This is a great first effort. However, as I think you realize, there’s much more to this story.

The current “anti-virus” regime places ultimate responsibility for computer protection on end users: ironically so, since in the main they are least able to cope with it. And while highly-profitable malware foundries flourish worldwide, law-enforcement stands idly by. This forces consumers to turn to companies like Symantec, who rake in billions “protecting” us from malware threats.

Now, there’s nothing wrong with making a buck cleaning up someone’s computer. So it’s no coincidence that when Symantec sued malware purveyor James Reno back in 2004, it ultimately just let him go. Reno, for his part, claims to have paid nothing in settlement of the suit, and simply moved his malware servers to Toronto. Four more years passed before the FTC sued Reno and others late last year for his malware offenses since Symantec v. Reno. How many millions of computers did Reno infect in the interim? I have gigabytes of data that provide a partial answer (i.e. sales for most of 2005), and volumes of other data showing who’s responsible.

Law enforcement and industry just aren’t interested. With the anti-virus business thriving, why should they be?

Harvard Professor Jonathan Zittrain has it right: if we don’t act soon, the future of the Internet looks grim.

There are now such wonderful things as certification authorities and cryptographic certificates.

While this infrastructure and the way it is presented to users could stand improvement, I’d still say that yes, one can verify the identity of a bank or shop website, today.

Dployment of DNSSec should also help, in the coming years.