How secure is zero confirmations?
For small amounts, like a cup of coffee, the double-spending risk is going to be negligible. If it's a person I know, I wouldn't mind receiving and accepting as valid a transaction with zero confirmations.

For shops that will start accepting bitcoin, a stronger security measure would be for them to have multiple bitcoin clients installed in multiple geographical locations. Once each of them has "seen" the transaction they can confirm it as valid, even though it hasn't been included in the blockchain yet. 

The idea behind having several machines look and validate the transaction is that it becomes much harder for someone to propagate a double-spend against a transaction that has already been seen and propagated by several machines across the world.