Chris commented on my previous entry regarding Microsoft's plans to charge for future OS security features and their admission that "we didn't think about security until customers told us to and were prepared to pay for it".

Chris said:

"No, I think this is good business practice. And besides that, I think that everyone might be better off had Microsoft not decided to go into the "secure software" business.

First of all, whenever Microsoft offers a new service or utility for free as a standard option of its, admitedly, overpriced software, a series of companies that were addressing this field suddenly lose the reason for their existence, and a bunch of lawyers all around the world start suing Microsoft for monopolistic practices.

Second, the security model that people at Microsoft have on their minds, is an all-encompassing scheme addressing security both as an issue of unauthorized access to one's data, and as an attempt to fight degital media piracy. If Microsoft ships the next version of its OS with support for that security scheme which will be implemented in hardware, I'd rather pass on the option.

For most people, security is something that can be achieved even by using freeware programs. Yes, it might be better if this was incorporated in the OS, and of course security is the No. 1 issue for servers, but are we willing to lose yet another piece of our digital freedom by delegating responsibility for security to Microsoft?"

Partially good points I think. For one, Microsoft is going into this market, and they always start like this: external product, tight OS integration, low price, and then they integrate it into the OS and destroy the competition. Remember in the early 90s when there was real-time transparent compression software sold as an add-on to operating systems? No longer.

On the other hand, it's apalling to think that Microsoft, will all the money (what was it at last count? $45 billion in cash, plus some $15 billion in long-term securities?), market share, and power they have, are not willing to "push the envelope" and give customers something more than "what they are ready to pay for." But then, maybe Microsoft is successful precisely because of that. Aim for the lowest common denominator, and out-market everyone else.

As for innovation, Microsoft clearly is, partially by design (i.e., innovate less to minimize risk), and partially by necessity, locked into a market-protection spiral like those described in Clayton Christensen's excellent book The Innovator's Dilemma. They ask their customers what they like, and their customers don't want change. So they don't give it to them, and innovative projects (which of course exist within Microsoft) fail to get the resources they need, since all the projects that have customers and revenue have priority.