnerability here) ways, but literally moving the location of an application from onsite to a remote location introduces an incredible number of possible points of attack, from data corruption to privacy violation / industrial espionage.
A perfect example: GPS-Assisted Destination Routing. Take something like Mapquest.Com vs. a traditional CD-ROM based Street Atlas USA.
Mapquest requires no CD-ROM sale, would never have out of data information on the marketplace, could probably add a Dialpad-style applet to receive location data from a GPS receiver, and would probably require some form of wireless connectivity a la (the soon to be ridiculously oversubscribed) Ricochet service.
In comparison, Street Atlas USA does require a CD-ROM sale, would eventually suffer from stale data, would have GPS easily integratable with the core application, and would require no (expensive) wireless networking to function.
How easy it is to ignore that Mapquest would be receiving up-to-the-minute accurate positional and destination data for whoever's using their service. Combine the ridiculously pitiful privacy standards that Corporate America operates under with constant pressure from VC's to find sources of funding and the ease at which Net vendors can pass off security and privacy lapses as "accidental occurances which have already been fixed" and suddenly the ASP picture becomes much more dangerous for the end user.
The bottom line is, when it comes to security, trust, no matter how great, is no competition to a brick wall: Security Through Impossibility is simultaneously the simplest and most effective means by which sensitive data can be protected from malicious agents. ASP's demand much trust to be usable, and while benefits from ease of deployment and harms from reduced functionality and accessiblity are significant concerns for any business considering employing an ASP, one has to wonder at what times it is justified to remove the brick wall inherent in on-site deployed solutions.
Yours Truly,
Dan Kaminsky
DoxPara Research
http://www.doxpara.com
- Recurring income. This was pointed out by a previous poster, but I mention it again because it's relevant.
- Lock-in. This is where we need to get scared, kiddies. If you're using hosted, outsourced software, who really controls your data? Here's a hint: it's not you.
Once you've built up a backlog of data on your host, you're locked-in, forever. You'll never be able to migrate off their system, because THEY have all their data!I come from the mainframe world, where this type of lock-in is standard practice. Once you get your system into a customer, you start turning all of their OWN data into your proprietary format. In the mainframe world, this mostly happened by accident, because people HAD to just invent file formats left and right. In the outsourced ASP model, it will happen ON PURPOSE.
So, let's assume that you're using XYZ Accounting, an ASP package. Maybe you decide that you want to use QRS Accounting instead, and you notify XYZ that you want your data.
They say no. Or, if you were careful in writing your contract, they'll respond by charging you a fortune in "conversion services" -- which you agreed to when you signed the contract.
And I'm sure some of you are thinking "hey, that's my data, they can't do that!". Well, let's think about the credit card companies -- it's YOUR purchasing patterns that they monitor, and they get to sell them for a profit. If you want to see your "own" data, you have to jump through their hoops. If it hadn't been for an Act of Congress, you probably wouldn't be allowed to see that data AT ALL!.
In summary: if any of you are thinking about going down the ASP route, be sure that you have clauses in your contracts that give you final ownership of any data you generate. If you don't, you'll get screwed.
Take it from me; I've seen it happen by accident. Now it's going to happen on purpose . . .
The whole "paradigm" (yech, I hate that word) of network-distributed applications falls right in the laps of Free OS's like *BSD and Linux. Here, they can offer low-cost, high-availability servers running on commodity hardware. The platforms are exceptionally well-suited to becoming application servers in much the same way they've already proven themselves as http and ftp servers.
IMHO, this is such an easy win for these systems it's not even funny. It would be a shame if a myopic infatuation with Linux on the desktop led to this opportunity being lost. By the time Linux is accepted as a "desktop OS", distributed apps may make the desktop OS an outdated concept. Why not get an early start on tomorrow's goals right now?
Save the whales. Feed the hungry. Free the mallocs.
any idea why DialPad wants to have network access...
Well, I'd venture it has something to do with the fact that it lets you call up telephones via the Internet for free.
Yours Truly,
Dan Kaminsky
DoxPara Research
http://www.doxpara.com
One thing the author keeps jumping up and down about is how we "won't need an IT department" anymore after the move to ASPs.
Ummmm, who exactly is going to connect up all thse network workstations to the net in the first place? Who's going to run the LAN? Remember, now, folks, your average biz user has about as much interest in IP subnetting as the contents of Rob Malda's stomach. And rightfully so -- the whole point of IT folks like me is so they don't have to worry about 40 acronyms that end in "P".
It would be nice not to have to fight with Windows/Office/etc. all the time, but I really don't see IT departments going by the way side just because you're dependent on the outside network now.
dragonhawk@iname.microsoft.com
I do not like Microsoft. Remove them from my email address.
This ASP thing has been Ballmer's wet dream for a couple of years now. It's one of the reasons they invested so heavily in IE, and MAD (Microsoft Active Directory).
However, this is a thing that the software companies are pushing for, and the analysts that are in their pockets.
I suspect that most people will not buy into this idea. It's an issue of trust, and "having the biggest dick" (fastest desktop machine). While the ASP model may be adopted roundly as an internal corporate thing, the vast majority of users out there will not adopt this stuff if they have the choice. It is bad, economically for consumers. It's like the difference between owning and leasing a car. Or owning your home and renting it. The data security issues go on top of that.
Unfortunately, like I said, if there's a choice, consumers won't buy into this - however, the way the software industry looks today, there's not much choice out there. Software vendors only have to tweak their pricing structures to make "renting" more attractive (short term), and owning economically unfeasible (like, when was the last hobbyist you talked to who actually BOUGHT a copy of Photoshop? I know ONLY professionals who pay the exorbitant fees Adobe charges). So, MS Office = $30/month through ASP, or you can BUY a copy for $1500. Don't like it? So? - Intuit. Quicken via the web = $30 a month, except for April, where they'll charge $50 because of increased demand, CD, $1000 (or more likely, unavailable).
Ballmer would just love to become a software slumlord, rather than a salesman. It's all about steady revenue streams, and captive audiences.
I wish I had a nickel for every time someone said "Information wants to be free".
These are my friends, See how they glisten. See this one shine, how he smiles in the light.
Well if the suits end up tethering all of us to centralized servers using software we can't own, I'll be happy to put them out of business by offering consumers a package they can take home and actually own outright, even if my degree isn't CS, like they seem to banish you if you don't have.
At first blush I would tend to agree with you, but let's dream a little. IPv6 has the potential for revolutionizing autoconfiguration of devices on a network, as does Jini or whatever Sun's NC flavor of the month is. I can imagine a world in which computer networks are set up like telephone networks or electrical networks. A professional contractor comes out to install and maintain the major hardware, but the individual user can plug in an individual device that doesn't need any configuration to be useful.
But never fear, pager jockeys aren't likely to be out of work anytime soon.
--
"L'IT c'est moi!"
Since ASP providers never distribute their program, it would seem to me that they could integrate GPL software into their offering without redistributing source. If ASP became ubiquitous (a big if), this could lead to interesting conflicts.
I'm not terribly concerned since it would simply make GPL software more BSDish, and BSD software seems to be doing just fine.
--
"L'IT c'est moi!"