I think the real problem here lies in the lack of auto-update. Devices will always have vulnerabilities, constantly being discovered, which once weaponized will

I think the real problem here lies in the lack of auto-update. Devices will always have vulnerabilities, constantly being discovered, which once weaponized will be just as trivial to own a large swath of devices as telneting for root was here. The UCC provides an implied warranty for suitability for intended purpose. The FTC defines unfair and deceptive business practices to require a baseline level of security commensurate with the sensitivity of the data that could be exposed or the potential damages that can be inflicted. As in most cases, new laws tend to make things worse, we just need to do better with the old laws. It's not that it's illegal to sell someone a Io(S)T device that can be owned for running a DDoS, but I am willing to bet it is illegal or at least creates significant liability for the manufacturer to sell such a device that also has no way to be fixed after that flaw is discovered. What would be nice is a simple industry standard labeling that indicates a device has auto-update functionality, along with a large numeral indicating the number of years from date of purchase that updates will be provided. The same decal could be used on computers, phones, routers, and IoT. Just like we trained consumers to look for the WiFi Alliance logo to know the router or card they are buying will "just work" I think we are missing a label which would drive consumer confidence and encourage good behavior by the manufacturers. Probably an industry consortium already exists for something like this, but I just haven't heard of it... Because there's no such thing as a new idea, right?