e-business 2

[mhar12]

Hi everyone,

A lot of IT vendors and articles mention that e-business is the only way to go for the future. Surveys show that internet users are growing every second. Many companies have adopted the capability of internet shopping for customers, e-ordering, e-payment and other types of transaction online.

A lot of projects fail to meet the expectation.
I am working with a company, that recently uses internet to sell products. This is losing rapidly than anything else.

Many of these companies have gone down. We all aware that the IT sharemarket plummets and have not recover fully.

My questions to all of you:
1. What are your general comment on this issue?

2. Should the companies continue to invest in the internet business and keep covering the losses from this division?

3. What kind of (security) measures can be used to assure consumers that their profiles and transactions are safe and not used for unsolicited purposes?

4. Should we go with big vendor that promises a lot to the clients? Or is it preferable to manage everything in-house?
(My company can afford both options.)

Thank you for all your inputs. I would really appreciate some comments.

Mhar.

 

[rycamor]

My responses to each point:

> A lot of projects fail to meet the expectation.
I am working with a company, that recently uses internet to sell products. This is losing rapidly than anything else.

> Many of these companies have gone down. We all aware that the IT sharemarket plummets and have not recover fully.

This can happen for two reasons:

- Many companies spend far more than they really need to, on expensive proprietary server software, Oracle databases, "e-business" development suites, expensive developer time on overbloawn Java components, ... you name it. Poor execution, poor integration with existing resources, etc... These all add up to unnecessary costs.

- What is it they are actually trying to accomplish online? Often it is a poor match for the kind of activity that the online environment encourages. (In other words, like selling air conditioners in Alaska.)

> 2. Should the companies continue to invest in the internet business and keep covering the losses from this division?

- Only if they see a definite future in it. Yes, it can be worthwhile to take a loss on something, if you see that it will eventually pay off. But much of what happened in the 90s was pure fantasyland. For example, there were actually several companies that thought they could make money by selling "storage space" online. Meaning you could upload files to a remote location for storage, rather than on your own nice safe-n-sound hard drive. As predicted, billions of people flocked *away* from this concept (lol).

> 3. What kind of (security) measures can be used to assure consumers that their profiles and transactions are safe and not used for unsolicited purposes?

- SSL encrypted web access, No storage of credit card information online unless absolutely necessary. (And no usage of Microsoft products) Strong, 128-bit or higher encryption for all communications, including emails.

4. Should we go with big vendor that promises a lot to the clients? Or is it preferable to manage everything in-house?
(My company can afford both options.)

- I think a strong middle ground can often be the best choice. Leaving everything up to the vendors invites them to walk all over you. Managing everything in-house can mean your project will be endlessly mired in politics and pointless revisions. The absolute core of this is your database technology. Your database should be managed in-house by someone who really knows solid relational database design. If your data is really critical (meaning money will be lost if data is lost), then don't use a non-transactional database such as MySQL (at least not until the new developments in MySQL are proven). And don't let someone sell you on some slick new "post-relational", "Object-Oriented", "XML-based" database system. None of these concepts has been proved over time, and they have significant logical problems for true data management.

Security-wise, you need someone in-house who knows security, And you need a security consultant. Security is too big a problem to leave to just one person.

In all of this, don't choose a developers and consultants (in-house or not) who are just glorified salesmen for this or that pet technology vendor. The fundamental concepts stretch beyond what any one vendor can encompass. -------------------------------------------

"Calculus is just the meaningless manipulation of higher symbols"
                          -unknown F student

 

[Prefbid]

"2. Should the companies continue to invest in the internet business and keep covering the losses from this division?"

One marketing concept that may apply to e-business is the idea of an "enabler market". This is a market that by itself does not produce enough revenue, but because it exists it allows other aspects of the business to be more profitable.

Sometimes defining an enabler market is the hardest point to determine. A recent example for us is a company that sells tea. My wife wanted the particular brand of tea. After hunting several stores she called the company. Turns out the company does not sell that flavor of tea in the entire state. They offered to sell to us on the web at a considerable discount over what it would sell for in the store. Now, under normal conditions we would have just picked up the stuff in the store and as soon as it is available in a local store, we will drop the hassle of buying it on the web. However, the tea company gained several long term goals that may not reflect on the P&L for the website.

1. They can gain a better understanding of "word of mouth" penetration in a new area.

2. They maintain a relationship with a loyal customer base while they build their store-shelf marketing reach.

3. They may pick up a few people who are willing to try their product.

None of those three will show up on the P&L statement for the web division. To ignore them, though, could be a disaster in the making.

The company needs to understand that portion of their business and build their website appropriately. If the website is designed to satisfy a few people and to maintain customer relationships, then keep the site small and simple. If the business is tea -- don't sell tee-shirts in the hope of attracting new business. Don't add a bunch of stupid advertising banners in hopes of defraying the cost of your site. Don't trick customers into signing up for mailing lists (better yet, don't have anything to mail).

Accept that the site exists for the convenience of the customer and not as a reveue generation portal for the marketing department. Its a customer service portal and not a revenue generation portal.

If for some reason the site becomes popular, then consider getting the big slick tools and fancy CRM packages.

 

[cooldude17]

@rycamor

You say that for security there should be no use of MS software, this concerns me a lot as I use EBAY to buy and sell who use MS software. I think that I am not going to use them anymore if there is a security risk.

I am going to email them and ask why they are using unsecure software. Thanks for pointing this out I will let collegues know.

Gareth

 

[mhar12]

Is there any particular reason for not using ms software?

That is right that many companies are in the internet just to be known to the public. When a company has been successful nationwide, it is time to target the international market.
When the sole business of the company is selling products via the internet and management knows that it would take years to pass the black line.
Why do you think the company still continue business even though they are forever in the red?

Mhar

 

[garwain]

reasons for not using microsoft?
1) windows crashes too often. I manage several servers for my own company plus several clients. I have (internally) a server running Win2K advanced server, I've seen win2k professional servers and NT servers as well as several unix servers including netBSD, OpenBSD, Redhat linux, mandrake, suse, SCO Unix, and I will guarantee that if I was to reboot every sever the same day, any of the unix based ones would still be running strong after the windows based servers have NEEDED a reboot. I have one linux server that has been running fine without a reboot since last Easter when I finished the configuration. If you are recieving hundred of hits/minute then every second of downtime is loosing money.

2)Too many security bugs in windows. I'm not saying that unix systems are perfect, but I've found that a consultant who knows his way around security can lock up a unix system well enough to prevent the average hacker from wasting much time on it, while it seems that every few days, a new security hole is found is some M$ product.

3) viruses. This shouldn't matter much if you have a good administrator, but there are very few viruses that will affect a unix machine, while windows is at risk of every virus out there. With the number of viruses that have been released lately that can affect IIS I'd think twice about using software that needs to be patched again and again.

4) ugrades: Unix systems hardly ever need to reboot in order to upgrade the software. I can download the latest source for apache, postgres and whatever else, compile them and restart the processes while on windows I'd see 2-3 reboots to upgrade all components

5) hardware: windows machines REQUIRE more system resources just to run. A windows 2K server would crawl along on 256M DDR while a linux system would be running smoothly.

6) price. For a small company to get a server ONSITE to manage their e-commerce site that might make a few thousand dollars per month, using a MS system they would need a strong server that could run 2-3 thousand. Licencing fees for win2K Small buisness server would put another dent in the bankbook. A linux server could be built for half the price paying $35 or so for the distribution on CD along with a manual.

This is just what comes off the top of my head. I'm sure if I was to think about it I could find several more reasons to avoid MS...

 

[rycamor]

cooldude17:

"I am going to email them and ask why they are using unsecure software. Thanks for pointing this out I will let collegues know."

Hehe... I am sure Ebay has had enough complaints in the past. This email will be no surprise to them.

I am not saying it is impossible to run a secure environment with Microsoft products, but the track record speaks volumes. Yes, if you apply all kinds of third-party software: virus checkers, software firewalls, software encryption kits, etc... you can eventually arrive at a somewhat secure system, but you are still at the mercy of Microsoft in some core ares of the OS and server software. The Code Red, and Nimbda viruses were perfect examples. It didn't matter what kind of a firewall you had on your Windows server, because it just made a simple HTTP request on port 80, like any web browser, which raised no security flags until it was too late. In these cases, you simply have to wait until Microsoft delivers the service pack, and meanwhile rely on an external firewall with complex filtering rules to hopefully prevent the attack (which doesn't fix the vulnerability at all, but just puts a temporary (unreliable) bandage on it. )

With a Linux or (even better) a *BSD system, such as FreeBSD, you need no expensive third-party tools to secure your server. The default installation is waaaaaay more secure than most other systems, and with some work, you can configure your system to have all kinds of safeguards which are practically impossible in Windows.

Consider this: Microsoft itself uses FreeBSD Unix as a server platform on more than one website, including HotMail.com.

My opinion on the best technologies for webservices at the moment:

1. For a top-level enterprise Fortune 500 system, your best bets would probably be
a. Sun servers, running Solaris (not because it's that much better than FreeBSD, but because it carries corporate weight)
b. Oracle as a database
c. Java servlets/beans as a development environment
d. Cisco Pix firewalls

2. For a corporation that doesn't care as much about politics, and perhaps has a smaller budget:
a. FreeBSD, running on Alpha servers
b. PostgreSQL as a database (

http://www.postgresql.org)

c. PHP Apache (

http://www.php.net)

as a development environment, running on the Apache webserver
d. NetBSD or FreeBSD, running on a non x86 chipset, with ipfw or ipfilter, as a firewall, along with IPSEC VPN tunneling, and several other security packages. (non-x86 chipset makes it harder to hack certain buffer overflow conditions, etc..., since the chipset is unfamiliar)

The reason larger corporations tend to prefer Sun/Oracle/Java, is that these have the seal of approval of both the corporate world, AND the academic/research world. A very safe political choice, and a safe technological one. Microsoft is a somewhat safe political choice, but a very questionable one in certain areas of technology.

For absolute quickest development, and cheapest software/deployment costs, I recommend choice 2, because these are proven technologies, and they have the benefit of being free software, but not using the GPL (such as Linux, or MySQL), meaning that your corporation can redistribute binary versions of the software with no license restrictions other than to provide credit to the original developers somewhere in the software. This is much more business-friendly open source than the Linux GPL approach, which requires any redistribution of the software to include ALL source code included in the project, even if some of it was developed in-house. (Note: I'm not trying to start a holy war about GPL versus BSD license, etc... I understand all the implications of both, and I prefer the BSD approach to open source. IMHO, of course).

PHP, while not being as "serious" a development environment as Java, is the most complete web scripting language I have seen yet, and I expect it to get dramatically "more serious" in the next version (5.0), which will be due out in a few months. It has many of the benefits of Java, though, and requires considerably less fuss to get a project underway. PostgreSQL is the open source world's best answer to Oracle. It is a very capable, mature database system, with true data integrity, which is still lacking in MySQL.

If I were making IT decisions for a major corporation, I would actually use some combination of choices 1 and 2. Maybe Oracle/Java handling the core business logic, running as an application server, handing out requests to PHP/FreeBSD/Apache webservers, which could be clustered easily around such a concept. Then you would get the political benefit of saying you use Java/Oracle at the core, but the cost/time savings of FreeBSD/PHP/Apache/PostgreSQL for the many actual webservers and minor application servers you would need.

All in my perfect world, of course... ;-) -------------------------------------------

"Calculus is just the meaningless manipulation of higher symbols"
                          -unknown F student