Software configuration management - Strengths and weaknesses

Bruce Taylor spoke with Tom Welsh, senior consultant with Cutter Consortium on the topic of software configuration management -- a vitally important but not necessarily enjoyable discipline he colorfully likens to cleaning your teeth or getting the car serviced. Following is an edited transcript of that conversation. You may also listen to the original interview here.

Hi I'm Bruce Taylor and this is Voices on ITworld. Our guest today is Tom Welsh, a Senior Consultant with Cutter Consortium's enterprise architecture practice. Today we're going to learn some of Tom's expert views on the tools and platforms for software configuration management (SCM) based on the second of a series of three survey parts for a paper submitted to the Cutter library. Welcome Tom, thank you for joining us.

Tom Welsh: Thank you Bruce.

Bruce: Tom, this is the second in a series that you've authored, based on a Cutter survey of nearly 400 IT organizations. That's a pretty good sampling, I would say. And based on that, in part one, you talked about the general attitudes of the survey respondents to configuration management. So if you could, I'd like you to begin with what you've learned from that about how organizations view software configuration management in their overall architecture and what I'm particularly interested in is what surprised you.

Tom: You know, SCM is a vitally important discipline, even the people who are telling you to use it, the advocates will confess that it's a bit dull. It's kind of like cleaning your teeth or getting the car serviced and it's not something you enjoy, but you know the consequences of not doing it may be frightful someday. So one fact I'd seize on isn't actually in the survey at all. It can be inferred from it -- is that SCM is gaining mindshare pretty well everywhere you look -- whether it's geographically or in the world or in different marketplaces, different vertical industries. And this is big news. For years SCM was a Cinderella activity down in the basement with things like testing and support. People didn't want to do it. Now in testing, Mercury Interactive has made a big breakthrough and brought it right up to the CXO level and in the process, of course, they're able to sell bigger bundles of software and services at very good prices. In the SCM world, IBM was already in that area where they could sell high, but it's greatly enhanced its position by acquiring Rational, of course, and with it the premiere SCM and defect management tools which are ClearCase and ClearQuest. Another huge change in the SCM market was Serena's acquisition of Merant last year, the fourth biggest SCM vendor bought the second biggest. And now it poses a real threat to IBM because whereas IBM isn't even primarily a software company, Serena is a SCM company, that's all they do, and they do it very well. IBM and Serena have the clout to sell direct to the CIO.

Remember that TV commercial where all the managers are sitting around a table discussing some big failure and after a bit of babble, the CIO calls for silence and asks, okay, who is responsible for all this? And then there's a silence and one of the braver guys says, "That would be you." That's the message that companies like IBM and Serena are driving home. Software really, really matters to an enterprise's success. And if the software goes wrong, the CIO is the first person at risk. So they go in and tell the CIO, "Have we got SCM for you." It's really good because for all these years, people didn't understand how vital it is to get this right. It's basic hygiene for developers.

Bruce: So from your perspective, what are some of SCM's best and worst attributes in the minds of the people who are using the tools?

Tom: Well, the surprise here is that there isn't much of a surprise. The top benefits that they identified out of a list of a dozen or so are ones that nobody would quibble with. Mostly they're simple obvious things. At the top of the list comes better control of changes, which of course is what software configuration management is all about. But it does indicate awareness of the essential as opposed to the peripheral. Better quality software is the second most commonly cited and risk management is third. Note in particular that these are all things that the CIO or even the CEO can relate to and understand and perhaps feel the need for.

Bruce: They're almost strategic in nature.

Tom: Exactly. They're not nitty-gritty technical. But when we asked about the most serious drawbacks to SCM tools, the two leading issues were complex procedures and license fees. Well, the second one, nobody likes paying socking big license fees, but they are paying them because they think the software is worth it. If they weren't paying them, they wouldn't be resenting them. So that's probably not a big problem. Except of course for the growing number who are now resorting to open source tools. Complex procedures is a bit more ramified. This leads me into an important issue about SCM, that you have to match the procedures and tools to the project's requirements and the developer's skills and, if you like, character. So if you buy a top-of-the-range tool, like ClearCase, when all that's needed is something relatively simple like Visual SourceSafe or CVS, people will get frustrated. They'll see the overheads are excessive and they'll appreciate that they don't have to be. Nobody likes being forced into ceremonious procedures that they don't think are necessary.

Bruce: So it seems to me that the value proposition for SCM is very different when you're talking about a mainframe environment and when you're looking at a client-server environment. And then there's even a bigger delta when you get into the open source, no matter whether it's mainframe or client-server. Do you think that's true?

Tom: Well, I do believe there are differences. But at core, I think the proposition is essentially the same. In each case, the problems of writing and maintaining software are common -- the environment that you're doing it in, the tools, even the processes are just something that you tailor for the needs of each individual project. Perhaps SCM is even more indispensable when you're building big, expensive business-critical mainframe applications than with small throw-away, say, Visual Basic applications that someone might write today and not use after tomorrow or next week. So I'd say almost on the mainframe it's more important. Again, open source brings in an interesting new dimension in that it is free. The real importance of something being free of charge is that anyone who wants to can use it and that leads to the creation of a big, sometimes worldwide community, all of whom are familiar with how this is done. And that in turn can lead to almost a quantum step upwards in the benefits that flow from it.

Bruce: One of the things that I'm curious about that as we move into a Web services world, is that going to change -- does that have the potential of changing the growth dynamic between the mainframe platform and the client-server architecture world? Will it level that playing field?

Tom: Again, I don't think Web services are as much of a differentiator, or in fact, I don't think Web services are nearly as strategic as they've been cracked up to be in some quarters. You know very well that in the software industry, as in most other industries, people are continually trying to position new ideas, new products as being strategic, simply in the hope of selling more of them, as we've seen has been happening with SCM in general. And it seems to me that Web services are essentially, in a way, tactical. Their most successful applications so far have been on the small scale as a kind of, if you will, Internet duct tape and then the big ideas about service-oriented architecture have not necessarily been delivered yet and if they have been, they haven't necessarily involved anything terribly new in terms of technology. Web services can be hosted on mainframes as well as client-server operating systems, in fact. One of the interesting things about them is they're so completely ubiquitous. IBM supports Web services from CICS and IMS now and NEON Systems and many other companies have got very good alternative products. The question in my mind, the big question, is whether the Web services themselves will be placed under adequate SCM control because as emerges from the survey -- actually from the third installment, which is now published -- not all Web sites by any means are under SCM control. And that is something that gives cause for concern.

Bruce: In this paper, in this part two, you really got down to the nitty-gritty of the competitive arena for the SCM tools and you touched on that a little bit earlier. But I'd like to come back to it. It's no surprise that Microsoft continues to dominate the client-server side with its Visual SourceSafe (VSS). It's cheap, it's easy to deploy, it's easy to use, but one of the things that you suggested is that it got there, it got into that position because it was already bundled in with Visual Studio. And as I understand it, it's now at the end of its lifecycle, coming up on it. What's next for Microsoft here and do you think that provides an opening for competitors?

Tom: Well, I've got to admit that everyone makes mistakes from time to time and I did write that Visual SourceSafe was probably nearing end of life. It seems that like Mark Twain, predictions of its demise turned out to be premature. In fact, Microsoft has announced that it will be updating VSS with a new release called Visual SourceSafe 2005, which will be in Visual Studio .Net 2005. But they are emphasizing that this is now aimed at individual developers or small teams who need a mid- to light-weight client-only tool that just does basic source code control and nothing else. So they're strongly de-emphasizing or deprecating it. The 2005 release will have some interesting new features, of course, like remote Web access and it will also have support for things like Unicode and XML, regional time zones and languages. So some of the things that some of the top-end tools have had for a while, VSS is catching up. What has caught people's attention is the all new Visual Studio Team Foundation Suite, which Steve Ballmer announced at TechEd last year. Now this will be for teams working on complex projects and it does comprehensive metadata tracking through a relational database, which begins to make it sound a lot more like IBM's ClearCase and some of the other top-end tools. There's everything in there that Microsoft has seen other people doing for years, things like work item tracking, build management, project management, cross-system reporting. There's a whole new source code control system built in too, different from the VSS one, to integrate with the rest of the Team Foundation Suite and it will also integrate with Active Directory, SQL Server Security, SharePoint Services. So Microsoft has done a very thorough job. And true to form they've covered all the bases. You have to expect Microsoft to be competitive in the future against IBM in the SCM arena based on past experience and in view of Microsoft's close relationship with its very large developer community.

Bruce: Sounds like you've destroyed my next question altogether, but I'm going to ask it anyway because it appears to me, seems to me, that Rational ClearCase from IBM, which trails Microsoft in market share, but it always has been a very different product. It's different in how it controls project assets and the teaming side of things. Do you see today that ClearCase no longer has that, what I would have considered to be, a real differentiator?

Tom: Well, on the contrary, Bruce, I think it's still a very good question and it's well known in the software industry that as they say, vaporware has no faults. The Microsoft product, the Team product is still -- it's an announced product, but we haven't seen it in action and we know about the first releases of products, they're not always perfect let's say. So it's a bit premature to start saying that Microsoft has completely equalized. Also, the market share thing isn't as clear as it seems. Whether ClearCase trails Visual SourceSafe or vice versa really depends on what you measure, because if you look at the number of licenses shipped, which is what we were looking at, Microsoft is way ahead. Our survey shows that 52% of shops have Visual SourceSafe. But in terms of revenue, IBM would win hands down because ClearCase costs so much more, several thousand dollars per seat. That has been fully justified by the greater functionality of ClearCase, which comes very close to being comprehensive in its features -- it's pretty much state-of-the-art. Plenty of people down the years have complained that ClearCase is too big or complex or too hard to operate, but you don't often hear people saying that it doesn't have such and such a feature. It's just that it takes a bit of effort to find out about it and get it fired up and get people to support it.

Bruce: So among the other competitors in this space, there are a number of very good tools. You've touched on some of them. Give me a quick sampling of those that you really like and why.

Tom: Well, this is where I give you a classic evasive reply to a very straightforward question, a very reasonable question. But this ties in with my main theme, which I think I mentioned a little while ago about SCM in general that it's a matter of matching your procedures and your tools to your requirements and also to your staff. And if you get a mismatch, then you have problems. If you don't have enough tool, say for the work that you're doing, then you will lose out on some of the potential benefits. If, on the other hand, and this is perhaps more frequently done, you have something that is overkill, then you get psychological problems, people will resent the straightjackets as they see it. It costs more and it can have a negative effect overall.

Perhaps studying these products too closely makes it a bit hard to answer because there isn't a single well-known SCM tool that I can think of that doesn't have a lot going for it. They just tend to be slightly different things. And they also tend to vary in fairly technical ways that would only interest a developer. It sounds a bit like a copout that, but definitely it is true. And they all have their drawbacks too. For a big enterprise system, which has been developed by a team that is distributed around a network, and perhaps it's got lots of different threads of development going on at the same time, you can hardly go wrong with ClearCase from IBM or Serena's ChangeMan, which probably is it's main challenger now. But Telelogic's SYNERGY is excellent too, especially if you want to have integration with Telelogic's DOORS product, which is the world's leading requirements management tool. And that's an example of the way in which different product have their particular strengths. At the low end, you have things like Visual SourceSafe, Serena Professional (which used to be PCVS) and the open source packages -- as we say in England, you pays your money (or not as the case may be) and you takes your choice.

Bruce: Well, that was a great segue into the next question. Open source plays in this end of the world very well for lots of reasons. There are the usually trotted out ones. The first-blush advantages around no fees. But what are the attributes of the leading open source SCM tools that make them attractive enough to look at from an adoption standpoint?

Tom: Well, actually Bruce, you've already said it. The main advantage of open source tools really is that they are free. It's very easy to skip over that and say, we're not going to be materialistic, but it really is important that you don't have a license fee to pay. As I said before, that means that it can be very widely adopted. In the case of CVS it is a de facto standard. I mean if you're working on an open source project, you expect to be using CVS at the heart of it unless it's a very good reason why not. And maintenance and upgrades, don't forget, are also free if they're part of the main project. Or if you want to have it modified, then you can modify it at will. You don't have to get anyone's permission. All you have to do is find a competent programmer who understands the source code. You have the source code, of course, and you can make the changes that you want. And perhaps if other people like them, then it will propagate and your changes will become popular.

Bruce: And that does seem to me to be maybe where the real motivator here is is that the nature of SCM is that it has to be very flexible. It's up for rapid change. You can't wait for the next version of a software program to come out to upgrade your SCM tools. So isn't that the real motivator behind open source in this case that people are free to adapt it to their culture and to their fast-changing needs?

Tom: I think it is definitely an important driver. On the other hand it's contradicted by the next one, which is rather paradoxical; another important advantage is that open source tools tend to be pretty simple. Now, no good SCM tool is all that simple because there are quite a lot of things even in the basic functionality. But on the whole, open source products don't tend to have many of the motivations that apply in the world of commercial software and if you ever heard open source developers being asked when they're going to ship the next release, so there's none of this pressure from marketing, you know, that it must be shipped this quarter for financial reasons. They'll tell you quite calmly that they will ship their code when it's ready. Sometimes they'll insert a few chosen adjectives into that phrase to hammer home the message, but the message is that it will ship when they're ready, not when anyone else wants it to ship. And this is also another big advantage of open source. You don't get code that has been rushed out by people who are under pressure. They take their time. Because the thing that is really important to them is their software should be as good as it can be.

Bruce: Well, and you did say something just a second ago that I want to come back to. It's the simplicity of the source code and that that leaves then the customer free to do the customization they need to do to have it meet their cultural needs. Is that a fair statement?

Tom: Absolutely. In fact, that's something that hadn't entirely occurred to me. Thank you very much for identifying that and bringing it forward because from an engineering point of view it is, I think, almost obvious that it's better to have something simple that everyone is familiar with and that you can change within reasonable limits, rather than having something that's very, very complex and that forces you to accept it on its terms and learn how to use it. And that is one of the main objections. If you recall, one of the things people really don't like about SCM tools is that they're too complex.

And my complexity is never bad. It's other people's complexity that is bad.

One of the syndromes that you come across all the time in the software world is that people have to become very, very good, very experienced and very expert in order to accomplish some of the very difficult tasks that have to be accomplished and that gives them guru status. The trouble is gurus, even if they're not arrogant in terms of their personality, they tend to suffer from a strange form of blindness where they start to think that things are very simple just because they've been completely immersed in them for years or because they wrote them from the beginning. You start with writing something simple and then you notice that it needs a bit more so you add a bit and then you add a bit more and you add a bit more. And all this time you remain familiar with it and it seems the most obvious thing on earth to you and then some newcomer comes along and you're trying to explain it and they're completely baffled. And you can't understand why they think this is difficult. And that's one reason why you do need SCM tools because the newcomers need to be given a chance. You can't rely on your resident expert who won't be there always.

Bruce: Tom, this has been great and I'd like to have you end by just perhaps telling us a little bit about what readers can expect from the third part of the series on the Cutter Consortium site.

Tom: Well, the third update focuses very much on SCM tool features and in the familiar, rather simpleminded way we're going to look at the features that are most appreciated and the weaknesses that provoke the most ire in respondents. That isn't going to quite set up the issue, so I'm also going to have a look at a bunch of specialist capabilities, things like branching, merging, use of baselines, a few other things. And also that question that came up a little while ago, whether organizations are keeping their websites under SCM, to which there is a slightly surprising answer.

Bruce: Well, thank you for joining us today. We've enjoyed this and we look forward to the next part.

* * *

Tom Welsh is a Senior Consultant with Cutter Consortium's Enterprise Architecture Practice, Editor of Cutter Consortium's monthly Web Services Strategies, and a regular contributor to the its Advisory Service. He is an independent consultant and analyst specializing in middleware, object technology, and software engineering. At Digital Equipment Corporation, Mr. Welsh was a hardware technician, software support specialist, corporate software developer, and senior technology consultant, before taking on the task of marketing Digital's object-oriented software products in the UK. In his role as a principal analyst at ComputerWire, Mr. Welsh has been a leading contributor to Client/Server Tools Bulletin, Internet Tools Bulletin and Object-Oriented Tools Bulletin. He has written many reports and papers, as well as chairing and speaking at conferences and seminars. Since 1992, Mr. Welsh has closely followed the work of the Object Management Group and its specifications, including CORBA, UML, XMI and CWM. He can be reached at consulting@cutter.com.

Bruce Taylor is principal of Performance Communications, an independent research journalism provider specializing in business process management and performance improvement. He has written and published extensively for over 25 years on information technology and business topics. His primary areas of focus are on content and knowledge management, work and business process management and performance improvement, and business and competitive intelligence. Most recently he has been looking at the relationship of emotional intelligence (EIQ) to human and organizational performance. Reach him at btaylorconsults@aol.com.