DISCLAIMER: The below represents my personal views.


The announcement by VMware and AWS that they are partnering to deliver VMware services from Amazon datacentres has already started to generate quite the flurry of excitement around the interwebs, and quite rightly so – it’s a big announcement from two of the biggest global players in Cloud (AWS) and traditional virtualisation (VMware) today. The timings are interesting, with the announcement coinciding with the launch of Windows Server 2016 and the delivery timeframe the same as that of Azure Stack. A cynic might call it reactionary and say that it lends great credence to Microsoft’s ‘all in on hybrid’ strategy. A cynic might.


I want to really delve into some of the messaging they’ve delivered, what it means, what’s changed in our world now vs yesterday, really try to understand where this industry of ours is heading, and what it all means as a service provider.


First up, this would seem to sound the final death knell for vCloud Air, which was unceremoniously downplayed and pretty much put out to pasture at VMworld in recent weeks. Effectively, VMware are deploying a similar model as vCloud Air into AWS datacentres, extending it with enhanced hardware-level elasticity and resiliency, and integrating AWS services and the AWS name and reputation in Cloud into the mix.


As these AWS services will not be deployable on-premises or within service provider datacentres, this is effectively the same hybrid story as previously with vCloud Air, with lower latency and less of an air gap between the off-prem VMware instances and AWS services, and a better management story.


As an Enterprise, I could well see this as a great way to bridge the gulf between on-premises virtualisation and born-in-the-cloud capabilities of AWS with a view to eventually moving to all AWS. In a world inexorably moving away from IaaS and into the world of PaaS, I cannot see the long-term here for VMware beyond buying some more time.


I say inexorably, because as IT Pros, loathe though we may sometimes be to admit it, the platforms we build and support are driven not by our wants and needs, but by those of the applications we deploy and the developers who create them. Innovation doesn’t follow IT, innovation in our world follows developers – from mainframes to PCs to the web to app stores and now on into cloud services, it’s a truism that we build to support that created by others.


Even today, a majority of new players entering the market fresh from university have been taught, guess what, either Azure or AWS. It’s so easy for a university to spin up and down developer resources in these true cloud platforms, and both throw huge numbers of free credits at educators in order to upskill the forthcoming workforce in their respective technologies, that snowballing and default adoption of them is all but inevitable.


Indeed I equate the time we’re living in now to the OS ‘wars’ of the 80s and 90s, where many many operating systems vied for attention, be it RiscOS, DrDOS, OS2, BeOS, or a plethora of others. Now twenty plus years on, the majority of these are dead and buried and we’re left with two main players – Windows, and ‘the *nixes’. Two distinct and core development platforms which development talent settled into naturally as each hit a critical mass that just couldn’t be stopped. If you wanted to develop an application which had good market penetration, you would target Linux or Windows, not BeOS. Through this natural attrition, all the other snowflake operating systems effectively died off or became very niche plays.


I believe this is what is happening in the world of Cloud today. The market is being hit by an influx of new talent coming in which expects just to be able to take advantage of Cloud-native PaaS services, because that’s what they’ve been taught. Containerisation is a nice compromise and half-way house in some cases here as it removes IT as a point of conflict and friction (if the container works on developer’s laptop it’ll work on IT department’s container host), but it’s only a tiny bit of the journey to true PaaS and cloud-native development. It’s long been my view that developer need will naturally kill off snowflake Clouds over time, and if we believe that AWS and Azure are the analogs of Windows and the *nixes from the OS wars in the Cloud era, we have to believe that they’ll emerge as the de-facto hyperscale offerings. I believe that if you’re ploughing money into building a Cloud which is not designed to dovetail into AWS or Azure consistency in time, what you’re building is the RiscOS of today. I loved RiscOS, but it didn’t attract sufficient development talent, and it ultimately fell into the hobbyist niche.


This being the case then, what does tying VMware into AWS actually bring to the table here? It offers an easy path for existing VMware houses to get more comfortable running their workloads in Amazon datacentres, which is wonderful for AWS as that’s a massive market for them to capitalise on. It gives VMware a hybrid story that actually includes Cloud-native development services from a true Cloud player for the first time. It doesn’t in my opinion give a true hybrid story, as those services still cannot run on-premises.


When you boil it down to its core and examine the differences between this offering and Azure Stack, fundamentally the value prop here is in bringing you from your premises and into AWS to leverage their Cloud services, using tools and technologies you already know to ease the way. The value prop of Azure Stack is in bringing the Cloud services from Azure back to your datacentre, and allowing you to take advantage of developer capabilities that are wanted and expected, but on your own terms and where you want and need them.


Regardless of how this deal plays out, I believe that AWS and Azure becoming the de-facto hyperscale Clouds is all but inevitable now, and in the best possible way, so that’s the world I architect towards. Other than as an on-ramp to AWS and a way for VMware houses to keep running virtualisation on-prem while giving developers Cloud capabilities in AWS in a reasonably credibly hybridised way, I don’t see the long-term play for VMware here.


While I may paint a picture here of hyperscale ruling all, there are some fundamental factors which absolutely necessitate the existence of Azure Stack and the ability to run true Cloud on your own premises, or from a regional service provider.


The most basic one is the speed of light. We can’t break it, and latency matters. It particularly matters in the world where IoT is starting to explode, and data needs to be captured and managed not up at the hyperscale cloud level, but at the edge in regional facilities. Not just for IoT, but for any big-data generating application or toolset – the less distance you have to send your data, the better – more and more often, sub-millisecond responses matter. Believe in the future of Bots and the BotFramework? You’d better believe latency matters.


There are of course always varying regional compliance and audit requirements that necessitate running things on-prem or in local providers, and even sometimes public-sector mandates to use local services as much as possible from a local economics perspective – this is one area I can’t see changing any time soon.


In many more rural areas, the connectivity just doesn’t exist to reliably make use of hyperscale cloud services, and this will be the case for many years to come in many countries. With all the innovation happening in AWS and Azure and all the new services being offered by them pretty much day by day, up until this point organisations in this situation have had no choice but to work in a more traditional IT modus, regardless of their desire to take advantage of Cloud. Azure Stack fixes this. Virtualisation doesn’t. AWS doesn’t.


I appreciate that a number of things I say above are contentious and that a lot of people disagree with them. I always enjoy lively discourse around this topic, so please do weigh in.


I believe that faster, more productive, and more innovative development work can only happen best in a Cloud-native world. I believe that we need to be able to run Cloud-native services on-premises and in regional datacentres, with exact hyperscale consistency. I believe that a developer should be able to develop once, and run their app consistently using the same services in our facilities as in the hyperscale cloud.


I believe that Azure Stack is the only product which fulfils these needs.


I believe that this deal is VMware’s best chance at staying relevant in the world of Cloud where they have no Cloud story of their own.

Chapter 1: Prologue

Chapter 2: Shielded VMs

Chapter 3: Storage Replica

Chapter 4: Speaking at Ignite

Chapter 5: The True Value of Ignite

Chapter 6: The Parties

Chapter 7: Key Learnings

Chapter 8: Thoughts to the Future


Chapter 2

So having noted in my previous post that I was asked to speak about my experience in operationalising a Guarded Fabric which hosts Shielded VMs, the question which you, dear reader, may have, is “what the blazes is a Shielded VM and why should I care?”


Well it’s a good question, so well done for asking it. Before I dive into what a Shielded VM is and what it aims to achieve though, first I want to take a little detour through human psychology.


We humans are inherently built for pattern-matching and auto-association – there’s a wonderful book called ‘Thinking, Fast and Slow‘ which dives deep into this trait and which I heartily recommend reading. Wherever our brains can, they look for the familiar, correlate, and file as neatly as they can – in many cases we have no conscious control over this.


If you read the word ‘Library’, you have no choice but to automatically understand it and process it. You simply cannot make your brain incapable of instantly recognising, reading, and understanding the word. This is a wonderful evolutionary trait which lets us make decisions in split seconds and understand relatively new concepts which relate to existing knowledge with ease. This is a very base definition of ‘Thinking Fast’.


If I ask you to solve 1463 * 432 in your head, then unless you are a mathematical savant you will need to engage a series of conscious processes and steps to work through the multiplication to find the answer. This is a very crude way of explaining ‘Thinking Slow’.


Thinking Fast and Thinking Slow are not complementary processes which work in harmony, they compete and conflict, and can cause significant angst and annoyance, or even danger. Everyone who drives knows well the feeling of getting in their car, setting off to work, arriving at work and wondering how the hell they got there as there’s no memory of the drive. The fast thinking portion of the brain has taken over and is almost automatically driving a route it knows well while other parts of the brain engage elsewhere to focus on other thoughts. If the route was ever unchanging and always the same every day this would be an extremely valuable trait, however other drivers are unpredictable and conditions change, so we’ve also all experienced being jolted into alertness as another driver swerves in front, or roadworks get in the way.


All of the above is contextually relevant, because without fail every time I start to explain Shielded VMs to someone, they immediately drop into a fast thinking modality, relate it to basic encryption, nod and file it away in their mind as just that. They could not be further from the truth. So before I explain what assurances VM Shielding provides, first empty your mind of preconceptions about existing security technologies, and believe me when I say that this capability is completely unique to Hyper-V 2016 today.


Shielded VMs as a concept came about because of a growing attack vector which Microsoft Research identified around four years ago. This attack vector covers many different methods of infiltrating and exfiltrating data from virtualised environments, but the one commonality across them all was the leveraging of fabric-level admin credentials to conduct malicious activities.


Today, a virtualisation admin is the god-emperor of all that he or she has purview over – there is no effective way to protect the data and secrets contained within a virtual machine from the fabric on which it runs. Whether it’s taking a copy of a VHDX/VMDK on USB and attacking it or booting it off-site, consoling on to a VM, capturing live migration or state traffic, attaching debuggers to VM processes, or a plethora of other routes, the contents of virtual machines today are inherently open to the admin credentials of the fabric on which they run.


I say admin credentials, because more than a few people I’ve spoken to about this have taken significant umbrage at the implication that they may be in some way untrustworthy or capable of malicious activity. ‘IT is an position of trust, we’re given these services to manage and it’s our duty to protect them.’ is a common line of rebuttal, and I agree wholeheartedly.


There’s no avoiding the fact though that today the majority of data breaches which occur are caused by insider attacks, be it due to malware, compromised credentials, coercion, or, yes, malicious administrators. This isn’t a slur against sysadmins, it’s a recognition of three routes to insider attack which can occur even to the nicest sysadmin, and that in all large-scale industries it’s inevitable that bad actors and disgruntled employees will at some time exist.


What Shielded VMs aim to do is completely fill in this hole in the security model that we currently have patched together with process, audit, and trust, and completely remove it as a valid attack vector. It does this through a series of very clever technologies which come together to form a cryptographically trusted platform on which we can run Shielded VMs, in a model we call a Guarded Fabric.


I’m not going to go into any great detail here about the methods in which this is achieved, for that I strongly recommend watching this Dive into Shielded VMs with Windows Server 2016 Hyper-V session from Ignite 2016. All I want to achieve here is an understanding of what the feature seeks to and manages to achieve.


  • VM Disks are encrypted at the VM level using strong cyphers and the most secure method of key release we have today, TPM.
  • VMs are only allowed to boot/migrate on cryptographically provably healthy hosts. i.e. hosts which have not been compromised.
  • PowerShell Direct does not work to a Shielded VM.
  • Console connections to a Shielded VM will not work.
  • RemoteFX is disabled.
  • Specific WMI calls are disabled (screenshot, thumbnail, keyboard, mouse)
  • Guest File copy IC is disallowed.
  • IMC registry hive injection is disallowed.
  • Some virtual devices like debug devices, synthetic keyboard, synthetic mouse, serial device are removed.
  • Shielded VMs run inside a protected process which will not allow debuggers to be attached.
  • A whitelisted Code Integrity Policy is enforced on hosts to ensure that only known trusted binaries can run on them.
  • All live migration traffic is encrypted.
  • All VM states are encrypted.
  • VM access is available to owners only, via certificate signed RDP or key-trusted SSH.
  • For all the encryption items above, the VM owner owns and maintains the encryption keys, not the fabric admin.


For a hosting service provider like ourselves, this allows us to guarantee to tenants that their VM secrets are completely hidden and protected from us the fabric admins. For tenants, they can run workloads which have stringent compliance and regulatory requirements in a multi-tenanted environment. Enterprise admins can enforce strong separation between Hyper-V administrators and sensitive workloads. I would argue that this is a huge benefit to enterprise sysadmins, who can use VM Shielding to indemnify themselves in the event of data breach, as the data remains completely encrypted and secure.


The absolute most important point here is that all of the above trust is rooted in hardware through TPMv2 based attestation. In a fully operationalised and working Guarded Fabric there isn’t a locked down subset of admins who can still compromise the security model, the trust is rooted in cryptography, and in the hardware.


Hopefully the benefits here are now obvious, and why we as a hosting provider are so excited about the capabilities that VM Shielding allows us to bring to our customers.


Hopefully it’s also obvious that VM Shielding represents a leap step forward in virtualisation security that goes way beyond anything else available in the market today.

Chapter 1: Prologue

Chapter 2: Shielded VMs

Chapter 3: Storage Replica

Chapter 4: Speaking at Ignite

Chapter 5: The True Value of Ignite

Chapter 6: The Parties

Chapter 7: Key Learnings

Chapter 8: Thoughts to the Future


Chapter 1


I spent last week with Senior Systems Engineer Craig Dalrymple at the Microsoft Ignite conference in Atlanta, one of the largest IT conferences in the world with 20,000+ attendees, which is around half the number of people who work on the Redmond campus.

A lot of times at conferences like these there’s a lot of hot air and future announcement designed to show thought leadership and keeping pace with competitors. Not so this year at Ignite, with the launch of Windows Server 2016 and System Center 2016 scheduled for the same week (a one in four year event, basically an IT world cup), and Azure Stack technical preview 2 being released to the masses. These are hugely impactful products to the IT landscape, so it was vital we attend and immerse.

I was originally signed up as an attendee, but a few weeks before the conference I was asked by Dean Wells and Ned Pyle if I’d join them on stage to talk about their products – Shielded VMs, and Storage Replica respectively. After ploughing the last year and a half or so of my life into making sure that brightsolid could be among the first in the world to bring these and other valuable features to market at the launch of Windows Server 2016, naturally I said ‘hell yeah!’

We’ve hammered the bejesus out of Storage Replica and Shielded VMs along with the new SDN stack over the past year and a half or so, through various technical previews and engagements with Microsoft. We’ve worked fervently to operationalise and learn them intimately so that now, at general availability, we can immediately start bringing the value they represent to our customers. With Shielded VMs in particular, there’s a huge amount of preparation required to take it from installed to fully ready to sell to customers, and as that is knowledge that’s pretty unique to brightsolid, it was that aspect we focused that session on.

Beyond those speaking slots, the conference as a whole was a smorgasbord of knowledge, networking, and opportunity, and the energy and buzz running through the venue was palpable. What I’d like to do through this series of posts is capture some of that knowledge, enthusiasm, and energy, and send it on to those who couldn’t be there, because it is ridiculously and utterly infectious.

Disclaimer: The below are my views. I hate calling out specific companies on things I think they’re doing wrong as I’d rather focus on what we’re doing right, but in this instance I feel it necessary.

After the buzz and excitement of Ignite, I was looking forward to getting home and writing up a few blogs about VM Shielding, S2D, Storage Replica, and my overall experience at the event, but today I’ve read an article which needs to be immediately addressed.

At Ignite I spoke about how to operationalise a Guarded Fabric to host Shielded VMs at session BRK3126, a session specifically designed to talk about all of the lessons we’ve learned over the past year and a half of working with Shielded VMs in how to bring a Guarded Fabric from being ‘installed’ to ‘fully operationalised’.

There are a lot of lessons to be learned, from customer education through changes to backup schedules, new hardware to deploy and so on – new processes, new procedures, new contractual obligations, and new ways of providing support to customers.

I also spoke about how despite there being quite a bit of additional onus and administrative overhead on us as a service provider, we’d made the decision to bring VM Shielding to market at zero additional cost to our customers.

This is incredibly important to us, as we don’t see security as a revenue generator, but rather as something that we the service provider are duty bound to provide to our customers. We never want to squeeze our customers on security, and we never want them to feel like they have to choose between security and their budget.

I believe that when you are first to market with a new capability, you have a moral duty to help guide the direction the market takes in its adoption of it, and to take a long-term view of the capability and how it can help the market in the future.

I believe that VM Shielding removes one of the last great barriers to customers moving certain workloads from on-premises into the cloud, protecting their valuable data from being accessed by the fabric on which it runs, and the admins who manage it. This being the case, it’s an absolutely critical capability in the overall uptake of cloud across our entire industry, and we’re beholden to help bring it from a state of ‘desired’ to ‘required’ in order to provide our customers with the best platform, experience, and security possible.

The absolute worst thing you can do when bringing a new capability as important as VM Shielding to market is to treat it a short-term cash grab, as that will ultimately slow adoption as customers are forced to choose between budget and security, and hurt the industry and customer cloud adoption as a whole.

Imagine my absolute dismay then when I read this in a well-publicised article from Rackspace about VM Shielding.


Not only does it claim that all VMs can be encrypted by default through VM Shielding (it’s actually just WS2012 upwards), and that it takes no effort or cost on their part (which is completely untrue, as can be verified by watching BRK3126), but after claiming that there’s no cost or effort to them, on the next line they state that they’ll charge more for Shielded VMs than regular VMs! I can’t fathom the mind-set which can state in one line that there’s no cost to them and in the next that they’ll happily charge more. More mind-boggling is the fact that it’s definitely not zero cost and zero effort, so why not say that there’s additional overhead to them which necessitates a slightly increased price? That line of reasoning at least makes sense, even if it is an incredibly short-sighted approach to business and customer need.

The real benefit of VM Shielding is not the ability to win business that was off limits before, it’s the ability for customers to secure workloads in the cloud which they previously couldn’t, allowing them to reap the cost, performance, agility, and scalability benefits of cloud, for the first time without compromising on security.

That’s the messaging we’d expect from a customer-centric organisation, and is the messaging we will continue to push to market. Inherent security where it’s needed, never as an additional cost item. Smooth the path to cloud, don’t throw up barriers.

Maybe I’m just being precious here, and if so please let me know. Very interested to hear thoughts on this, so please do leave comments below, or on Twitter @KennyLowe.



I’ll preface this blog by saying that if you’re here to learn the basics of VM Shielding then this probably isn’t for you. If you’re already familiar with the concepts of VM Shielding and Guarded Fabrics and want to learn more about how to recover a stricken Shielded VM, then read on!

One of the core concepts of a Shielded VM is that a fabric admin should not, cannot, and will not ever be able to gain access to a tenant VM for any reason. This is brilliant from a security perspective (and unique feature in Hyper-V 2016 compared to all other hypervisors/public clouds), but when it comes to troubleshooting can definitely raise a few eyebrows.

I often get asked why we can’t just temporarily un-shield and then re-shield a VM after troubleshooting, and the answer is that this fundamentally breaks the trust model of VM Shielding as that VM could not ever be trusted to be uncompromised, so that’s not a feature or function available.

So if a tenant borks the networking in their VM, or reboots it and it fails to come back up, or it crashes, or a whole plethora of other scenarios happen that breaks remote access over RDP, SSH and the like, then originally your only option would be to restore from backup.

Thanks to the advent of nested Hyper-V however, we have a new option available to us which empowers the tenant to repair a VM themselves, without ever compromising the trust model of it being Shielded.

Enter: The Repair Garage. All scripts referenced in this blog are available through this link, unless otherwise specifically noted.

The Repair Garage concept allows a tenant to bring a Shielded VM inside another Shielded VM which is also a nested and guarded Hyper-V host, un-shield it, console on to the stricken VM and repair it, re-shield it, and return it to the main fabric, all without it ever being exposed to the fabric admins at any time.


Ok, it’s a theory, but there aren’t exactly a plethora of Guarded Fabrics available in the world to test it on – fortunately we have a production-ready and fully featured TP5 one at our disposal, from TPMv2 to WAP, so testing-ho!
For this testing we have set up a three node Hyper-V cluster of Dell R630s, each host fitted with TPMv2 chips, set up as a Guarded Fabric managed by VMM2016TP5, and actively able to run fully Shielded VMs.

Within this environment we set up a new Cloud for the purposes of testing, and enable it for VM Shielding, then deploy a VM that we presciently name ‘Stricken VM’.

As expected, I can RDP to the VM using my signed RDP file.

Once connected over RDP, I disable the NIC in order to ruin my access to it. At this point, there is no way to regain access to the VM through traditional means, be it Console, PowerShell Direct, or other.

As we see, I as a Fabric Admin cannot console on to the Stricken VM to repair it. Oh balls.

The first stage in recovering this VM is deploying a new Shielded VM to function as a nested Hyper-V host, or a ‘Repair Garage’ as Microsoft term it.

IMPORTANT: These VMs need to be connected to the same vSwitch and on the same Host.

If Nested Virtualisation isn’t enabled on your host, enable it with bcdedit /set {current} hypervisorloadoptions OFFERNESTEDVIRT and reboot.

Please, please, please, make sure that your Repair Garage VM has all available updates installed. If it doesn’t, there is a very high chance that it will all go tits up later on.

Next we enable Nested Virtualisation on the Repair Garage VM using the script at https://github.com/Microsoft/Virtualization-Documentation/blob/master/hyperv-tools/Nested/Enable-NestedVm.ps1

We can check whether all is set up correctly using the following script on the host:


Our Repair Garage is indeed ready to be a nested virtualisation host, so onwards we go!

On the host, run the script StartShieldedVMRecoveryOnFabric.ps1 as an Administrator.

The process kicks off, and you hold your breath…

… and it fails. Every time for me. Until I realised that the script is dependent on your Stricken VM’s disk being Dynamic, not Fixed, so a quick convert to Dynamic later and we’re up and running again…

Note that at line 78, the script attaches an exported version of the Stricken VM’s OS drive to SCSI Controller 0, Location 1 of the Repair Garage. If you have an ISO or data disk attached to your Repair Garage, this will cause it to fail as the slot will be occupied.

If all goes well, you should get this output:

… and you can hopefully see the recovery VHDX attached to the Recovery VM.

Taking on the role of the tenant now, I RDP into the Repair Garage VM and check that the recovery disk is attached and offline.

Next, we run the PrepareShieldedVMTroubleshooting.ps1 script from the documentation, which will do a whole lot of stuff which will result in the Stricken VM starting as a VM nested within the Shielded Recovery Garage. In theory. The script claims to install Hyper-V on the Repair Garage VM, but it doesn’t, so install that manually first and reboot, then wipe your brow when you can RDP back in successfully.

Next we run the PrepareShieldedVMTroubleshooting.ps1 script provided in the documentation, grit our teeth, pray to the old gods and the new, and again breathe a sigh of relief when it succeeds.

This brings the data disk online…

… imports the VM into Hyper-V in the Repair Garage…

… creates C:\Certs, and populates it with a temporary recovery guardian certificate and a key protector file.

These should be copied to the Hyper-V host on which the Repair Garage and Stricken VM reside, after which we run the ‘GrantShieldedVMRecoveryGuardian.ps1’ script, which should generate a new Key Protector, but unfortunately at this stage it fails.

I’ve spent some time troubleshooting this and haven’t been able to make any headway yet – it fails at the point in Grant-HgsKeyProtectorAccess (in HGSClient module) where it passes Key Protector and Guardian info to the MSFT_HgsKeyProtector Class to Grant access, and from debugging all fields are being correctly populated and passed, unfortunately it’s failing with this Index out of range error every time.

So a few lessons learned so far, and I’m confident part 2 will see this resolved and then on we push as there are but a few steps left 🙂

Edit: I’ve had confirmation that this issue is a bug in TP5 which is fixed in RTM.

I suffer from what is probably a common affliction in our field – I assume that everyone reads the same articles, attends the same webinars, and goes to the same conferences as me. Over the past few weeks though I’ve had to answer the titular question quite a number of times, I’ve also been asked a few times when we’re upgrading our Hyper-V/WAP platform to Azure Stack, so figured it worth writing a short blog on the subject.

To understand Azure Stack, you first need to understand a few fundamentals about it:

  • Azure Stack is not an upgrade to Hyper-V – it’s a whole separate product, however…
  • Azure Stack does make use of Hyper-V 2016, and…
  • It runs on top of Storage Spaces Direct…
  • … but it cannot run on an existing Hyper-V environment. It’s a greenfield installation.
  • Critically, Azure Stack is Azure. Not Azure-lite, not Azure-like, not an imitation, it’s Azure.

Not virtualisation plus, not an abstraction of System Center, Azure Stack is the Azure codebase slightly tweaked to run in smaller environments. Azure Stack is Cloud.

More than that, Azure Stack is the fulfilment of a multi-year old promise from Microsoft – true hybrid cloud. Whether you consume Azure from your own datacentre, from a service provider, or from Microsoft, the experience is the same, your applications will work the same

This is utterly unique and compelling capability. It draws back the veil on Azure, increases knowledge and confidence in that platform, and democratises cloud in a way not just that no one else is doing, but in a way that no one else is capable of doing.

Finally in Azure Stack the term ‘Cloud OS’ makes sense. If you think about the Windows operating system, you can buy a laptop, or a desktop, or components to build your own PC as you please. Your hardware can be super-powerful and enable extra functionality in Windows, or it can be lightweight and cheap and use a core of base functionality. Whatever hardware you run it on though, Windows is consistent, and applications written for it (assuming the hardware is capable) will work.

Azure is the Operating System for Cloud.

You can deploy your own Azure Stack on-prem, you can consume it from a service provider, or you can take it direct from Microsoft’s hyperscale cloud, and the experience is the same. Your choice now that drives the decision of where your applications run comes down to cost model, scale requirement, regional or global needs, latency, support, vertical integration of applications, and so on.

Critically, in just the same way as you have choice in your hardware vendor for your computer – moving between Dell, Microsoft, HP, Lenovo et al at will with Windows being the point of consistency, Azure enables simple movement between providers depending on your wants and needs at the time, with the knowledge that your applications will continue to work, and won’t require conversion or re-architecture.

This is a weird concept, but I think it’s an important one – architecting for Azure, using your DevOps tools of choice, removes the risk of vendor lock in. The vendor here isn’t Microsoft, it isn’t Azure – Azure is the cloud operating system, the vendor delivers Azure.

Azure Stack doesn’t replace Hyper-V

Let’s get this straight – to me, Hyper-V 2016 is a more capable IaaS platform than Azure Stack. We have the same software defined networking stack in Azure Stack and Hyper-V 2016 now, and all the same cost/performance benefits inherent in Storage Spaces. Importantly, because Azure Stack is Azure Consistent, there are capabilities inherent to Hyper-V 2016 that it cannot make use of. If a feature doesn’t exist in Azure, it doesn’t exist in Azure Stack – consistency is king, and needed to ensure guaranteed portability of applications. That means that IaaS in Azure Stack misses out on…

Generation 2 VMs

VHDX and Shared VHDX

Shielded VMs

Encryption Supported VMs


Secure Boot

SCSI Support

Faster boot times

… and probably more that I’m forgetting. Additionally, because Azure Stack is Azure, VM sizes can only be consistent with those in Azure. Hyper-V 2016 remains a much more flexible platform for pure virtualisation and running existing workloads. This means that until these features are available in Azure, they won’t be available in Azure Stack, and Hyper-V will remain the more capable virtualisation platform.

Even once those features come to Azure, if they do, a cloud platform may not be the right place for some workloads – much in the same way as some workloads still benefit from running on physical servers vs virtualised, some workloads are best suited to running on a traditional virtualisation platform.

Virtualisation is not cloud. Cloud is a leap step beyond virtualisation.

Finally, in some ways Azure Stack actually improves upon Azure. We have choice in our storage – we can put whatever (supported) combination of NVME, SSD, and HDD we want in our Azure Stack servers, delivering consistent storage performance in a way which public clouds just don’t. Azure (and other public clouds) have no concept of live migration – if a host goes down, the VMs on it go down. This is not true in Azure Stack, as it can make use of Hyper-V live migration, so we get better individual VM SLAs by default.

This is actually a key concept in Cloud – architecting for application resiliency so individual VM availability doesn’t matter, so it’s interesting that it’s not as important in Azure Stack. One of many thoughts to ponder.

So then – what is Azure Stack?

Azure Stack is Azure.

Azure Stack is the fulfilment of the hybrid cloud promise.

Azure Stack significantly mitigates the risk of cloud-vendor lock in.

Azure Stack makes Azure the ultimate developer-first cloud platform.

In my opinion, Azure Stack is the most revolutionary advancement in the cloud industry since the formation of the cloud industry.

We are so used to caveats and limitations in on-prem and service provider hosted platforms vs the hyperscale clouds that it’s almost a shock that we now have the same capabilities available to us. Now we can use hyperscale where hyperscale makes sense, use regional when regional makes sense, and use local when local makes sense.

True, beautiful, capable, hybrid cloud. This is the promise of Azure Stack. Let’s just not fuck it up now.

I’m delighted to be able to say that brightsolid has been awarded both Scottish SME Employer of the Year and overall Scottish Employer of the Year in the annual Business Insider Scotland’s Best Employer awards 2015. I had the honour of accepting the award on behalf of brightsolid. This is especially pleasing as it happened the evening before we opened our new Tier3+ data centre in Aberdeen!




Chapter 1: In Which a Gauntlet is Cast



Every month at brightsolid we have a full company update, wherein a member of each team presents a short talk about what their business area has been working on for the prior month. Four weeks ago, our Customer Account Manager kicked off her talk by throwing me a Rubik’s cube, and challenging me to solve it before she’d finished her update.

I hadn’t touched a Rubik’s cube since I was a child, and had never learned how to complete it, so I spent the talk fervently and very randomly flipping colour to colour, with never a hope of completing it in time. After a couple of minutes I did have the wherewithal to fire up a guide on how to complete it, but by then it was too late, and the guide too complex to follow in such a short space of time. I failed.


Learn from Doom




For many, many years Dr. Doom was and remains my all-time favourite Marvel supervillain. Many people say that Doom’s superpower is his intellect, being regularly ranked the most intelligent or second most intelligent person in the Marvel universe, but I disagree.

Doom’s true superpower is his capacity for learning from failure.

In a fictional universe where villains make the same mistakes again and again and again, Doom stands alone in the fact that whenever he is defeated, he comes back better prepared, having fully learned lessons from his failure, and kicks ass.

He must have a phenomenal post-incident analysis process, because his lessons learned invariably work. When he was defeated by Galactus, he developed a weapon to steal Galactus’s powers. When he was defeated by the Beyonder he developed a weapon to steal the Beyonder’s powers. When he was defeated by the Silver Surfer, he developed a weapon to steal the Silver Surfer’s powers… these might not be the greatest examples.
















The point is that Doom learns, he adapts, and when he’s defeated he comes back better prepared and ready to fight. It’s a lesson that other Supervillains would do well to learn – after all, the definition of stupidity is doing the same thing over and over again and expecting a different result.

So with Doom’s resolve at the fore of my mind, I decided I’d learn to do the Rubik’s cube in time for our next team update – that was four weeks ago, our next team update is on tomorrow, and I can now complete the Rubik’s cube in 2mins 30. It’s a bit off the sub six second world record, but it’s sufficient for my purposes.


Chapter 2: Over-complication can be Overcome


I’ll be honest, the first time I looked at instructions for how to learn to solve the cube I almost chucked it aside. Memorising over 100 different steps and multiple different patterns did not fill me with glee – I’ve always been a more practical person than theory-based, and the idea of learning pages of coloured patterns and rotational algorithms was fairly anathematic to me. Therein then lies the next lesson…

Make the Problem Your Own.



This applies to so many aspects of life, but it in particular applies when problem solving or learning a new skill. Don’t approach it on someone else’s terms, make it your own. Turn it on its head and redefine it in terms you are well equipped to manage.

In this case, to solve the problem of memorising rotational algorithms, I applied a portion of my memory that I know works well and with little effort – remembering rhyming patterns. I took every step, and created a little poem that I could just rattle off mentally which would take me through process end to end.

I used the guide at Rubiks.com, and memorised steps 1-3 as they’re straightforward enough. Indeed stanza 1 of my poem reads as follows:


“Steps one to three don’t need a rhyme

They’re so damn easy just take some time

Learn them all then come back here

This poem will aid you, have no fear.”

Step Four: The Enfourening

When you come to step four, on each side of the cube there’s an inverted ‘T’ shape. Depending on the colour at the top of that inverted T, you need to move that piece clockwise or anticlockwise. Below is how the Rubiks.com site explains how to rotate the pieces based on where you want it to go.









No. No no no no no. That is not something that clicks in my mind, and the way they call anti-clockwise ‘inverted’ and give it a lowercase ‘i’ suffix is just horrendous to my mind. I hated it, so I reworked it into more manageable nomenclature, and critically, into terms which could rhyme. All the ‘i’ suffixes became ‘a’ for anticlockwise, leading to the following:


‘U’ -> Top

‘R’ -> Right

‘L’ -> Left

‘F’ -> Front

‘B’ -> Back

‘Ui’ -> Ta

‘Ri’ -> Ra

‘Li’ -> La

‘Fi’ -> Fa

‘Bi’ -> Ba


Make sense?

Under this nomenclature then, the steps to turn the piece clockwise become ‘Top, Right, Ta, Ra, Ta, Fa, Top, Front.’

Turning that into a memorable rhyming stanza, I ended up with:

“If Clockwise falls the square so bright

turn top then right,

Remember munt,

TaRa, TaFa, then top, then front.”


It could have been rude, but I behaved. The steps to turn the piece anticlockwise become:

“If Anticlockwise wends its weft,

Tala top left,

then top and front,

and end it all with tafa’s shunt.”

Two short stanzas replace those horrendous diagrams – simple! To my mind, anyway, and ultimately that’s the whole point of this exercise. Reinventing it in terms that make the most sense to me.

At the end of Step Four, you end up with this:


Step Five: Where you’ve probably already stopped reading

At this stage you can probably just stop reading unless you want to apply this poetry method to solving the rest of the cube.

To follow the entirety of my method, go to https://uk.rubiks.com/blog/how-to-solve-the-rubiks-cube and learn stage 1 to 3 right now. Once you’re comfortable with those, read the instructions for steps four, five and six, then follow the poem below to complete it faster than ever before!


Steps 1 to 3

Steps one to three don’t need a rhyme

They’re so damn easy just take some time

Learn them all then come back here

This poem will aid you, have no fear

Step 4

If Clockwise falls the square so bright

turn top then right,

Remember munt,

tara, tafa, then top, then front.

If Anticlockwise wends its weft,

Tala top left,

then top and front,

and end it all with tafa’s shunt

Step 5

For five we play the front then top,

The right goes Ta then RaFa plop.

If there’s a line it’s front then right,

And top goes Ra to TaFa tight

Yellow corners flow from right

Then on to top then ra top right

Now stick it the sun god’s ma,

we finish off with top top ra

Step 6

We’re almost done so ra front ra!

Then double back damn right and fa!

Ra dub back give thanks to ma,

We finish off with right right ta

Clockwise turns a twice front whore,

Top left Ra then front once more

Front la right and top we sing

Double front is the last thing


If you do end up trying to use this poem to solve a Rubik’s cube, you’re probably mental. I can’t imagine it making sense to anyone other than myself, but that’s the point of this blog post, it doesn’t have to.


When you fail, use the opportunity to learn.

When you’re learning, don’t hold yourself to anyone else’s standards or expectations.

Make any problem your own.

And win.




My current role is Head of Emerging Technologies at brightsolid, the technology and innovation arm of DC Thomson & Co Ltd. For the past ten years I’ve worked in technology-related roles in a number of industries, from financial services and publishing to video games and datacenter hosting. A few years ago I set up the first Code Club in Scotland and ever since have championed the need for coding in our primary and secondary schools, both to the industry and to the educational establishment itself. Through this journey I’ve learned a huge amount about current preconceptions around coding, about how hungry kids are to learn these skills, and critically, just how undervalued said skills still are in some quarters.

I got my first computer at age 4 in 1986, an Amstrad CPC6128 of which I have many fond memories. I was ‘coding’ in Basic by age 6 and haven’t really ever stopped. I spent large portions of my primary school career coming in early each day with my friend to write a new game on the class BBC Micro – it had to be a new game each day because there was no disk drive on which to save our creations, so each day our labours were lost. Much of my spare time in secondary school was in the Computing Studies department, coding and creating features or ‘mods’ for wholly unsuitable video games like Doom and Quake. In sixth form I won the Service to School prize for services rendered in computing. At university while I was ostensibly studying Electrical and Electronic Engineering, I spent much of my time as a volunteer programmer for a popular online multiplayer game using the C programming language, and in this my fourth decade I have written and published a couple of applications into the Microsoft App Store.

With this rich history of coding stretching back throughout my life, it’s completely natural that my career would follow thusly into a programming related field, but the reality was not so. My job has never been as a programmer or software engineer, my roles have never required me to be able to code, however I absolutely and unequivocally state that the skills I have learned through coding have been absolutely critical to my success in my career. Granted I’ve worked in IT fields in systems administration and strategic technology roles, and many would equate those to or drop them under the same umbrella as software engineering, but the reality is that the jobs I have done are as far removed from software engineering as something like medicinal chemistry is from being a surgeon.

The reality of the world that we live in today is that it is a technology-driven society, a fact which only becomes more and more prevalent as time advances. Few industries today are not wholly dependent on technology, not just from an infrastructure perspective, but also their workforce’s ability to effectively utilise and leverage technology to the benefit of themselves and the business. Something I hear time and time again is that children today are a digital generation, grow up with technology, and know everything about how to use it – this is completely and demonstrably false. Children are growing up as content consumers of technology, where computers and tablets and mobile devices are black boxes of mystery into which they enter a search term and a YouTube video pops out for them to watch. This in no way makes them technologically literate any more than me being able to drive a car makes me a mechanic.

Few would argue the benefits of having a core understanding of how a car works – how to check the oil levels, how to change a tyre, how to keep tyre pressure at an appropriate level for fuel economy, how to change a headlamp… yet the equivalent skills in computing are being washed over as unimportant in favour of the ‘driving’ skills such as word processing. Having a core knowledge doesn’t necessitate following that field to completion – becoming a mechanic or software engineer – what it does do is empower the individual with knowledge which they can then use to solve problems on their own, without depending on others.

It’s opening up technology from being a content consumption black box into an open world of content creation that structured curricula like Code Club seek to do. Opening children to the concepts of coding grants them new skills in logic and numeracy, as well as problem solving and analytical thinking. In fact, I’ve always maintained that coding at its most basic teaches strict attention to detail in spelling and grammar, as a single misplaced character in code can prevent it from working at all! I strongly believe that not knowing how to make use of or understand technology will be as detrimental in the future as being illiterate or innumerate are today. Those who treat computers as content creation devices and who are not constrained by the black box mentality of ‘query in, answer out’ have today (and will continue to have tomorrow) a significant advantage across all walks of life and a majority of industries – this is something I see day in and day out through discussions and meetings across many sectors.

Dundee as a city has a rich technology heritage, with our One City, Many Discoveries moniker and vibrant creative and gaming industries standing at the forefront of all that is driving the city forward. This drive for technology has always been within the city, but in modern days harkens back to the Timex factory creating ZX81 computers. Many of those found their ways into the hands of the enterprising Dundee youth which directly gave rise to the city now having a larger per capita population of games developers, designers, and software engineers than any other city in the UK. This is why Minecraft for consoles is made in Dundee at 4J Studios, the four J’s of Dundee now being Jute, Jam, Journalism and Joysticks. It’s this creative and technology industry which fuels our city today, and as caretakers of the future we’re obligated and beholden to not just deliver it in a fit state for the next generation, but also to adequately equip that generation with the skills required to flourish in it.

Coding is not an end unto itself; it’s a tool which can and should be used to teach new ways of thinking, new ways of viewing technology and the world, and as a method to teach other subjects. It affords a window into technology that delivers the skills required to thrive in a digital age, and transforms the plethora of compute devices which litter our lives from being dumb consumption terminals into hugely useful and important problem solving and content creation devices.

Ultimately the greatest misapprehension to have is to believe that coding is a standalone entity which can be set aside during childhood and effectively picked up in later life. This is no more true than it is of literacy and numeracy – technology is woven through the fabric of our society, and the stark reality is that those who are able to best understand and utilise it have will have a significant advantage over those who do not.

Just quickly jotting down some thoughts on the Win10 event yesterday.


This is the reason I’ve not put the Win10 tech preview on my Surface Pro 3 – the current tech preview is not designed for touch, and works really poorly. With Continuum, it should detect whether it’s got a keyboard attached or not, and flip between touch and desktop mode automatically. This is a good thing for me. It also further builds the case for IT departments to deploy hybrid or convertible devices to staff in place of the laptop/tablet combo. This is a good thing for the enterprise.


New rendering engine is good. Not based on WebKit is probably bad – that was an opportunity to unify the web experience. Oh well. Having Cortana built in is awesome, after all what’s a Spartan without his AI? The socialisation stuff I’m not really fussed about – I can’t see myself annotating a webpage with pen and sharing it around.

Cortana on Desktop

The context aware surfacing of information is very cool. The voice command stuff is not useful in an office environment, but built into the Xbox One with Kinect for voice input? That could be useful. That makes your Xbox the equivalent of the computer interface in crew quarters in Star Trek TNG et al, in terms of information gathering, and even potential for home automation and control.

Windows 10 on Phone

We all knew this was coming, and it’s excellent – I want more unification for consumer as well as developer. This is a very positive step forward. A lot of fuss was made over having the Word rendering engine in the mail app on Windows Phone 10 – I don’t care about that. I want my mail app on my phone to be as lightweight, rapid and responsive as possible. I can only see the Word engine slowing that process down. Who cares about formatting from phone? It’s for rapid consumption and delivery of information, it’s not a device to work from.

Windows 10 Free Upgrade

Upgrade from Win7 – 8.1 in year one, and your upgrade cost is waived. That’s cool, I would have been upgrading anyway, but nice to get it for free. Not sure how this translates to the workplace, I assume it’s not for Enterprise Editions and there will still be upgrade costs for businesses. If not, holy hell that’s awesome.

Free Office (not desktop) on Windows 10

This is awesome, not sure how it’ll be licensed for the workplace though. Office desktop on RT was free for consumer use, but not licensed for the workplace. I’m hopeful that the touch-first versions of Office will be free across the board, with the desktop versions still licensable.

Xbox Streaming

I will now be setting off Dragon Age Inquisition war table missions on my home Xbox from my SP3 while at work :/ Needless to say this is an awesome feature for me, it won’t have much of an impact on the opinions of the pig-headed ‘PC Master Race’ gaming sorts though. They should find value in the new Game DVR features of the Xbox App though, as well as the built-in party chat features. It looks like Steam needn’t worry for now as well, as it seems the Xbox App will be a store for Win10 style games, rather than traditional desktop-based ones. DirectX 12 looks great, time to hold off getting a new graphics card until more info there is available…

Surface Hub

On the face of it this is ridiculous, and just another way of justifying some of the Perceptive Pixel stuff. The Skype for Business and OneNote integration is cool. It’s also available on any existing Win8/8.1 machine. Writing on a screen that size is a terrible experience, regardless of input resolution. Outstretched arms, out of FOV of the cameras – awful. You could literally get the same features today out of a Surface Pro 3 embedded in a conference table, wired into a large TV and webcam, but with the ability to draw on-screen without having to get up. I guess it’s not about features though, it’s about looking cool. Which it does. It’s still ridiculous though.


I don’t know where to start here – I want one. I actually need it now. I was sceptical until I realised that it’s not just transparent LCDs overlaying data AR style, it’s literally f*cking with photon direction, intensity and wavelength en route to your eye to make your brain think there are objects in the real world that aren’t there. Incredible curveball, massive talking point, if it achieves 50% of what it claims I will still want one.