Just how is this news?

One of the top stories on CNET for Jan. 15, “Seeds of destruction,” focused on a report that said some computer security experts see a parallel between the spread of agricultural blights and computer viruses. These experts think today’s technology monocultures, such as Microsoft desktops, might react like the agricultural monocultures of the past when confronted by a new virus – mainly, that they will mostly die.

What I don’t understand is why CNET thought this was news in January 2004; this has been the long-held view of computer security experts and amateurs for many years. CNET itself had multiple stories on the topic in 2003, including one about the National Science Foundation (NSF) funding university researchers to look at the issue.

This conclusion is also obvious: If more than 90% of the computers in an organization run the same operating system, more than 90% of the machines in that organization are vulnerable if a new virus shows up to exploit a previously unknown bug in the operating system.

In case you have been living in a cave, exploits of new bugs in the dominant operating system are not uncommon, even if they tend to exploit known bugs. If the same organization had machines running operating systems from 10 different vendors that did not share their code, only about 10% of the organization would be at risk. It might be an important 10% but still the effect on the organization likely would be a lot less than in the monoculture (and currently common) case.

But so what? There are not enough vendors of PC operating systems to make any significant difference to this threat. Even if one did not take into account the advantages of managing a uniform environment and the need to have good application-level interoperability, it would be next to impossible to come up with more than three possibilities.

All this talk of the dangers of software monocultures, which I’ve done some of myself, is accurate but irrelevant. As history has made very clear, no matter how often security holes are found companies are not going to swap their Microsoft systems for alternative solutions in enough quantity to make any significant difference. Even if they did, it would just make the alternative a more attractive target.

Macs – at least the latest versions – do have quite good interoperability with Windows environments, but they seem to scare the support people.

When I’m feeling selfish I’d like to see Macs stabilize at 15% to 20% of the market. That would be a big enough market to keep Apple creating these fantastic products but not so big as to become too much of a target for the wackos. When I’m not feeling quite so selfish I think the better-for-Apple level would be about 25%.

I’m all for NSF funding good research and hope the project focus is more on ways to deal with the effects of the monoculture rather than lamenting its existence.

Disclaimer: Many things can be accurately said about Harvard, but “monoculture” is not one of them. The above lament on lamenting is my own.