What inspires me to bring this up now is the press around Microsoft Sharepoint. Apparently, there’s long been a SaaS version of Sharepoint for big firms, and now Microsoft is rolling it out for everybody. Now, I haven’t read the press releases, which weren’t sent to me by anybody at Waggener-Edstrom and are not easy to find on Microsoft’s web site. But the reporting doesn’t seem to mention partners, except in the negative. I.e., this seems like yet another significant direct-sales SaaS business.

If you follow this logic through, it suggests that a large part of the SaaS market will wind going to large companies with global reach — whether or not the rumors are true that Salesforce.com is currently being shopped around.

1. I need a mail host that can stand up under the kind of mailbomb/DDOS attacks that shut me down twice in the past year.
2. Similarly, I want to diversify my email addresses among two providers, rather than leaving them all with my general web hosting company.
3. David Ferris first wrote up Google Mail outsourcing, with a favorable view, last July. And some of his criticisms (e.g., lack of IMAP support) have already been rectified.
4. What’s more — as I remarked last night, David and his associate Richi Jennings have been voting with their feet, and moving their own email to Google. That’s an impressive endorsement. Ferris Research is a serious rival to Gartner as an analyst firm covering email, and Richi — who evidently LOVES Gmail — has also carved out a non-trivial identity as an expert in his own right.
5. Free sounds good, compared with the alternatives.

Now that I’ve gone ahead with the move to Google Mail, here are some scattered thoughts:

• Some terminology: Technically, Google Mail is part of the Google Apps service. And the terms “Google Mail” and “Gmail” are pretty interchangeable (you even have two choices of server name when setting up POP3 access).
• Google’s UI to get started can be a bit confusing. But googling on Google Apps will get you to the right place, namely this link.
• Particularly confusing is dealing with the MX records. My domain registrar didn’t seem to offer a way to redirect them at all. The cpanel interface for redirecting MX at my hosting company wasn’t very good; Google asks for about 7 entries of declining priority, but cpanel only makes it easy to enter 1. (I wound up asking my hosting company’s support to make sure all the entries were listed that should be.)
• If there’s a way to sort messages by subject or sender in Gmail online, I haven’t found it. That’s a major oversight if it can’t be done, or a minor one if it’s merely too hard to figure out how to do it.
• Setting up POP3 access has some steps that aren’t present in, say, setting up POP3 via a typical hosting company. You need to go into “Settings” and explicitly enable POP3 access. You also need to explicitly enable SSL in your mail client (on Eudora, the default setting did NOT work). Basically, you need to open this page or something similar, and actually look at the steps for your client. Chances are one or two will be non-obvious.

That’s about it for now. In particular, I haven’t done anything yet with Google Mail’s search capabilities. More on that down the road, perhaps.

We market our service to businesses on a subscription basis, primarily through our direct sales efforts and also indirectly through partners.

Looking back, I should have quoted that in support when I wrote:

By the way, I think the assumption SAP needs to sell ByDemand via indirect channels is an erroneous one. (Dennis Howlett seems to be at least partway to recognizing this. He also reports that SAP realizes that this is truly a sales issue.) Hence my stress on SAP’s internal sales management issues.

For 40+ years, application-oriented services have been sold in large part by direct sales forces. That goes back to the other payroll processors, and to time-sharing in general. Why would it change now?

1. SAP sure has a lot of resources to bring to bear – and as previously noted, I think the company is dead serious about this initiative.

2. On the back end, the business-service granularity SAP has been implementing is well-suited to deal with the unique challenges of SaaS, both the very real (e.g., short upgrade cycles) and the largely imaginary (e.g., multi-tenancy).

3. SAP recently hired Dan Rosenberg away from Oracle to head its UI efforts, and Release 1 of a Dan Rosenberg user interface is likely to be very good. I know Dennis Howlett has a contrary view, and he’s actually seen the product. Even so, I’m optimistic about SAP’s claims to have designed the UI with an open mind, for maximum ease and simplicity, and validated by many rounds of testing.

As for sales and marketing – that’s a solvable problem. Indeed, SaaS and high-end packaged software can be synergistic businesses. True, a ByDemand salesman will need to earn much lower compensation than a high-end software sales team leader. But that’s a management challenge companies like SAP already know how to meet. Inside salespeople, product specialists, and so on can already tend to be compensated a lot less than the classic account-manager types are.

By the way, I think the assumption SAP needs to sell ByDemand via indirect channels is an erroneous one. (Dennis Howlett seems to be at least partway to recognizing this. He also reports that SAP realizes that this is truly a sales issue.) Hence my stress on SAP’s internal sales management issues.

All this assumes, of course, that SAP’s ethics and organization aren’t as screwed up as I sometimes fear.

Keep getting great research about enterprise applications, analytics and related technologies. Get a FREE subscription by RSS/Atom or e-mail!

Technorati Tags: SAP, ByDemand, SaaS, software as a service, Peter Zencke, Dan Rosenberg

Salesforce.com is the biggest SaaS company. Salesforce.com is making next to no profit. Therefore, SaaS is currently not a profitable business.

But that’s nonsense. Here’s why.

If you look at Salesforce.com’s second quarter 10K, 6-month revenues were $339 million, up from $223 million the year before. Marketing and sales costs were $174 million, slightly over 50% of revenue. Profits were negligible. The company says the churn rate is negligible, so that 50% of revenue was spent increasing sales by 50%.

Now let’s suppose that the SaaS (Software as a Service) industry becomes more mature. 1% would no longer be a realistic churn rate. Let’s suppose it instead goes to 10%+, based on both true replacements and client disappearances. Let’s suppose the revenue growth rate settles down to somewhere in the teens. Bam. To a first approximation we can whack marketing and sales by a factor of 2, and take pretax margins well over 20%.

Of course, things aren’t really that simple. It’s also necessary to market and sell for customer retention. And true marketing cost (as opposed to sales) isn’t closely tied to the number of opportunities you have. But on the other hand, as you grow there are all kinds of economies of scale too. So to a second approximation, 25 – 40% pretax margins don’t seem unrealistic.

So how profitable can a recurring-revenue computer services company be? Two examples come to mind quickly – Automatic Data Processing and Paychex. ADP’s main business and Paychex’s whole business is services in the area of payroll processing and human resources. Paychex reported 39% pretax margins on its latest 10K, while ADP’s figure was in the 25% range. (Incidentally, it seems that ADP is a partner for ByDemand.)

ADP and Paychex actually tend to get much less revenue per client than, say, SAP’s ByDemand “please don’t call it ERP” system would, yet they manage to generate substantial levels of profitability. So even if we didn’t have the hard evidence from Salesforce.com cited above, it would be a good bet that nicely profitable business models exist for SaaS offerings sold to smaller clients.

Keep getting great research about enterprise applications, analytics and related technologies. Get a FREE subscription by RSS/Atom or e-mail!

Technorati Tags: SaaS, Software as a Service, SAP, ByDemand, Paychex, Automatic Data Processing, Salesforce.com

]]> http://www.monashreport.com/2007/09/25/the-unprofitability-of-the-saas-business-is-an-illusion-caused-by-growth/feed/ 0 http://www.monashreport.com/2007/06/09/technology-of-guild-wars/ http://www.monashreport.com/2007/06/09/technology-of-guild-wars/#comments Sun, 10 Jun 2007 02:00:23 +0000 Curt Monash http://www.monashreport.com/2007/06/09/technology-of-guild-wars/ Being an analyst has its perks, the main one being that you get to have some really interesting conversations. And so I recently had the chance to interview Mike O’Brien and Pat Wyatt, two of the founders and lead programmers for ArenaNet, makers of the Guild Wars MMORPG (Massively MultiPlayer Online Role-Playing Game).

If you play games of this sort, it’s surely obvious to you why you should care. But if you don’t, maybe you should be interested anyway. After all, Guild Wars is a graphics-intensive SaaS offering that easily supports 100,000 simultaneous users, while managing a gig or so of fat client even over dial-up speeds. Every user is a potential hacker, whether for fun or actual real-world cash profit, although we didn’t actually talk about security very much. And ArenaNet provides all this on a relatively shoestring budget; in particular, Guild Wars subscription fees are precisely $0.

Note: If you’re familiar with video RPGs but not MMORPGs, please just read on; the main salient difference is that in an MMORPG lots of people play at once. If you’re familiar with other MMORPGs but not Guild Wars, there’s one GW-specific design feature you should know of – Guild Wars is instanced. That is, a group of 1-24 players will get their own private copy of the game world. Any changes to the environment (e.g. player movement, monster-killing) are made only by them.

And if you’re not familiar with video RPGs at all, I suggest you stop working quite so hard and go play.

Here are some of the technical highlights I managed to glean in a brief half-hour conversation:

• The client doesn’t do much except graphical presentation and input preparation (including encryption). This is a deliberate security choice. They assume the game client is infinitely hackable, and hence limit its power to sending a small number of well-defined messages.

• Their servers run on blades – originally all IBM, now more varied. Generally these are 2.8 gigahertz dual-processor Xeon IBM blades with 2.5 gigs of RAM.

• There are a number of different categories of servers. These include: Authorization/log-in, game update download, actual gameplay, database cache, DBMS, several secondary game functions (e.g. guild membership, tournaments), and watchdogs overseeing the rest.

• Gameplay servers can support 2500-3500 users each, with the main limitation being addressable memory. (They run on 32-bit Microsoft Windows.) 3500 users is a bit uncomfortable. This matches well against the fact that character records are several 10s of kilobytes, for reasons I explain in this companion post on Guild Wars data management.

• There are 4 ½ million total lines of code.

• Their connectivity design goal is .0045 megabits/sec/user, and they’re close to achieving it. Dial-up is a fairly realistic way to play. (That said, as a player I can tell you it creates some lags that make a dial-up user less than idea to be partnered with.)

• Reliability is not just a nice thing for users, but an actual game integrity concern. There are possible exploits in MMORPGs that involve deliberately crashing a server when a goods-trade transaction is partway through. ArenaNet fights this both by focusing on transaction integrity (but not in the way you may think; I refer you again to the database-focused companion post) and by generally trying to make their database cache servers extremely reliable. Database cache servers typically stay up 150-200+ days at a time.

*Note: There is a high level of motivation for cheating in MMORPGs. One of the biggest is that professionals in low-wage but well-wired countries acquire fictional gold, so that they can sell it for real money. Gold sellers are a huge concern to ArenaNet.

That’s just some of what I heard. For more on the technology of Guild Wars, please see my companion post on the database technology of Guild Wars and Guild Wars game notes. This interview is also just one of several I plan with game and virtual world companies, so I hope to in the future address other kinds of issues, such as rules and AI.

• VMware quotes a figure of 20,000 enterprise customers, if you count everybody who is at least testing the software and so on; i.e., it’s a somewhat inflated figure. Still, the “real” number is surely big.
• They claim ¼ of those have a “VMware first” policy, to deploy new apps on a virtual rather than dedicated machine. That’s impressive until you realize enterprise try to roll their own apps as rarely as possible these days.
• They suggest VMware is extremely helpful at times you’d like to have two copies of the same platform – e.g., for development, or when you have to take the system down for brief maintenance. It’s hard to argue with that claim.
• We didn’t have the time to talk about my performance concerns.

As for how this all plays with appliances and SaaS – that’s largely a future, but potentially a very interesting one. Here’s what I mean.

In July, 2005, VMware starting pushing the concept of “virtual appliance” with 6 ISVs, mainly large software vendors who wanted to make their software easy to deploy for evaluation cycles. By November, 2006 they’d rolled out a “marketplace” with 380 ISVs, although many of those seem to be single individuals offering software for free. Microsoft, Cisco and so on have rival announcements of partnerships and so on, but I haven’t ascertained whether these get past the Barney level (“I love you, you love me” without real substance).

Basically, a virtual appliance is a bundled software stack (e.g., DBMS plus OS), with more or less the same ease-of-deployment advantages boasted by regular appliances (assuming, of course, that you’ve deployed virtualization in the first place). However, virtual appliances lack the other big advantage of regular appliances – specialized hardware. Right now, they do not support the networking cards, encryption chips, and so forth that many appliance vendors use. What’s more, as I noted previously, I don’t see how they could be as well tuned in their hardware/software combinations as real appliances are. VMware has APIs and a “community source” program to encourage one-off extensions to support special hardware, but mainly this is an area where future innovation will be needed. As to when that innovation will come, and whether it will come primarily from the hardware or the virtualization side — well, that remains to be seen. But if I wanted to grow market share or start a new venture on the hardware side today, I’d be looking to generic appliance support (with a strong blade orientation, of course) as the way to make my mark.

And here’s something that very few people seem to have thought about so far – virtual SaaS. As with appliances, SaaS has as one of it major selling points ease of deployment. What’s more, another of its big virtues – rapid update cycle – requires super-easy deployment as well. Traditionally, this is done on a hosted basis. But there’s actually no reason the same benefits couldn’t be provided using virtual appliance technology. So if issues of data privacy or control or whatever are barriers to the adoption of SaaS applications – well, they won’t always have to be. Conversely, if traditional packaged software vendors want to co-opt SaaS’s benefits, they should be perfectly able to, performance-overhead-cost issues perhaps aside.

EDIT: The specific VMware gentleman I spoke with was

• Srinivas Krishnamurti
• Director, Product Management and Market Development

]]> http://www.monashreport.com/2007/01/03/virtual-appliances-saas/feed/ 4 http://www.monashreport.com/2006/11/30/anonymizer-great-firewall-china-iran-censorship-privacy/ http://www.monashreport.com/2006/11/30/anonymizer-great-firewall-china-iran-censorship-privacy/#comments Thu, 30 Nov 2006 09:11:27 +0000 Curt Monash http://www.monashreport.com/2006/11/30/anonymizer-great-firewall-china-iran-censorship-privacy/ Lance Cottrell of Anonymizer is one of those rare guys who make me believe he started a company in no small part to do good. And so his cloaking-technology company is providing free services to help Chinese citizens sneak through their national firewall, and is doing the same thing for Iran on a paid basis, under contract to the Voice of America. I think this is wonderful, and he reports that it’s working well now. Even so, I think there are scalability concerns. Right now only 10s of 1000s of users are covered. If there were a few more zeroes on that, standard spam-blocking techniques, currently ineffective, might work. What’s more, the Chinese bureaucracy, currently not highly motivated to shut the service down, might bestir itself to be much more effective.

Anonymizer’s methods are surprisingly straightforward. They make available an anonymous proxy server and, when the Chinese government blocks access to its URL, distribute a new URL on a daily e-mail list. Apparently, the mean time to blockage used to be months, and now is down to a couple of days. Lance claims to have already worked out prepared (undisclosed) tricks prepared for when the mean time to blockage drops so low — e.g., less than a day – that current techniques stop working.

I would guess that one of these tricks is to distribute different proxy URLs to different list subscribers, making it hard for the Chinese government to block them all … especially since the subscribers whose URLs did get blocked would quickly be dropped from the list. One bonus to this hypothetical approach is that they could use all sorts of standard spammer techniques to punch the e-mails themselves through any filters. The only truly reliable way to block spam is to identify it via the call-to-action part. But if you’re sending different URLs to different people, that makes call-to-action identification and blocking hard.

Still, there’s a scaling problem. Right now they only reach 10s of 1000s of Chinese citizens. It’s hard to see how they could get through to a really large fraction of the population without leaving themselves open to standard spam-blocking techniques. What’s more, there’s no compelling technical reason China couldn’t block 100s, 1000s or even 10s of 1000s new URLs each day on a quick-response basis.

That said, Anonymizer’s heart and head both seem to be in the right respective places. What Lance told me doesn’t go nearly as far as my Operation Peking Duck proposal, but it’s in the same direction, right down to requiring the Chinese citizens to have a secure piece of client software, and hoping the authorities don’t criminalize the very act of running that software, or defeat it via a spyware blocker. More fundamentally, he seems to understand that he can’t win long-term without being, in his great phrase, a “freedom spammer.” Indeed, right now a significant fraction of the e-mail list subscribers are actually spam recipients, to provide legal cover should anybody get into trouble simply for being on the list.

1. Provide anonymity services to ordinary individuals.
2. Provide anonymity services to enterprises (aka enterprise sneakiness support).
3. Help people get through the national firewalls in Iran and China.

For the record: They’re profitable, only ever took about $2 ½ million in mainly angel funding, get 70% of their revenue from enterprises (an increasing percentage even though the consumer stuff is growing to), and are paid by Voice of America for their Iran work but do China on a pro bono basis.

The consumer service, for an annual fee of $20-40 or so, is designed to reduce the marketing-related hassle of using the internet. If you need to give out an e-mail address, you can use a pseudonymous one, from which Anonymizer will re-route mail to your main address – until such time as you shut it down, because that particular address is attracting spam or other unwanted traffic. They also work to make you untraceable via IP address or cookies, protect you from spyware, and so on.

Is this worth the hassle for an individual to use? Well, I hate getting 100+ spam/day, but given how widely published my main e-mail address is, new sign-ups are the least of my problems. But if you’re an enterprise, it’s a whole other matter. That’s because enterprises have lots of reasons to be sneaky. These reasons fall into two major categories.

First, enterprises have a lot of legitimate reasons for concealing their interest in a subject. If they’re going after a bad guy – hacker, fraudster, whatever – it’s good not to be spotted. If they’re so much as checking out a possible merger target, it’s good not to be spotted. AOL accounts and the like will do the job too – but if you’re a professional snoop, having a professional cloaking device makes sense.

Second, there are cases where web sites are automatically configured to defeat snooping. Lance cited a number of cases – hackers again, trademark infringers, and so on. Most interesting, however, are the enterprises who engage in hardcore automated price-checking. It wouldn’t be unreasonable for an airline or major online retailer to fire off hundreds of thousands of competitive price inquiries daily – and for competitors to detect that and try to feed incorrect information back.

How big is this need? Lance assures me that he has commercial customers – not just government/intelligence – with low thousands of seats each, paying low hundreds per seat per year. But does that go far beyond a few obvious-suspect airlines and the like, plus a few top-tier Fortune-50-type brand owners? I don’t know.

One subject I forgot to ask about – and a hat-tip goes to Linda for raising the question after I got off the phone: Why isn’t this sneakiness-enabling technology a boon to bad guys too? Offhand, I couldn’t think of anything Anonymizer provides to crooks that isn’t simply provided by consumer free e-mail, encryption, and the like – unless they’re mega-spammers, and then they don’t need Anonymizer anyway because they have their botnets to conceal their identities. Still, I’m e-mailing Lance for follow-up, and will ask him to address the point in the comment thread below.

Some interesting aspects of enterprise deployments – they’re subscription-priced, they’re appliance-based, and the appliance is just a Juniper/Netscreen box configured to route traffic through Anonymizer’s servers. (Usually, at least – I get the impression they’ve tried other vendors’ boxes, but are mainly standardized on Netscreen.)

As for their penetration of the Great Firewall of China — that’s too important to bury this far down. I’ll write a separate post for it.