I have just found these two pdfs, one from NIST, and other IEEE. IEEE is more technical.
The NIST pdf seperates surges into two types, external and switching from other applications.
Both documents cover plug in surge protectors. Look at the IEEE section 2.3.2 Lead Length.
http://www.nist.gov/public_affairs/practiceguides/surgesfnl.pdf
http://www.mikeholt.com/files/PDF/LightningGuide_FINALpublishedversion_May051.pdf
Thanks very much for these links, these (particularly the IEEE document) cover most of my questions.
The Nist doc is slightly off, and obviously a little tainted by marketing bias, but generally seems correct as far as I can make sense of it.
The IEEE document there explains the issue very well, and even tells you exactly how you should set up equipment and use surge protectors.
The general message from these sources is that no single surge protector is capable of effectively protecting your devices in all situations. Protection (i.e. grounding) near the incoming utilities and proper 'bonding' seems essential in the event of lightning strikes, be that direct or indirect. You need protection on incoming AC supply and utility lines into the house that can withstand and dissipate large amounts of energy. You need protection on any devices that may suffer surges that come into the house from the outside, such as telephone cables. The aforementioned protection requires good planning in house construction and protection devices at utility entrances, which can possibly be installed by power companies etc. These are the 'whole house' protectors previously mentioned.
In addition to this, protection using 'plug in' protectors (the sort this thread concerns) will probably not protect any equipment unless there are already the above measures in place in the event of a large energy surge or strike (the effects of which can be felt up to 1.6km away if a lightning strike!). It depends on how much energy is in the system that needs to be dissipated, and in the event of strikes or even moderate to large surges on AC power, plug in protectors won't help. Same applies for a UPS as surge protection technology in them is essentially the same, they just also provide a battery backup.
Used in conjunction with whole house protectors, plug in protectors may be useful in filtering out constant overvoltages (not high, e.g. 1.5x mains) and small surges that the whole house protectors do not respond to, as they only respond at levels that may be above potentially damaging electronics inside the house (though will provide protection above this for large surges).
It is recommended that you use a plug in surge protector with every device that is of high value and potentially sensitive to small surges, though many devices have this functionality built in to an extent. I need to confirm the difference in numbers between the maximum amount of energy a device can dissipate and the max a plug in protector can. There may only be a small difference. However, the surge protector is easily compromised, and possibly worsens the problem if you are connecting your equipment outwards to other grounds or sources of surges, such as telephone, TV etc. If you use a plug in protector, it's important that all connections to the devices you wish to protect are going through the protector. The devices sit in a 'bubble' of which the only physical route out is via the protector. Therefore, a plug in surge strip with your PC would be inadequate if you're connecting RJ45 to a router, an aerial or telephone line or any thing else connected to something outside the 'bubble'. Also if you're not using 'whole house' protection, it will not protect against any significant surge. They also have to correlate and work well with your whole house protection, or they may simply conduct surges to your equipment and worsen the problem.
So are plug in surge protectors a waste of money? Not necessarily, but without other measures in place they're not doing an awful lot to protect your hardware. Don't think that the warranty will save you if your house is incorrectly grounded or open to surges, as it won't. Only failure of the protector itself will result in a legitimate claim, and the plug in protectors scope is very limited.
It was also noted in the paper that a lot of emphasis put on joule ratings is meaningless without context, and may be totally irrelevant depending on the design of the protector.