My Ideal Hosting Environment

Before I even start, let me say that I haven't found the perfect hosting company, but eApps comes pretty darn close. They hit all the big points, and only miss a few smaller "nice to haves". This is why I promote them to all my consulting clients and use them exclusively for hosting Reliable Response Notification.

#1 - Reliability
This is more than the server not crashing. I've been on hosting companies that switch around the file system structure without telling me. Since RRN uses a few absolute paths in the config file, moving these paths have negative affects. I've also had hosting companies simply switch off Tomcat, or exceed the allotted maintenance windows, or change IP address. I need to know that my hosting company won't break my app on me.

eApps does require you go through some hoops to get everything working reliably. You need to set Apache directives through the control panel...just editing files is a no-no. I got caught by this. But, they patiently explained how and why it works, so I'm on board.

Also, I don't mind being on a shared server, but there needs to be some protection against the other customers. I've been a bad shared customer at times, too. I had a nasty bug where Yahoo IM access would occasionally drive CPU utilization to 100%. Some hosting companies happily allow you to continue driving CPU up. Others will stop your app and boot you off the server. A good hosting company simply reduces the CPU cycles you have available.

#2 Support -
I *HATE* when someone tells me "I rebooted it and it works now". I need to know why it failed, so I can avoid that in the future. Customer support isn't about answering emails. It's about populating those emails with useful information. Phone support is nice, too. Online chat doesn't work well for me.

#3 Features -
Virtuozzo/OpenVZ is a wonderful thing. I suppose Xen and VMWare are, too. Most of my apps don't require an expensive hosted server. OpenVZ gives me the ability to purchase a small, cheap server that acts like a dedicated OS. Plus, it can dynamically scale, restrict resource usage, and migrate between physical servers.

Linux has a lot of good software for it. Some of that should be available to the hosted server. MySQL, PostgreSQL, Tomcat, Apache, PHP, curl/wget, Nagios, and some web stats package. If you don't support those, then at least allow us to use the standard package installers, yum, apt or whatever, to install them. Failing that, then, we should be able to install from source.

#4 Scalability
With most hosting plans, you can move up and down plans fairly easily, ie scaling vertically. eApps takes it to an extreme. You can move up and down, most of the time without stopping your application. 0 downtime. As well, they support clustering, using excellent hardware load-balancing. This allows you to scale horizontally, by adding new servers. Combine that with their super-cheap, super-flexible OpenVZ servers, and you have one of the most affordable, scalable solutions on the planet.

All in all, I've been very happy with eApps. They have some competition from Amazon, which I imagine will get tougher soon. They also have competition from the classic providers like Verio, GoDaddy and Network Solutions. None of these companies provide the individualized support, attention to your particular app, and general excellence that eApps does.

Privacy in a Twittery World

Reliable Response is in an office building across from the Capital of Colorado. We get a lot of political groups in here. The most excellent Colorado Statesman is downstairs. The Colorado Right to Life group is next door. My favorite is Jim from the Colorado DLC. He and I talk occasionally. He lets me rant, and I help him with technical issues. Coming soon...webcam-based interviews with politicos around the state. Maybe he'll let me rant on camera.

Jim was asking me what I thought about the phone companies eavesdropping on us. Obviously, no one wants their private conversations to be listened to by anyone, especially some low-level government or telecom flunky. As a former low-level flunky, I can attest that we flunkies *love* listening in on internet traffic.

The fact is, to quote Scott McNealy, "Get over it. You have no privacy." I couldn't agree more. The government can't give it back to you. We can sue whomever we want, but the RBN will always be willing to sell your information to anyone who's willing to throw down a couple bucks for it. Try asking Putin to help...let me know how that turns out.

Anyone who knows me knows that I have worked in security, including a long-ish stint for RSA Security. I believe in encryption. I love it! Mostly because it puts the control over your privacy back in your hands.

To answer questions about telecommunications security, I will always say that counting on the government and the telecommunications companies to keep out of your business is naive at best. There's only one person you should trust. You. Make sure you have the best encryption you can use.

On the other hand, the government can, and should, make it easy for you to do that. To this end, the IETF has released RFC 3711, the Secure Real Time Protocol. This is an extension on top of the most popular VoIP protocol to provide real security. People should start using it. We should demand it's support for all VoIP phones, including Skype!

Reliable Response Notification doesn't use any of these mechanisms. It's a problem we're looking to address. We're publishing some pretty private information. Stuff like IT outages, purchase requests, and internal marketing communications. It keeps me up at night to think that someone might at AOL might be looking at these IMs streaming past. The problem is that the communication methods people use simply don't support these encryption standards. Even support for PGP, an encryption standard that was old 10 years ago, has seen so little uptake as to be considered effectively dead. This is a problem.

The government can help. Richard Clark's cybersecurity efforts are a start. The government should lead, promote and market security solutions. But, it should never make them mandatory. When there's critical mass, people will use them. I hope one day, people will tell me that they won't purchase Notification without built-in security.

WorkFlow and Notification

I've been working with an OEM partner, Advantage Integrated Solutions. They have been using Reliable Response Notification for an interesting purpose. Notification has been taken out of its typical role as an emergency notification tool, and they've been using it integrated with a workflow system. This has been very interesting to me.

It brings notification out of the IT horizontal market. IT is a notoriously difficult horizontal to sell new products into. They've been burned by poor quality, fast changing requirements, large bills, and difficulty maintaining the software they install. I can promise that my software is easy to use, bug free, etc. I can even show them, with demos, trials, references, etc. But, nothing will remove a deeply felt belief.

It introduces an SAAS model. I've come to love software as a service. It's cheaper for the customer, while providing Reliable Response with a reoccurring revenue stream. Support is 100x easier, and the product appears more reliable because Reliable Response can handle problems before they show up with the customers (for instance, hardware or network issues). I get better usage statistics so I can further improve the product. Best of all, it opens up a market to a whole new breed of customer, the small company that doesn't have a lot of money. Instead of a one-time $10k purchase, you can do a $40/month and buy only the features you need.

It's a new market. I have competitors in the IT space. At least one is a good competitor. And, another competitor has the vast market share. Competitors are good because they let you know the market is proven. Even better are customers. Pretty much every vertical out there requires this sort of product, but the IT horizontal is the only market that's being addressed. Same product, more customers, fewer competitors. Even though I get less money per sale, the sales are easier.

It's easy to get technology partners. When Notification is an IT product, I can partner with monitoring, help desk and security packages. Most of these are closed systems with few easy integration points, and a difficult partnership program. Once I get outside of IT, I can partner with a much broader range of customer. Pretty much every SAAS vendor has the hooks I need. Heck, I don't even need the buy-in from the SAAS vendor for the most part (although it's nice to have).

So, why hasn't Notification taken off in this space? Well, I only got the religion a few weeks ago. Mostly, though, I am looking for partners to bring into the company who know particular verticals that I can attack. Anyone who's interested, email david@reliableresponse.net

Reliable Bunnies!!!

David Hauser of GotVMail sent me a gift. The Nabaztag WiFi Bunny. I posted a video of my bunny working with RRN and Nagios at:

Software Consultant Time Tracking with Google Calendar

One of the challenges facing someone with a small company is tracking where you spend your time. It gets more important and harder when you charge hourly. There are a lot of products out there that allow you assign hours to a client. They run the gamut from a handful of PHP pages to full-blown CRM systems. I found a better solution in an unlikely place, Google Calendar.

At first, I used vTiger CRM, a fork of SugarCRM, to track time. I have vTiger on my hosted server and I have populated all my clients in it. When I get new clients, I put them in as well. I don't have this automated because I have few, long-term, clients, so it's not more than 2 or 3 entries a month.

When I did work for a client, I would login to the CRM, navigate to the “Tasks” page, and add a new task. Every task had to be associated with a client, which meant I ended up adding new clients even for one-offs. Also, the calendar view was very inconvenient for me. It was near impossible for me to figure out what I did on a particular day.

In the end, what killed vTiger for me was simply that it was too slow. It's slow to load. It's dependencies on a lot of tables makes it slow to render. And, it takes way too many clicks to get something done, so it's slow to navigate.

After months of using vTiger, I was still unable to track what work I did for whom. So, I went looking for a new solution. My requirements were simple:

1. It needs to allow me to enter a job title, a client, and a timespan

2. I must be able to view a day in its entirety so I can see if I have any unaccounted for time

3. It must be quick to load and require very few clicks to perform any task

4. The storage must be more or less permanent, so I can review tasks for a minimum of 4 years

5. It must have some way of exporting data, in case I need to migrate to another system

I found no time tracking package that met these requirements. The only real solution came from an unexpected quarter, Google Calendar. Since I've started using it, I've found it very easy to enter time records and very easy to examine my time spent. Google backs-up and maintains the database. Import and Export can be done with iCal or XML, both of which can be converted easily with Perl or Java.

Now, I can tell a client with easy assurance how many hours I spent on their project and what I worked on. This simple change has made billing and project management 100 times easier, and that's key for any software consultant.

IM in the Enterprise

We all love instant messaging. It allows us to send quick thoughts to our peers, clients, bosses, users, friends, relatives and vendors. The value for IT professionals is enormous. IM allows an IT operations employee to know of problems, to track down help and to communicate status instantly. IM has been ported to our cell phones and smart phones, too, so that we're never out of the loop. When it works, IM file transfer is a very convenient way of sharing files. But, it's run into some trouble in the workplace.

• IM's communication is too quick, exacerbating etiquette issues that plague email.

• Since each IM protocol uses a different port, a different server, and a different text format, filtering and monitoring IM traffic is very difficult. The potential for abuses is large. Inappropriate chatting, divulging of the company's inside information, time wasting, sharing viruses, identity spoofing. The list goes on.

• I often make the point “who runs the servers and do you really want them know what your employees are talking about?” There are more than a few companies that would consider Yahoo, Google, AOL or Microsoft to be competitors.

There's an answer to all of these problems; Enterprise IM. Enterprise IM is simply an IM server that exists behind the firewall and is officially sanctioned by the company. And, there are a lot of options available for Enterprise IM servers. IBM makes SameTime. Microsoft sells an MSN-compatible server with its Exchange product suite. I think AOL has an offering. My favorite, by far, is Jabber.com's Jabber server.

Jabber offers

• AIM and Google Talk integration, so your employees don't need to download a non-supported program to talk with their clients.

• LDAP and Active Directory integration, so it's a good enterprise client.

• A single, unified access point for all IM communications, making monitoring much easier.

• Widely available, high quality, free SDKs for integrating IM and presence features into applications.

• All internal company communications remain internal.

• An open protocol with an open implementation.

• The ability to federate the Jabber server with other Jabber servers both inside and outside of your network with no loss of control or privacy.

IBM's SameTime is a close second. It has many of the same features, including an open protocol since it uses SIP, and a high quality SDK. But, SameTime does not include an AIM gateway, so your employees will download the AIM client themselves, which leads you right back to the monitoring questions.

My product, Reliable Response Notification, supports all of these clients. We want to spread our net as widely as possible. But, when someone asks me which IM I suggest, I never hesitate to suggest Jabber.