The answer is to make sharing secure, easy, and with informed consent. The answer is not to impose IP addresses, NAT routing, keys, etc. so that only technical people can give their consent.

How _does_ it work then, without imposing IP addresses, NAT routing, keys, etc?

I mean, realistically: let us run your thing, uploaded all data to our cloud, and then let us handle access control.

One method (for many trans-NAT routing issues) is the manufacturer provides a proxy on the Internet, creates a secure connection between camera and proxy (controlling both ends, they should be able to navigate NAT issues, etc.), and then securely publishes the video. The manufacturer could encrypt the video E2E so they can't see it. This also hides the camera's location and IP.

All with informed consent of course.

Edit: Come to think of it, video chat apps (WhatsApp, Signal, etc.) seem to do this, at least sometimes.

But then you’re tethered to the device manufacturer and probably need other Terrible UX like an account/credentials, password resets, and so on. And that tether also opens the door for the company to remote control the product, spy through telemetry, and remotely “alter the deal” at their whim. Some people might be ok with this but a “tether to the company” is a deal breaker to me for most products.

For me too, but we can manage keys, firewalls, routing, IP addresses, etc. The issue is a solution for the vast public of end users who can't do those things. Anyway, the vendor could offer the proxy as an optional service, and let you and I do what we want in some advanced mode.

Here-in lies another issue, users see "$£€$" when it's a subscription, but oh look, a free version. Lets do that!

For most, “these cameras might livestream your bedroom to the open internet if you aren’t tech savvy” is a bigger dealbreaker. And “the product from XYC corp is controlled by XYZ corp” is not concerning, but what they expected.

The idea of tech sovereignty for the sake of it is not an idea that resonates with many people outside of the tech community. Many people buy a product or service based solely on their immediate need.

While I agree about the current state of things ...

> The idea of tech sovereignty for the sake of it is not an idea that resonates with many people outside of the tech community.

That's a failure of the tech community to educate the public, and accepting the idea that it 'just doesn't resonate' is a failure of responsibility and a condescending arrogance. The people in the public are intelligent and learn many things, such as literacy and sanitation.

> for the sake of it is

It's not for the sake of it, it's necessary for security and freedom, and it's a practical, simple solution to the problem of technically analyzing every product and every update to every product.

Self hosting is not necessary for security. If it were, B2B and B2G services wouldn’t exist.

It could be necessary for “freedom” depending on your definition, which is a political argument and not a technical one.

I don’t know if you’ve ever tried to explain RMS’s opinions to anyone outside of tech before, but the primary disconnect is not an issue of education or literacy, but priority.

The primary reason people are not dissuaded by a services model is because they want a service.

Imagine you are reading a lawnmower enthusiast forum and everyone unanimously agrees that lawn services are immoral because they don’t let the homeowner own the mower or make adjustments to it. This is what this argument sounds like to many people. Many people just want their lawn cut, they don’t give a shit about the tool that accomplishes it.

> Self hosting is not necessary for security.

That moves the goalposts from 'tech sovereignty' to self-hosting.

The rest describes the tech community's failure to communicate its importance. Sanitation is also inconvenient, as is quitting smoking, wearing seatbelts, and forgoing lead where it might be eaten or breathed, but people are persuaded. We've failed so far, and it's even more embarassing to blame the circumstances.

The way that Nest/Wyze/Ring/etc all universally do it. They provide an service to intermediate and enforce access controls.

If you give laypeople a DIY project outside of their expertise, you can expect failures.

We technical people use IPv6 so that anything can access anything, and the camera people put a password on their camera so you can only see the video feed if you know the password.

Meanwhile users

"admin admin is fine"

Granted, I only have worked in B2B and never B2C, but as a technical PM, I care VERY much about security and am often the primary SME for several aspects of security (I was an engineer with a background in security for more than a decade before becoming a PM). Saying "Users don't want to deal with that and it should be easy" is not the same thing as "open a gaping security hole", the fact you are conflating them indicates either the people you're referring to or you yourself lack creativity.

People do want simplicity though. Plug in the device, be able to access it.

So you either host some infrastructure it calls back into, so you get around things like NAT. Or you punch holes in the network.

The same users who want simplicity don't want the complexity of having to remember passwords either...