Here is something important: regardless of what people in IT like tothink, we don't really control user desktop machines if the users feelstrongly about it. We can try to dictate hardware and software standardsand we can often get away with it for a while, but in the end if theusers want something badly enough they are going to win.

This has really been the case for quite a while, but it is especiallyacute these days with desktops; the ultimate issue is that the usersjust have

One of the things that the situation with security fixes and the Linuxkernel changelogs illustrates isthe difference between programs and products. With a program, what youget is the program; with a product, what you get is the program and awhole ecology of things surrounding it, ranging from documentation tobackporting security fixes into older versions.

(This is why it takes a significant amount of effortto turn a program into a product, as Fred Brooks and others have noted. Icredit Fred Brooks because I believe The