I’ll preface this with the fact that I am a security engineer (‘penetration tester’) but I probably don’t live in your country. I care more about my privacy th

I’ll preface this with the fact that I am a security engineer (‘penetration tester’) but I probably don’t live in your country. I care more about my privacy than I do about the security of my device, but an architecture that supports the second almost always supports the first (my neighbours hacking my zigbee isn’t a threat model almost anyone should be concerned about, unless there’s a pattern of hacking en masse). I found out my smart lights literally have a microphone in them the other day, under the guise of ‘plays light to your music’ or something. I architect my IOT by implementing a network without internet, fronted by home assistant - that way my devices can’t ‘phone home’ which who knows what privacy infringing crap. I know that botnets driven by iot is a real and ongoing problem, but it’s a problem that is probably not going to get much vendor buyin without regulation, but what I’m pointing out is that it’s not the only threat facing these devices. I want: - clear guides on what data is collected, I don’t trust they’d only use it the way they say they will so I wouldn’t bother reading that part, if it existed - the ability to opt out of any data collection aside from anything required to do technical updates. I want any data transfer to occur in a clear and auditable way (e.g the ability to inject a root CA and perform a mitm if I wish) - enough protocol spec that at least basic functions can work offline via a system like home assistant These won’t directly solve the ddos vectors, but they will solve the problems that come shortly after on the timeline.