Dream machine: laptop with hypervisor?

Podcasts are an interesting way of staying up-to-date, especially when spending a lot of time in your car like I do. A podcast that I recently discovered is DABBC. DABBC focuses mainly on virtualization and tracks vendors such as Citrix, VMWare, Microsoft, Parallels and others.

Episode 67 of DABBC Radio is an interview with Ian Pratt, a Britt who co-founded XenSource (acquired by Citrix). Interesting to learn about paravirtualization, whereby the OS on top of the hypervisor is aware about the hypervisor underneath and the OS behaves somewhat differently as when it had full access to the hardware. I also learned that more and more vendors are shipping machines with virualization support in the hardware. E.g. HP and Dell seem to ship servers that contain Xen in the hardware.

Most customers I work for don't allow me to connect to their corporate network with my own laptop. They provide me with a laptop configured according to their corporate guidelines (typically XP). As a consequence, I'm always on the road with 2 or 3 laptops. Wouldn't it be great if they provided me with a machine image that I could run on top of the hypervisor of my own laptop?

MD5 broken - Rogue CA certificate created

The ACM TechNews contained a pointer to an interesting article. The MD5 hash algorithm is broken. Based on this weakness, researches have succeeded in creating their own intermediary CA certificate. And this in turn allows them to sign whatever SSL certificate they want!

The presentation by the researchers is quite clear and very interesting. The researchers used 200 PS-3 game consoles, but Amazon EC2 could have been used just as well. They also leveraged some weaknesses in the CA they attacked (RapidSSL): use of MD5 (obviously), predication of serial number (sequential) and validity (fixed amount of time to generate cert).

Their conclusion:

• No need to panic, the Internet is not completely broken
• The affected CAs are switching to SHA-1
• Making the theoretical possible is sometimes the only way you can affect change and secure the Internet

Anyway, it's getting time to move to something stronger than SHA-1 as well.

The "ESH"

For people less acquainted with the Integration world, the word Bus in "Enterprise Service Bus" causes many to believe that an ESB is something distributed. But on the contrary, 95% of ESB deployments are hub and spoke. One or a few servers located centrally through which all the messages pass. Distributed execution of integration logic remains the exception.

Therefore, we should maybe introduce the "ESH", the Enterprise Service Hub?

Notes:

1. Older integration solutions often had their adapters running on the same servers as the back-end applications or database, so away from the central message broker. But nowadays, also all the adapter logic is put in to the central hub.
2. Obviously, every ESB can deployed in a distributed manner, interconnected by some messaging solution. But that's definitely not the standard approach.
3. Why is integration logic put centrally? One justification is to avoid disturbing the servers on which the back-end applications are running.
4. Maybe lighter-weight, open source ESB's will make distributed execution of integration logic more popular. E.g. with such open source ESB's deployed along with a J2EE application.
   

Devoxx 2008

Last week I was at the Devoxx conference in Antwerp. Just 20 kms from where I live and the city where I grew up. Being one of the steering members, I gave a hand here and there and was involved in selecting the talks, in particular regarding SOA and security. I really enjoyed the conference, some of my highlights:

• Logo: simply love it
• Venue: the Metropolis movie theater is a really nice location and the the logo on these big screens looks soooo nice; the seats are just a bit too comfortable: my eyes seem to close automagically
• The team: I really had fun times this week with Frederik, Sven, Valérie, Jo, Stijn, Stephan, Gert, Dan, ...
• DataPower: the IBM partner talk had obviously some commercial aspect, but some insight on XML threats and the idea of an 'ESB in hardware' were simply awesome
• Paul Fremantle's talk on complex event processing and the conversation afterwards, e.g. on AMQP and the "unreliability of WS-ReliableMessaging" (Paul is the WS-RX spec lead)
• XSLT 2.0 by Doug Tidwell: XML remains relevant and Dough can bring his story in such a funny way (thanks Robin for arranging this)
  
• REST talk by Stefan Tilkov: although I have a more biased view on the REST and WS-* story, Stefan brings his message so well

And so much more: JAX-RS talk, OpenMQ, XML Persistence by John Davies and meeting Mr Ivar Jacobson at the Devoxx reception desk.

Already looking forward to Devoxx 2009! And thinking about new topics and speakers in the SOA/security area for 2009: Smooks, more cloud computing, new ESB features, BPM and BPEL (BPELScript?), design- and runtime governance of services, Master Data Management, new XML stuff, claims based security, trusted computing, ... Any suggestions?

Microsoft ESB and WS mediation

In this post, I'll cover the 2nd question that I raised in my previous post: "where to do transformations (and routing, monitoring, ...) of the web service interactions?" When a consumer and service use different service defintions, how to transform between both in a Microsoft world? Or re-phrased: where is the Microsoft EBS to mediate synchronous, request/response web services?

When searching on "Microsoft ESB", one quickly ends up at Enterprise Service Bus Guidance. This is not a real product but documentation and components developed by Microsoft's Architecture team. As BizTalk is a hub-and-spoke integration solution that persists every incoming message in it's MessageStore, BizTalk isn't really suitable to be an intermediary for synchronous, request/response service invocations. As such, BizTalk lacks crucial features to be called an ESB, although it remains a nice integration solution.

With no Microsoft ESB available, what are the options?

• Java based ESB: commercial (WebSphereESB, AquaLogic/OracleESB, Tibco BusinessWorks/ActiveMatrix, SoftwareAG, JCAPS/OpenESB) or open source (Synapse, WSO2 ESB)
• Runtime governance tools such as Amberpoint that are also capable of doing transformations. Microsoft has SOA Governance integration with Amberpoint and SOA Software.
• XML appliances

But none of these options are really appealing to the average Microsoft shop. If there is full access to the .net source code at one side (consumer or provider), some custom transformation logic can be added. But there doesn't seem to be any clear hooks for transformation in WCF.

Note: Microsoft's new cloud computing - Azure - specifies an Enterprise Service Bus in its .Net Services. The preliminary documentation of the Microsoft .Net Service Bus talks about naming, different types of RelayBindings and security. But transformation and routing of messages isn't covered (yet).

Microsoft .Net and JMS?

Recently I was challenged by a customer with strong Microsoft focus that required integration with a newly accquired application based on Java/JEE. Both the Microsoft .Net and Java side supported Web Services. The service contracts - message formats - were obviously different. The Java side also leveraged JMS for asynchronous communication.

That brought up 2 very interesting qustions:
1. How to link a .Net application to JMS?
2. Where to transform (and route, monitor, ...) the web service interactions?
In this entry, I'll cover the JMS question. In a next posting, I'll discuss the Web Service mediation question.

To start, there is no out-of-the-box solution: no generic .Net component to talk to JMS, no generic MSMQ/JMS brige or no standard .Net version of the JMS API. Below a list of other options:

• Most JMS providers come with some .Net (or COM) API, although all proprietary. E.g. IBM has WebSphere(R) MQ classes for .NET and XMS.Net. WCF bindings from JMS providers are hardly available: Tibco has announced one (is it available already?) and IBM has a prototype available.


• Some JMS implementations expose a REST like interface, so simple interactions over HTTP. In case of WebSphereMQ, this is the MQ Brige for HTTP.
• Microsoft BizTalk has a WebSphereMQ adapter already a long time and more recently, a TibcoEMS adapter is available as well. But BizTalk does not have a generic JMS adapter.


• JNBridge is a company providing .Net/Java interoperability products (and earlier COM/Java interoperability). JNBridge has .Net JMS adapters: one for BizTalk and one for .Net.


• And Host Integration Server has a MSMQ/MQSeries bridge.

The 1st or 2nd option have my preference. Although you're programming against a proprietary API, no BizTalk nor 3rd party software needed.

Note: using the JMS API with WebSphereMQ introduces an extra complexity because of the way JMS header fields are mapped to the MQ message structure. MQ uses the MQRFH2 header to store JMS specific properties. The Microsoft ESB Guidance comes with a a BizTalk Pipeline component that provides support for this MQRFH2 header.

Note: not 100% sure, but most probably the .Net or MSMQ adapters of Java based integration solutions such as WebSphereESB or JCAPS use JNBridge underneath.

Amazon cloud computing goes fast

Right now, I have my own (virtual) server running in the Amazon data center. Getting such an Amazon server running has really become very easy. With Elasticfox, a plug in for Firefox, everything can be configured in a trivial and user friendly way. No more need to use command line tools or write your web service calls yourself. Just follow the Getting Starting Guide.

July of this year, I read the book "Programming Amazon Web Services" by James Murty. Great book, with lots of Ruby code explaining how to invoke the low level Amazon web services. The book was published in February 2008 and already a bit outdated during summer when I read it, but getting more and more behind. Amazon is implementing new features at such a rapid pace:

• Public IP address (Elastic IP address), earlier one needed a computer elsewhere with fixed IP address to forward clients to server located at Amazon (e.g. through HTTP 302 or other)
• Local, permanent file system (Elastic Block Store), earlier one needed to leverage S3
  
• Lower prices
  
• Windows support, before there were only *nix distributions available
  
• Database support with Oracle on Linux and now SQL Server on Windows
• No more beta but full production with SLA
• Elasticfox plug-in along with good documentation
  

So now I have my own simple Windows 2003 server with a fixed IP address and DNS name. Accessing the server goes fine with Remote Desktop. The responsiveness is not always top, but similar to a local VMWare instance. By the way, this is a perfect alternative for VMWare and a serious competitor! I have the smallest server instance (AMI) running, which is obviously virtualised at Amazon. But it looks like dual-core Opteron with 1.66 GB of memory. And bandwidth is phenomenal: downloading Acrobat at more than 8 MByte/s.

Amazon is already announcing future features such as load balancing, monitoring and automatic scaling (automatically launching extra server instances). Strange that charging is still done via credit card. But I assume that big users can get a real invoice with payment terms.

Extra remarks:

• On Friday Dec. 12, the Amazon evangelist Simone Brunozzi will give a talk at Devoxx conference.
• Running the server instance during a couple of hours had a cost of 70 dollar cents, mostly because I left the elastic IP address unused for a while