Peter Christy

VMworld 2009

 As always, this is one of the high energy user group meetings, with 12,000 attendees this year, not quite matching last year's attendance, but not showing the drops of other big shows. There were lots of free goodies from the exhibitors and even some scantily dressed show babes. The underlying business proposition was less clear: a lot of the vendors seemed to be selling features that VMware was strongly hinting were coming in future releases (hope springs eternal). The non-aligned parties were a visible part of the event, not quite up to RSA standards but clearly heading that way. Microsoft was visibly absent. We're told that at the MS Partner Meeting earlier in the summer nasty things were said by Microsoft about partners playing with VMware and the potential consequences if you did, and this was the quid pro quo. VMware clearly isn't ignoring Microsoft anymore. A lot of the new management team has been hired out of the software industry and its top leadership combined has nearly 50 years of Microsoft experience — CEO Paul Moritz (14 years at Microsoft), COO Todd Nielsen (12 years at Microsoft) came from Borland most recently, as did CMO Rick Jackson; CDO Richard McAniff (directly from 21 years at Microsoft).

VMW VDI and Windows 7

In the earlier days, Diane Green predictably spoke contemptuously of Microsoft, sort of like Khrushchev at the UN pounding his shoe on the podium and yelling "we will bury you" (for those of you who are old enough to know what the UN is). The new, wiser VMware is a lot more aware of what's going on in the rest of the industry (good!) but still a little bit psychitzo when it comes to MS. VMW recognizes that Windows 7 may well unleash a major upgrade wave within enterprise customers (all those who never did Vista but are running out of headroom and support with XP) and that this upgrade wave is an ideal time to call the question on remote application delivery alternatives (smart marketing). But it seems that many at VMW still find it distasteful to even speak the word "Windows" without spitting so this strategic argument comes out wrapped in condescension and denigration. VMware needs to think a little more about why people would adopt Windows 7 now in the first place (‘because they are idiots' is probably the wrong answer) and more to the point carefully look at all the things in W/7 that make VDI less valuable (sorry VMW, Microsoft hasn't stood still). Part of the maturation process I guess.

VMware Acquiring SpringSource

Paul Maritz seemed a little discouraged that the analysts didn't want to ask questions about SpringSource, which is understandable since the acquisition clearly has strategic importance for VMware beyond the $420M they are paying (not chump change). The lack of questions isn't surprising if you ask how many of those analysts really know what a framework is (having managed Dev Tools for Apple, I do.) The underlying question is whether VMware can thrive building systems that manage virtual machines or whether they need to get much more involved in what happens within those VM's in order to solve the customers' important problems and profit by providing those solutions. I've never thought that VM's were the do-all, end-all, and apparently VMW has come to the same conclusion. A framework is an architecture for implementing applications and a lot of code ("subroutines" in the good old days) to support that architecture and make application programming easier by providing a higher level abstraction. Utility and Cloud computing have great benefits but come with their own challenges. For example, what kind of data storage systems work well across multiple data centers and improve application performance for remote users? Or how do you know enough about what an application is doing in order to better automate its operation (e.g., provide desired availability and scaling)? In both cases, VMware's ability to play in the game is considerably improved with access to a framework than if complex technology can be largely concealed under the framework abstraction and just come to play when needed behind the scenes without much involvement from the application programmer. Microsoft already has broadly used frameworks (Microsoft Foundation Classes and more recently the .NET Framework). It's really hard to create a framework from scratch — the value of a framework goes up quickly as more people use it so you need both the framework and the users. The Spring Framework was created as an alternative to complexity of what Sun had developed for Java application architecture, and caught on in no small part because it was open source and free. As a way of getting into the framework business (more specifically, getting in a position of influence with the developer community and being able to add mechanism behind the scenes) VMW didn't have many alternatives and SpringSource was by far the best, subject only to the high cost (spending $420M for SpringSource isn't "accretive" by any stretch of the imagination). As noted above, it isn't as if MS doesn't have frameworks or developers — they certainly do —  but it does redefine how VMW views the competition and competes. (VMware declined to comment on this story)

Virtualization and Security (Redoux)

Up until now, VMware treated security by saying as little as possible about it, knowing that arguing that virtualization didn't open up new security surface area just gave credibility to the thought that maybe it did (let sleeping dogs lie) which could only impede sales. Now that VMware is looking beyond the individual virtual machine, and thinking about the Cloud, they have started to talk (credibly) about how virtualization actually helps security. The issues are ultimately complicated (thank goodness there are bright analysts to think about them J ) but here's the basic story line. (1) If you want to talk seriously about the Cloud or even utility computing you need to talk about entire applications — virtual applications or Vapps — that include all the bits needed to get the job done, not about single virtual machines. (2) In order to deploy a Vapp to the Cloud (or even to a private utility or DR data center) you need to specify how it is to be protected. At first blush, a good answer is "just like you did before" except now the security can be largely provided by virtual appliances rather than the physical appliances used previously. (3)When specified on a Vapp by Vapp basis, and implemented by virtual appliances, the security can be as specific and customized as desired. For example, you can think about offering data leakage protection (DLP) tailored to the function and specifics of the application. You need to bind these security specifications in with the other application details so you know what else needs to be provisioned when the application is provisioned and you know where you can and cannot run the application (e.g., what other applications you can co-mingle with). Where it makes sense, part or all of the security can be specified parametrically (e.g., "PCI protection") so that as the regulations change, the specifics of the protection change automatically. VMW's observation is that binding security to the application and assuring it is provisioned as specified is a lot better than what we have now, where in most cases this is partially a manual process, and often requires coordination between multiple teams, all of which is complex, expensive, and prone to errors. The automation also makes it possible (and reasonable) to be much more specific about each application which is also good. Thus, virtualization makes security easier and better.