If that's true, then market mechanisms are insufficient to curtail the existence of huge IoT botnets. That's a strong motivator for regulatory intervention. B

If that's true, then market mechanisms are insufficient to curtail the existence of huge IoT botnets. That's a strong motivator for regulatory intervention. But also, the sorts of minimum safeguards that are being requested by the FTC don't actually cost these companies anything more to implement. Requiring credential changes on first login? That's maybe 100 LoC. A basic once-over to catch any super obvious command injections in a relatively simple web UI? Maybe a day or two of engineering effort. Not posting private keys on a public website? Properly train one set of people and make them gatekeepers -- a bit of overhead, but again, extremely minimal when measured against overall product lifecycle costs. FTC isn't asking for formally verified secure kernels with locally sourced state-of-the-art crypto and in-depth end-user training by top psychologists. They're asking for very simple, easy to implement safeguards that a novice developer could implement in a few days. These companies surely spend more than the entire cost of compliance on executive retreats and office holiday parties... Device manufacturers do have to hire one or maybe two engineers who are competent at security. But it's not like those people necessarily cost more than whoever they have on payroll ATM. And in fact, it's likely that those people already are on payroll at these companies -- in which case, all they have to do is start prioritizing and listening to security-minded voices already in their organization.