The Inquirer reports that at least one individual has devised an interesting solution to the problem of spyware: when the machine becomes infected, throw it away and buy a new one. The fact that it's almost reasonable that someone would go to this length to rid himself of spyware does a good job to underscore that there is a serious problem here, but I find it difficult to believe that this is actually a cheaper and faster alternative to simply putting the Windows XP CD in the drive and reinstalling the OS and reformatting the drive.
Speaking of hard drive reformatting, just last week I happened to walk by as a colleague was reinstalling the OS and reformatting the hard drive on his laptop. "Whatcha doin'?" I asked. "Computer's gotten slow. Time to rebuild it." I nodded knowingly and walked on. Thinking back on it, the whole exchange was rather surreal. That's really an awful solution to an awful problem.
We're really talking about two separate problems here, malware and applaque, that share an all-to-common solution: nuke it. There's gotta be a better way.
The Invisible Hand of Malware
The big problem with malware is that it's grown into a relatively mature market economy. Malware is going to go wherever it can reach the most "customers." Today, this means malware authors get the most bang for their buck by targeting Windows and Internet Explorer, which each own around 90% of their respective market. A common suggestion is to switch to lower-market-share environment like Firefox, or - better yet - to Mac or Linux. With malware, there's safety in (lack of) numbers. The more esoteric your environment, the safer you are. That may be true, but what if we all do this? Obviously, as market share of other environments grow, the more attractive a target those environments become to the bad guys. In the end, staying on the fringe may buy us time but it doesn't make us safer. The obvious solution is that web browsing needs to be safer. IE, frankly, has taken too long to make this happen. Firefox certainly lit a fire and raised the bar in terms of browser security and productivity. From what I've seen of IE7, it should up the ante even further. Market share issues aside, I hope several major players remain in the browser game for a long time to come. In the end, our best hope for safer browsing is a healthy, competitive browser market with each player trying to "out-safe" the other.
When Flossing Doesn't Help
Applaque is that clotting, sticky, performance-sapping residue that forms in your PC over time as you install and uninstall applications and just generally use your computer. No, no, not in the hardware, but in your OS. It's this applaque that causes your system to slow down over time, and its traces are found in the file system, registry, shell, kernel, and pretty much everywhere on your computer where you'd rather this kind of junk didn't accumulate. You know the problem... install this app and it puts something your Startup folder, install that app and a drops in a little background service, install this other app and it makes about 37 thousand registry entries, another that includes a device driver that shims into your network stack, etc. etc. etc. Needless to say, all of this stuff adds up. It's not unreasonable to say that our operating systems die a little every day. Of course, the solutions here aren't so cut-and-dried as with malware. Nobody is wearing a black hat here. On the one hand, you have a bunch of well meaning ISVs trying to build software that people find useful, and on the other you have some individuals PC and its unintentional death by a thousand paper cuts.
So how do we solve it? I have an admittedly overly-Utopian scenario in mind where ISVs self-regulate away the problem by coming up with some objective ways to measure an application's performance impact and then disclosing those measures in an obvious way to potential customers. Coming up with those measures would be a challenge, since there are dozens of variables that go into hardware capabilities.... processor speed, RAM, FSB speed, disk performance, etc. However, if it could be done, wouldn't it be cool if you could understand how a software impacts your system before installing it? Not only would it help you make decisions about what software to run and when you need to upgrade your hardware and how, but the act of disclosure would create a situation where companies competed on the basis of efficiency.
As it is today, we unknowingly allow sloppy engineering into our desktops every day. Somewhere on your computer right now, a developer made an egregious memory-for-performance trade off. And another developer used a linear search across a big list because they didn't have time to implement a more efficient search. Yet another used a busy-wait loop instead of sleeping a thread while waiting for a synchronization object to signal. And still another left dozens of registry-bloating droppings even after uninstalling. And unfortunately, the evil third cousin of Moore's Law states that the concern we developers have about our impact on system performance is inversely proportional to the increase in hardware performance.
It's a big, tough problem to solve, but eventually one of two things will happen: Either computers will become so ridiculously fast and storage so abundant that efficiency will matter very little, or users will run out of patience and demand disclosure of key resource and performance metrics from ISVs, perhaps pushing for legislation as a means to get the industry's attention.
