> Why can't products have a "declaration of security", like they have for EMI compatibility, safety standards and other such things? Because its a moving targe

> Why can't products have a "declaration of security", like they have for EMI compatibility, safety standards and other such things? Because its a moving target. A light switch that isn't going to burn my house down when I buy it will still be safe in 10 or 20 years. A "secure" piece of software of even minimal complexity almost certainly has many severe bugs yet to be discovered. I worry that the effect of legislation like this would mean you could no longer buy a $25 router to hack around with or put OpenWRT on - the legal liability would make such products non-viable, leaving only expensive enterprise grade stuff for purchase. Maybe that's for the greater good in the long run, but it would still be something of a loss.