A great starting point for practicing agile ideology in startups is The Startup Holy Trinity:

• Agile development for high-velocity product execution
• Cloud deployment for managing operating costs
• Customer development for achieving product/market fit

Pick a methodology and, unless you are already an expert in it, follow it blindly for two iterations. Put incentives that support your team’s blind faith. Make it fun. Make it competitive. Make it understood exactly when blind faith will go away.

Unless you have a very good reason or two why your product can’t be running on infrastructure-as-a-service (IaaS) or, even better, a platform-as-a-service (PaaS) provider, try the cloud. Take the top two reasons why you think you can’t deploy to the cloud and question the assumptions they are based on. Early stage startups don’t have Innovator’s Dilemma but their founders do. Don’t be like those to looked at Windows 3.0 in 1990 and thought they needed their Unix workstations or like the those who laughed at the Web’s clunkiness in 1994.

Customer development is the tricky one. The methodology is iterative and self-regulating but the iteration lengths can vary. It’s easy to know when to initiate blind faith but not so easy to know when to stop. It’s an issue a number of us are starting to think about and one we’ll cover at Customer Development: The Second Decade.

Where I will deviate from the traditional lean startup thinking is on the topic of bootstrapping. I simply do not see the type of fundamental, long-term transformational benefits coming from bootstrapping that I see from agile development, cloud deployment and customer development. Don’t get me wrong, I like bootstrapping, have used it and have recommended it to others in the right circumstances. But bootstrapping has an opportunity cost and there are common anti-patterns that lead startups to under-perform in bootstrap mode.

For example, we now think about our pictures as stored on a PC or Mac, uploaded through a USB cable and protected by an online service such as Carbonite or Dropbox. We select which pictures to put in Facebook, Flickr or Picasa Web Albums. In a couple of years we’ll think about the pictures as stored primarily online, directly uploaded there by our WiFi or UWB-enabled camera and protected by a service such as Backupify (yes, we’ll still need backups).

Our computers’ will still have our documents and pictures and music downloads but these won’t be the “master” copies but serve merely as performance optimization and offline access caches for the data, in the same way you can read your email on a plane with no WiFi access using Google Gears for Gmail and Cached Exchange mode for Microsoft Outlook. Amazon’s Kindle is another good example. I read my Kindle books on my laptop, iPad, iPhone, Blackberry and, oh yeah, Kindle. All my content is there, locally cached for fast access without requiring connectivity with the latest read position automatically synchronized without me having to even think about it.

Side note: A few weeks ago Google deprecated Gears with an eye towards HTML5 offering more standard approaches for building these types of application experiences. I would expect significant extensions–going well beyond HTML5–to show up in ChromeOS.

The change will profoundly impact both the hardware and SW industry. On the hardware side, it benefits netbooks and tablet devices as well as smartphones. On the software side, it benefits third-generation SaaS players who are targeting this deployment model as they will have a noticeable performance and user experience advantage over current-generation Web apps.

I’m even more excited about fourth-generation SaaS apps whose user experience will automatically scale up and down with the capabilities of the client-side hardware and bandwidth constraints, similar to the way some gaming engines & services work today.

The shift of master data from PCs and local networks to the cloud creates significant opportunities. Get in touch if you are working in this area–I’d love to hear from you.

This experience got me thinking about the evolution of application development and that led to a guest post on Om Malik’s GigaOm on the migration of cloud computing from infrastructure-as-a-service (IaaS) to platform-as-a-service (PaaS).

Most assume that server virtualization as we know it today is a fundamental enabler of the cloud, but it is only a crutch we need until cloud-based application platforms mature to the point where applications are built and deployed without any reference to current notions of servers and operating systems.

As I mention in the post, I’m quite impressed with VMWare’s willingness to push forward in this direction. Listening to Paul Maritz, CEO of VMWare, speak at Structure, it’s clear he’s aiming very far and has the leadership potential to get there. More than a decade ago, I used to listen very carefully to what he said because he owned several large groups inside Microsoft, some of which loved my first startup (Allaire) because we pulled through many thousands of Windows & SQL servers and some of which hated us because we had the best Web development environment on Windows. He’s back on the list of execs I’ll follow carefully.

This is a big opportunity for Amazon to go up the stack at the right time. It’s good from an economics standpoint as it can increase margins in two ways: (a) improves efficiency and (b) switches pricing to more value-based application-related metrics. AWS has gone up the stack into data storage,  management and analytics. I doubt they’d miss the opportunity to become a meaningful PaaS provider at the right time. Breadth of platform support and platform expertise will be interesting challenges to resolve.

The other interesting trend to watch for here is that a reduction in the capabilities of the server virtualization tier increases the value of intelligent networks, one reason why Cisco smartly grabbed @lewtucker as CTO of their emerging cloud group and has security gurus like @Beaker on board.

The comments have raised several questions:

• Is security harder with PaaS? In the short run, yes, but only because we have less experience with shared hosting on locked down PaaS platforms. Google App Engine, Heroku and others are leading the way here. Werner Vogels said that he trusts hypervisors to provide isolation. It will take a while for big cloud providers such as AWS to equally trust PaaS implementations. In fact, it’s likely they’ll build their own as Google has. Cisco badly wants to help, too.
• How does IT rebill in enterprises? Having a simpler hypervisor or no hypervisor at all doesn’t mean you can’t collect HW usage metrics and decide how to apportion them to simultaneous users of the hardware. Even better, you can measure and rebill based on other, more business-value-oriented metrics which could give the IT organization some budgetary slack. It would certainly give them more deployment flexibility both inside and outside of their data centers.

Soon we will be able to throw away the server virtualization crutch and, like in that memorable moment from Forrest Gump, we will be able to run leaner and more scalable applications in the cloud on next-generation platforms-as-a-service. For the time being, my call to action is for application developers to stop writing code that directly touches any hardware or operating system objects and try the current generation of platforms-as-a-service.

Developers out there building applications, give me a shout about when was the last time you programmed against a file.

Let me know what you think in the comments or on Twitter @simeons.

I will be leading an unPanel (like unConference but smaller) at Xconomy’s Cloud³ Forum. Great lineup of speakers and the audience will be full of pundits (trust me, see the invite list) so the conversation is guaranteed to be both interesting and educational. This isn’t yet another “intro to cloud” or “cloud 101″. Expect a much deeper and more engaging and interactive forum. CloudCamp comes right after. Register here.

• John Considine, CTO, CloudSwitch
  Cloudswitch is about helping enterprises get into cloud computing on their own terms. This is a hot area of innovation. Even Amazon got in the game with their Virtual Private Clouds (VPCs).
• David Skok, General Partner, Matrix Partners
  David invested in CloudSwitch and has spent a lot of time looking at various investment opportunities in cloud computing and related spaces, trying to separate hype from reality.
• Omer Trajman, Senior Director for Cloud and Virtualization, Vertica Systems
  I’ve known Omer for many years. He is a sharp technologist, always aiming to tackle the next big problem. He is also not at a cloud computing company per se and will bring the valuable perspective of a vendor looking to the cloud for their own benefit and for the benefit of its customers.
• Michael Werner, Senior Platform Strategy Advisor for Microsoft’s developer and cloud-services technologies, Microsoft
  Mike wins the award for the longest title of any panelist I’ve had the pleasure of working with over the years. Beyond that, he’s someone who’s deeply versed in technology distribution and adoption by developers and companies and will have an interesting perspective on when and how cloud computing will become broadly deployed.

I hope to see you there. Bring your enthusiasm, skepticism, ideas and questions.

Tollbit is a cloud virtualization company with the lofty goal to do for cloud computing what virtualization did for data centers. Wish us luck and stay tuned by following @Tollbit.

I spoke on a panel with Google, IBM, Microsoft and Sun. Their offering are somewhere between vaporware and beta.

• Google recently launched App Engine
• IBM has a big vision and is mastering resources internally
• Microsoft is trying to equate enterprise application hosting and SaaS as cloud services
• Sun recently did a beta release of Project Caroline.

Absent from the discussion due to schedules was Amazon, so I had to be the one to talk about Amazon Web Services. For the record, I like what AWS is doing for the simple reasons that (a) they shipped early and (b) they took a very open approach to the core of cloud computing (EC2 and S3).

The audience focused Q&A on a couple of interesting areas: SLAs/reliability, where is became clear that one-size cloud computing would not fit all, and security/privacy, which is indeed a very interesting topic, especially when one considers, for example, what governments can force your cloud services provider to do with your data.

There are three complementary approaches to both topics or, for that matter, any facet of value-add on top of the core infrastructure-as-a-service cloud computing layer:

• You can architect a solution that achieves your objectives based on core cloud services. For example, since many startups don’t trust Amazon S3 and EC2 not to fail they have made alternative provisions. In another example, one can introduce application-level encryption such that Amazon or Google only keep encrypted data and don’t have access to the keys.
• You can rely on enhanced cloud services, e.g., data encryption add-ins or spreading servers across different zones with an automatic failover layer maintained by the cloud service provider (CSP), etc. This carries potential lock-in implications in exchange for having to solve less of the problem yourself.
• Rather than solving the problem through technology, you can solve it through processes and contracts. For example, failure to meet SLAs can carry financial penalties.  

My point is that the cost to vendors for upgrading products has gone down substantially. First, there were the truck rolls. Then it was about provisioning and shipping the right type of media to the right customer. Then it was about posting a nicely packaged updater online. And, if you are hosting, you don’t even have to package an update–just get it to your servers anyway you can.

As upgrade costs to vendors have gone down, it has become easier to push more and more smaller upgrades. There are other factors driving this trend also, including the spread of security vulnerability exploitation tools. The net effect on customers is not necessarily positive. Just find a CIO and ask him/her about the cost of planned and unplanned outages due to upgrades. For example, several of the Blackberry outages have been pinned on upgrades.

The worst type of upgrade in the shrinkwrap world was a “forced upgrade,” an upgrade that you had to install in order to maintain support coverage or deploy any additional upgrades. As I have been thinking more about building startups that leverage online platforms and cloud computing, I’m starting to realize that almost every SaaS and PaaS upgrade is a forced upgrade.

When Facebook changed the way in which so-called “forced friend invites” were handled last February, hundreds of Facebook application vendors using the F8 platform were affected overnight. They had no control over Facebook’s choice — it was a “forced upgrade.” The only options developers had were to roll with it or get off the platform. This is much different from building applications on top of infrastructure deployed on premises (for example, if you don’t like Vista, don’t upgrade).