An article called ” Microsoft’s consumer brand is dying” by CNN points out that the software giant’s execution is no longer winning the market. They cite a blog from Ray Ozzie who says fit and function has been surpassed. This sounds right to me. Consumers often say they like the feel of Apple and Google better.

Then the article has this odd quote from an analyst:

“In this age, the race really is to the swift. You cannot afford to be an hour late or a dollar short,” says Laura DiDio, principal analyst at ITIC. “Now the biggest question is: Can they make it in the 21st century and compete with Google and Apple?”

I disagree. Apple and Google were not swift. Neither was first to market. The race is to the simple (smooth and sexy), not the swift. Ozzie is right, Didio wrong.

More importantly no one seems to be saying the race is to the secure. Microsoft used to get beaten up in the news for being insecure. Although they have done much to improve this, which helped them stop loss in the enterprise market, it appears not to be a primary factor in the fashion-fickle American consumer market where simplicity reigns.

EDITED TO ADD: Tonight I spoke with students at Cal Berkeley and they asked me to explain this further.

First, let me give another great example of a latecomer strategy that is successful:

…interviews conducted by SF Weekly with several former Zynga workers indicate that the practice of stealing other companies’ game ideas — and then using Zynga’s market clout to crowd out the games’ originators — was business as usual.

Rather than comment on whether Zynga is right or wrong, my point is just that they are not in a race to the swift. Zynga apparently is making a lot of money and being successful with a strategy of being later but executing better.

Second, since they were students of political science, I emphasized that people underestimate the value of complexity. Consumers often say they like simplicity but they probably do not realize that this is inversely related to freedom.

The less you can adapt and alter an environment the less freedom you are granted. Looking at the spectrum of freedom in another context, democracy is complicated while a dictatorship is simple. It was at this point the eyes of my audience suddenly lit up, wide with excitement. I was gratified to hear:

Oh! I see now. I never thought of it that way.

Reducing complexity in one area can open up freedom to tinker in another area. Demand for simple interfaces is not hard to understand. But if the market for simplicity gets crowded then differentiation may next come from privacy or security, which Microsoft has actually made progress with lately. I still do not see speed to market as the race Microsoft has to win.

Park staff in South Africa have installed GPS devices into Rhino horns to help protect them from poachers. Rusty Hustler, head of security for North West Parks Board, explains:

“There are a number of alarms that can be programmed: one for excessive movement, so if the rhino starts running, and another that goes off if the rhino sleeps for longer than six hours, which is abnormal.”

An alarm also sounds if the chip goes outside of the area of the game reserve.

Poachers could jam the signal to obscure their location but this too would set off an alarm.

I remember in the late 1990s when people made fun of the Microsoft certification program because 12-yr olds were passing the MCSE test. That was a measure of what kids saw as the future career path and they were mostly right. Today the measure of success has shifted to security bounty programs, as reported by the San Jose Mercury News. I see attempts made to portray a 12-yr old bug hunter as brilliant:

“Mozilla depends on contributors like these for our very, sort of, survival. Mozilla is a community mostly of volunteers. We really encourage people to get involved in the community. You don’t have to be a brilliant 12-year-old to do that,” [Brandon Sterne, security program manager at Mozilla] says.

[…]

Alex is virtually self-taught, says his mother, Elissa Miller. Reading his parents’ very technical books is not an assignment, it’s something he just does; and he understands them. He has a “gift for the technical,” Elissa says.

The story mentions that it took only 900 minutes of testing (15 hours) for Alex to find the bug he reported. He received $3000 so that’s $200/hour by his own estimate. This probably does not account for all the times he sent in bugs before he found the right one and the time taken by Mozilla to tell him why and how those did not qualify. Even at four times slower it is still a good rate for kids. The bounty program is, in short, offering very well-paid training to find security bugs…which can be found by virtually anyone. Rather than call this an act of brilliance (as some also tried with the MCSE tests) we could call this further proof that the barrier to finding security flaws is actually quite low.

Companies that want to raise the barrier should invest in security management up to the executive level who will not let software go to market without passing a rigorous test. Apple just released a program to the web that did not prompt for the old password before allowing a new one to be created. This unbelievable mistake was said by some to be a result of “beta” status. Let’s get real. Apple security just played its hand — if you are watching this game you can now confidently say they lack the desire or capability to stop serious security bugs from going to market. They can’t even find the little ones.

Compare with the HMS Astute that just ran aground. Even the most sophisticated systems have errors, but a day after the incident the Royal Navy started talking court martial and criminal proceedings for the Captain of those errors. Until that level of seriousness is given to software, you can very well expect everyone to be capable of finding and turning in security flaws. It is not how brilliant attackers are but also the liability of defenders that gives a measure of security maturity and management.