What the Heck is THE CLOUD?

There's an ad that's been running on TV lately - one from Microsoft (and you know they're my "favourite" company) wherein the answer to some question is "let's go to the cloud" or something similar. What is this thing "The Cloud" they're referring to?

It certainly bears no resemblance to what I know of as "Cloud Computing" so I thought you might be confused too. In fact to me, a person who has grown up in the thick of the technical and computing revolution for much of my life and all of the past 30+ years, what they're doing in the ad pretty much looks like just using the internet to get to their home computer - so is Microsoft re-branding the internet as "The Cloud?" Maybe.

On the other hand, maybe they're hinting at something more sinister.

First I'll give you some background on where this concept came from. Then I'll talk about what it means to you. Finally, I'll tell you about a new facility that will extend the concept to you and your home, and that shows potential to fix a number of problems with today's internet and cloud computing environment.

There are some definitions of cloud computing already on the internet but IMHO they are both too general and too limited, and in many ways too self-serving to really inform the average non-technical person.

To really understand what Cloud Computing is, one must understand the difference between a computing "client" and a computing "server," and how a server might be just one of many programs running on real computer hardware; as well as some privacy and information issues.

What is Cloud Computing?

Cloud Computing is both a computer technology and a user technology. I'll first talk about the computer technology and where it came from.

At its basest, Cloud Computing is using any available hardware to run a program such that the program neither cares nor in most cases knows, what hardware, where, or how big (or small) that hardware is. The program is simply one of many and the hardware can be a single computer in a single location, or many different and dissimilar computers spread across a country or around the world - and the change between running on a single hardware platform and running on any/all of many is not noticed by the program. It is "Virtual" computing at its basest form, and many cloud computing providers state right in their policies that they reserve the right to move your data and/or operating environment anywhere they like.

The program might be a simple one - and the reason it might spread to be run on many hardware computers might be simply that the computers were not otherwise busy doing something else that was more important.

The classic example is SETI@HOME - the program that at times has run pieces of itself on over 3 million different volunteers' home computers when those computers would otherwise have run a screen saver.

From this beginning, the concept of "distributed computing," where a program was parceled up into many pieces and those pieces pushed out to many computers and later re-aggregated into a final outcome, began to grow.

Today a program wishing to "use the cloud" simply is started running on a "virtual server" that to the program looks like it is real hardware.

Virtual Server Technology

I run a number of physical servers for various companies as well as for my own use. Over the years I've grown a set of software that I run as services to various people, including email services and web sites.

When my partner and I first started offering web sites at Wimsey.COM back in 1994, our typical computer server could just barely handle a single site that got a million simple page-views per month. We had two such systems, and they had the two most active web sites in Canada on them at the time.

Today I can't purchase a computer that slow or small. Your basic netbook computer or smart cell phone new costs about $200, has more CPU, RAM, storage and raw speed than those two computers had - and they were worth about $10,000 each at that time, and hand-built.

But today I still have need of running simple, segregated and secure systems. Should I purchase, power, administer and find space for a single computer for each of these systems? In the past that's exactly what I had to do. At one time not long ago I had a "farm" of 10 such systems housed in co-location services at a network server farm. They took up a full rack, 8 feet high, and the hosting cost me in excess of $2,000/month.

Today I have one computer that does all that the above 10 did and more. It uses less power, cost far less, and costs me a lot less per month to host.

The difference is that I run one of many different "virtual server" software setups. I happen to run VMWare, mostly because I was an early adopter of this technology and VMWare was pretty much the first of such software to work the way I wanted it to, but there are now several competitors.

Each virtual server instance, and I run 8 on my current hardware, can and does run a completely separate operating system as if it were on its own piece of hardware. I have a mix of current and old Linux and even a Windows server, all on a single piece of hardware.

Moving a Virtual Server - While It Runs

The leap from having such a "virtual" system running on a single hardware platform to having it run on one of many such platforms was the first step. This "virtual migration" ability allowed a service to be migrated while continuing to run - so it never had to be shut down to service the underlying hardware, or make the underlying hardware bigger/faster. Of course the concept of never rebooting might be a bit foreign to the average computer desktop user, but it is the nature of server computing and has been since the time of mainframe computers. Imagine if Visa or Mastercard had to reboot their server every day (or every time they updated the software) - and credit card processing stopped for that time. Companies have grown up just to provide this "non-stop" computing in the past.

So virtual server instances able to move from one hardware platform to another was the second step on the path to true cloud computing.

From Movable Virtual to True Cloud Computing

The technology to move a server instance from one hardware platform to another had to so completely emulate and abstract the underlying hardware that it was only a fairly minor step to completely divorcing the process from the hardware and allowing it to run not only on one (or microseconds later another) hardware server but to instead allow it to migrate across and in fact grow larger than the constraints of any single hardware unit. Truly virtual computing had been born.

Today, I can purchase the use of a tremendous amount of computing power by the hour for pennies or dollars. I can run pretty much any software I want on that computing power, and the size of the underlying processing, disk, memory, and data transmission facilities can change at my command, or on a schedule, or "on demand."

This means that, unlike back in 1994 when "hot site of the day" designation was all but a stroke of death to most web sites because their hardware was typically just not powerful enough to survive a sudden 1000% increase in traffic, I can create a web site for minimal cost and yet know that when it gets "hot site of the minute" and grows by a factor of a million or more, I didn't have to pre-purchase a rack full of equipment "just in case" - my site's computer facilities will grow as needed (and my bill will go up too - so the site had better make me money to pay that.)

I save up-front costs and pay only for usage on potentially huge facilities instead.

That's the technical side of cloud computing - it is really simply mainframe "time sharing" moved into the 21st Century. Back in my days at Dataline Systems in 1976 we had rooms full of DEC System 10 and 20 computers that hosted hundreds of people and programs each. We charged by the "kilo-core-second" for this use. The program's memory size times the number of seconds it was in the CPU's "core" memory and active.

Today's charges are typically based on how many CPU "cores" per hour with a surcharge for how much RAM and disk and network traffic is needed/used. Each "core" is roughly equivalent to one physical core on a typical multi-core processor; possibly exactly equivalent in some cases.

SAAS - Software As A Service - Lose the Operating System - Just Run the Program

A small, but growing, number of cloud service providers are going one step farther than just giving access to virtual hardware on which we techs can then configure and run our programs. They're providing pre-set server instances and facilities that will run specific types of active web sites as if the underlying computer system were completely unknown but which grow and shrink as necessary to ensure a level of response regardless of the number of viewers. My first experience with this was with live video hosting, where the number of viewers might grow from a handful to tens of thousands, then shrink back to the small handful again.

This resource-intensive hosting is now handled by a number of companies. What it really is is "Software As A Service" or SAAS as the industry likes to call it. The fact is, these companies simply pre-provision a number of otherwise normal cloud virtual computer systems for the specific service, and sell you or me access to this for something more than it costs them to purchase the raw computing power from the likes of Amazon's EC2.

Today, many industry observers lump the likes of Google, Facebook and Twitter into this "SAAS" paradigm. Knowing this might help you understand that you are using "cloud" computing facilities each time you interact with these huge sites, since their software does in fact run and migrate across huge numbers of physical servers that in many cases are geographically dispersed; their facilities cross provincial, state and national lines in many cases, and that's where at least one of the problems with "being in the cloud" lies.

What Cloud Computing Means to You

This "virtualization" of computing facilities, coupled with the fact that many of the companies that provide and use such facilities are now large enough that they span multiple physical and legal jurisdictions, changes the entire character of our interactions with each other via the internet and the facilities available through it. 

Most of the virtualization technologies have been developed to take advantage of the fact that once something is connected to the internet, where it physically is no longer is relevant, at least within the limitations imposed by the speed of light and the time it takes packets to flow from one part of our planet to another; times measured in fractions of a second and which for most of us are moot.

Most people simply don't know where their personal computer ends and the internet begins. When we at Wimsey first started offering internet services in the late 1980s and early 1990s, this was OK because all the facilities for any given company were either on a single computer at a single location, or spread across a small number of computers, one per service (web, email, ftp, etc.) and mostly in one place. There was potential to, and actuality of, finding specific laws that governed both ends of a typical network "conversation" between a user and the host provider of a web site or other network facility.

That specificity of legal jurisdiction no longer holds true for the most part today - and this is not a good thing for the individual (or company.)

Your Data In The Cloud

When you compose a memo or letter on your computer in your home (or office) with a word processor program running on it (like MS Word or Open Office Write) you are within the walls of a legally defined physical spot on Earth, defined within a specific legal framework, and in which you have specifically defined legal rights and obligations. IANAL - I am not a lawyer, but... in this case I don't need to get into any specifics to make the general case, and I refer you to a couple of talks by a real lawyer about this if you're interested in reading through them.

The general case (in the "free world" - I'll leave aside those dictatorial parts of the world where anything goes if there is a gun involved) of you sitting, working on your own computer in your own premises, is that if someone wants to learn what it is that you are doing in a legal sense, they must convince a judge that there are grounds to get a search warrant, which must be legally served and observed. Once you put the letter into an envelope and mail it via snail-mail to its intended recipient, similar legal paperwork needs to be done in order to have it opened along its way, and the recipient has similar rights of possession and jurisdiction once it is in their hands.

Now, lift that action of composing a letter and put it onto the likes of Google Docs. Similar facilities for editing but in this case your computer is simply a "window" (client) onto the processor (server) and storage of Google's computing facility and neither you, nor I, nor in fact in most cases even Google, is aware of where specifically that computing facility is, or where your document is stored. In fact, knowing a bit about how Google's underlying storage system works from their own description of it, the document might be stored in pieces in many different places and is most certainly stored in whole or parts in multiple places; and Google has computing facilities in multiple states and countries.

What legal jurisdiction holds for your document? Any? None?

Do you have any legal recourse if Google gives (caves into) access to your document by U.S. government even though you might be Canadian and were sitting in Canada when you created it? How about Chinese? Or German, French, British...?

A similar set of questions may be asked about your information and the likes of Twitter, Facebook, YouTube, Flickr and virtually any other well-known web site. It can also be asked of business-specific SAAS facilities such as CRM (Customer Relations Management) and Accounting facilities offered by many different companies.

OK - what does this mean to me?

The vast majority of people might not really care where their documents, email, spreadsheets or other information is stored - at least today anyway. "If I never break the law, why should I care?" Well, maybe you should ask the citizens of Egypt that question. Ask the citizens of China and other repressive countries; countries where people are put in jail and in some cases executed for simply questioning the way things are, the way their government or some bureaucrat has treated them, or even just that things are not as good as they were a few years ago.

Losing your privacy by not protecting it is the first step toward being persecuted and prosecuted for trivial and repressive thoughts, even those put down "in private" and in anger or frustration as messages between friends and cohorts. 

Here in Canada the government feels at least responsible enough that we have a privacy commissioner whose duty it is to try to guard us against obvious and malicious privacy breaches. Some other countries have similar posts, but many do not.

It is primarily up to the individual to understand and deal with potential privacy problems, and guard themselves from them. The problem is, understanding privacy in this wired and clouded world is hard, hard even for professionals and those who deal with the technologies themselves. It's far easier just to accept that your birth date, picture, mother's maiden name, family tree, and all other manner of previously difficult-to-come-by information is OK to post to your Facebook account "because everyone else does it so it must be OK."

The fact is, there are already documented cases of hundreds of thousands of sets of personally identifiable information being "scraped" from the likes of Facebook and other similar sites - information that was supposedly "private" but which the individuals granted access to by default simply by using one of the Facebook applications that are owned and run by companies that are not part of Facebook but are simply piggy-backing onto their user pool. I know how this is done as I've written Facebook applications and know what is available once you click "allow" for such an application.

Other APIs (Application Programmer Interface) facilities on other sites allow similar access to otherwise un-vetted external companies and individuals from other similar sites.

Companies that use SAAS similarly risk exposing their customer base, correspondence, activities and plans to not only viewing by others, but direct and un-vetted access by government agencies acting with overly broad access grants that typically require nothing like a warrant or other legal hoop to be jumped.

We've recently watched what IBM's latest wow-product, Watson, did on Jeopardy - now think what this same machine might do when asked to "show me a list of people who think the current government is corrupt" or "who has written bad things about the current government?"

And we thought that Carnivore, the "all-hearing and all-seeing" key-word recognition program that the FBI has monitoring telephone and email/internet traffic, was bad. With the data-mining technologies available and the wealth of such data "in the cloud" the limits just came off.

OK What Can I Do?

The first thing is - at least think about what you're entering into that web program or site. Think about what it might mean for someone criminal to have that information. If nothing else, ask someone knowledgeable about how to set the site's settings so that only the people you think should have access to the information will actually be allowed - and then temper this with the fact that the owners of the site have access to it all in any case.

The second thing to do is - make sure you have copies of anything and everything you post to "the cloud." While it is highly unlikely that companies such as Facebook, Microsoft, Flickr or other huge multi-nationals will go out of business, there are already instances of them stopping specific product offerings and simply trashing the content that users have posted to them. There are also many instances of cloud providers going out of business with no notice and taking all their customers' data with them.

As an individual, keep copies of documents, spreadsheets, photos, videos, etc. that you create or send to the cloud providers.

As business people, keep in mind that tomorrow you might not have access to your critical computing infrastructure and data - so keep backups and have a backup plan in place "just in case"

Now, On to What the Future Holds

What happens if you create a computer that, by its very design and nature, is part of a cloud computing facility yet is also designed to host and protect your own data so that many of the bad features of commercial cloud computing no longer apply?

That's the goal of the Freedombox Foundation.

"Smart devices whose engineered purpose is to work together to facilitate free communication among people, safely and securely, beyond the ambition of the strongest power to penetrate, they can make freedom of thought and information a permanent, ineradicable feature of the net that holds our souls."

Eben Moglen

Today, mid 2011, we are in the midst of one of the various "fee" world governments most legally schitzophrenic periods I've ever seen. 

On the one hand we have examples of policies and actions such as the U.S. government funding creation of "stealth" internet and communications facilities for installation in the likes of Afghanistan and Libya to offset the local repressive governments' closing down or radically censoring their traffic, and on the other hand we have laws and motions in various governments (such as Canada's "Lawful Access" proposal) that will treat conversations and postings on the internet in far more invasive ways than similar utterings or publication on the streets or in book stores.

The point is, today your information and postings can be (and for the most part are) tracked back to you and may be potentially held against you without due process by your "free" governments of the world. The crooks we expect, politicians and bureaucrats we don't - but they want your information and are willing to pass laws to get it - even while supporting others' "rights" to privacy against "repressive" regimes.

Only by participating in and encouraging creation of privacy laws and privacy-protective technologies is the world going to be able to survive without represssive governments; even ones that purport to be free.

So... think about what you post "to the cloud" - and in fact, think about what you post on the internet in general.

richard