> Imagine if white hats were given legal immunity to hack devices that are easy to hack (for some definition of "easy") and, for example, replace the firmware w

> Imagine if white hats were given legal immunity to hack devices that are easy to hack (for some definition of "easy") and, for example, replace the firmware with something that flashes some red text reading "contact manufacturer for replacement", and simultaneously closing the security hole in of which they came in the first place. I think something comparable to this is going to be necessary. There's simply not enough pressure to fix devices otherwise. With IoT especially, we seem to have an ugly incentive structure where there's no motivation to improve security unless there are lots of high-profile failures (and perhaps attendant lawsuits) that create demand. White hat work is often prohibited and almost always disdained - we've all seen stories of disclosures being completely ignored. So we get bad security not because consumers don't care about flaws but because they never know the weaknesses are there.