> If you're an ISP, your choices are basically just that: Expose user networks fully and trust that all users have enough expert knowledge to put up their own f

> If you're an ISP, your choices are basically just that: Expose user networks fully and trust that all users have enough expert knowledge to put up their own firewalls - or put up a common firewall for all users. This is a false dichotomy. Given that ISPs now overwhelmingly give you some router to plug stuff into, they can very easily have an opt-out firewall configured on the box they give you. That is in fact what i have seen most ISPs do. The incentives for network filtering etc have nothing to do with "protecting the user", this is both easy to do and actually done, frequently the right way (with user-controlled fw).