> But forcing Microsoft to reveal their crown jewels (they sell software) vs car companies reveal how an internal controller works (they sell cars), is not comp

> But forcing Microsoft to reveal their crown jewels (they sell software) vs car companies reveal how an internal controller works (they sell cars), is not comparable in any way. Its disingenuous to imply that. This makes two assumptions that I disagree with. The first assumption is that software isn't a core component of cars. I think this is already not true. And to the extent that it is true, it won't be in 2-5 years. Software is at the core of emerging differentiations, such as self/assisted-driving features. The second assumption is that that software doesn't or can't reveal sensitive information about (other) core components of cars. I think you'd be surprised at how much you can deduce about a physical system from its control software. Finally, there's no clear bright line on which companies should or should not get to protect their IP. For Microsoft it's open-and-shut, but e.g. Google doesn't sell its search engine software. And what about IoT companies? "We're a software company that sells IoT appliances, not a lightbulb/car/robot/etc. company". So the only way to write such a regulation would be to write a regulation for the auto industry -- which is insufficient for the same reasons that Schneier talked about IoT and car companies in the same breath.