Sense with Cents

In If I Had a Nickel for Every False Positive I told the story of the one virus that ever made it onto a Medlin device. I included a disclaimer: the events were before my time, the story was handed to me, and I’d update the record if better information surfaced.

Better information surfaced. It was sitting in the Napa Valley Register of March 4, 1992, which covered the whole thing while it was happening. Here is what I got wrong, and what actually happened.

I wrote that the virus was caught because the practice, even then, was to scan every new device. That’s the part my handed-down version had sanded smooth. The truth is harder. The scan missed it. The antivirus definitions in the shop were two years old, and the Michelangelo virus was newer than that. The machine — a new computer from a local shop that built systems from parts — arrived with the virus already on its hard drive. Before anyone knew, 250 payroll disks went out to customers carrying it.

So the virus didn’t just make it onto a Medlin device. It made it out the door.

What Jerry did next is the actual lesson. When the Register covered the Michelangelo scare that March, he didn’t hide or soften anything. He put Medlin’s name on the record as a victim, explained exactly what happened and how — the new machine, the outdated scanner, all of it — and got on the phone to call every customer he could reach. Four months later, the disk vendors of the shareware industry voted Medlin the first-ever Shareware Industry Award for Best Business & Finance Software. Owning a mistake in public didn’t cost the company its reputation. It built it.

The rule I inherited when I joined in 1993 — never trust a new device or new media, scan everything before it touches anything — wasn’t proof the system worked. It was the scar tissue from the time it didn’t. There’s a difference, and the difference matters. An outdated scanner is a false sense of security. Which, come to think of it, is its own kind of false positive.

So the count stands at one virus in forty-plus years. But the honest version is that the one got out, and the company told everyone, and called everyone, and kept the lesson. I’d rather have that story than the tidy one I remembered.

Accuracy is the standard here, even when the person being corrected is me. Especially then.

See also: If I Had a Nickel for Every False Positive