Caveat venditor

I've just been reading perhaps the most thoughtful essay I've ever seen come out of a Microsoft source. It describes why computer security is a waste of time.

Not "waste of time" in the normal colloquial sense, that it does no good. "Waste of time" in the strict economic sense, that the costs (in time) associated with basic security measures outweigh the plausible economic benefit. Basically, if (in any given year) 0.1% of computer users suffer direct monetary losses averaging $5,000 to computer-based fraud attacks, then the expected benefit to the average user of protecting themselves from such attacks is $5.00 per year - or, about half an hour of time at a low wage. Since it's impossible even to read the current set of security advice, much less implement it, in so little time - and since it provides no guarantee of safety anyway - most users, quite rationally, ignore it.

The paper goes on to dissect three popular "security" provisions: password rules (password expiry "will help only if the attacker waits weeks before exploiting the password"), user education about URLs ("a user who conscientiously follows the rules on URL parsing shoulders a considerable burden. The ΔBenefit is that he avoids some subset of phishing sites") to SSL (secure website) certificates ("Ironically, one place a user will almost certainly never see a certificate error is on a phishing or malware hosting site. [...] The rare cases that employ certificates use valid ones.")

Or there's the occasionally-quoted figure that "an unpatched Windows machine connected to the Internet will be compromised within 12 minutes" - the intended message being that you should keep your machine patched. But of course, to patch the machine, you need to connect to the Internet. And it would take considerably more than 12 minutes connected to download the patches on such a hopelessly outdated machine. You could only do it safely from behind a solid firewall - the kind that would make the security patches redundant.

Anti-virus software. What is it good for? It prevents someone else from installing and running software on your machine that you don't want. But it requires you to instal and run - and worse, maintain - software on your machine that you don't bloody want. It protects you from a limited set of types of damage (that might potentially cost you money and time), but it inflicts other costs (in money and time). It updates itself to protect against new threats, but only if you connect to the Internet and thus expose yourself to those threats. (If you haven't connected in a while, your anti-virus will start nagging you to update it - even though "not connecting to the Internet" is far better protection than it can ever offer.)

(Incidentally, most of these objections to anti-virus software also apply to Windows itself.)

The trouble with computer security is that it's been left up to the market. If seatbelts had never been mandated in cars, how many people would choose to pay extra to have them fitted? If there were no government regulation of food safety, how would we think about the steady trickle of deaths from poisoning and disease? Judging by our attitude to computer viruses, the default response would be: "It's their own fault, I always check my Symantec Bacteriograph before eating anything".

The market's solution to such things is not based on making things or people safer: it's based on selling stuff, which is best achieved by making people feel threatened. When the question is about safety, "the market" is not only not the best answer - it's quite possibly the worst.

It's probably too late, now, to try to impose seatbelt laws and driving-license requirements on computers, as well as being way beyond the competence of any government anyway. But there's nothing to stop us passing laws that put the costs where they belong: on the people who sell crappy software. Everyone who sells software should be directly liable for any damage occurring to its users as a result of security holes in that software, and there should be no disclaiming of that responsibility, no matter what contract the buyer signs. After all, it's no more than we expect of people who sell cars, or food, or electrical goods, or drugs.

Of course there are problems with vendor liability (how do you decide which piece of software was at fault? what do we mean by "selling" software? what about "free" software? what about people who charge you to instal or customise someone else's software?) But these are just the sorts of complications that the industry likes to throw up, to make it seem as if the whole idea is impracticable. In fact, once you get over the sheer number of such objections, it's not hard to come up with simple, equitable answers to all of them. Once we've agreed to the principle, the details will be solved in short order.

Cobblers to the world

I don't suppose that shoemaking is quite immune to the recession, but it's not at the top of the list of industries clamouring for our money to prop up its business plan. After all, most cobblers went out of business decades ago.

And yet they're still out there. What high street doesn't have a shop advertising, among random other services, "shoe repair"?

Not ours, I'm delighted to say. This shop also offers to repair handbags and other random leatherware, but shoes feature prominently in its advertising, which is good. It's a lot of work to find a really comfortable pair of shoes, I'm glad there are still people out there who can extend their lifespan, and I was delighted, this morning, to have the chance to give them a bit of business.

"They're my wife's", I explained as I dumped the bag on the counter. Just in case they might be under any misapprehensions, you understand. Like any heterosexual male, I personally have never owned more than two pairs of shoes concurrently.

The cobbler was an elderly man - not perhaps old enough to be the Wandering Jew, but certainly old enough to remember a time when "service" wasn't a dirty word. He pulled out the shoes and examined them critically. Susan had helpfully tucked a note into the boot explaining what was wrong with them, but on examination it wasn't hard to see.

"Sandals - $30 to 40. It's fiddly, you see, taking the sole apart, you can never tell what's going to happen. The boot, that's easy - $20."

"Perfect", I replied. "I'm authorised to spend that much."

He grinned and gave me two tickets, stamped "THURSDAY" - which, after some thought and debate with his colleague, he crossed out and replaced with "MONDAY". "They're in good hands, sir," he assured me as I left the shop.

I'm not sure what it was that made me feel so good about this transaction. Perhaps it was the warm glow of repairing two of Susan's most-loved items of footwear. Perhaps it was the old-fashioned service ethic - the man was all but tugging his forelock as I left. Or the surprising sense of smugness from knowing that, once again, we were mending something rather than throwing it away. Whatever it was, it left me positively looking forward to visiting again.

Tips to Kiwi cinema-owners

1. Popcorn tastes better when it's less than a day old.


2. Selling tickets is not the same as popcorn and ice-creams. When I'm trying to buy a ticket to a movie that starts in four minutes, I don't want to be in a queue behind six teenagers arguing about which Meal Deal they want.


3. It is possible to focus the projector. Try doing it at least once a day. Oh, and much as I applaud your equal-opportunities policy, I suggest this particular job be given to someone who isn't blind.


4. Don't make stupid rules about what I can take into the theatre. If you make me go home to leave my stuff there, I'm not coming back.


5. A hot dog is a sausage in a bun. It doesn't have to taste good - that's what mustard is for - but it's appropriate to the movie-going experience, and that's what counts. What that porcine abomination on a stick might be I don't know, but keep it away from me.

Just call me Alex

I'm having an agreeable yuppie fantasy today.

That probably sounds contradictory. What it involves is a little window in the corner of my second monitor that shows me the exchange rate between the UK pound and the NZ dollar, and -- and this is the nifty bit -- updates itself once per minute. This window is provided courtesy xe.com, a lovely little site that epitomises the service industry ideal of doing one thing and doing it well. And, most importantly, for free.

This rate is of interest to me because I still have a noticeable amount of money in the UK, and I've been meaning to bring it over, for house-buying purposes, when the rate looks good. As I type this, 1GBP would buy me NZ$2.68159, up from $2.67496 when I first checked this morning.

Over the day, the pound has been trending slightly upwards. But every time I watch it actually make its update, the pound weakens (which is bad). It's almost touched 2.686, before dropping back again when I got too excited and began watching too closely.

This is, of course, entirely in keeping with the known laws of economics, and will come as no surprise to anyone.

When the rate hits 2.71 -- which, for the record, I don't think is going to happen this week -- I'll call my trader and finally switch over my millions from sterling. That's the agreeable fantasy part, anyway. In the meantime, however, it really is pretty exciting to watch it out of the corner of my eye.

(D'oh! Just lost another $200.)

So here's this information that, when I was entering the job market, would have been available only to braying young wine-bar-haunting gits with bicycle clips on their sleeves, whose employers paid more for the service than for the people to watch it... and today, it's freely available to anyone with a broadband connection. Today, a mere twenty years too late to make my fortune, I get to play at being a yuppie for free, without even having to take time out from my real job.

That's so cool.

Addendum (added Thursday lunchtime): So much for my powers of prediction. Today the pound is over $2.72. I'm not pushing my luck any further.