Refreshing honesty sets the tone for the inaugural CloudOpen conference, which took place in tandem with LinuxCon North America, Sept. 29-31 in San Diego, Calif. The seaside resort location was an interesting backdrop for some heady discussion that may be more generally associated with colder-weather climes, like Boston, New York and Seattle – but hosting events like these is what sunny, seaside towns do best. Plus an attractive location is an added draw for participants and speakers alike.

The combined LinuxCon/CloudOpen show included many valuable keynotes on the state of Linux and cloud, as well as a series of panels, divided into tracks for business, developers, operations and “wildcards.” One CloudOpen panel in particular stood out, both for its noteworthy panelists and insightful discussion. While designated a business track, this session titled “Cloud APIs – the new agent of vendor lock-in” had something for everyone. The diverse array of speakers included Eucalyptus Systems CEO Marten Mickos, Virtustream’s Reuven Cohen, and Apigee’s Sam Ramji. The session was moderated by Cole Crawford, who is both Cloud Advisor to the Linux Foundation and the Storage Project Chair for Facebook’s Open Compute Project. The lively discussion centered on the state of cloud APIs, which, depending on your point of view can be used to enhance or undermine vendor lock-in. As Crawford rightfully points out you can look at APIs in both ways, as a proprietary tool or as a shared resource.

Apigee’s Sam Ramji starts off by referencing Tim O’Reilly’s quote about how the utilization of the service can improve the service, a point exemplified by comparing Google search with Microsoft search. In this scenario, a critical mass of incoming requests provides metadata which can be used to optimize the service itself. Leaders in every vertical industry are not only shifting to become software companies but are moving to become platforms, says Ramji.

The backdrop for this transition has two elements: cloud computing and device ubiquity, from mobile phones to car computers to smart TVs. Writing a unique device-specific experience for each and every unit is impractical to near impossible. So instead a company starts with an API and leverages platform economics. They start with a couple of flagship applications on Android, iOS, and typically a third platform to lead existing partners and new developers to build new applications. “Without the API, you don’t have the right economics,” explains Ramji. It’s about lowering the cost of innovation. On the flip side, it creates a single point of lock-in for the data: “That data’s going nowhere, you can’t get your data out of Twitter,” says Ramji as an example. He cites the current Twitter use agreement, which only allows you to take out 3,250 tweets out of Twitter – subject to change at any time. What are the user rights to data? This important question is often overlooked, and if elements such as these are poorly understood among technical users, what does that say about the consumer market? The situation is not likely to change unless there’s a big push to educate, like with seatbelts or smoking, notes Ramji.

On a somewhat similar bent, Ramji is concerned about the issuing of copyrights and patents in connection with APIs. He urges his colleagues to take collective action on this point, to contact their representatives to ask that they not allow copyrights or patents to apply to Web APIs or to the implementations behind APIs because it will create a “broken world.”

Panel moderator Crawford makes the connection that protecting copyrights and patents is a major part of OpenStack’s raison d’etre – and, perhaps trying to stir the hornet’s nest, asks Eucalyptus CEO Mickos for his take on this. The CEO’s circumspect response is that the business dynamics are beyond that. He believes that while these issues may have repercussions, they are not what’s truly important. Despite this sentiment, Mickos wants it known that he is against software patents, which draws some applause from the roomful of open source compatriots, but he adds that the game is won or lost based on the IT more than the legalese.

As for the issue of lock-in, Mickos is, as always, pragmatic, believing that organizations are either challengers or dominant (or irrelevant). The underdog always wants to talk about avoiding lock-in, but the moment they become dominant, they become greedy and want to drive lock-in. It’s just the nature of companies:

“We can’t say that open source people are for avoidance of lock-in and closed-source people are trying to do lock-in – every dominant player becomes greedy and wants lock-in whether it’s an open source player or a closed source player.”

“There are closed-source players who are challengers who are breaking the lock-ins of others. So it’s detached from the nature of the openness. It’s a function of your own strength – if you can afford to lock people in you will. If you cannot afford, you’ll be a freedom fighter. When you bring Robinhood into the castle, he isn’t Robinhood anymore.”

Crawford wonders where that inflection point lies between open and closed: “Where do the APIs start and stop in terms of innovation?” he asks.

It’s a dichotomy, says Virtustream’s Reuven Cohen, referring to the open and closed approaches. He notes that open environments are continually changing, which creates problems for enterprises who want stability. So the question becomes one of deciding where you want to be locked-in since you can’t avoid it completely. The point of lock-in could be the operating system, a programming environment, or a particular API. Cohen also makes the claim that users will sometimes say one thing and do another. If they really don’t want to be locked-in, they could use an abstraction layer, a meta-API, with different clouds, but most companies just pick a provider, like Amazon, and use it. The message here is that people say they want choice, but often their actions say otherwise.

This prompts Crawford to ask whether the other panelists can envision a future where cloud is completely open – “where we get this wonderful interoperability, compatibility, portability, across SaaS APIs, PaaS APIs, IaaS APIs”?

Mickos suggests that such a future is possible, but it won’t be vendor-driven. “When you have true sustained openness and lack of lock-in, it is because the buyers, the users, the consumers are choosing it and enforcing it,” he states. And this is why Mickos contends that the Amazon EC2 API is the de facto “non-lock-in” standard – once the user has made this choice, not even the inventor can undo it. Vendors use lock-in as a strong argument, but any release will need to come from the consumer.

To take the point a step further, Mickos says it’s easy to not be locked into Oracle, just use the basic SQL language – it’s the additional features that lock you in. This prompts another panelist to make the point that no one wants the lowest common denominator. Cohen responds that it’s the non-standard features that are the differentiators and what leads a user to choose one database vendor or service over another. The additions or support are what create the value.

Crawford next raise the idea of cloud brokers, asking what is the right way to access APIs. Cohen jumps in by saying there is no magic API capable of solving every problem; the solution depends on the needs of the job. It’s also his opinion that brokering adds latency and introduces a single point of failure.

Mickos agrees that it’s important to remember there are different use cases. He reminds everyone that cloud is not exactly like electricity because the demands are so different. Someone needs low latency, or high throughput, or security, or safety or response times – and these needs will dictate machine layers or native or using a broker which means less lock-in, but adds latency. Whatever choice is made, there will always be a tradeoff between at least two things, imparts Mickos. However, this is where he sees the most promise in APIs because it enables a flexibility of combinations.

“In the last 10-20 years, it was all about the source code. We were building a stack, the LAMP stack, and if you knew the source code, you could win. Now it’s so complex, that it’s no longer about the stack, it’s about the APIs. You can’t run on just MySQL, it’s about Cassandra, Sphinx, MongoDB, and so on, in the same application. The only way to keep it dynamic is APIs, that’s why APIs are the promise, but will still carry the exact same challenges and technical tradeoffs,” says Mickos.

Cohen adds that there are so many different devices that there has to be a lowest common denominator way to get to it. The API is the as-a-service aspect of software these days. Ramji jumps in with the fact that there is universal, ubiquitous connectivity, an HTTP stack on all operating systems – finding a way to reuse it to be able to let clouds and devices talk to each other could be one way forward.

Ramji steers the conversation back to the subject of brokers, making the point that they do not have to add latency. He notes that one of the challenges for providing a data feed is being able to deliver a common current and modulating it to different devices, being able to take a common data pool and slice and dice that as appropriate to a given device. For example, an iPhone prefers to sip that data – a DVR wants gulps. “This requires caching and indexing and lots of state at massive scale to be able to give the right version of the right thing on the fly. It’s mass customization,” says Ramji.

Cohen reiterates the point that anytime a decision is made it introduces latency, to which Ramji responds that it’s necessary to look at the cost of the entire system – end-to-end processing, with the goal of obtaining the best possible user experience.

Changing gears a bit, Crawford directs the panel to answer the big question: what’s next? Mickos jumps in with the answer: data! The world is collecting so much data, disseminating it, collecting it, and mining it. The mass sum of data is not important, it’s the metadata, it’s the way you slice and dice it. We’re starting to see the emergence of data products, says Ramji, and there’s a two-fold issue on why they have to create a level of openness – to bring lots of apps in – and lock-in – because if they lose the requests, the value is lost.

Returning to an earlier theme, Ramji says challengers will band together around interoperability, which creates progress on the open source front. With this in mind, it’s perhaps not surprising that it’s the tier 2 providers who desire federation, who want to take their networks and expose them as a shared API and capitalize on this pooling of resources. The leaders, on the other hand, will fend off interoperability until forced to do otherwise.

Next on the agenda are APIs and security. Crawford refers to the fact that government helped drive open source forward and wonders what the implications are for APIs. Cohen suggests that since APIs create a firehose, this is definitely an important area for security experts to focus on.

Ramji points to several reasons why APIs, by breaking the Web model, have the potential to ultimately be much more secure than current practices. Since sessions no longer exist, the whole expectation around security is different. Every single request has to be accompanied by a token, which is opaque and can be encoded for multiple dimensions of security: the developer of the app, the user, the device, the location – these can all be encoded or stipulated and then analyzed in audits.

With 10 minutes left, Crawford poses some purposely provocative questions about the OpenStack API, namely, does OpenStack as an API interfere with or offer advantages over Eucalyptus, and can Eucalyptus benefit from the OpenStack API?

Ramji says he will be “super-interested” in the OpenStack API when major providers actually adopt it, until then he’s keeping his focus on the Eucalyptus/AWS API. He says today the money is in providing AWS compatibility:

“I’m not getting a lot of requests for copying OpenStack APIs. I’m getting a lot of requests for, ‘Hey we implemented OpenStack, could you copy the AWS APIs and get a compatibility layer in place so that we can get those advantages.’ “

The general panel consensus seems to be that OpenStack is making a mistake by not supporting the AWS API, but that it may not be a fatal mistake. Cloud pioneer Cohen adds that when he was CEO of Enomaly (the company he founded in 2004) he was dead set against adopting the Amazon API, but in hindsight, he says he should have gone the “Eucalyptus route.” He admits to being too hung up on whether it was open or closed instead of following the money and what the user wants.

Mickos sees a paradox in the fact that there’s this obvious dominant API on one hand (AWS) and all this excitement about OpenStack (which “doesn’t have a credible API”) on the other hand – what’s the truth, he wonders.

OpenStack is not just an API but a club, says Cohen, so the value isn’t solely the API – it’s the accumulation of some of the biggest names in business and government – a substantial mindshare.

Crawford recalls the Mirantis quote about OpenStack being the Soviet Union of the cloud. Rackspace is using OpenStack APIs, but what about their customers who want to use the AWS API?

“People care about having an open source cloud datacenter operating system. So we’re seeing AT&T standardize on OpenStack. We’re seeing Dell standardize on OpenStack,” says Rahmi. “What open source did…is provided a most efficient mechanism in human history for the challengers to get together and upset the leaders.”

But will they be federated hyper-compatible with Amazon, asks Crawford?

Rahmy responds: “It’s so much worse than that, they just want the software to work – it’s so hard to build a cloud/datacenter operating system, let alone learning how to deploy that stack. We have seen customers repeatedly fail to implement clouds and then they start bringing in OpenStack committers, and they say this is incredible, it works!”

Isn’t that what this is all about – whether it’s a workload, an application, or a datacenter – there’s a user, a developer, or a company that just needs it to work.