Get rid of/make void the fact that software and hardware companies disclaim any and all liability. If they make bad things, they should be liable for them.
I would provide an exception to this, and that's if they are open sourced, able to upload firmwares, and able to revert to a safe baseband.
Define 'bad'.
What one person sees as "insecure and bad" another person will view as "configurable and open".
Ultimately the consumer shares a good percentage of blame.
Say, I have a Samsung tv with internet. I hook it up to the 'net. I use the built in features intended. It updates when it needs to.
Except, for a year and a half, those TVs were vulnerable to a whole range of bad things. They were used as local spying platforms. They were used as jumping off points for local networks. And they were used in attacks on other networks.
We can quantify the damages that this malfeasant software/hardware did. They certainly weren't "intended features", nor can customers just roll their own signed firmware.
> What one person sees as "insecure and bad" another person will view as "configurable and open".
Depends. Does the default behavior leave you open to a range of unintended effects? Are there known and unpatched errors/bugs?
Yes, configurations can be made that open you to vulnerabilities. Making an open relay over SMTP is one such. But the default Postfix is sane and secure.
> Ultimately the consumer shares a good percentage of blame.
That's what I'm arguing. When the customer is not much more than in a rental agreement faked as a purchase, 100% of the blame needs to fall on the renter operator.
In your proposed universe, you won't have a "smart tv" because you will choose not to pay the $3500 price tag to cover the security audits and increased litigation insurance that will accompany the manufacture of such devices.
Most linux distros will also be sued out of existence. Such laws are a dream for authoritarian regimes. Ultimately there will be a only a small handful of monopoly powers who have enough resources to navigate the regulatory landscape.
I'm proposing excising these "smart" features out of devices that don't need it. A TV/Monitor is and will be useful for the foreseeable future. A TV/MOnitor with bit-rotted 'smart features' will turn the device into a disposable device when the maintainer/owner finally wants to get rid of it.
Then just buy a TV / Monitor?
Without liability, there is no disincentivizing including smart features for manufacturers.
I agree that "Use a user-patchable / open source / replaceable stack -> shielded from some liability" or "Lock everything down -> take on legal liability for your own security" is a sane system to put in place.
There's no reason 50%+ of IoT devices (especially Chinese clones) aren't built top-to-bottom open source, aside from manufacturer ignorance / laziness.
The problem with most companies that put some intelligence in dumb devices is that they:
1. Rely on their own cloud platform
2. Use lockin to their specific plan
3. Fail to quickly respond to security incidences
4. Abandon when their next incremental version comes out
And most of these types of devices are the ones that end up being a member in a botnet or other bad networks.
The best defense is to make "dumb" devices. No, our microwave, refrigerator, oven, dish washer, and others do NOT need network connectivity. Hard to hack a machine with no connectivity.
mind you, I'm NOT Advocating for insecure devices, I'm just saying be prepared for monthly service fees or short product lifecycles if this is what is expected. All of which will drive up costs and potentially reduce utility.
Or, the public being price sensitive, will with appropriate legislation, either start killing 'smart' devices, or use secured and local standards.
That's the point I'm trying to make.
Support your shit properly, or keep the devices dumb.
I prefer dumb, so I can add my own smarts without being tied to some shitty proprietary IoT.
It already is void or at least significantly limited by law in most jurisdictions. It might be better if we waived statutes of limitations and enhanced damages (e.g., 3× multiple) for damages where the basis of liability would be reasonably viewed as within the scope of a disclaimer which purported to disclaim liability that could not legally be disclaimed, so that there was a significant disincentive for the currently-routine overly-broad disclaimers.
There is already a kind of hardware and software where companies are liable: in medical equipment. Now look at what that does to the prices.
Open source and consumer serviceable makes sense, but that's already being fought for with the "right to repair" movement.
If three brands of GPS mapping device dominate the consumer market, but only one of them bothers to certify for aircraft, the exact same hardware in an aircraft dash-mount will cost many times the amount for a consumer handheld. Costs only determine prices for commodity suppliers. Everyone else charges what the market will bear.
The same would happen with any other kind of software/hardware where liabilities are regulated. Suddenly companies would have to tighten their development processes, triple check for IP, formally verify every component, get certified and insured, and prices to the consumer would skyrocket.
I think consumers will want regulation when they see what it fixes.