While i accept my recent post on Google Desktop Search (GDS) could be considered somewhat imflammatory, i have also been somewhat surprised to see the opposite view writ so large. <\/p>\n
It seems extraordinary to me that the security editor at ZDNet Larry Seltzer could categorically state that GDS presented no security risk<\/a> (or maybe that’s just the headline writers, the article is more nuanced to be fair). Maybe i just don’t get it but i tend to defer to Bruce Shneier<\/a> on matters security related – and he repeatedly makes the case that there are no absolutes in security, only risks to manage.<\/p>\n But Seltzer was confident enough to say: Like the web is secure right now?<\/p>\n I guess i must be in touch with my female side because privacy issues do tend to make me feel a little hysterical. (by way of explanation, the origins of the word “hysteria” come from theories that women are more unstable because they have wombs-the same derivation in “hysterectomy”.)<\/p>\n Anyhow – i was not in the least bit surprised to see the first news story looking at google’s first GDS breach<\/a> fix. <\/p>\n Jim Ley<\/a> found the flaw 2 years ago. Google announced a fix this week. nice. <\/p>\n One thing i wanted to clarify im my post about google and Sarbanes-Oxley<\/a>. I should have made it clear this was a second order audit issue – that is while Sarbanes-Oxley itself is not that granular about IT controls-it does posit a requirement for an operational controls framework; COSO, ISO17799 and Cobit are all emerging as potential answers in that space, and all offer prescriptive guidance on authorization, authentication and identity issues. Auditors using these frameworks could well refuse to certify an organization without clear policies, strategies and processes in this regard. I would like to point you to Chris Byrne<\/a> who first brought the GDS issue to my attention. He has been taking some lumps for doing so – learning new words such as poxy<\/a>.<\/p>\n So back to passion and unreasoned analysis then. It seems we are already turning red or blue – we are either google apologists or attackers. go figure. it doesn’t take long to create partisan hackship now does it. Ideally i would like to be in the reality based community<\/a> though.<\/p>\n This red or blue binary is true within RedMonk- my business partner Stephen is inclined to give GOOG the benefit of the doubt<\/a>, while i believe we should all encourage google to open up now rather than later. <\/p>\n As we know from Microsoft, worrying about ethics after the fact just doesn’t work. We must use web transparency, a la Dan Gillmor<\/a> to persuade google it needs to open up on governance and policy. that will benefit everyone – Google included. Indeed why don’t we make google the target\/poster child for the new transparency movement.<\/a><\/p>\n
\n“Privacy hysterics bring old whine in new bottles to the Internet party. The desktop search beta from this Web search leader doesn’t do anything you can’t do already.”<\/p>\n