Hello, alleged human.
This is the Chaos Lever Podcast, and I was on vacation
last week, so there's no new episode this week.
But instead, I thought we could revisit a favorite topic of mine.
And when I say favorite, I mean that I hate it and I want to burn it with fire.
We are going to talk about the supercloud by listening to
an episode that Chris and I recorded on October 4th, 2022.
So sit back, Pop open a can of something strong
and enjoy this episode about the super cloud.
All right.
So anyway, you were watching a TV show about taking over the world.
And I was inspired as one is.
That was hilarious because the ELM that was presented in the
show, the Earth Liberation Movement, was like this pseudo
terrorist Eco organization, and they were all treating them like,
Ah, ridiculous, these climate people with their climate stuff.
And I was like, shit.
Man, when was this filmed?
I'm guessing this was like 2005 ish time frame.
So, you know, I mean, solid 15, 17 years old.
Doesn't matter.
Sure.
The point is, it felt outdated.
They were making fun of like, people firebombing SUVs and stuff.
And I'm like, no.
Oh, sweetie.
That's hilarious.
It's like, A, the actual terrorist organizations we have to worry
about are, they're not the Earth Liberation Foundation or whatever.
It's probably the white nationalists.
And also, climate change is a real thing and it's a big problem now.
So you can put that in your pipe and smoke it y'all.
I mean, that's your opinion.
Well, just like facts.
Oh, okay, 2006.
I was very close.
I had to look it up.
Yeah, that's not bad.
And I mean, I remember that term or that the name of that series,
but I thought it was A movie, first of all, when you said it.
Like, Numbers was definitely a movie, right?
Probably with Jim Carrey.
Might have been filmed in black and white.
I don't know what you're talking about.
I can't even tell if you're doing a bit.
It's a bit of a bit, yes.
I just melded, like, five things together from the late 90s, early 2000s.
Okay.
Showtime!
Thank you, that's all I got.
Have you seen the new Sonic movies?
Oh yeah.
There's two of them.
Okay.
So you've seen both of them, and you know that Jim Carrey is excellent in both.
Yes.
Yes, he, not only is he great casting, in my opinion, for Dr.
Robotnik, he's the only casting.
There are very few other people I can think of that could potentially
fit the bill, and they would have done it in completely different ways.
So, I mean, like, could you imagine Dennis Hopper?
As Dr.
Robotnik.
I'm just, well, I mean, he does have the, the major
negative on that front is that he is not alive.
That's got to imagine it.
And if he's, if he had the forethought to sell his likeness to
AI, which we can get to later, it wouldn't even be a problem.
You heard about the Bruce Willis thing, right?
Yeah, it's, there's a little bit of fake
news involved in that story at the moment.
Complicated.
Isn't it always when it comes to AI, that's a future episode.
I think.
AI, it's complicated.
Oh, let's get into this one.
Hello, alleged human.
And welcome to the Chaos Labor Podcast.
My name is Ned.
I'm definitely not a robot.
I abide in a ranch style domicile of my own volition.
It has nothing to do with the fact that stairs
are a frightening and insufferable mystery.
Everyone has their thing, right?
Vacuum cleaners frighten the dogbot and stairs?
Oops, never mind.
I just, I don't like stairs.
With me is Chris, who is also here.
How do you feel about stairs, Chris?
I mean, I can go both down the stairs and
up the stairs at whatever speed I choose.
So, you know, that's how legs work when you're, um, alive.
Going upstairs is perfectly fine.
Going downstairs is a terrifying nightmare.
I think we can all agree on that.
So you're an opposite cow.
That's why they have ramps.
Is that really true?
I feel like that's urban, not even urban legend, like rural legend.
Rural legend.
I feel like there's a name for that already.
An old wives tale.
You've got to imagine for a cow, they would at least be perplexed.
I think that's the constant state for a cow.
Grass?
Repeat for 40 years.
Oh, I'm glad we're laughing because the rest of
this episode is just going to be me cursing a lot.
So let's do that.
Strap in.
Let's talk about some tech garbage.
Supercloud.
Trademark.
Supercloud.
Trademark.
Trademark, TM, R, copyright, all those things.
It's a thing now, so I guess we need to address it.
Fuck.
Cool.
Let's do that.
I mean, yay!
In the not too long ago, I think we mentioned Supercloud briefly
in a larger discussion of hybrid, on premises, and other things,
and my original take was something along the lines of, this is a
stupid term that someone invented so they could own and promote it.
The term adds nothing substantive to the discussion on the future of
technology, conflates multiple terms we already don't have a solid definition
for, and adds a fluffy, confusing buzzword to the marketing hellscape
vendors can glom onto and abuse until it is more meaningless than it started.
There
is an AI idea.
We need to put together a fluffy, confusing buzzword bot.
I think that's already taken care of for us.
Well, yeah, but that's by IT Dude Bros.
This would be by
AI.
We've
always wanted to put the IT Dude
Bros out of business.
Okay, well, that's fair.
Yes.
And yet, despite all of this, all the angry things that I said into
a microphone that clearly some people listen to, you, it persists.
Supercloud persists.
And also, no, I'm not listening.
Okay, well, I mean, it was the royal you.
So since we can't simply nuke it from
orbit, I supposed we have to engage head on.
With a robust discussion on the origin of the term, the evolving use
of the term, a working definition that is definitely, completely, and
entirely too long, and the popularity of the term now and in the future.
But first, a word from our sponsor, Pedantry!
Tired of being an easy going person people
enjoy talking to at social gatherings?
Exhausted by the constant bother of interfacing with fellow human beings?
Sick of being pleasant and reasonable at company retreats?
Try Pedantry, a product of Misanthropy Incorporated.
I can't say words.
With Pedantry, you can ignore even the most well
intentioned person by correcting their grammar.
You can lose and alienate loved ones by picking apart their sentence structure.
You can even be ostracized by critiquing your friend's pronunciation.
Yes, Pedantry is here to make your life as lonely and miserable as possible.
Sign up now, and we'll send you a hefty supply of grammar Nazi Absolutely free.
There was actually a couple of split
infinitives in there that we need to talk about.
At least one.
Did you know that rule was made up by like some German
editor in like the 1800s and everybody was just like, yeah,
that's the rule we're going to follow from here on out.
Yeah,
he noticed that in Latin, you never split infinitives.
Therefore, that should be a rule in all the
other languages that were descended from it.
The trouble is, the way that words are structured in Latin, you literally
can't.
Exactly.
And also, English is not completely derived from Latin,
as any cursory overview of the language will show you.
But anyway, I've reached a point in my life and career.
where I've recognized that, you know what, being pedantic
and exacting about language is not always the best solution.
I know that that is heresy, Chris.
But mostly?
Probably not even mostly.
Are there situations that call for using your lexicon with exacting precision?
Certainly.
Is that situation a casual conversation with a colleague or friend?
No, Chris, it's not.
This is going to bother you so much.
I love it.
Words mean things.
But what they mean is constantly evolving and
changing based on how humans use language.
There's no right way, except what we've collectively decided is right.
Remember, language isn't physics or mathematics.
There's no natural law or inherent rules.
Just humans being silly and trying badly to communicate with each other.
Just remember, language literally evolves.
Oh, you really wanted to get the literally in there, didn't you?
I appreciate it.
I just wanted to decimate your argument.
Do you even know what decimate means?
It means multiply by 10.
For the most part, I've stopped correcting people
on the use of on premises versus on premise.
I don't care.
I know what you mean.
I also don't care whether you've capitalized VMware properly.
And neither does OneNote, by the way.
I'm convinced Microsoft does that on purpose.
SMI.
And I've just accepted that AI and ML, like literally
and figuratively, are going to be used interchangeably.
And for most situations, that's fine.
Oh, I couldn't care less.
You mean you couldn't care more?
Or couldn't I?
And yet, Supercloud really chaps my ass.
Part of this discussion is an attempt to define
Supercloud and how it's used, but the other part is a
personal exploration of why this term bothers me so much.
Cue the soft soothing zen music.
There better be a, like a pan flute, or I'm just going to flip a table.
Not this one.
This one's too heavy, but I'll find a table and I'll flip it.
God damn it.
Okay.
I tried to go into this with happiness, sunshine, and
rainbows in my blood and just like feeling the Zen, feeling
the flow, feeling the vibe, and I did not get there, Chris.
So what you're saying is you're lying to the
listeners
and
yourself.
You went into this with malice aforethought, and we both know it.
Okay,
I tried.
An attempt was made.
So I'd like to first acknowledge that the term SuperCloud has been
around since at least 2016, and if you google slash DuckDuckGo
it, you will get a website from Cornell that is an actual software
project to allow For application migrations between clouds.
Having nothing to do with the way it's being used now.
The second hit is actually an MIT web page about a
project they called SuperCloud that was meant to enhance
collaboration between MIT Lincoln Labs, students, and faculty.
So again, nothing to do with this term.
But my point is that the term is not exactly new.
People have thought of it before.
And we can trace the origin of its use to Microsoft.
In the current context, back to a post on SiliconANGLE
called The Rise of Supercloud, which is not written in title
case, just to poke the pendant in me a little bit more.
Thanks.
So, if you're not familiar with SiliconANGLE, and hey, if they can't capitalize
things right, then I can't be bothered with their name capitalization either.
You'll appreciate that if you're looking at the
Google Doc, which, You aren't, but here we are.
Just roll with it.
They are an industry analysis and news firm that is probably best known
for theCube, which is usually recorded live at various tech conferences
with hosts like Dave Valente and John Furrier chatting with vendors,
other analysts, or themselves about what's going on in the tech industry.
Sometimes the microphones are even on.
Usually on.
It's a professional outfit.
They wear suits, Chris.
That's how you know it's serious.
I saw a TV show about that.
Ironically, it was not a serious TV show.
And I used irony properly.
Huzzah.
As someone who has done some work as an analyst, I can
say that your primary job is to make shit up and try to
make it catchy so your brand or your firm gains traction.
I'm sorry, I believe you mean a percentage of my share?
Ouch.
For example, uh, consider the Magic Quadrant from Gartner.
You know it?
You love it?
You might even think there's some hard science behind it.
I assure you, there is not.
For all the talk of qualitative versus quantitative measurement
of vendor products, most of it is just a gut feeling and a guess.
When I say most, I mean all.
Well, you did say magic, so It's in the name.
So analysts, as a job, you have to take multiple briefings a week from vendors,
and you absolutely do not have time to test drive any of these solutions.
In most cases, you do try to apply a skeptical eye to what the
vendor is telling you, but not too skeptical, because you have to
stay in the good graces of the vendor if you want future briefings.
Hmm, that's not a perverse incentive or anything.
Ugh, I mean, it is fraught.
I'll say that.
So, you take the briefing, maybe you read some of the white papers, the
marketing, whatever, you peruse the website, and then you do a quick write
up and move on with to the next briefing that you have on your calendar.
Now, analyst firms make money In two ways, broadly.
The main way is by selling their analysis to companies
who don't want to or can't do the research on their own.
They also make money by doing research for the same
vendors that they are supposed to be impartially judging.
I'm going to admit, it is a weird industry.
I'm not accusing anyone of unethical behavior.
You 100 percent can maintain your morals and still get paid.
But it does introduce the potential for pay to
play and other, shall we say, below board behavior?
So that was quite a tangent.
Why did I even get into all that?
Irish coffee?
Yeah.
Woo!
Uh, no.
The super cloud.
That's, that's where.
Oh, yeah.
Yeah.
Forgot about.
Alright.
So, analyst firms need you, the ostensible
customer, to trust what they are saying.
They need to be thought leaders.
They need to be on the cutting edge of what's happening in the industry.
And there's no better way to do that than making up a new
term and convincing everyone it's useful and relevant.
Gartner has their magic quadrant.
Forrester has the wave.
And I guess SiliconANGLE has rolled out the supercloud?
Rerolled it, I guess.
Rickrolled it?
Because we never got to give it up.
They might never let it down.
I don't know.
Why supercloud?
Didn't we already have enough cloudy terms, Chris?
One would think.
Let's review some of my favorite examples.
Hybrid cloud.
Running applications in your data center and the public cloud.
Multicloud.
Running applications in multiple clouds.
Private cloud.
Running applications in a non public cloud.
Public cloud.
Running applications in a public cloud.
Multitenant environment.
Community Cloud.
Running applications in a cloud that has
really strict rules about who can use them.
Fuuuuuuuuuuuuuuuuck.
Cloud.
How I feel every morning.
We've got a lot of terms here.
that define a lot of ways to deploy and manage applications
and all of them seem to have this cloud term attached.
What's that all about?
Why so much cloud, Chris?
Well, I mean, we're talking about the cloud.
One would assume that the word would show up
every once in a while.
See, the term cloud has been used into oblivion.
If I had to define it, I think of cloud as
an operational model more than anything else.
You know, it's about things like automation, elasticity, self
service, I And Measuring Consumption, you know, that NIST definition.
It wasn't so bad, like, they did a pretty good job.
Yeah, I mean, what ended up happening is that the
language turned Cloud into a verb as well as a noun.
And that's where a lot of the problem comes in as you're mixing definitions.
Which is why we had so many names for things that
don't have all that much difference between them.
Right, but it's different implementations of the same operational model.
Right.
It mostly has to do with where your applications are running.
So, Supercloud, as a term, came to exist because Silicon Angle
analyst John Furrier was trying to invent a term to describe
a trend he and others had observed in the tech landscape.
Simply put, there were a bunch of technology vendors building new platforms
based on the primitives of the public cloud vendors, like AWS, Azure, and GCP.
So, we're talking about Infrastructure as a Service coming from any of
those vendors, or maybe even Platform as a Service, like RDS or Azure SQL.
And these vendors were building higher level abstractions.
And offering those to customers as an alternative of building it themselves.
Now, if that sounds suspiciously like, uh, SaaS, you're not wrong.
Cause it is X as a service X as a service.
Sure.
So I also noticed this trend of what I would call cloud native
companies and products that aren't SaaS in the traditional sense, but
they are using public cloud primitives to build out their platform.
And when I use the word platform, I'm using that.
For a reason, I'm talking about a set of technologies that another company would
use to build their product or application that they would offer to end users.
In the same way that Oracle has a database platform used
by thousands of companies to build their applications.
A super cloud offering would do the same, but with
the added benefit of offering it as a service.
I mean, you can get Oracle as a service.
I feel like a lot of this would be cleared up
in 30 seconds with a whiteboard demonstration.
It might.
Since this is an audio medium, I'm going to do
an audio whiteboard, which takes a lot longer.
Pictures of a thousand words, etc.
Yeah.
So the cognitive dissonance here lies in the
difference between a platform and an application.
And I'll be the first to admit that that is a tenuous distinction at best.
And it harkens back to the old defense of, I know it when I see it.
Maybe some examples are in order.
That might clarify things.
So, an example would be Snowflake.
They built out a data warehouse and analytics
platform that sits astride the public clouds.
Now, your average end user is not going to directly interface with Snowflake.
Instead, they're going to use an application that leverages
the Snowflake platform, but that fact is abstracted
from the end user, hidden from the consumer entirely.
Another example is, uh, Aviatrix.
They are building a multi cloud networking abstraction solution.
Now, you might use that as the transport for your applications,
but again, this is never going to be customer facing.
The customer who's using your apps has no idea that you're using
Aviatrix to manage the network transport across your clouds.
Now, the differentiation here is traditional software
as a service is generally end user or customer facing.
Think Canva, Office 365, NetSuite, etc.
All of these offerings are consumed by non
technology professionals to get their work done.
In some cases, solutions like Salesforce.
com have drifted into the platform territory, But as I said,
the distinction between platform and SaaS can be a bit tenuous.
Especially for the Salesforce example.
Like that might even end up being its own definition.
Salesforce as a service.
Well, the thing about Salesforce is they bought a whole platform.
So what's the name of it?
Heroku.
They bought Heroku.
So that was like, Hey, this is literally a platform
people build applications on on a regular basis.
So they do have that, but also we're going
to call this Salesforce too.
Also within the larger Salesforce umbrella, they bought like a web
application firewall company, I think at some point, and they also.
Just their actual service has a bunch of programming platforms inside of it.
So it's just like, yes, it is a platform, but it's also a service.
It's confusing.
Anyway.
Maybe they're a cloud.
Maybe they're a service.
Oh god.
It's a cloud inside a cloud.
Dear god.
So, There is a working group definition of Supercloud
you can check out, links in the show notes, etc.
And it attempts to put some formal constraints around
the term Supercloud and what it is intended to mean.
And they allow, they lay out three key characteristics or essential
properties that a Supercloud offering would have to include.
First one, run a set of services across more than one cloud.
Maybe.
Okay, Purpose Built SuperPaaS Layer is the second one, which is a new term!
SuperPaaS!
Fun!
Wait, so we're using a new term to define
a new term?
Yes.
Yes, we are.
Mm hmm.
I swear this is not an Ouroboros type situation.
The last one is Metadata Intelligence.
You probably want me to define that too.
I think we should.
Yeah, let's take it from the top.
Okay.
So the first one is pretty intuitive.
You know, it's a service.
It's multi-cloud.
It's multi-cloud, right?
This application is available across multiple clouds.
Okay, I get that.
That's easy enough.
The second one is a new made up term called Super
Paths Super platform as a service, which no.
Nope.
Stop it.
That's also just multi cloud.
They're trying to describe a platform that spans multiple
clouds and hides the underlying cloud primitives.
That's what a platform is.
We have a word for it.
Don't need a new one.
It would just be a multi cloud platform.
Yes.
The third property simply means that the SuperCloud offering
is aware of the underlying components and it can make informed
decisions based on regionality, cost, reliability, etc.
And that's um, that's just cloud native.
Already has a term.
Right.
Okay.
So those are the properties.
There's also three deployment models.
Single cloud instantiation, which really seems
to contradict the first essential property.
Yeah.
Multi cloud slash multi region and global instantiation,
which again seems like the same thing twice.
So that's a super cloud of super clouds?
Of super clouds.
Nice.
It's a super, super set.
Which actually just gets you back to the empty
set, which is different than the null set.
Ah.
It's too early in the morning for math, we're just going to power on through.
Putting that CS degree to work, baby.
No mention of transubstantiation, which, weird, but okay.
Trying to pick those terms apart.
The key here, I think they're trying to make, is the
distinction of the control plane versus the data services.
So, the deployment model is mostly referring
to how the control plane itself is deployed.
As a consumer, I shouldn't have to care about that at all.
As long as your control plane is available and I
can access it, why do I care how it's deployed?
Give me the right number of 9s and everything
else is just an implementation detail.
Like for instance, Does Office 365 tell me where their control plane is running?
No!
Not even if you ask.
Exactly.
So that's it.
We get three properties of the super cloud and three deployment models.
That contradict each other.
So if I can summarize.
Supercloud is a distributed platform used to build
applications from abstractive cloud primitives.
It's a platform for building applications.
It's a platform.
You ever say the same word so many times
that it just kind of starts to lose meaning?
Platinum, Constantly, Orange, Toy Boat, Toy Boat, Toy Boat, Toy Boat, Toy Boat.
So Supercloud is as Supercloud does.
Does this new term need to exist?
No.
Sweet.
Episode over.
Bye.
Good work.
Thanks.
Just kidding.
Let's go get sandwiches.
In the working definition document, they address that very question in an FAQ.
And I thought I would just quote it.
Quote, There is broad agreement that clouds in
the 2020s are different from clouds in the 2010s.
Lot more cumulonimbus, I think.
Sorry, that was an aside.
That something new is happening within the AWS and other cloud ecosystems.
beyond traditional IaaS and PaaS, and isn't just SaaS running in the cloud.
Supercloud is an attempt to describe a new architecture that integrates
infrastructure, unique platform attributes, and software to solve
specific problems that public cloud vendors aren't directly addressing.
Supercloud is an evocative term that
catalyzes debate, conversation, and thought.
So, that's the end of the quote.
Basically, what that tells me is, this is a term for stirring the pot.
It's exciting.
It gets the people going.
It's a term that elevates the profile of those who invented it.
It's a term that can be trademarked and used for marketing purposes, if desired.
And it's desired.
Right.
What do you mean, if?
It's a term that is both useful for debate and useless for anything practical.
It's the change my mind Steven Crowder meme.
Worse yet, it might even be the Ben Shapiro of cloud terms.
Whoa, too far.
Whoa.
Yeah.
Okay.
Fair enough.
That might've been too far.
I'll take that one back.
No one deserves to be called the Ben Shapiro of anything.
Thank you.
Okay.
And shit, you know, it's working.
I'm talking about it.
It was discussed in an it round table at
cloud field day 15 link in the show notes.
I've heard it mentioned on podcasts in articles and blog posts.
Now, most of them are dismissive of the term at best, but They are engaging.
Does that make me culpable?
Am I part of the problem?
I've been telling you that for years.
That's because we're all pundits now, Chris.
Gotta feed the content machine.
If you're an analyst or a marketing firm, supercloud is a term that will likely
be used to imply or imbue some mystical properties on a product or service.
Leverage the supercloud with pedantry from Misanthropy Inc.
Subsidiary of Salesforce.
Probably.
They just acquired us.
1.
6 million.
Is it useful to practitioners?
Probably not.
If I am an application architect and I need a data platform, I can evaluate
Snowflake, AWS Aurora slash Redshift, and Oracle and decide which one meets
my requirements without throwing some kind of weird terminology into the mix.
If I'm, I don't know, working on a platform team at an enterprise,
I might be interested in a super cloud type product to integrate
into the platform I offer to my product teams in my organization.
But again, the super cloud terminology itself, not all that useful.
Especially since we've already got words for all of that.
I know.
Does the term group similar offerings into a category
where they can be compared fairly on their merits?
Not really, which would actually be a useful thing to do.
What does NetApp vs.
Snowflake vs.
VMware have to do with each other?
Ooh, ooh, we can compare the swag bags we get at conferences.
Ooh, that's true.
In my experience, NetApp has been the best with the swag.
I was going to say one time
I
got a wind up
dancing robot.
I got a like a raspberry pi robot assembly from them.
Yeah, stop bragging about how many raspberry pies people give you.
So many, so many.
None of these vendors have anything to do with each
other, but they all could have a super cloud product.
So what we're really doing here is grouping together disparate product offerings
and rolling them into a useless category for comparison and evaluation.
So I think it also fails as a term used by analysts as well.
Yeah, which is why I have a feeling, A, if it does
continue to be used, it's going to evolve again.
But B, I kind of feel like it's just not
going to get used because it's not precise.
Well, that's never stopped
anybody.
But I mean, at the end of the day, it is what it is.
Which is everything and nothing at the same time, which is a paradox.
Isn't it ironic?
Don't you think I do and Atlantis would agree that this is really just a
marketing term with a touch of self promotion from Silicon angle And we already
have a term for what they're talking about and it's called cross cloud platform.
What are you multi cloud?
I'm building a multicloud Cloud is great.
Yes, I'm building a multi-cloud platform.
Done.
Did it.
Have a term.
Don't need another one.
Thanks a lot.
High five.
Nailed it.
Boom.
Nailed it.
So I will be happy to never mention Supercloud again.
Like a fish?
Hmm.
I like fish.
Left shark?
Right shark?
Left shark, right shark, left shark, right shark.
Okay.
Landing round?
Sure.
This is so gross.
Amazon announces pre order for Halo Rise because
Bezos literally wants to watch you sleep.
This has nothing to do with the Halo show.
No, it has to do with the Halo stream of products from Amazon.
I don't know what the hell that is.
Okay.
It's a whole, can I just talk?
Maybe?
Last month brought the announcement that Amazon wanted to buy
iRobot, the company that is most famous for the Roomba, which Bad
enough that now Amazon wants to know what your house looks like.
Now they're releasing a sleep tracker slash alarm clock
combination that observes your night moves from the
bedside table, and of course, can integrate into Alexa.
Will it help me work on my night moves?
So you could, in theory, have an automation for the Halo Rise
to, I don't know, alert a smart outlet to power on as you wake
up, thus brewing coffee at the moment you gain consciousness.
Why not?
I have little to say about the sleep tracker itself.
Except to remind people that all consumer sleep tracking
devices are based on inference and averages, and most sleep
doctors recommend against relying on them for anything at all.
If you're having problems, go get a sleep study.
For example, my sleep tracker has recorded me having exactly zero
REM sleep for the past five days, and that can't possibly be accurate
because I feel completely biscuit doppelganger banana nosedive.
I'm back.
The problem I have with this is Amazon's increasing intrusions into
all aspects of our lives, and that is by their own admitted design.
They want their Skynet to be All of our individual Jarvis's.
They also want to misuse all of our most personal information for their profit.
For me to trust this kind of uniform visibility into my life would require
Amazon to have ever been responsible regarding people's PII in the past.
You would think that this would be, I don't know, important to Amazon?
Well, TLDR, it isn't.
Unfortunately, much like Facebook, keeping your data safe is a
bar that Amazon has consistently and repeatedly failed to clear.
Yay?
No, not yay.
Reason number zero, not to run Exchange yourself.
Late on Thursday, September 29th, Microsoft announced a zero day
vulnerability for Microsoft Exchange servers that ranked a whopping 9.
8 on the CVE scale.
So close to 10.
Thought you could have done it.
You know, with a little more gumption, they could have gotten there.
So that's um, bad.
Yes, I have it written down here.
That is bad.
How bad is it?
There are roughly 220, 000 exchange servers running out in the
wild that are internet accessible and vulnerable to the exploit.
Or exploits, rather, since this is a combo attack.
The first is a server side request forgery vulnerability which allows the
attacker to trigger the second, A remote code execution through PowerShell.
Attackers will need valid credentials of at least one email user to
successfully run this attack, so hopefully none of your users have weak or
reused passwords and can't be fooled by phishing or social engineering attacks.
As far as we know, this set of exploits only affects on premises
Exchange servers and not Microsoft's Exchange Online service.
However, if you happen to be running in hybrid mode, which I know
a lot of you are, that pesky hybrid server that you put in a corner
and forgot about, that is still very much vulnerable to this attack.
Microsoft has an advisory post up that details the
vulnerabilities and suggested mitigation strategies.
They all basically boil down to adding a URL rewrite to prevent access
to PowerShell through the AutoDiscover service and disabling PowerShell
access for non admin users, which you probably should have done anyway.
As of this recording, there is no patch for the vulnerability,
but Microsoft is scrambling to get one out the door ASAP.
On an unrelated note, I am available to assist with Office
365 migrations for the low, low price of 400 an hour.
Send inquiries via Carrier Pigeon to NEDS, Northeast
Bay Station Care of Cybernetics Incorporated.
A subsidiary of Salesforce.
A subsidiary, uh,
OpenAI removes waitlists and gives full immediate access to DALI.
Man, the world of AI generating apps is moving fast.
Once upon a time, we had only ever heard of DALI.
Well, I mean, really it was crayon because DALI was only
available to a select few artists, technologists, AI researchers.
That all changed this week though.
OpenAI has decided to grant full public access
to DALI, completely removing the waitlist.
According to OpenAI, this is to expand DALI's capabilities
through widespread use and training, with the company saying
effectively, we need to put it out into the world and let it learn.
Realistically, though, this is probably because competitors in the
AI image generating space, such as Midjourney and Stable Diffusion,
are absolutely eating Dali's lunch when it comes to popularity.
The decision feels fraught, as OpenAI wasn't supposed to just chase users.
The company was designed to work for the benefit
of all humanity and other such high minded goals.
Many hand wringing Twitter users have said that this is going to
be instantly problematic, as this widespread access could lead
to misuse, such as creating offensive or pornographic images.
There is also concern that OpenAI could be overwhelmed with requests,
and that the quality of images Generated could suffer as a result.
Twitter user, at Tim O'Brien, states, The accumulation of ethical debt will
be immediate, while the mop up of the resulting mess will go on in perpetuity.
Love it.
Doesn't that just
describe society, though?
Really, really does.
C and C are looking mighty rusty.
Or rather, they aren't.
Now I'm going to say this up front.
Programming languages don't die.
Just ask any COBOL programmer and they'll answer
in the affirmative all the way to the bank.
So while the death of C or C is not exactly nigh, There is a
young upstart taking the systems programming world by storm.
Rust.
The Rust programming language is considered memory safe by default, meaning
that it won't allow you to make common memory management mistakes like
invalid heap and stack access, memory leaks, and mismatched memory allocation.
These are the kinds of errors that make up the vast majority of CVE
security problems, and it is all too easy to do so in C or C Rust was
designed with security in mind, while still supporting lower level
programming, and for that reason, it is considered a suitable replacement.
The tipping point for many was the coming inclusion
of Rust in the Linux kernel, starting with version 6.
1.
Side note, 6.
0 dropped this past week as expected.
Now, Mark Russinovich, the CTO at Microsoft Azure, has
said that all of his new projects will be written in Rust.
And, as goes Russinovich, so goes Microsoft.
In fact, Microsoft has admitted that upwards of 70 percent
of its CVEs can be traced back to memory unsafe bugs.
Now, that doesn't mean that anyone's going to go rewrite
the Windows kernel in Rust tomorrow, but future development?
We could definitely see a Rustacean creation in 2025.
Totally unrelated note, guess who started learning Rust this week?
Definitely wasn't you.
You're not a learner.
That's true.
I know Kung Fu.
You're wearing a shirt that says, down with books.
That's right.
Videos only.
And podcasts.
Podcasts are better in every way.
Live it, learn it, love it.
Google, moving forward with Manifest V3
mandate, much to society's general disgust.
Advertising company Google happens to be in charge
of the world's most popular browser, Chrome.
Recently, advertising company Google made a dramatic change to the code base
of Chrome to make it harder to use ad blocking and privacy enhancing add ons.
This is solely and exclusively because Google is an advertising
company first and they can't have us running around blocking
ads or protecting our PII from bad actors now, can they?
Not when that shit can be monetized.
Now, a manifest is simply the underpinnings of
how a browser works with third party extensions.
Manifest v3 changes a lot of APIs and operating procedures to the extent
that extensions written under manifest v2 are incompatible with v3.
In fact, a lot of the processes that were made possible by v2, particularly
ones used by the aforementioned ad blocking and privacy enhancing
extensions, are now much more difficult to implement, some impossible.
This is allegedly being done to enhance security.
And I'm sure it's a total coincidence that advertising company
Google made the biggest changes to the ad blocking functionalities.
And in January 2023, it will be mandatory in Chrome to use only version 3.
It's enough to make people want to switch.
And this time, they might actually do it.
Many third party browser companies such as Brave, Firefox,
and even Chromium based Vivaldi have announced that they
will continue to support v2 extensions indefinitely.
Oh, you sweet summer child.
You really think people are going to switch their browsers?
Speaking of Google, Stadia fragged by friendly fire.
There's an absolutely fire post on TechCrunch about the
unexpected death of Stadia that I recommend everyone go read.
Back in the pre COVID times of 2019, when Chris and
I had an eerily similar podcast, we were skeptical.
If not downright dismissive and derisive towards Stadia.
This was both on technical grounds, the required bandwidth for clients and cost
of running at the edge was probably a non starter, and on historical grounds, i.
e.
Google is unlikely to fight a protracted battle in a crowded space, or really
keep any product going for any significant amount of time, Google Reader.
Rest in peace.
Too soon.
Even so, the platform launched with some AAA titles and a few exclusives.
Google seemed to be making the right moves by creating an in house
game studio and hiring people from the games industry, most notably
Phil Harrison, previously at Microsoft and Sony Computer Entertainment.
However, after the fanfare and confetti settled in
November 2019, the sheen immediately started to fade.
Sales were mediocre.
Marketing was all but non existent, Stadia disappeared from Google
presentations, and the in house studio was shuttered in February of 2021.
They are aware that typical AAA games take at
least four years to develop and release, right?
Right?
Oh, the writing was on the wall, and yet Stadia limped
along for another 20 months, loudly denying the inevitable,
before Google finally gave up the ghost last week.
Stadia will officially shutter in 2023, provide refunds
for those who purchased hardware, and stop charging
those with pro subscriptions during the wind down period.
Alas, another service killed by Google.
I wonder if there's a site tracking that sort of thing.
That site
is getting large.
And it's growing in popularity every time another product is killed by Google.
Which there are so, so, so many.
Hey, thanks for listening or something.
I guess you found it worthwhile if you made it all the way to the end.
So congratulations to you friend.
You accomplished something today.
Now go for a hot air balloon ride and compliment a cloud.
Make it feel super.
You've earned it.
You can find me or Chris on Twitter at Ned1313 or
Hainer80 respectively, or follow the show at Chaos
underscore Lever if that's the kind of thing you're into.
Show notes are available at ChaosLever.
com if you like reading things, which you shouldn't.
Podcasts continue to be better in every conceivable way.
Shirt's forthcoming for that one.
We'll be back next week to see what fresh hell is upon us.
Ta ta for now.