We know that botnets are a problem, but why should anyone pay attention? How big a problem are they and what can the average person do about them anyway? In this talk I will discuss what's known about the costs botnets and other shared criminal infrastructure impose on society from the viewpoint of an analysis of the costs of cybercrime. I will then discuss what we know about the effectiveness of warnings. Many warnings are designed by lawyers to benefit the person giving the warning rather than the person receiving it; how would we communicate a warning to someone if we really want them to act on it?