> that vendors ensure the devices are free from known vulnerabilities when sold. > Under the proposal, an IoT device has a fairly broad definition, being descri

> that vendors ensure the devices are free from known vulnerabilities when sold. > Under the proposal, an IoT device has a fairly broad definition, being described as “a physical object that is capable of connecting to and is in regular connection with the Internet;” and one that “has computer processing capabilities that can collect, send or receive data.” What is the exact definition of "known vulnerability"? With very broad definition, that would likely prevent them from buying any computers equipped with Windows for good part of the year as while Microsoft is preparing a patch for some vulnerability (which may have been internally discovered). With even more broad definition, it could prevent selling with Linux as well for similar reason (as one of the tens of thousand packages is likely preparing a patch). If it means vulnerabilities where there's either 1) exploit 2) patch 3) detailed information available, it would likely be enough.