What is SASE? A cloud service that marries SD-WAN with security

 Secure Access Service Edge (SASE) is a network architecture that combines software-defined wide area networking (SD-WAN) and security functionality into a unified cloud service that promises simplified WAN deployments, improved efficiency and security, and application-specific bandwidth policies.

First outlined by Gartner in 2019, SASE (pronounced “sassy”) has quickly evolved from a niche, security-first SD-WAN alternative into a popular WAN sector that analysts project will grow to become a $10-billion-plus market within the next couple of years.

Market research firm Dell’Oro group forecasts that the SASE market will triple by 2026, topping $13 billion. Gartner is more bullish, predicting that the SASE market will grow at a 36% CAGR between 2020 and 2025 to reach $14.7 billion by 2025.

What is SASE?

SASE consolidates SD-WAN with a suite of security services to help organizations safely accommodate an expanding edge that includes branch offices, public clouds, remote workers and IoT networks.

While some SASE vendors offer hardware appliances to connect edge users and devices to nearby points of presence (PoPs), most vendors handle the connections through software clients or virtual appliances. SASE is typically consumed as a single service, but there are a number of moving parts, so some SASE offerings piece together services from various partners.

On the networking side, the key features of SASE are WAN optimization, content delivery network (CDN), caching, SD-WAN, SaaS acceleration, and bandwidth aggregation. The vendors that make the WAN side of SASE work include SD-WAN providers, carriers, content-delivery networks, network-as-a-service (NaaS) providers, bandwidth aggregators and networking equipment vendors.

The security features of SASE can include encryption, multifactor authentication, threat protection, data leak prevention (DLP), DNS, Firewall-as-a-Service (FWaaS), Secure Web Gateway (SWG), and Zero Trust Network Access (ZTNA). The security side of SASE relies on a range of providers, including cloud-access security brokers, cloud secure web gateways providers, zero-trust network access providers, and more.

The feature set will vary from vendor to vendor, and the top SASE vendors are investing in advanced capabilities, such as support for 5G for WAN links, advanced behavior- and context-based security capabilities, and integrated AIOps for troubleshooting and automatic remediation.

Ideally, all these capabilities are offered as a unified SASE service by a single service provider, even if certain components are white labeled from other providers.

What are the benefits of SASE?

 Because it is billed as a unified service, SASE promises to cut complexity and cost. Enterprises deal with fewer vendors, the amount of hardware required in branch offices and other remote locations declines, and the number agents on end-user devices also decreases.

SASE removes management burdens from IT’s plate, while also offering centralized control for things that must remain in-house, such as setting user policies. IT executives can set policies centrally via cloud-based management platforms, and the policies are enforced at distributed PoPs close to end users. Thus, end users receive the same access experience regardless of what resources they need, and where they and the resources are located.

SASE also simplifies the authentication process by applying appropriate policies for whatever resources the user seeks, based on the initial sign-in. SASE also supports zero-trust networking, which controls access based on user, device and application, not location and IP address.

Security is increased because policies are enforced equally regardless of where users are located. As new threats arise, the service provider addresses how to protect against them, with no new hardware requirements for the enterprise.

More types of end users – employees, partners, contractors, customers – can gain access without the risk that traditional security – such as VPNs and DMZs – might be compromised and become a beachhead for potential attacks on the enterprise.

SASE providers can supply varying qualities of service, so each application gets the bandwidth and network responsiveness it needs. With SASE, enterprise IT staff have fewer chores related to deployment, monitoring and maintenance, and can be assigned higher-level tasks.

What are the SASE challenges?

Organizations thinking about deploying SASE need to address several potential challenges. For starters, some features could come up short initially because they are implemented by providers with backgrounds in either networking or security, but might lack expertise in the area that is not their strength.

Another issue to consider is whether the convenience of an all-in-one service meets the organization’s needs better than a collection of best-in-breed tools.

SASE offerings from a vendor with a history of selling on-premises hardware may not be designed with a cloud-native mindset. Similarly, legacy hardware vendors may lack experience with the in-line proxies needed by SASE, so customers may run into unexpected cost and performance problems.

Some traditional vendors may also lack experience in evaluating user contexts, which could limit their ability to enforce context-dependent policies. Due to SASE’s complexity, providers may have a feature list that they say is well integrated, but which is really a number of disparate services that are poorly stitched together.

Because SASE promises to deliver secure access to the edge, the global footprint of the service provider is important. Building out a global network could prove too costly for some SASE providers. This could lead to uneven performance across locations because some sites may be located far from the nearest PoP, introducing latency.

SASE transitions can also put a strain on personnel. Turf wars could flare up as SASE cuts across networking and security teams. Changing vendors to adopt SASE could also require retraining IT staff to handle the new technology.

What is driving the adoption of SASE?

The key drivers for SASE include supporting hybrid clouds, remote and mobile workers, and IoT devices, as well as finding affordable replacements for expensive technologies like MPLS and IPsec VPNs.

As part of digital transformation efforts, many organizations are seeking to break down tech siloes, eliminate outdated technologies like VPNs, and automate mundane networking and security chores. SASE can help with all of those goals, but you’ll need to make sure vendors share a vision for the future of SASE that aligns with your own.

According to Gartner, there are currently more traditional data-center functions hosted outside the enterprise data center than in it – in IaaS providers clouds, in SaaS applications and cloud storage. The needs of IoT and edge computing will only increase this dependence on cloud-based resources, yet typical WAN security architectures remain tailored to on-premises enterprise data centers.

In a post-COVID, hybrid work economy, this poses a major problem. The traditional WAN model requires that remote users connect via VPNs, with firewalls at each location or on individual devices. Traditional models also force users to authenticate to centralized security that grants access but may also route traffic through that central location.

This model does not scale. Moreover, this legacy architecture was already showing its age before COVID hit, but today its complexity and delay undermine competitiveness.

With SASE, end users and devices can authenticate and gain secure access to all the resources they are authorized to reach, and users are protected by security services located in clouds close to them. Once authenticated, they have direct access to the resources, addressing latency issues.

What is the SASE architecture?

Traditionally, the WAN was comprised of stand-alone infrastructure, often requiring a heavy investment in hardware. SD-WAN didn’t replace this, but rather augmented it, removing non-mission-critical and/or non-time-sensitive traffic from expensive links.

In the short term, SASE might not replace traditional services like MPLS, which will endure for certain types of mission-critical traffic, but on the security side, tools such as IPsec VPNs will likely give way to cloud-delivered alternatives.

Other networking and security functions will be decoupled from underlying infrastructure, creating a WAN that is cloud-first, defined and managed by software, and run over a global network that, ideally, is located near enterprise data centers, branches, devices, and employees.

With SASE, customers can monitor the health of the network and set policies for their specific traffic requirements. Because traffic from the internet first goes through the provider’s network, SASE can detect dangerous traffic and intervene before it reaches the enterprise network. For example, DDoS attacks can be mitigated within the SASE network, saving customers from floods of malicious traffic.

What are the core security features of SASE?

The key security features that SASE provides include:  

- Firewall as a Service (FWaaS)

In today’s distributed environment, both users and computing resources are located at the edge of the network. A flexible, cloud-based firewall delivered as a service can protect these edges. This functionality will become increasingly important as edge computing grows and IoT devices get smarter and more powerful.

Delivering FWaaS as part of the SASE platform makes it easier for enterprises to manage the security of their network, set uniform policies, spot anomalies, and quickly make changes.

- Cloud Access Security Broker (CASB)

As corporate systems move away from on-premises to SaaS applications, authentication and access become increasingly important. CASBs are used by enterprises to make sure their security policies are applied consistently even when the services themselves are outside their sphere of control.

With SASE, the same portal employees use to get to their corporate systems is also a portal to all the cloud applications they are allowed to access, including CASB. Traffic doesn't have to be routed outside the system to a separate CASB service.

- Secure Web Gateway (SWG)

Today, network traffic is rarely limited to a pre-defined perimeter. Modern workloads typically require access to outside resources, but there may be compliance reasons to deny employees access to certain sites. In addition, companies want to block access to phishing sites and botnet command-and-control servers. Even innocuous web sites may be used maliciously by, say, employees trying to exfiltrate sensitive corporate data.

SGWs protect companies from these threats. SASE vendors that offer this capability should be able to inspect encrypted traffic at cloud scale. Bundling SWG in with other network security services improves manageability and allows for a more uniform set of security policies.

- Zero Trust Network Access (ZTNA)

Zero Trust Network Access provides enterprises with granular visibility and control of users and systems accessing corporate applications and services.

A core element of ZTNA is that security is based on identity, rather than, say, IP address. This makes it more adaptable for a mobile workforce, but requires additional levels of authentication, such as multi-factor authentication and behavioral analytics.

What other technologies may be part of SASE?

In addition to those four core security capabilities, various vendors offer a range of additional features.

These include web application and API protection, remote browser isolation, DLP, DNS, unified threat protection, and network sandboxes. Two features many enterprises will find attractive are network privacy protection and traffic dispersion, which make it difficult for threat actors to find enterprise assets by tracking their IP addresses or eavesdrop on traffic streams.

Other optional capabilities include Wi-Fi-hotspot protection, support for legacy VPNs, and protection for offline edge-computing devices or systems.

Centralized access to network and security data can allow companies to run holistic behavior analytics and spot threats and anomalies that otherwise wouldn't be apparent in siloed systems. When these analytics are delivered as a cloud-based service, it will be easier to include updated threat data and other external intelligence.

The ultimate goal of bringing all these technologies together under the SASE umbrella is to give enterprises flexible and consistent security, better performance, and less complexity – all at a lower total cost of ownership.

Enterprises should be able to get the scale they need without having to hire a correspondingly large number of network and security administrators.

Who are the top SASE providers?

The leading SASE vendors include both established networking incumbents and well-funded startups. Many telcos and carriers also either offer their own SASE solutions (which they have typically gained through acquisitions) or resell and/or white-label services from pure-play SASE providers. Top vendors, in alphabetical order, include:

• Akamai
• Broadcom
• Cato Networks
• Cisco
• Cloudflare
• Forcepoint
• Fortinet
• HPE
• Netskope
• Palo Alto Networks
• Perimeter 81
• Proofpoint
• Skyhigh Security
• Versa
• VMware
• Zscaler

How to adopt SASE

Enterprises that must support a large, distributed workforce, a complicated edge with far-flung devices, and hybrid/multi-cloud applications should have SASE on their radar. For those with existing WAN investments, the logical first step is to investigate your WAN provider’s SASE services or preferred partners.

On the other hand, if your existing WAN investments are sunk costs that you’d prefer to walk away from, SASE offers a way to outsource and consolidate both WAN and security functions.

Over time, the line between SASE and SD-WAN will blur, so choosing one over the other won’t necessarily lock you into a particular path, aside from the constraints that vendors might erect.

For most enterprises, however, SASE will be part of a hybrid WAN/security approach. Traditional networking and security systems will handle pre-existing connections between data centers and branch offices, while SASE will be used to handle new connections, devices, users, and locations.

SASE isn't a cure-all for network and security issues, nor is it guaranteed to prevent future disruptions, but it will allow companies to respond faster to disruptions or crises and to minimize their impact on the enterprise. In addition, SASE will allow companies to be better positioned to take advantage of new technologies, such as edge computing, 5G and mobile AI.

https://www.networkworld.com/

How intelligent automation will change the way we work

Automation in the workplace is nothing new — organizations have used it for centuries, points out Rajendra Prasad, global automation lead at Accenture and co-author of The Automation Advantage. In recent decades, companies have flocked to robotic process automation (RPA) as a way to streamline operations, reduce errors, and save money by automating routine business tasks.

Now organizations are turning to intelligent automation to automate key business processes to boost revenues, operate more efficiently, and deliver exceptional customer experiences. Intelligent automation is a smarter version of RPA that makes use of machine learning, artificial intelligence (AI) and cognitive technologies such as natural language processing to handle more complex processes, guide better business decisions, and shed light on new opportunities, said Prasad.

For example, Newsweek has automated many aspects of managing its presence on social media, a crucial channel for broadening its reach and reputation, said Mark Muir, head of social media at the news magazine. Newsweek staffers used to manage every aspect of its social media postings manually, which involved manually selecting and sharing each new story to its social pages, figuring out what content to recycle, and testing different strategies. By moving to a more automated approach, the company now spends much less time on these processes.

“We use Echobox’s automation to help determine which content should be shared to our social media and to optimize how and when it is posted so that the largest possible audience will see it,” Muir said. “Automating in this way has created more time for us to focus on our readers and find new ways to engage our audience.”

Industry watchers predict that intelligent automation will usher in a workplace where AI not only frees up human workers’ time for more creative work but also helps them set strategies and drive innovation. Most companies are not fully there yet but do have numerous opportunities for business process automation throughout the organization.

Business processes that are ripe for automation

Ravi Vasantraj, global delivery head at IT services provider Mphasis, cites several characteristics that make business processes good candidates for automation:

• Processes that deal with structured, digital or non-digital data having definitive steps
• Processes with seasonal spikes that can’t be fulfilled by a manual workforce, such as policy renewals, premium adjustments, claims payments in insurance, and so on
• Processes with stringent service level agreements that need quick turnarounds, such as transactions posting, order fulfillment, etc.

Many companies are automating contract management, added Doug Barbin, managing principal and chief growth officer at Schellman, a provider of attestation and compliance services. “If you consider all the steps needed to draft, send, redline, and execute contracts via email, the use of technology to manage the content, coordinate change approval, and automate the signing process, the savings in time and reduction of errors is significant,” he said.

Beyond contracts, anything that reduces manual interaction for sales is an opportunity. For example, companies are providing chatbots to automate the ability to answer key questions and connect prospects to sales, according to Barbin.

UMC, a mechanical services contractor in Seattle, has automated many of its sales processes, said Bob Frey, director of sales operations. “We’ve automated various sales stages so we can track sales through our pipelines,” he said. “We are able to track what stages the different sales are in. We do this using Unanet CRM by Cosential that’s designed specifically for the construction industry.”

Schellman’s Barbin cites security as another area where automation is making inroads. “In cybersecurity, the mundane often resides in compliance and the need to test controls in an increasingly complex environment,” he said. “There is an entire segment of compliance automation tools that are being built to collect data and perform initial analysis before triaging and passing to [a human] assessor.”

In addition, more organizations are automating the procure-to-pay process in finance and the hire-to-retire process in human resources, said Wayne Butterfield, global lead for intelligent automation solutions at ISG (Information Services Group), a research and advisory firm.

“There are large numbers of tasks in every organization across just about every function that can be automated,” he said. “The question is: What is the technology needed to automate them, and does it make sense from a value realization perspective?”

The contact center is a huge opportunity, not only because of the large number of people completing similar activities with every contact but because of the positive impact it can have on customer experience and agent efficiency, Butterfield said. For example, companies can use automated virtual agents to handle the more routine customer requests, such as balance inquiries, bill payment, or change of address requests. This enables human agents to handle the more complicated customer inquiries that require creative problem solving. Handing these routine tasks off to automated virtual agents shortens the time it takes to resolve customer issues.

Where intelligent automation is taking us

In coming years, the architecture of work will change and become more event-driven, with business processes controlled with intelligent automation and work broken down into discrete tasks that are performed via automation, assigned to a worker, or interactively executed between a robot assistant and a worker, said IDC’s Fleming.

“There will be far fewer task workers using enterprise applications on a constant basis; task work will increasingly be delivered to workers via automation,” she said. “Employees will spend more time digitally enabling themselves by learning how to develop using low-code tools. And employees will spend more time planning, proactively identifying and resolving problems, making decisions, creating, etc. — in other words, performing knowledge work and/or creative work.”

Prasad said that in the years to come, there will be a huge opportunity for automation to be viewed as an indispensable co-worker with a vital role to play in companies’ successes by bringing in opportunities to reinvent individual processes, transform customer and employee experiences, and drive revenue growth.

“Intelligent automation promises to usher in a new era in business, one where companies are more efficient and effective than ever before and able to meet the needs of customers, employees, and society in new and powerful ways,” he said.

Automation pitfalls to watch out for

As organizations automate their business processes, there are many potential hazards to avoid.

“The main one is ignoring your people and underestimating that,” Butterfield said. “Although the outcome is driven by using a technology, everything up to the actual automation of a process is generally very people-focused. A lack of change management will unfortunately cause many issues in the long term. Organizations need to keep their people aligned with their overall goals.”

Security, mainly authentication, is also a key concern, Barbin said. “Any automation, API [application programming interface] or other, requires some means to pass access credentials,” he said. “If the systems that automate and contain those credentials are compromised, access to the connected systems could be too.” To help minimize that risk, Barbin suggests using SAML 2.0 and other technologies that take stored passwords out of the systems.

Another pitfall is selecting only one technology as the automation tool of choice. Typically organizations need multiple technologies to get the best results, said Maureen Fleming, program vice president for intelligent process automation research at IDC.

And when companies decide to automate a business process previously carried out by a person or a team of people, it’s natural to receive some pushback, Newsweek’s Muir said. “Some of our journalists had initially struggled with the idea of letting an algorithm make choices that were previously weighed up and decided by a human,” he said. “There can be a bit of fear around AI and algorithms and a perceived lack of control when processes are suddenly automated.”

Organizations also need to establish clear strategies for business process automation, according to Vasantraj. “Automating the processes without understanding the ROI [return on investment] could lead to business loss, or automations built with multiple user interventions may not yield any benefit at all,” he said.

Take it slow, plan carefully, and listen to your people

Scaling intelligent automation is one of the biggest challenges for organizations, said Accenture’s Prasad. Therefore, it’s crucial that companies be clear about the strategic intent behind this initiative from the outset and ensure that it’s embedded into their entire modernization journeys, from cloud adoption to data-led transformation.

“Intelligent automation is not a race to be the first to implement the latest technology,” he said. “Success depends on understanding people’s needs, introducing new technologies in a way that is helpful and involves minimal disruption, and addressing issues related to new skills, roles, and job content.”

In other words, focusing on people is just as important as focusing on technology, Prasad said. Investments in intelligent automation must be “people first” — designed to elevate human strengths and supported by investments in skills, change management, experience, organization, and culture.

Butterfield agreed that strategic thinking is critical. “My advice would be to start small and think strategically,” he said. “Understand the shape and type of problems you are trying to automate or improve before you move to a technology solution. Work with your people, and ensure you use their tribal knowledge to understand why they do something.”

However, Butterfield cautions that organizations should avoid relying on people’s opinions on how long things take and how many actions they are able to complete in a given timeframe. “Such reliance often causes your business cases to be inaccurate, as they include the agent’s local management bias versus hard data and facts,” he said.

Muir’s advice is to let the results speak for themselves. Once an organization has introduced AI and automation to a process, it should let any time gains and increases in performance be key factors in objectively determining whether the project was a success. “In our experience, using Echobox proved the quantifiable value of automation to our organization, which made it easier for our teams to embrace it,” he said.

“Another piece of advice would be to find a balance that works for your team or your business when it comes to how much automation you use,” Muir said. For businesses that want to dip their toes into automation but are hesitant to automate 100% of their processes and relinquish manual control, there are often ways to just partially automate tasks, he added. “Take a realistic look at where you’re regularly spending time and talent on repetitive, manual tasks and explore how you can automate those parts of your workday.”

How workers can keep pace with automation

Rather than push back, employees should embrace automation and the opportunities it creates for them to provide high-value contributions versus management of administrative tasks, Barbin said.

“For security operations, for instance, leveraging automation allows those watching the networks for attackers to focus on high-priority threats and incidents, keeping up with a faster-moving landscape,” he said. “For compliance, they can move from managing a single US framework, [such as] SOC 2, to global compliance requirements, all from a single management plane.”

IDC’s Fleming noted that most organizations try to upskill and shift workers into new roles when their current roles are automated. They also consolidate new responsibilities into an existing role. And they tend to hire internal candidates for open jobs.  “When offered an opportunity to learn how to develop for automation, process improvement, etc., employees should embrace that opportunity,” she said. “Employees should look for internal upskilling programs as well as external ones.”

Newsweek’s Muir agreed that employees need to remain open to learning about new technologies and keep an open mind about how they can be leveraged. “Technology changes fast, and the tools and systems we use today may not be the same ones five years from now,” he said.

https://www.computerworld.com/

Recession in the US may cool off attrition in IT sector along with revenues

After two years of bumper profits and mind-boggling salary hikes, TCS, Infosys, Wipro and other Indian IT companies are treading on a cautious path as wages and a likely slowdown in demand add to margin woes. However, an economic slowdown in the US might not be all that bad for India IT majors. Experts believe that a potential slowdown could have a positive effect on spitballing wage costs and attrition.

A rapid shift towards digitalisation due to the Covid pandemic in the last two years proved to be a big boon for the Indian IT sector. Giants like TCS, Infosys and Wipro rely predominantly on the US and European markets, which contribute to 80-90% of their revenues.

Recession and high attrition rates – a double whammy for IT majors

Now, with talks of recession in the US and Europe gaining momentum, these IT companies are already under stress. The stress due to economic slowdown in the US and Europe has reflected in the FY23 earnings guidance of these IT companies.

However, an economic slowdown in the US might not be all that bad for India IT majors. Slower revenue growth could curb wage hikes and slow down attrition too, say experts.

“Indian IT companies source a lion’s share of their revenue from the US and Europe. Both these geographies face looming macro pressures in the form of one of the highest inflationary pressures and a slowdown in GDP growth,” said a Motilal Oswal report.

After clocking 19% revenue growth in FY22, the Indian IT sector is headed for two years of moderation, according to a Crisil report.

“Revenue growth is expected to moderate to 12-13% this fiscal and 9-10% in the next, [due to] an expected tightening in corporate capital spends because of inflationary headwinds,” the report stated.

“An economic slowdown in the US and EU could prove to be the inflection point for a cool down in wage hikes and attrition rates as well,” Dhananjay Sinha, head of strategy research and chief economist at JM Financial, told Business Insider India.

Attrition levels remain elevated – another source of margin stress

With attrition levels remaining elevated – Infosys is the worst affected with an attrition rate of 28.4% in Q1 FY23, research firms suggest that the margins will remain stressed, too.

“The companies had reduced their margin guidance at the start of FY23, but we believe continued pressure due to elevated attrition levels is likely to result in margins dropping near the lower end of guidance,” stated a report by ICICI Securities.

Wage hikes and attrition rates could simmer down come December

Sinha explained that wage hikes and attrition rates could simultaneously simmer down by the December quarter this year. The cool down in wages across the IT sector could also help solve the attrition headache for IT companies, he said. With startups facing funding crunch, too, there could be fewer exit routes for IT executives.

Amongst the industry, Sinha said that Infosys could lead the pack as its decision to cut variable pay to 70% has shown it is ready to control costs. Media reports suggested that Wipro delayed payouts for certain employee categories, suggesting that companies are beginning to feel the pressure.

However, in contrast, TCS rolled out 100% variable pay days after Infosys.

An economic slowdown in the US is already showing signs of spillover in the Big Tech revenues – Amazon Web Services, Microsoft Azure and Google Cloud, the world’s top cloud platforms, reported a 7% decline in revenue.

This could have a direct impact on TCS, Infosys and Wipro – according to media reports, the revenues of these IT companies could be impacted by up to 33%.

“A weakening macro environment may translate into lower IT spends and slower growth for Indian IT companies,” stated a report by Motilal Oswal.

Courtesy: https://www.businessinsider.in/

Why Wasm is the future of cloud computing

Wasm may just be the most important emerging technology that you’ve never heard of.  It’s important!

Shorthand for WebAssembly language, Wasm was developed for the web. However, Wasm technology has expanded beyond the web browser. Now organizations are starting to run Wasm on the server side. For example, my company, SingleStore, is using it in our database.

Some think Wasm will replace container technology and the ubiquitous JavaScript.

Whether or not you believe that, Wasm is clearly making an impact on cloud computing. 

Wasm is cross-platform: Making it safer and simpler to bring cloud components together

People use all different kinds of languages to write software. Getting those languages to interact with each other is difficult. Wasm provides a framework in which you can write in whatever language you want. Then it produces a common, simulated machine format.

That format allows components written in various languages—like Rust, C/C++, and Go—to talk to each other. Wasm also provides the ability for server-side systems like databases to embed components from different languages without requiring you to know or care how that module was produced.

Think of Wasm as a universal plugin format. Say you would like to augment your system’s capabilities with a component developed by a third party. Wasm lets you bring the new component into your system without the risks that typically come with integrating add-ons. For example, an external component might crash the system or work in an unexpected way. Wasm mitigates these problems by creating an extremely safe framework for disparate systems and components to interact together.

The cloud is a big driver of Wasm’s expansion. Wasm is a good match for cloud because it’s virtualized and can work in any environment that supports the Wasm runtime. Also, cloud systems are typically composed of many services pieced together and connected in different ways. That can get complicated. But the more you can simplify your cloud environment, the easier it is for various aspects of cloud systems to work together correctly.

Wasm is secure: Lowering risk with its approach to running code and representing functions

In most language runtimes, functions have addresses. Those addresses are executable points in memory. If you are just looking at memory as a bunch of bytes, a function may be indistinguishable from the rest of the memory. This opens the door for people to find the function and inject code into it, or call a function in a privileged way so the function does something that it’s not supposed to do. Wasm’s design eliminates those problems.

Wasm represents functions in a way that is not exploitable. It also runs the code in a sandbox, which mitigates common security problems associated with running untrusted code. Because Wasm encapsulates the program memory in a safe area, nothing can get outside of it and access other places that might affect the host that’s running the program or compromise security.

And with Wasm’s capability-based security model, hosts have complete control over what kinds of privileged operations the Wasm program can run. For example, hosts must explicitly grant access to directories if file access is a requirement.

Wasm is fast: Eliminating what is not needed and enabling greater speed and efficiency

Clearly, Wasm isn’t the first technology people have used to bring things together in a safer, more simplified way. However, Wasm is much faster than some of those other technologies.

Compilers can generate Wasm programs by leveraging the LLVM back end, compiling down to the LLVM intermediate representation. LLVM, or low level virtual machine, is an extracted machine that many languages already compile down to. As a result of this approach, and thanks to many years of community effort around the LLVM project, Wasm programs can be compiled to highly optimized machine code.

At SingleStore, we created the Wasm Space Program—a virtual real-time universe inside a database—to demonstrate how fast and lightweight Wasm is. In this simulation, spaceships use different strategies to replenish energy and fight other spacecraft in a vast, real-time “universe.” That involves a vast amount of data, with more than one million ships in the system and nearly three million database updates per second.

Traditionally, integrating that data and assembling it on a mid-tier layer would require you to pull up a lot of data to the mid-tier. That could introduce a huge amount of lag, and require some complex caching to achieve a real-time response. Rather than taking that approach, each spaceship’s strategy has been written in Wasm, and loaded into the database as a UDF. Each second, each of the spaceships’ strategy functions are invoked to decide on its next move.

There’s nothing on the front end—a JavaScript program running in the browser—that understands these strategies, or anything about the state of the universe. Its job is simply to issue SQL queries directly to the database and graphically present the information that is returned. The database maintains all of the state  information, and because Wasm has allowed the compute to be right next to the data, it’s a lot faster. No mid-tier was even necessary.

But Wasm isn’t all fun and games. You can use it to address countless other applications and use cases. For example, you could use Wasm for sentiment analysis. The kind of complex logic required for sentiment analysis isn’t something that can easily be expressed in a database SQL dialect. So, in order to do this, you usually need to implement it in a more sophisticated language and then bring the data to it by downloading each row of data. Then you need to push the sentiment analysis rating back into the database. That means a round trip for every row in the database you use. If you have millions of rows, that creates a lot of network traffic. But with the way SingleStore has integrated Wasm, you are already in the database, so you don’t incur that overhead.

Wasm is getting better all the time: Creating standards makes it even more powerful

Wasm is already very capable. And with the new technologies and standards that are on the way, Wasm will let you do even more.

For example, the W3C WebAssembly Community Group, with help from members of organizations such as the Bytecode Alliance (of which SingleStore is a member), is currently working on standardizing the WebAssembly System Interface (WASI). WASI will provide a standard set of APIs and services that can be used when Wasm modules are running on the server. Many standard proposals are still in progress, such as garbage collection, network I/O, and threading, so you can’t always map the things that you’re doing in other programming languages to Wasm. But eventually, WASI aims to provide a full standard that will help to achieve that. In many ways, the goals of WASI are similar to POSIX.

Wasm as it now stands also doesn’t address the ability to link or communicate with other Wasm modules. But the Wasm community, with support from members of the computing industry, is working on the creation of something called the component model. This aims to create a dynamic linking infrastructure around Wasm modules, defining how components start up and communicate with each other (similar to a traditional OS’s process model).

Additionally, an emerging standard IDL syntax, called WIT (for WebAssembly Interface Types), will allow people to describe their Wasm interfaces in a language-agnostic way. As a result, binding generators will be able to take what’s in the IDL and compile code that will allow both the Wasm host and the guest to communicate data back and forth in a common way.

Wasm is the future: Providing a faster, more secure, and more efficient way to bring things together

Wasm, though more lightweight, may not replace containers any time soon. But you can expect Wasm to become part of a whole lot of software going forward.

Whether on the server or on the edge, Wasm lets you create custom logic that runs much closer to the data than it could before—and you can do it securely, efficiently, and with greater flexibility.

And now with SingleStore, you can compile your existing programs to Wasm, push them into the database, and run them there. That means that you may not  have to rewrite that code and put it somewhere the data is not. With Wasm technology, you can have the best of both worlds. 

https://www.infoworld.com/

Java 20 begins to take shape

Java 20, the next planned version of standard Java, has its first feature proposal: Pattern matching for switch statements and expressions will be previewed for the fourth time in the forthcoming Java SE (Standard Edition) release.

While OpenJDK’s JDK (Java Development Kit) 20 web page still lists no features for the planned release, the Java Enhancement Proposal (JEP) index cites a fourth preview of pattern matching for switch as targeted for JDK 20. JDK 20 is due next March.

Pattern matching for switch statements and expressions is viewed as a mechanism to enable concise and safe expression of complex data-oriented queries. Previously previewed in JDK 17, JDK 18, and JDK 19, the fourth preview would enable a continued co-evolution with Record Patterns, also included as a preview in JDK 19, allowing for continued refinements based on experience and feedback.

The main changes in pattern matching for switch since the third preview include simplified grammar for switch labels and support for inference of type arguments for generic patterns and record patterns in switch statements and expressions.

Record Patterns has been designated for a second preview but no specific targeted release of Java SE has been set for it yet. In addition to pattern matching and Record Patterns, other possible features for JDK 20 include universal generics and string templates.

JDK 20 is set to be a short-term feature release, with only six months of Premier-level support from Oracle. JDK 21, due in September 2023, will be a Long-Term Support release, backed by multiple years of support.

https://www.infoworld.com/

Condensers promise to accelerate Java programs

Project Leyden, an ambitious effort to improve startup time, performance, and footprint of Java programs, is set to offer condensers. A condenser is code that runs between compile time and run time and transforms the original program into a new, faster, and potentially smaller program.

In an online paper published October 13, Mark Reinhold, chief architect of the Java platform group at Oracle, said a program’s startup and warmup times and footprint could be improved by temporarily shifting some of its computation to a point either later in run time or backward to a point earlier than run time. Performance could further be boosted by constraining some computation related to Java’s dynamic features, such as class loading, class redefinition, and reflection, thus enabling better code analysis and even more optimization.

Project Leyden will implement these shifting, constraining, and optimizing transformations as condensers, Reinhold said. Also, new language features will be investigated to allow developers to shift computation themselves, enabling further condensation. However, the Java Platform Specification will need to evolve to support these transformations. The JDK’s tools and formats for code artifacts such as JAR files will also need to be extended to support condensers.

The condensation model offers developers greater flexibility, Reinhold said. Developers can choose which condensers to apply and in so doing choose whether and how to accept constraints that limit Java’s natural dynamism. The condensation model also gives Java implementations considerable freedom. As long as a condenser preserves program meaning and does not impose constraints except those accepted by the developer, an implementation will have wide latitude for optimizing the result.

To improve startup and warmup time and footprint can be best done by identifying computation that can simply be eliminated, Reinhold said. Failing that, computation can be shifted backward or forward in time. This concept of shifting computation in time is not new. Java implementations already have many features to shift computation. For example, compile-time constant folding shifts computation backward in time from run time to compile time, and garbage collection shifts the reclamation of memory forward in time. Other computation-shifting mechanisms are optional including ahead-of-time computation and class-data sharing.

Project Leyden was under discussion for more than two years before beginning to move forward earlier this year. The project is sponsored by the HotSpot virtual machine and core libraries groups within the Java development domain.

https://www.infoworld.com/

Why the C programming language still rules

The C programming language has been alive and kicking since 1972, and it still reigns as one of the fundamental building blocks of our software-studded world. But what about the dozens of of newer languages that have emerged over the last few decades? Some were explicitly designed to challenge C’s dominance, while others chip away at it as a byproduct of their own popularity.

It's hard to beat C for performance, bare-metal compatibility, and ubiquity. Still, it’s worth seeing how it stacks up against some of the big-name language competition.

C vs. C++

C is frequently compared to C++, the language that—as the name indicates—was created as an extension of C. The differences between C++ and C could be characterized as extensive, or excessive, depending on whom you ask.

While still being C-like in its syntax and approach, C++ provides many genuinely useful features that aren’t available natively in C: namespaces, templates, exceptions, automatic memory management, and so on. Projects that demand top-tier performance—like databases and machine learning systems—are frequently written in C++, using those features to wring every drop of performance out of the system.

Further, C++ continues to expand far more aggressively than C. The forthcoming C++ 23 brings even more to the table including modules, coroutines, and a modularized standard library for faster compilation and more sucking code. By contrast, the next planned version to the C standard, C2x, adds little and focuses on retaining backward compatibility.

The thing is, all of the pluses in C++ can also work as minuses. Big ones. The more C++ features you use, the more complexity you introduce and the more difficult it becomes to tame the results. Developers who confine themselves to a subset of C++ can avoid many of its worst pitfalls. But some shops want to guard against that complexity altogether. The Linux kernel development team, for instance, eschews C++, and while it's now eyeing Rust as a language for future kernel additions, the majority of Linux will still be written in C.

Picking C over C++ is a way for developers and those who maintain their code to embrace enforced minimalism and avoid tangling with the excesses of C++. Of course, C++ has a rich set of high-level features for good reason. But if minimalism is a better fit for current and future projects—and project teams—then C makes more sense.

C vs. Java

After decades, Java remains a staple of enterprise software development—and a staple of development generally. Java syntax borrows a great deal from C and C++. Unlike C, though, Java doesn’t by default compile to native code. Instead, Java's JIT (just-in-time) compiler compiles Java code to run in the target environment. The JIT engine optimizes routines at runtime based on program behavior, allowing for many classes of optimization that aren’t possible with ahead-of-time compiled C. Under the right circumstances, JIT-compiled Java code can approach or even exceed the performance of C.

And, while the Java runtime automates memory management, it's possible to work around that. For example, Apache Spark optimizes in-memory processing in part by using "unsafe" parts of the Java runtime to directly allocate and manage memory and avoid the overhead of the JVM's garbage collection system.

Java's “write once, run anywhere” philosophy also makes it possible for Java programs to run with relatively little tweaking for a target architecture. By contrast, although C has been ported to a great many architectures, any given C program may still require customization to run properly on, say, Windows versus Linux.

This combination of portability and strong performance, along with a massive ecosystem of software libraries and frameworks, makes Java a go-to language and runtime for building enterprise applications. Where it falls short of C is an area where the language was never meant to compete: running close to the metal, or working directly with hardware.

C code is compiled into machine code, which is executed by the process directly. Java is compiled into bytecode, which is intermediate code that the JVM interpreter then converts to machine code. Further, although Java’s automatic memory management is a blessing in most circumstances, C is better suited for programs that must make optimal use of limited memory resources, because of its small initial footprint.

C vs. C# and .NET

Nearly two decades after their introduction, C# and .NET remain major parts of the enterprise software world. It has been said that C# and .NET were Microsoft’s response to Java—a managed code compiler system and universal runtime—and so many comparisons between C and Java also hold up for C and C#/.NET.

Like Java (and to some extent Python), .NET offers portability across a variety of platforms and a vast ecosystem of integrated software. These are no small advantages given how much enterprise-oriented development takes place in the .NET world. When you develop a program in C#, or any other .NET language, you are able to draw on a universe of tools and libraries written for the .NET runtime. 

Another Java-like .NET advantage is JIT optimization. C# and .NET programs can be compiled ahead of time as per C, but they’re mainly just-in-time compiled by the .NET runtime and optimized with runtime information. JIT compilation allows all sorts of in-place optimizations for a running .NET program that can’t be done in C.

Like C (and Java, to a degree), C# and .NET provide various mechanisms for accessing memory directly. Heap, stack, and unmanaged system memory are all accessible via .NET APIs and objects. And developers can use the unsafe mode in .NET to achieve even greater performance.

None of this comes for free, though. Managed objects and unsafe objects cannot be arbitrarily exchanged, and marshaling between them incurs a performance cost. Therefore, maximizing the performance of .NET applications means keeping movement between managed and unmanaged objects to a minimum.

When yo can’t afford to pay the penalty for managed versus unmanaged memory, or when the .NET runtime is a poor choice for the target environment (e.g., kernel space) or may not be available at all, then C is what you need. And unlike C# and .NET, C unlocks direct memory access by default. 

C vs. Go

Go syntax owes much to C—curly braces as delimiters and statements terminated with semicolons are just two examples. Developers proficient in C can typically leap right into Go without much difficulty, even taking into account new Go features like namespaces and package management.

Readable code was one of Go’s guiding design goals: Make it easy for developers to get up to speed with any Go project and become proficient with the codebase in short order. C codebases can be hard to grok, as they are prone to turning into a rat’s nest of macros and #ifdefs specific to both a project and a given team. Go’s syntax, and its built-in code formatting and project management tools, are meant to keep those kinds of institutional problems at bay.

Go also features extras like goroutines and channels, language-level tools for handling concurrency and message passing between components. C would require such things to be hand-rolled or supplied by an external library, but Go provides them out-of-the-box, making it far easier to construct software that needs them.

Where Go differs most from C under the hood is in memory management. Go objects are automatically managed and garbage-collected by default. For most programming jobs, this is tremendously convenient. But it also means that any program that requires deterministic handling of memory will be harder to write.

Go does include the unsafe package for circumventing some of Go’s type handling safeties, such as reading and writing arbitrary memory with a Pointer type. But unsafe comes with a warning that programs written with it “may be non-portable and are not protected by the Go 1 compatibility guidelines.”

Go is well-suited for building programs like command-line utilities and network services, because they rarely need such fine-grained manipulations. But low-level device drivers, kernel-space operating system components, and other tasks that demand exacting control over memory layout and management are best created in C.

C vs. Rust

In some ways, Rust is a response to the memory management conundrums created by C and C++, and to many other shortcomings of these languages, as well. Rust compiles to native machine code, so it’s considered on a par with C as far as performance. Memory safety by default, though, is Rust’s main selling point.

Rust’s syntax and compilation rules help developers avoid common memory management blunders. If a program has a memory management issue that crosses Rust syntax, it simply won’t compile. Newcomers to the language—especially coming from a language like C, that provides plenty of room for such bugs—spend the first phase of their Rust education learning how to appease the compiler. But Rust proponents argue that this near-term pain has a long-term payoff: safer code that doesn’t sacrifice speed.

Rust's tooling also improves on C. Project and component management are part of the toolchain supplied with Rust by default, which is the same as with Go. There is a default, recommended way to manage packages, organize project folders, and handle a great many other things that in C are ad-hoc at best, with each project and team handling them differently.

Still, what is touted as an advantage in Rust may not seem like one to a C developer. Rust’s compile-time safety features can’t be disabled, so even the most trivial Rust program must conform to Rust’s memory safety strictures. C may be less safe by default, but it is much more flexible and forgiving when necessary.

Another possible drawback is the size of the Rust language. C has relatively few features, even when taking into account the standard library. The Rust feature set is sprawling and continues to grow. As with C++, the larger feature set means more power, but also more complexity. C is a smaller language, but that much easier to model mentally, so perhaps better suited to projects where Rust would be too much.

C vs. Python

These days, whenever the talk is about software development, Python always seems to enter the conversation. After all, Python is “the second best language for everything,” and unquestionably one of the most versatile, with thousands of third-party libraries available.

What Python emphasizes, and where it differs most from C, is favoring speed of development over speed of execution. A program that might take an hour to put together in another language—like C—might be assembled in Python in minutes. On the flip-side, that program might take seconds to execute in C, but a minute to run in Python. (As a good rule of thumb, Python programs generally run an order of magnitude slower than their C counterparts.) But for many jobs on modern hardware, Python is fast enough, and that has been key to its uptake.

Another major difference is memory management. Python programs are fully memory-managed by the Python runtime, so developers don’t have to worry about the nitty-gritty of allocating and freeing memory. But here again, developer ease comes at the cost of runtime performance. Writing C programs requires scrupulous attention to memory management, but the resulting programs are often the gold standard for pure machine speed.

Under the skin, though, Python and C share a deep connection: the reference Python runtime is written in C. This allows Python programs to wrap libraries written in C and C++. Significant chunks of the Python ecosystem of third-party libraries, such as for machine learning, have C code at their core. In many cases, it isn't a question of C versus Python, but more a question of which parts of your application should be written in C and which in Python.

If speed of development matters more than speed of execution, and if most of the performant parts of the program can be isolated into standalone components (as opposed to being spread throughout the code), either pure Python or a mix of Python and C libraries make a better choice than C alone. Otherwise, C still rules.

C vs. Carbon

Another recent possible contender for both C and C++ is Carbon, a new language that is currently under heavy development.

Carbon's goal is to be a modern alternative to C and C++, with a straightforward syntax, modern tooling and code-organization techniques, and solutions to problems C and C++ programmers have long faced. It's also meant to provide interoperation with C++ codebases, so existing code can be migrated incrementally. All this is a welcome effort, since C and C++ have historically had primitive tooling and processes compared to more recently developed languages.

So what's the downside? Right now Carbon is an experimental project, not remotely ready for production use. There isn't even a working compiler; just an online code explorer. It's going to be a while before Carbon becomes a practical alternative to C or C++, if it ever does.

Courtesy: https://www.infoworld.com/