The Downsides of Software as Service

JustinBrock writes "Dvorak's article yesterday, entitled Don't Trust the Servers, argues that the danger of software as a service was highlighted when 'the WGA [Windows Genuine Advantage] server outage hit on Friday evening and was finally repaired on Saturday. It was down for 19 long hours.' The whole fiasco raises an interesting perspective on the software as a service 'fetish'. Dvorak highlights it hypothetically: What if the timeline were reversed, and we were moving from online apps to the desktop. Hear his prophecy of the marketing: 'You can image the advertising push. "Now control your own data!" "Faster processing power now." "Cheaper!" "Everything at your fingertips." "No need to worry about network outages." "Faster, cheaper, more reliable." On and on. I can almost hear the marketing types brag about how much better "shrink wrap" software is than the flaky online apps. The best line for the emergence of the desktop computer in a reverse timeline would be "It's about time!"'"

When is the last time Dvorak...

I'm trying to think of the last time I read an article by Dvorak, and said "You know, he's got a good point". It's almost like he intentionally trolls his readership by stating the most outrageous possible point of view, just to stir up hits and discussion.

Re:When is the last time Dvorak...

I, for one, can't think of a single upside of "Software as Service"

Re:When is the last time Dvorak...

I can! It's a new funding model, necessary for the continued existence of giant software factories like Microsoft. The upside is that you no longer have to figure out ways to persuade your customers to buy the new version of your software, which has become more and more difficult (how many features can you add to a word processing app, anyway?)

The upside to the customer is not so easy to find, unless you consider the possibility that with all this hypothetical easy money flowing in, Microsoft would be able to make a better product.

Re:When is the last time Dvorak...

I can think of one, possibly two upsides to software as a service.
1) Software provider has an 'incentive' to ensure the product is bug free or that the bugs get fixed quickly. With shrink-wrap software, they have your money and are providing fixes for free.

2) This is an accounting style advantage. Say, you have the option to pay $300 for a software suite up front, or $5/month for as long as you use it. Most of us would go with the $300. Except, what if the $5 gives you free upgrades forever? Now, what if it was $1.50/month? Here we start getting into a grayer area about it being cheaper to pay per month than up front, due to about how much money you could make off of the base cost in interest on investments.

Re:Here's a few more - readable this time...

3) No desktop installation required - no screwing around with what build works on your particular OS.

4) IT maintenance - while not a big issue for most of us that post here, for all those mere mortals keeping the software up to date, or upgrading to a new version can be a major headache. With software as a service, its done for you.

5) Accessibility - what if you're outside the firewall and can't get thru the VPN? Again, a bigger deal for mere mortals that /.-ers. (of course the disadvantage is no working offline)

6) less start up risk. If I can start with a couple of seats a month for $50/seat versus having to kick out hundreds or thousands of dollars per desktop copy, it's a better deal (well, legally anyways).

7) Generally the Software as a service providers have better backup/recovery processes than the average SMB (think law firm, not software house).

There's lots more reasons of varying importance. I think the parent's point #1 is probably the most relevant of all tho.

Re:Here's a few more - readable this time...

I'm not a big fan of Microsoft but this service (intially, until they have a lot of people signed up then they can tighten the screws) could save a small business a lot of money.

And that, my friend, is the biggest problem that I have with software as a service. Your data is held hostage. You can never leave their service, even if they raise their prices tremendously.

If I buy a copy of Office today, I know that I can always get access to the files I create with it. Even if it's a hassle--having to reinstall every X days because their product activation server was dismantled years ago--I can always do it. Can the same be said of Google Apps? Of whatever Microsoft offering you're discussing? In 10 years, if I need access to my financial documents, will they still be around? Maybe, maybe not, but it's a pretty huge uncertainty right now. And that's the rub--that's the thing that, if left unaddressed, will prevent me from ever subscribing to software-as-a-service for anything important.

Re:When is the last time Dvorak...

I, for one, can't think of a single upside of "Software as Service"

Software as a service can be run locally by a company, rather than on the web. There are several (provided the server is maintained on site).
Single point of failure should a catastrophe happen.
User's can't go in and break the system.
There is one system to maintain, one anti-virus package, one system to back up and so on.
Files are much easier to share and keep updated. It is a nightmare to have a single spreadsheet that is updated by several people when they are updated on the own personal systems.

When the server is remote, there are still advantages, just not as many:
My step-dad uses quickbooks for his small business. He has architects and accountants that need access to the books. Originally, he had purchased a copy for each of them to run on their personal computers. Unfortunately, when one made a change, he had to call everyone else to tell them, or email a backup copy of the DB and everyone would have to manually update their own DB's. It was a nightmare and this was only with four or five employees. With Quickbooks Online, each user logs into the website, enters their data and everything is updated almost in real time. He's a roofer and does not have the knowledge, nor the time to keep up with the application. He only cares about the reports, not how they are created. This works very well for him.

However, with all these advantages, I agree that it sux for the most part.
It's slow... much slower than running apps locally.
In the event of a failure, you're at the mercy of the tech folks that you do not employ and have not control over.
You are not in control of your own destiny.

Re:When is the last time Dvorak...

Single point of failure should a catastrophe happen.
User's can't go in and break the system.
There is one system to maintain, one anti-virus package, one system to back up and so on.


All of the benefits you mention depend on all software running as a service, not just MS Office and a few other "enterprise" apps. That simply won't ever happen, even if everyone buys into this scam-of-a-revenue-model, because something absolutely critical won't play well with others.



You are not in control of your own destiny.

And it all comes down to that one point. Every other fact or opinion aside, what does it mean when Microsoft EOL'ing a product means you no longer have any program with which to review the last ten years' worth of customer transactions or tax records? "Sorry, you'll have to cancel that audit, Microsoft cut us off. But no doubt the IRS understands completely and trusts that we filed accurately, right?"

Re:When is the last time Dvorak...

"There is one system to maintain, one anti-virus package, one system to back up and so on."

Untrue w.r.t. the anti-virus especially. Once a user terminal is zombied, your server is directly exposed to application level attacks.

I was speaking of an application based virus, like the good ol' Word Macro Virus. Of course, running your word processing apps on a remote server will not protect each terminal from other viral/trojan attacks, but it makes it easier to ensure that your sales team isn't sending infected Word docs to customers trying to sell them security software!

"Single point of failure should a catastrophe happen."

I've never seen this as a good thing for survivability. The classes I took, and my industry experience tend to support adding redundancy to elements identified as SPoFs. I think I know what you're trying to say, but still...

Keeping an application running on a bank of redundant servers is still easier than maintaining that same applications on 20,000 independent PC's. While it does have its drawbacks, such as when the servers or network go down, everyone is SOL, it's easier to fix that single bank of localized servers than it is to fix every single machine if something really catastrophic happened, like a virus run amok on your network that trashes 20,000 copies of Office.

I can see why it is a good idea to remove critical applications from the control of the end user, but the drop in performance does not justify the increased level of maintainability. And no matter how much we hate it, there are some applications that are required to have some or all of it run at a centralized location. Examples would be your Exchange server, your database server and any web based applications that simply can not be run on local PC's.

Re:When is the last time Dvorak...

A few months ago, I found an old article in an old copy of PC/Computing where he lambasted Microsoft for releasing a $90 bugfix called Windows 98.

Re:When is the last time Dvorak...

This article. He's got a good point.

"Software as a service" should be viewed with the same suspicion as "Trusted Computing." Something so bundled in Marketing, with no particular benefits to the consumer, has to be a money/power grab.

Re:When is the last time Dvorak...

> I'm trying to think of the last time I read an article by Dvorak, and said "You know, he's got a good point". It's almost like he intentionally trolls his readership by stating the most outrageous possible point of view, just to stir up hits and discussion.

"This time." Centralization and decentralization has always been a pendulum sort of affair, varying with the relative costs of bandwidth, CPU, and storage.

Once upon a time, there was the mainframe. Nobody ever got fired for buying (or more accurately, leasing) IBM!

Then came the microcomputer. Decentralize! Applications run right on your desk! Buy Apple! No more monthly payments to IBM! (At 9600 baud, dumb terminal bandwidth is expensive. 8-bit micros are cheap!)

Then came the dickless workstation. Oops, "diskless". Centralize! It's a client/server world! Buy Oracle, and run it on your Sun! No more huge capital outlays for PCs that become obsolete the day they're purchased! (Workstations are expensive, but this new ethernet stuff is cheap!)

Then the PC-as-workstation. Decentralize! Don't rely on that expensive server! (Doesn't matter how much cable you run, if you have 100 users trying to render the Sistine Chapel on X Terminals, bandwidth and server-side processing power are shockingly expensive again, local storage and processing power are suddenly cheap again.)

We're currently on our way back to the server. This time, the excuse is DRM. An application that doesn't exist locally can never be used locally once the vendor decides to kill it.

But ultimately, the root cause is that bandwidth is relatively cheap again. Doesn't matter whether the application is Windows (which needs to call the mothership for patches every few days) or Steam (for the same reason).

This time it's extra stupid

"This time." Centralization and decentralization has always been a pendulum sort of affair, varying with the relative costs of bandwidth, CPU, and storage.

With Vista, the user has to buy a computer that provides all the ressources and is still depending on some server being available / working correctly.
In this case the WGA server, which does not give any advantage to the user. The only one who has an advantage is Microsoft (from disallowing pirated Windows versions), and that is questionable as I doubt Vista will stay uncracked ;-)

Let's imagine another hypothetical

Let's imagine another hypothetical: one where Dvorak is a respected columnist who is taken seriously. I can see the Slashdot comments now: "Wow, another Dvorak article! Hooray!" "No one understands the industry better than Dvorak!" "This is one of the most insightful and valuable things I've read all week!"

Of course, this is just a hypothetical, and like the one in the article itself has little to do with reality.

Why not both?

It's not like we'll move every single bit of computing into services. We're going to have a little bit of each. Huge growth in personal computing? More software for your PC. Huge growth in the network? Sure, more software as a service.

We'll have both, need both, but will still have a lot of cases where people try to the wrong one and get burnt.

Written without reading TFA (and boy, did it feel good!). I'll read it now. :)

Dvorak?

Did anyone else have to do a double take on the author of this article. The more I read, the more I'm thinking it can't be Dvorak right? This is pretty sensible. Rechecked the author when I was done and said, "huh"

This is cyclical in the computer industry

Hasn't this gone around in cycles already? First there was the mainframe batch processing era where everything was centralized, then the networked-terminal timesharing model where individuals could do stuff but it was all dependent on a central system... this gave way to the early PC era, where individuals could have totally separate machines and do things independently... then everybody got networked and we were back to a more central-controllable system. Because there are advantages and disadvantages of each model, things will keep going back and forth as people react to the issues of the currently-dominant model, whichever one it is.

Reasons for Service Software

The article make the assumption that everything is moving from a local desktop computer on to the internet. It is the same with all of those webOS people. There is a time and place for both local and remote services on computers. The WGA has to be remote because windows is cracked so easily on a local scale (not that WGA poses to much of an obstacle). Things like google documents is useful for having a decentralized work environment for papers and makes collaboration easy. However, that does not make office suites extinct...it is simple another option; and since when are more options a bad thing?

Damnit, Dvorak

Great. I happen to agree that putting things in networked services just for the sake of having it in networked services is a waste of resources. But since Dvorak came right out and said it now I haven't got a argumentative leg to stand on. It's like a child molester agreeing with me that we ought to have more public parks.

Next thing you know he'll declare how much he likes pizza, completely undermining my fondness of it.

The downsides of software NOT as a service

Software as a service is incredibly useful to smaller enterprises (like mine) that don't have the manpower, money and/or expertise to maintain our own servers. Mission-critical software isn't as simple as 1. install on computer 2. use software. There's uptime to worry about, backups, security, etc. For smaller businesses, it most certainly makes sense to farm this out to experts and take advantage of specialization of labor in terms of cost cost and skill.

At this point in time, software is as complicated and as important to some businesses as say, vehicles are. Only the very largest of companies have their own in-house garage and mechanics to take care of their own vehicles.

There are Many Busses

There are benefits to be gotten from both a served-software model and a standard local model, so why not use something like google gears and get the best of both worlds.

Even if you are off the internet at large, we are getting into an age where a personal area network will become ubiquitous. Served-software would still be available from, say, your phone as the server (always keep the gears software on your phone ready for load) or maybe your bluetooth watch could maintain local copies of frequently used software.

While at some remote location you might be lucky to find that a colleague has a local copy of a certain, rarely used software on their wristwatch.

Then again, it is something to think about that within 20 years will it be as unusual to find oneself without internet access as it is to find oneself without electricity...perhaps it will be even more unusual than that (what with satellite communication).

Just thoughts.

It is interesting to note how much more bandwidth my internet connection has as compared to my first computer's bus speed.

Depends on the situation

Just like anything else, there is a time and a place for software as a service. Some things simply make more sense that way. What about UPS package tracking? Not much point in having that be a standalone application... At the end of the day, developers, even users, have to decide which services make sense to have online as a service or offline as a standalone app. I choose email as a service (gmail) instead of Outlook or Thunderbird. It works for me because I use lots of different computers, and, lets face it, email isn't very much good if you can't get online anyway. OTOH, when I'm downloading emails for Scouts at summer camp, I prefer to use a standalone email application, as I can get online, download all the mail for the day, and disconnect, thus saving the camp phone line (and minimizing my time on a dialup connection). Not only is there room for both, both models make sense depending on your application requirements...

For Once I Agree with Dvorak

It has to happen by chance from time to time...

SAAS has worse problems than server availability. It creates nasty integration problems since your critical enterprise data is not only crossing an interface, but the other side of that interface is not in your control. That's not just an integration problem: I'm waiting for a security breach against one of the big SAAS vendors. And not only is it closed-source, it's closed-source managed by a third party that doesn't have the same priorities that you have. So if you need to fix or customize anything on the SAAS side, you're well and truly screwed.

The only reason SAAS emerged at all was as a response to the poor performance of most in-house corporate IT departments. Why wait for your own geeks to implement something badly in a year when you can go to an ASP who will give it to you in a couple of months? And of course there are the perverse incentives in how capital expenditure is accounted for versus externalized services. But the main motivation is that business managers just don't trust their own IT people. And based on the performance of most IT management, no wonder.

Dvorak's Ignorance and WGA...

So once again, I'll read up to the first Dvorak mistake, and then stop.

The first one I got: WGA can't "fail closed", otherwise pirates would just filter the communication to the WGA servers.

Rather, what WGA needs is a signed "check back later" message, where Microsoft's public key is used to sign a "check back by day X" message, so that a server outage can be handled in the future. And I'd bet that there is, by next Patch Tuesday, an upgrade to WGA to support such functionality.

And its not like people's home/office computers are so reliable, making this segque ridiculous.

I can't give Dvorak much credit...

for startling insights into marketing. (Ok, duh, this is John Dvorak, but still...)

Truly, marketing is designed to convince you that what they've got is much better than what you've got. If you have independent, localized computing, marketing will try to sell you distributed service-based computing. When you've had your fill of service-based computing, well, that's just an opportunity for marketing to sell you independent localized computing.

It's like samsara [wikipedia.org] except that the marketers consider the cycle of rebirth to be good. (They are marketers, after all; enlightenment means that they no longer have anything to sell you!)

I'd have to mod TFA "-1, Obvious".

Right tool for the job ...

His points are good, and they underscore why I rarely use the latest web apps, but nevertheless am amused by them (Flash-based image editing online!). Still, while we should show his level of skepticism toward many of these apps, the fact is that network-based app delivery still has many advantages. The main one is that you can update software for all your users in one place, and not care as much about the state of the client machines. As a recent Mac convert you'd think Dvorak would particularly like this, since he can do the same things as a web client on a Mac as on Windows or Linux.

Despite the stupidity of some online apps, I can think of a lot of examples of software I would definitely rather have on the web - e-mail (think Gmail or other webmail, which almost everyone uses to some extent), a trouble ticketing system for a helpdesk, a custom database used within a company (most of these are centralized), etc. Onlime apps particularly make sense where the data is centralized as well. That's worth emphasizing: Google Docs and Spreadsheets may be nifty, as well as cheaper than MS Office, but they won't catch on until people see the value in storing the actual files centrally as well, just as they store e-mail centrally when using a service like Hotmail.

It's already here, in "Higher" Education

As administrators drink the Kool-Aid® we see the SaaS fetish in action in labs, with online testing and content delivery, in text books, with DRM'd PDF files that must be read, or verified as "authorized", online, and I'm sure that more will come as marketers move to embrace the new paradigm.

The obvious problem arises when the network goes down,

But there are other "gotchas":

• Students with no internet connection at home to "verify" purchased content
  
• Students on *gasp* dial-up
  
• Labs or onsite facilities unable to deal with separate installations of proprietary applications for each user
  
• Bandwith hits taken when ebook download and validation peak
  
• Lack of portability of purchased content
  
• Students without printers unable to ... well, you get the idea
  

Again, I'm sure there are more that will come up as time goes on.

IMO, any time there's a move to vendor control, let alone remote, removed, vendor control, the end user will lose.

software as a service is successful

... it's called Webhosting. We've been offering this stuff for years. "Software as a service" is just a new buzzword for people who want to offer ASP-style apps in a windows environment.

Good webhosts have 99.99999% up time. The entire hosting industry measures success by uptime. If it didn't, the industry would collapse.

Dvorak attacks the WGA server that went down, rightfully so. However, he then goes into hyperbole mode and subtly lumps googles offerings in the same category. After using google.com for years, and google maps almost since it was launched, I can tell you I can remember only once significant outage, and it was some kind of DoS attack, I think, which was quickly dealt with. I can remember no minor outages in my experience, nor am I aware of any other outages reported in any major online media.

Yes, you have to be worried about losing your documents. The best ASPs should provide some kind of user data backup (I don't know if Google does this but if they don't they need to) or some kind of contractual obligation to users in case of data loss (more appropriate for Business to business apps). However, if someone provides you with excellent up time and reliability, why can't you trust them?

Microsoft has a lousy track record of reliability. Also, tying hundreds of ASP apps into a single WGA server is ludicrous.

Trust is about experience. Anyone using Microsoft based ASP apps is asking for trouble because the experience of most users is that MS is not reliable. If you want reliability, you need to look elsewhere, and there are plenty of options.

That's what this outage is really telling us. As usual, Dvorak has completely missed the point.

Dvorak's a little confused

He seems to be under the impression that WGA is a service Microsoft provides to Windows users.

It isn't.

WGA is a service which Microsoft provides to themselves, in order to protect themselves from said Windows users (AKA thieves).

If the main purpose is to protect your profit center, a 19 hour (or 72, or 30 day) outtage where the failure mode is "more protection" strikes me as perfectly reasonable. It's not like "pissing off customers" has ever been considered a liability in Redmond.

Sucks to be a Windows user, though. Should have got some sort of service agreement, I guess.

c.

One Word - Skype

Look at how many people were without phone service when Skype wen't down. Some were smart and either had a land line as a back-up to Skype or vice versa, but by creating a single central point of failure, thousands of businesses were inconvenienced and lost money.

Software as a Service (SaaS) creates all sorts of ripe opportunities for hackers, crackers, and other cyber criminals. It's been a cottage industry to blackmail online casinos, threatening DDOS attacks if you're not paid off. Since a half-day DDOS could cost the casino in the high five figures (or more), they pay the blackmail.

What if a large SaaS company had a 100,000 business customers... just 100,000? That's a ripe DDOS blackmail target if I ever saw one. And if you could hack the systems and gain access to the tax and banking spreadsheets of 100,000 clients? Can you say "low-hanging fruit" boys and girls? I knew you could.

And what if the company is being run by idiots who fake their numbers to make it seem like a sinking ship is just "settling in the water" until the ship suddenly capsizes without warning, going belly-up in the space of hours. All your docs and spreadsheets are offline... indefinitely. And if by some graceful foresight, you backed up your docs, if you can't find a piece of software that can both run locally and work with the proprietary formats the SaaS vendor used for their docs, you're still SOL.

Those are worst case scenarios, but you get the drift.