I do for a few things. I pay T-Mobile so I can make phone calls with my cell phone. I also pay Netgear for some Arlo cameras.

I'm more willing to get devices that have external services if the company offering them will likely be around for the life of the device. For my phone, I'm happy if T-Mobile lasts two years and for Netgear, I'm counting on around 5 years.

That's a good rule, but good luck opting out once most manufacturers no longer give you an option.

The irony is that this is Hacker News and so many people building those things hang out here. If we want to make a difference, we have to start making a difference.

I've long advocated the basic idea from the article here, but in a much more blunt way, with explicit warnings about the potential consequences:

Identity theft is the fastest rising crime in COUNTRY.

The average victim loses $X permanently and takes Y months to get their life back.

THIS PRODUCT DOES NOT MEET PRIVACY STANDARD Z SO YOU ARE MORE LIKELY TO BECOME A VICTIM IF YOU USE IT. COMPETING PRODUCTS MAY BE AVAILABLE.

(Or something along those lines. You get the idea.)

Which is more likely, that companies will actually create more secure devices, or that companies will simply label their insecure devices as required knowing full well that most consumers will ignore the labels? How many people read the TOS for anything they sign up for? How many Hacker News users, who should know better, read the TOS of anything they sign up for? Do people stop smoking because we put cancer warnings on cigarettes? Some, maybe, but enough for cigarette makers to make their products healthier?

It seems to me that the most likely result of labelling IoT devices would be to consumers and businesses to accept that lack of safety as an acceptable tradeoff for whatever features the device offers.

It's hard to separate effects, but certainly here in the UK where we now have aggressive labelling restrictions on packets and visible displays in shops and strict limits on smoking in most public places, smoking seems to be much less of a problem than it used to be. In particular, culturally among younger generations, social smoking is no longer the norm in the way that perhaps it was for their parents or grandparents.

I see no reason that similarly explicit labelling requirements for dangerous IoT devices couldn't help, particularly if also combined with restrictions on use in contexts that could affect others.

Failing that, I personally have no problem with powerful regulations that pose an existential threat to businesses that are deliberately and flagrantly cavalier with security or privacy in the online era (and I write that as someone who is typically very cautious about regulatory over-reach and unintended consequences).

To me, that combined with a campaign of education and raising consumer awareness might be more effective.

While this sounds like a wonderful idea (and one I would subscribe to), it doesn't address the fundamental problem with IoT security.

Most operating systems have updates made available on a monthly, weekly, or even daily basis, in order to keep them secure. Mostly, we know how to do this, the operating system generally auto-updates, and the people producing the OS keep up to date. This is necessary because the time from discovery of a bug to exploitation of a bug can be very short.

IoT devices rarely have this. A Meile washing machine should last 20 years, but there is no way I'm leaving a computer with a 20-year old OS on the internet. That's just asking for trouble. There's also the point that OS makers generally have a clue about computing security, but IoT makers generally do not.

A computer with no way of updating the OS for security (i.e. an IoT device) has a usable lifespan of maybe a couple of months. If you're lucky.

For example, in my country, it is typically the merchant who sells you a physical product who will be on the hook under consumer protection legislation if the product fails to meet acceptable standards somehow. It's implicit that they would in turn try to recover any losses from their own suppliers later, but that's not the end customer's problem, and the merchant is the one who loses out if they don't have such a recovery mechanism available.

However, that's hardly fair if there's a third party involved (the developer of some software component within the product) who can update it in whatever good or bad ways they want without any knowledge or consent on the part of the merchant. It is particularly unfair if that third party is also a relatively large or even monopoly supplier and can dictate more-or-less arbitrary terms to merchants selling their products, who typically do not benefit from a baseline of legal protections against exploitation in the same way that end customers do.

In short, our entire framework of consumer protection and product liability laws has been built around the model of a linear supply chain resulting in a single point and time of sale, but that model simply doesn't apply any more in many cases.

In fact, depending on how you view "intellectual property" laws, anything that isn't public domain could be considered a "grafted on service"

And how do you know, pre-purchase, whether it does?

By requiring a warning label on it, as the title suggests. Doesn't seem like such a silly idea now, does it?

> Doesn't seem like such a silly idea now, does it?

I never said that.

My navigator is an elderly TomTom, my phone an old Nokia and so on. I seem to be stuck in stuff that is now a generation or two behind the times but I've yet to be convinced that the 'new' stuff is better in a way that outweighs the privacy and security risks.

I agree.

Personally, I actively do not want OTA updates, or much of any remote communication to or from my car at all, that isn't 100% isolated from all the essential vehicle control, safety and security systems.

I can tolerate the idea of a vehicle-initiated automatic emergency call system, or a remotely activated but otherwise independent tracker device as an anti-theft measure. These have a clear and beneficial purpose for me as the owner/driver, and if strictly limited to that stated purpose they pose minimal privacy, security or safety concerns.

Anything beyond that, I would rather do without. And I'll maintain my current car indefinitely rather than buying any of the current generation of might-work-or-might-kill-you stuff. The lack of effective regulation and oversight in the auto industry was scary when it was just mechanics, it became more scary when software started to eat the industry, and it's just plain terrifying in the new, connected era.