I didn't buy any Internet of Shit products.

Unfortunately, my neighbour did, and now his toaster is used as part of a DDOS attack against a critical piece of internet infrastructure.

How does your solution help?

I dont think there is a legal solution. The pragmatic solution is to own, then secure or disable your neighbor's insecure toaster.

This is an amazing problem. There is simply no solution because most people don't care!

There is a solution, and it's called "government" and "law". No, really. We've been dealing with people who don't care from the very dawn of civilization. There's a reason societies always end up creating governments and regulations, and it's precisely that reason.

Well, the owner of the Internet infrastructure could sue your neighbor. They'd learn to pay attention to that pretty quickly!

And they could sue the manufacturer, for selling them a device not fit for use? Exactly how much would each party sue the other for? The damage only takes place in aggregate, when hundreds of thousands of devices become part of a botnet.

Or, how about instead of drowning in lawsuit chains over pennies, we establish some basic rules about how commercial devices connected to the internet are allowed to behave.

That's how this problem is solved by every other industry that manufactures devices that are dangerous when used correctly. Software isn't a special snowflake.

The proposal was mostly tongue-in-cheek. That said, I'm not sure the problem is solved in other industries - there's been plenty of unsafe electrical devices being sold to western markets, for example. It's just hard to police this stuff.

Fine your neighbor, just as if he drove a shit unsafe car on the public roads and caused damage.

If the car was unsafe by design, the manufacturer would be fined.

Distribute your critical piece of infrastructure, blacklist IP addresses, etc.

This solution depends on people following it voluntarily, which means it's a bad solution because people don't work like that at scale. Want to coordinate people? You need to change incentives - either encourage them to not buy shit, or discourage them from buying it. The way it's usually done is by fining people selling shit, fining people using shit to do damage, and fining people creating shit so that shit doesn't get created. Ergo, government solution. It should work for IoT just like it works for every appliance you use at home that could technically burn your house down, but somehow it doesn't.

That's a viable solution. Except that it relies on an implicit: The end user must be able to identify the shit devices.

We could help that right away, by bricking all the vulnerable IoT devices. The media will then inform of what manufacturers and models were affected :D