[ Well, that's fair.

I would point out though that the flaw in your analogy is that people have a perception that health care is improving, in real terms, supported by proof in the form of people actually living longer. People do not have a perception that computer security is improving. Now, I suppose it's possible that the "it's getting worse!" meme is a construction of bored tech writers, but at the same time, I personally see more spam in my mailbox and on my blog than i did once.

Still, your analogy does bring up one interesting comparison. Everyone knows that to keep your body healthy, you have to eat right, wash your hands, exercise, and so forth. Computers are now a measurable fraction as complex as human bodies, and so the same kind of effort needs to be put into their health.

Of course, lots of people don't put that much effort into their actual bodies, so it's pretty unlikely they'll put it into keeping their system running smoothly. Add to that that people think of the computer as an appliance -- in many cases, a tuly *magical* appliance, in the sense that it is, to them, beyond comprehension -- and the probability goes even lower. So perhaps computer security professionals face an even more daunting task than health care professionals, in some ways.

Or maybe it really is just a matter of perception. Maybe things are getting better.

Truthfully, i was more interested in the not-yet-published Part 2 of this article, in which possible solutions are proposed. You seem to belive they won't be particularly insightful.

Still, a lot of noteworthy people seem to have responded positively to the article, so I can't dismiss it completely, even if his hyperbole is a turnoff. -k]

RE: Security Absurdity; The Complete, Unquestionable, And Total Failure of Information Security.