Where does one sue the no-name Chinese manufacturers of these devices? I have a feeling a lawsuit won't get very far in Shenzhen Municipal Court. There's absolutely no consequences to them building these devices and you cannot expect a solution from them.

Cloudflare can start by suing a retailer. That's likely to result in the retailer pulling all merchandise from the offending vendor, even before the lawsuit gets very far. (Otherwise, they move to a higher tier of negligence and damages for knowingly allowing the problem to persist.) That will start to get the attention of manufacturers.

See this article.[1]

[1] http://www.techrepublic.com/article/lock-it-down-ddos-attack...

For now there is little evidence that says the bots are behind NAT's. I'm pretty sure this will come though. In the blog post I stated that there is indication that port 23/telnet is or was in past open.

Blacklisting IP addresses is indeed effective for L7 attacks. It's harder for L3 when the source IP's could be spoofed.

[0] https://medium.com/@cjbarker/mirai-ddos-source-code-review-5...

Sue the people who own and use the devices.

The first few times will be ugly and unfortunate, but if it becomes clear that buying a vulnerable device and installing it in your home is a potentially life-ruining liability, people will quickly stop buying and using the devices. And without a market for insecure IoT gadgets, well, one way or another we won't have insecure IoT gadgets.

Once a few Americans have been hit with ruinous lawsuits, the market for insecure devices will collapse, worldwide, overnight.

I don't even know what to say. Aside that you're clearly not targeting the right thing.

And, you have to admit, it'd be effective: the market would instantly collapse if device owners could be held liable for damage caused by their devices.