> If we want security standards, they need to be legislated democratically and applied to all devices -- not left up to consumer choice.
But if you want security standards, and bob does not, why should bob be forced to want them?
But if you want security standards, and bob does not, why should bob be forced to want them?
“I refuse to change away from my Linux2 busybox/php based home automation devices. https gives you autism!”
(Maybe we can maintain “herd immunity” by abandoning ipv4, and moving the “healthy herd” all over to an ipv6 only internet?)
The botnet that infects Bob's equipment will harm others. The same way his car might.
I suspect the long term answer here might look a lot like the auto industry. You won’t be allowed to sell network-connecting devices that don’t meet certain minimum security standards. Manufacturers will need to commit to a minimum security update period (like car manufactures need to commit to spare parts availability - for at least 10 years after the sale here in .au), and purchasers will will be required to accept responsibility for device’s operation, some of which will be mitigateable by insuring against it, but irresponsible use will not be covered by insurance and become the owner’s responsibility. (Admin while Under Influence? Speed limits on pushing patches?)
I don’t see a clear path to that kind of regulatory control over $15 devices sourced directly out of China by every vanishing retailers/manufactures though, and there’s a whole raft of genuinely useful use cases for inexpensive net connected hardware that’d be impossible or illegal if the expense of the sort of regulatory burden place of car drivers was imposed on people with smart powerpoints or dash cams...