Rupert Goodwins' Diary

Thursday 3/08/2006

Of all the deep, deep joys of IT journalism, none compares to a good old-fashioned vicar story. And that's what we have today, following a complaint from Church House Publishing — the propaganda arm of the Church of England — that they weren't getting no satisfaction from Symantec. Norton Antivirus was falsely identifying a component of their Virtual Liturgy package as a virus, and suggesting that the users delete it: they did, and subsequently found that the package didn't work. So they complained to the publishers at Church House, who in turn complained to Symantec, who in turn... didn't seem to do anything.

We got hold of Symantec, and the problem was fixed. Actually, Symantec says that the problem had been fixed last month and the publishers hadn't bothered to get in contact to find out. The publishers say that they couldn't get through to anyone at Symantec no matter how hard they tried.

We can't easily find out whose version of events is accurate, but it does highlight one problem in AV software: the people who end up doing the support are rarely those who can fix things. In this case Church House Publishing ended up fielding all the calls from frustrated clerics, for a mistake made by Symantec. Reason says that Symantec should take on that burden — even if just by giving CHP an email address or URL to distribute to affected parties — but when the company seemed unable even to tell the publishers that the darn problem had been fixed, it's clearly not going to manage anything like an acceptable level of user service. I wonder whether AV companies are worth the hassle. One of the unexpected benefits of switching to Ubuntu on my elderly laptop has been that stuff runs a lot faster; not necessarily because Linux is more efficient than Windows (although it is), but because there's no fat old, cycle-stealing, interface-clogging AV software imperiously squatting on top of my stack. What do you get for your money? False positives, their own security problems, incompatibilities and ineffectiveness — modern malware is tested to make sure it gets past the big four before release.

But is that enough to go open source? I think it is. One of the big no-nos about open source that the commercial boys push about is that you don't get support. What sort of support did the vicars get for their money? The community had to provide: it did. If we're going to have to support ourselves, then we might as well support the sort of software that gives back to the community as much as it gets. I don't like the feeling that we have to pay as well. Another no-no about open source is that it doesn't have any AV software. Guess what? If there's a need for it, it will evolve — and because it will evolve in an open environment with no secrets, it will avoid all the nonsense that happens because Symantec has to double-guess Windows and its applications.

Closed software is dangerous software: it cannot evolve, nor can it contribute to the evolution of its environment, and AV software is the best example of this. We know evolution works better than design in producing robust, flexible, working solutions to problems. Time to act on that knowledge.