On Bruce Schneier

Bruce Schneier's CRYPTOGRAM this month starts with an excellent commentary on "The Future of Privacy". Later, he reports on an experiment in London where people were handed software CDs in the street and subsequently installed them on their office computers. Schneier usefully points out that employees probably do care about security, but don't understand it. But then he says, "Rather than blaming this kind of behavior on users, we would be better served by focusing on the technology." Really? What about the IT managers at these firms? Schneier is usually all over them to set business-driven security policies, and such policies rarely tolerate autorunning CDs.

In concluding, he uses his home heating system as an example of something which "works fine without my heaving to learn anything about it", and comments that "computers need to work more like that". I find this comment bizarre; suddenly "computers" are at fault, not the IT departments who failed to lock down their Windows boxes. In my opinion, the whole piece is quite out of character, and there was a big discussion about it on his blog.