That said, it’s hard to ignore the breadth and depth of what’s on offer. Or think about how, regardless of any theoretical openness, using many of these APIs in your applications would tie you and your data inseparably to Google.

I predict than within 2-3 years many projects that depend on third party APIs will start including a data and API portability review just as they have security reviews today. This will come as a result of more and more data living behind SaaS apps and online services, making cloud integration as common as enterprise integration is today.

This experience got me thinking about the evolution of application development and that led to a guest post on Om Malik’s GigaOm on the migration of cloud computing from infrastructure-as-a-service (IaaS) to platform-as-a-service (PaaS).

Most assume that server virtualization as we know it today is a fundamental enabler of the cloud, but it is only a crutch we need until cloud-based application platforms mature to the point where applications are built and deployed without any reference to current notions of servers and operating systems.

As I mention in the post, I’m quite impressed with VMWare’s willingness to push forward in this direction. Listening to Paul Maritz, CEO of VMWare, speak at Structure, it’s clear he’s aiming very far and has the leadership potential to get there. More than a decade ago, I used to listen very carefully to what he said because he owned several large groups inside Microsoft, some of which loved my first startup (Allaire) because we pulled through many thousands of Windows & SQL servers and some of which hated us because we had the best Web development environment on Windows. He’s back on the list of execs I’ll follow carefully.

This is a big opportunity for Amazon to go up the stack at the right time. It’s good from an economics standpoint as it can increase margins in two ways: (a) improves efficiency and (b) switches pricing to more value-based application-related metrics. AWS has gone up the stack into data storage,  management and analytics. I doubt they’d miss the opportunity to become a meaningful PaaS provider at the right time. Breadth of platform support and platform expertise will be interesting challenges to resolve.

The other interesting trend to watch for here is that a reduction in the capabilities of the server virtualization tier increases the value of intelligent networks, one reason why Cisco smartly grabbed @lewtucker as CTO of their emerging cloud group and has security gurus like @Beaker on board.

The comments have raised several questions:

• Is security harder with PaaS? In the short run, yes, but only because we have less experience with shared hosting on locked down PaaS platforms. Google App Engine, Heroku and others are leading the way here. Werner Vogels said that he trusts hypervisors to provide isolation. It will take a while for big cloud providers such as AWS to equally trust PaaS implementations. In fact, it’s likely they’ll build their own as Google has. Cisco badly wants to help, too.
• How does IT rebill in enterprises? Having a simpler hypervisor or no hypervisor at all doesn’t mean you can’t collect HW usage metrics and decide how to apportion them to simultaneous users of the hardware. Even better, you can measure and rebill based on other, more business-value-oriented metrics which could give the IT organization some budgetary slack. It would certainly give them more deployment flexibility both inside and outside of their data centers.

Soon we will be able to throw away the server virtualization crutch and, like in that memorable moment from Forrest Gump, we will be able to run leaner and more scalable applications in the cloud on next-generation platforms-as-a-service. For the time being, my call to action is for application developers to stop writing code that directly touches any hardware or operating system objects and try the current generation of platforms-as-a-service.

Developers out there building applications, give me a shout about when was the last time you programmed against a file.

Let me know what you think in the comments or on Twitter @simeons.

My point is that the cost to vendors for upgrading products has gone down substantially. First, there were the truck rolls. Then it was about provisioning and shipping the right type of media to the right customer. Then it was about posting a nicely packaged updater online. And, if you are hosting, you don’t even have to package an update–just get it to your servers anyway you can.

As upgrade costs to vendors have gone down, it has become easier to push more and more smaller upgrades. There are other factors driving this trend also, including the spread of security vulnerability exploitation tools. The net effect on customers is not necessarily positive. Just find a CIO and ask him/her about the cost of planned and unplanned outages due to upgrades. For example, several of the Blackberry outages have been pinned on upgrades.

The worst type of upgrade in the shrinkwrap world was a “forced upgrade,” an upgrade that you had to install in order to maintain support coverage or deploy any additional upgrades. As I have been thinking more about building startups that leverage online platforms and cloud computing, I’m starting to realize that almost every SaaS and PaaS upgrade is a forced upgrade.

When Facebook changed the way in which so-called “forced friend invites” were handled last February, hundreds of Facebook application vendors using the F8 platform were affected overnight. They had no control over Facebook’s choice — it was a “forced upgrade.” The only options developers had were to roll with it or get off the platform. This is much different from building applications on top of infrastructure deployed on premises (for example, if you don’t like Vista, don’t upgrade).

What caused the problem however was a sudden unexpected surge in a particular type of usage (PUT’s and GET’s of private files which require cryptographic credentials, rather than GET’s of public files that require no credentials).  As I understand what Kathrin said, the surge was caused by at least one very large customer plus several other customers suddenly and unexpectedly increasing their usage. 

I would highly recommend for anyone who is building a developer community or providing SaaS infrastructure or relying on SaaS infrastructure to take the time and read the many posts on the AWS forums about the outage. You hear the real pain and frustration of people whose businesses depend on AWS. The key complaint was not that the service failed–failures do happen–but that Amazon was not prepared to engage with the developer community around the failure.

It’s AmazING the fact of having no info on what’s happening. Absolutely unacceptable. Come on, people on this forum are all tech guys, so we understand that bad things happen from time to time. However, you MUST be transparent with your customers and give them details on what’s going on (yes, we want to know exactly what’s happening and not a standard response like ‘The issue is resolved’). In fact, it is not. So please, scale these complaints to the right person and post the technical explanation of the issue as soon as possible.

Jesse Robbins over at O’Reilly has a good post comparing how Amazon dealt with the situation to how Salesforce responded to its infamous outage a couple of years ago. I’ve also blogged before about how SaaS brings increases responsiblities.All in all, Amazon worked very hard to get the issue resolved and the community was thankful for their efforts.

As I said before, you need to be transparent with your customers. No service can provide 100% uptime. It’s a fact. No matter if u have a redundant anycast network or supercalifragilisticexpialidocious elastic clouds. I just want to get notified and know what’s exactly happening. Nothing else. That said, the issue was resolved very fast, so you should be very proud. Hats off to Amazon’s IT staff.

With 60 employees to go with its $20 million, Veracode has “nice momentum going into 2008,” [CEO Matt] Moynahan says. “A company could hire a consultant to manually review their code, but we are a faster path to the same destination, especially if they have some application they don’t want to send off-site,” he says. The company even makes suggestions about how to fix code with proven vulnerabilities. Says Moynahan, “We’re trying to bring security to the masses.”

The finalists are:

• Brainscape
• Commerce360
• Justin.tv
• Milemeter
• Ooyala
• UserTesting.com
• WeoGeo

If you’ve any experience with the finalists, let me know. I’m one of the judges and Polaris is sponsoring the event. There is a cool dinner, which will bring together entrepreneurs and execs from the area. Unfortunately, it’s $100/seat. More importantly, Polaris is throwing together an after-dinner party. No, you won’t need to pay for that. If you can’t make dinner but want to come to the party, let me know.

Hope to see you in Seattle.

The typical sales pitch is a cost/benefit conversation that focuses on the benefit. Millions of sales people have been trained to talk benefits and make the customer realize the necessity of the costs. This is the only way to go when the product or service being sold has either a high up-front cost (money and/or time) or has non-trivial ongoing costs. Examples would be a car or a ERP deployment or a Salesforce.com subscription.

The biggest problem with this sales model is that it is slow. It requires research and, more often than not for more expensive products, lots of conversations. It is also susceptible to interference, particularly in the case where the discussion in category has already been framed by a competitor. Both of these are bad news for startups that need to suffer the core burn + grow a sales team to see whether the dogs will eat the dog food.

With the advent of ad-supported business models online and SaaS in the enterprise, a number of businesses have taken a different approach. Rather than asking a customer “how much are you willing to pay for these benefits?” the conversation has shifted to “if the cost is $0, how much benefit must we deliver for you to adopt?” Can we call this a cost-oriented selling approach? I guess so.

Flipping the value proposition from pay now, benefit later to don’t pay but still get some benefit is a no-brainer for consumer plays but it also can work miracles in the enterprise as demonstrated by the scalability of, say, LogMeIn‘s freemium model. (LMI, a Polaris portfolio company, offers consumers remote access to their PCs for free. They make money through upgrades for more functionality and enterprise deals.) It is a particularly good approach for entering areas with established competition where a benefit-oriented as opposed to a cost-oriented sales approach will bog down selling.

The challenge under this model is to find a monetization strategy. Online, for ad-supported businesses, the first step in the rule book is plugging in an ad network. The next step typically involves hiring an ad sales team–a difficult, expensive and slow undertaking, which is why many startups choose to sell to big players with good ad sales teams at this point. In the enterprise it typically has to do with value-added services such as manageability, SLAs; pulling through additional products; and building data businesses that leverage network effects in the deployment footprint (most commonly seen in security with anti-virus/spam/phishing).

There are an increasing number of new “social applications” as well as traditional application which either require the “social graph” or that could provide better value to users by utilizing information in the social graph. What I mean by “social graph” is a the global mapping of everybody and how they’re related, as Wikipedia describes and I talk about in more detail later. Unfortunately, there doesn’t exist a single social graph (or even multiple which interoperate) that’s comprehensive and decentralized. Rather, there exists hundreds of disperse social graphs, most of dubious quality and many of them walled gardens.

Currently if you’re a new site that needs the social graph (e.g. dopplr.com) to provide one fun & useful feature (e.g. where are your friends traveling and when?), then you face a much bigger problem then just implementing your main feature. You also have to have usernames, passwords (or hopefully you use OpenID instead), a way to invite friends, add/remove friends, and the list goes on. So generally you have to ask for email addresses too, requiring you to send out address verification emails, etc. Then lost username/password emails. etc, etc. If I had to declare the problem statement succinctly, it’d be: People are getting sick of registering and re-declaring their friends on every site., but also: Developing “Social Applications” is too much work.

The real question was when Google was going to move and how hard they were going to push. According to TechCrunch, who’s gotten some folks to ignore the NDAs they’ve signed with Google, the date is November 5 and the push will be significant under the perceived threat from the traction (imagined and real) that the Facebook platform is getting.

Note that this is a much bigger play than federating social networks. This is about federating the broad notion of social identities, including the rich meta-data, e.g., social relationships across many channels (FB, MySpace, email, IM, Twitter, etc.), that goes with them.

This reminds me of a conversation I had with a partner of mine years ago when we were looking at Friendster. We both realized that social networks were really applications built on top of a simple social software foundation with three key pieces:

• Identity
• Meta-data
• Policy

In general, this is a good thing for startups who don’t want to reinvent the wheel. It is another emerging platform and a big new piece in the social infrastructure puzzle. It is also a great Google response to Facebook’s secret plan (since Google doesn’t have a huge + successful social application to protect it can be more open + monetize in other ways). Last but not least, Google’s approach, on the surface, promises more freedom and independence for those building on top of Google as opposed to Facebook.

Still there are two big issues to think about:

• Building a business on top of somebody’s SaaS/Web services platform carries a lot more risk than building a business on top of a traditional installed product, e.g., Window or MS Office. What will be Google’s service agreement? What promises will they make to a budding ecosystem? Will they keep them?
• This type of massive federation project can only be pulled off by a major power and only one that is trusted by both consumers and other vendors. The privacy implications are significant. In a world where some people are questioning the reality of Google’s “do no harm” pledge, some resistance is inevitable. Beyond that, I wonder how easy it will be to come up with simple policy management of privacy & data sharing in this environment.

Facebook’s weakness in this case is its strength–the core Facebook social application is the main traffic generator for all applications built on the FB platform. Discovery and traffic generation are in many cases more important than purely technical leverage. It is not clear how Google will attempt to address this issue to drive adoption of its social platform APIs. I hope the answer goes well beyond SEO/SEM.

As an ex-platform guy who’s recently spent a lot of time thinking about social infrastructure, I’m was particularly interested in the opening panel on emerging online platforms, moderated by David who kept the conversation moving swiftly. The panelists were:

• Marc Benioff, CEO, Salesforce.com
• Marissa Mayer, VP Search & User Experience, Google
• Mark Zuckerberg, CEO, Facebook
• Philip Rosedale, CEO, Linden Labs (maker of Second Life)

The discussion centered on what it means to be a platform company on the Net and to get people to use your platform.

Philip and Mark acknowledged that they are in the very early phases of truly understanding what it means to be a platform yet there are some underlying principles for success.

Philip stressed that it is foolish not to allow your users to do what they want. Sometimes, that requires making some seemingly uncomfortable decisions. Traditionally, platform companies have tried to protect and leverage the core platform IP. However, if a platform enables network effects (which make it harder for users to leave), the platform owner can benefit by opening up and applying only a few key controls. Mark pointed out that there is a huge issue of trust between users, the platform provider and third party developers. That’s one key area of controls that the platform vendor should maintain control over for the benefit of all.

There are at least two other areas that IMO the platform provider should establish clear rules, if not controls, over.

The first one is around the question of who owns the data. Esther Dyson asked the panel a question along these lines and nobody provided a satisfactory answer. Mark’s response was “users have all the controls” but that doesn’t answer the ownership question. I’ve written about this before as one of the key issues underlining the emergence of social infrastructure.

There has been much debate recently on the topic of user data ownership. The information in question is the user-generated data and the attention data generated while using a site. There are three issues to consider. The first one is legal. Users implicitly assume that the profiles and the information they create on community and social networking sites is theirs. Most terms of service and privacy agreements are either mute on the topic or outright state that the operator can repurpose the data for their own use. Attention data is often not called out and its treatment therefore is unclear. The second issue is privacy. Facebook recently faced a huge backlash from their users when they made information about user activities on the site public. The specific outcry was less about the features Facebook had implemented and more about the fact that the information in question was gathered while the users thought it would be kept private. The company had to backpedal and put new privacy features in place.

The second one has to do with the notion of who is the law. Who provides the framework of what’s good vs. bad, what’s legal vs. not. Is there a notion of enforcement? By whom? If there are spillover effects into the real world (financial fraud, privacy violations, etc.) how is the real/virtual linkage managed. Release 2.0 had a good piece on this topic in its last issue.

Marc’s take is that the Net has become the OS and the killer apps (Second Life, Facebook, Salesforce.com, etc.) are becoming platforms. As an aside, none of these have any dependence on the “old” platform–the Microsoft OS. He further claimed that killer app companies that do not make the transition to platforms become irrelevant. His examples were Seibel vs. Salesforce.com, Oracle vs. Cullinet, etc.

One interesting question that comes out of this is whether one can build a successful platform company without ever building a killer app. Would Windows have been as successful without Office/Outlook? Unlikely. Could Facebook have launched as just a set of Web services? I bet not. I can’t think of many examples where a platform company has been successful over a long period of time without some ability to create user lock in + lead by the example of its killer apps. My personal experience at Allaire, which was a pure platform company, agrees with these observations.

In addition, everyone agreed that platforms only become successful if they give rise to successful ecosystems. One of the metrics Philip is watching is how many businesses in Second Life are cashflow positive. Facebook now has thousands of apps on its platform and some of them have millions of users. Marissa’s work at Google has enabled a huge monetization of content and traffic on the Net by many thousands of businesses. Beyond that, Google has been very successful with Maps, iGoogle and gadgets (10,000+ developers). I’ve written before about the Ecosystem Test that a platform must pass in order to be successful.

The ecosystem test asks whether a platform can enable a large group of average, poorly funded players with little to no domain experience deliver compelling solutions. It’s based on the observation that no platform has become hugely successful without a corresponding ecosystem of vendors building significant businesses on top of the platform. Typically, the combined revenues of the ecosystem are a multiple of the revenues of the platform.

The panel was followed by a short speech & interview with Catherine Cook, co-founder of myYearbook. She sees myYearbook, Facebook and others establishing the infrastructure for a new wave of media companies that will give old media a big challenge. One example she gave was myMag, a 100% UGC teen magazine they’ve launched. Teens contribute the content but professional editors package it.

Web-to-desktop convergence is a very interesting topic and one that is bound to change the way we think about software packaging and delivery, which has big implications for software-as-a-service. The driver for convergence is that consumers want the best of both desktop and web applications. I wrote about this last year.

The default distinction between “Web” and “desktop” apps is based on old assumptions. The former typically means something that runs in a browser and needs a server all the time. The latter typically means something that runs on the desktop and doesn’t use the Internet. These distinctions are now outdated. Most meaningful apps these days use the Internet. Yes, even MS Word does. So, the distinction really is about (a) implementation and (b) connectivity.

I built my first “Web 2.0 desktop convergent” web app in 1998. It used WDDX for passing data back and forth and storing it locally. The app only ran in IE because it relied on file system access COM objects for offline access.

The best approach for building rich, convergent Web applications that I know of is Adobe Apollo. There are many examples of convergent applications that leverage Apollo. I recently wrote about Web widgets coming to the desktop. It’s great that Google and Adobe are thinking about how Gears and Apollo can work together.

I’d be interested to learn more about Gears.