Return-Path: 
 <cloudstack-users-return-2938-apmail-incubator-cloudstack-users-archive=incubator.apache.org@incubator.apache.org>
X-Original-To: apmail-incubator-cloudstack-users-archive@minotaur.apache.org
Delivered-To: apmail-incubator-cloudstack-users-archive@minotaur.apache.org
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by minotaur.apache.org (Postfix) with SMTP id B4A80D348
	for <apmail-incubator-cloudstack-users-archive@minotaur.apache.org>;
 Wed, 19 Dec 2012 19:28:20 +0000 (UTC)
Received: (qmail 10544 invoked by uid 500); 19 Dec 2012 19:28:19 -0000
Delivered-To: apmail-incubator-cloudstack-users-archive@incubator.apache.org
Received: (qmail 10369 invoked by uid 500); 19 Dec 2012 19:28:19 -0000
Mailing-List: contact cloudstack-users-help@incubator.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:cloudstack-users-help@incubator.apache.org>
List-Unsubscribe: <mailto:cloudstack-users-unsubscribe@incubator.apache.org>
List-Post: <mailto:cloudstack-users@incubator.apache.org>
List-Id: <cloudstack-users.incubator.apache.org>
Reply-To: cloudstack-users@incubator.apache.org
Delivered-To: mailing list cloudstack-users@incubator.apache.org
Received: (qmail 10293 invoked by uid 99); 19 Dec 2012 19:28:19 -0000
Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136)
    by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 19 Dec 2012 19:28:19 +0000
X-ASF-Spam-Status: No, hits=-0.7 required=5.0
	tests=RCVD_IN_DNSWL_LOW,SPF_PASS
X-Spam-Check-By: apache.org
Received-SPF: pass (athena.apache.org: domain of runseb@gmail.com designates
 209.85.215.177 as permitted sender)
Received: from [209.85.215.177] (HELO mail-ea0-f177.google.com)
 (209.85.215.177)
    by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 19 Dec 2012 19:28:14 +0000
Received: by mail-ea0-f177.google.com with SMTP id c10so959187eaa.36
        for <multiple recipients>; Wed, 19 Dec 2012 11:27:53 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=x-received:content-type:mime-version:subject:from:in-reply-to:date
         :cc:content-transfer-encoding:message-id:references:to:x-mailer;
        bh=Y7D87jfD6W1ZhXL0sMjCn5JNLWVi1vU1Qs2bNY6Ak4o=;
        b=C3cVuApeP35vQd6uPZYkrjYAdgOBOX65q7g2wCfi2Z7QXc4uKCOJPs55ST96zu5RKW
         iniwyq+mAZvkK6jxBWsOmwE8MR/BhFxM/1sySOSrpz2fCkJ+aswNt4GqDeI7/DtjvNRu
         oyUNwDF6i8CZrUhQuT5kJlphB2KIDeMw3f5aHYMRi7x6zRKpnHj6+UZw+aslfiSET6bK
         v7HMKAd1AJJbgDiLBAVP+xN2noBhzb1AmDXGjDfV3qoA/b5XUo92L+adRzfP0bLKKi28
         dT2CF9+/QZaPKHzS2BiNBRJlen1detBHLIh6xqC10JQetn6ae0MwoU3ANCbUQs4YUsCk
         awgw==
X-Received: by 10.14.178.196 with SMTP id f44mr16596338eem.14.1355945272747;
        Wed, 19 Dec 2012 11:27:52 -0800 (PST)
Received: from [10.0.0.4] (156-239.193-178.cust.bluewin.ch. [178.193.239.156])
        by mx.google.com with ESMTPS id 6sm10941578eea.3.2012.12.19.11.27.51
        (version=TLSv1/SSLv3 cipher=OTHER);
        Wed, 19 Dec 2012 11:27:51 -0800 (PST)
Content-Type: text/plain; charset=windows-1252
Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\))
Subject: Re: [DISCUSS] CloudStack Marketplace Update
From: Sebastien Goasguen <runseb@gmail.com>
In-Reply-To: 
 <7A92FF96DF135843B4B608FB576BFC3E012DA2CF1BED@SJCPMAILBOX01.citrite.net>
Date: Wed, 19 Dec 2012 20:21:37 +0100
Cc: "cloudstack-dev@incubator.apache.org"
 <cloudstack-dev@incubator.apache.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <62B2017C-BC0D-4D21-9C51-D0FEB57F4F12@gmail.com>
References: 
 <CA+96GG5WtrxkyEsBCN4=_iztU8ZA9opLJPYsxgbDw1zrUFbOEQ@mail.gmail.com>
 <4F8072AF-F588-492D-BA38-093460F660AF@gmail.com>
 <7A92FF96DF135843B4B608FB576BFC3E012DA27F449A@SJCPMAILBOX01.citrite.net>
 <CAKprHVb5cXzcuq2_6MiM0YJfdvWLFWu=EeCh5Uu-9MXYUY_O-g@mail.gmail.com>
 <7A92FF96DF135843B4B608FB576BFC3E012DA27F44DC@SJCPMAILBOX01.citrite.net>
 <0889AA2F-F5DF-4633-88DB-9FD4A8ACB961@stratosec.co>
 <7A92FF96DF135843B4B608FB576BFC3E012DA27F44E3@SJCPMAILBOX01.citrite.net>
 <CA+96GG769HRA5bSPE775=GsM282Rt4bPkHTbnYDPxgNrA+PDbQ@mail.gmail.com>
 <CA+96GG68XgaxQ+KBwNHsveGtuCnMp-aqUyo4Za8QgQ9j0KZojQ@mail.gmail.com>
 <6DE00C9FDF08A34683DF71786C70EBF02F50E5CB@SBPOMB402.sbp.lan>
 <20121213215636.GC18515@localhost.localdomain>
 <15D29345-CF54-4A22-8C8A-F07F90FAF901@gmail.com>
 <7A92FF96DF135843B4B608FB576BFC3E012DA2CF1BED@SJCPMAILBOX01.citrite.net>
To: cloudstack-users@incubator.apache.org
X-Mailer: Apple Mail (2.1499)
X-Virus-Checked: Checked by ClamAV on apache.org


On Dec 19, 2012, at 7:10 PM, Jie Feng <Jie.Feng@citrix.com> wrote:

> Thanks Sebastian for trying to bring it to consensus. I like to =
separate each item and make sure we have consensus on all of them. I am =
also including the user community (in addition to dev) per Alex's =
recommendation.
>=20
> Here is the wiki site for the Marketplace Proposal:
> =
https://cwiki.apache.org/confluence/display/CLOUDSTACK/CloudStack+Marketpl=
ace+Proposal
>=20
> Here are items we need consensus on:
> 1. Separation of the marketplace code from the listing repository.
> We have reached consensus on this one.=20
>=20
> 2. The community will not run an Apache listing repository.
> We have reached consensus on this one. I will modify the Wiki shortly.=20=

>=20
> 3. Place marketplace code in source code tree.
> There are people supporting this, and there are people not supporting =
this when we talked about Marketplaceplace as a whole. When we separate =
marketplace code from the listing repository, majority of the folks =
responded seems to be ok with this.

I had not made the distinction, I thought marketplace =3D listing repo. =
IMHO, the marketplace is a functionality very different than the =
CloudStack orchestration.
There are possible comparison out there: Usharesoft has a marketplace, =
Amysta is a third party metering system etc=85they extend CloudStack and =
bring value to the users but they do not enhance the core orchestration.

So I would vote -1 on this=20

>=20
> 4. Disable Marketplace by default or not including any listing =
repository by default.
> The community in general seems to be concerned about including a third =
party listing repository by default. My question is if third parties do =
run a listing repository, how do we make CloudStack admins and users =
aware of this? And in general, how do we help folks who build =
value-added offerings on top of CloudStack to reach the admins and users =
of the CloudStack community? In my opinion, for an open source project =
to be successful, an ecosystem is very important. My original goal is to =
design the Marketplace in such a way that the listings are very easily =
accessible by admins and users, and have place for the ecosystem to =
participate (think iPhone and iPhone apps).=20
>=20

The many marketplaces that may develop from your code (by grabbing it =
from github for instance) will be part of the ecosystem and bring value =
to the users. But IMHO we cannot show bias towards one or the other.  =
There is also a huge security issue underlying all of this, and speaking =
for myself, I certainly would not want to see a user come back with his =
lawyers and say "You Apache CloudStack have this marketplace enabled by =
default, we used an image from this marketplace and it was the source of =
a $1B loss for our company". Security, audit, provenance are missing =
from your proposal.

What we could do I think is list CloudStack compatible marketplaces on =
our website and let the users choose. I don't want to push something on =
the users, they should pull it understanding the risks.

=46rom a practical standpoint, I would love to see a working marketplace =
out there (starting with just images) and a CloudStack patch for the =
marketplace client.
The client side I believe would be as welcome as things like the many =
storage backends integration that have been submitted or even the nicira =
integration.

+1 on disabling by default and not including default repos.

-sebastien

> Jie
>=20
>=20
>=20
>=20
>=20
>> -----Original Message-----
>> From: sebgoa [mailto:runseb@gmail.com]
>> Sent: Wednesday, December 19, 2012 8:02 AM
>> To: cloudstack-dev@incubator.apache.org
>> Subject: Re: [DISCUSS] CloudStack Marketplace Update
>>=20
>> Hi,
>>=20
>> I would like to help bring this thread to consensus.
>> I re-read the wiki:
>> https://cwiki.apache.org/confluence/display/CLOUDSTACK/CloudStack+Mar
>> ketplace+Proposal
>>=20
>> The biggest issues that I believe drew concerns are:
>> 1-Mention of an Apache CloudStack listing repository 2-Mention of =
including
>> a listing repository in the source code.
>>=20
>> To keep it short, we don't want to become liable for any image that a
>> CloudStack user would run on its cloud. We also don't want the source =
code
>> to contain anything that would be seen as product placement from any
>> vendors.
>>=20
>> That said if the wiki page was modified to remove the mention of "an =
apache
>> cloudstack listing repository" and "inclusion in source code" and =
geared more
>> towards contributing a plugin that would enable cloudstack users to =
link to a
>> third party marketplace if they so desired. Then this would be =
agreeable.
>>=20
>> I also believe this should be "disabled" by default with empty =
"listing
>> repositories".
>>=20
>> If this is agreeable, Jie Feng and co. could run a marketplace on =
their own and
>> Cloudstack users could link to it. I could also work with the =
opennebula folks
>> to make the plugin generic enough to tie to their marketplace.
>>=20
>> Thoughts ? (not too many flames, it's christmas soon :) )
>>=20
>> -Sebastien
>>=20
>>=20
>> On Dec 13, 2012, at 10:56 PM, Joe Brockmeier wrote:
>>=20
>>> On Fri, Dec 14, 2012 at 02:08:00PM +0000, Hugo Trippaers wrote:
>>>> Getting a bit late into the discussion here, but i agree with Chip =
here.
>>>>=20
>>>> I'm already uncomfortable with the idea for a marketplace inside
>>>> CloudStack, but providing just the features allow some external =
party
>>>> (or parties) to set something up should be ok. But neither the ASF
>>>> nor we as a community should maintain such a marketplace. We as a
>>>> community are responsible for maintaining and distributing the
>>>> CloudStack source code, initiatives like a market place seem better
>>>> suited to a commercial entity or another group that is not directly
>>>> related to maintaining the source code of CloudStack.
>>>=20
>>> +1
>>>=20
>>> Best,
>>>=20
>>> jzb
>>> --
>>> Joe Brockmeier
>>> http://dissociatedpress.net/
>>> Twitter: @jzb
>=20