>> In fact, the software used to attack Krebs was simple and amateurish. What this attack demonstrates is that the economics of the IoT mean that it will remain insecure unless government steps in to fix the problem. This is a market failure that can't get fixed on its own.
> Why does it demonstrate that? "Neither the seller nor the buyer care" can also be applied to traditional botnets using computers - if the botnet is clever enough to not make any noise. He "justifies" the "sellers don't care" part with:

Not really. When a desktop PC is compromised sometimes it is noticed because eventually malware comes along that bricks the system, installs ransomware, or otherwise discloses itself.

But the sad truth is that a lot of compromised desktop PCs aren't noticed which is why there are millions used in botnets right now. Microsoft decided to take it seriously and pushed automatic updates, adopted secure coding standards, etc. It took a decade to make a good dent in the problem and it still isn't completely resolved.

>>they're now selling newer and better models, and the original buyers only cared about price and features.
>... again the same for smartphones or laptops. And furthermore, what regulation he proposes to solve this? I mean, he presents the issue as being:
>>The security of our computers and phones also comes from the fact that we replace them regularly. We buy new laptops every few years. We get new phones even more frequently. This isn't true for all of the embedded IoT systems. They last for years, even decades. We might buy a new DVR every five or ten years. We replace our refrigerator every 25 years. We replace our thermostat approximately never.
>Would he suggest that the companies selling these devices be obliged to push security patches? The same companies that he wrote could not even afford testing?:

If all manufacturers have to meet certain standards then no one can undercut anyone else by skipping out. You can save some money by not including various safety features but then you can't sell those devices to over half the world so what's the point? If it is all voluntary you have busy consumers who don't have the requisite background knowledge (nor the time) to learn the details of software security, nor audit the code for secure coding standards and that's assuming the code was even available. If you want to make the claim that every human being should be an expert at evaluating such claims that's a massive inefficiency.

Really that's the primary problem with libertarian ideas in general: it introduces massive inefficiencies in the market. Not everyone can be an expert in chemistry, software, mechanical design, food safety, et al simultaneously. (Not to mention needing perfect and instantaneous information). Claiming that lawsuits will fix everything after-the-fact ignores the real human cost, the lost potential of the ruined lives, and doesn't work unless you completely eliminate the corporate veil and make everyone personally liable. Otherwise every company will just be incorporated with various shells to ensure you can't actually recover anything. That goes on today - get sued? File bankruptcy and re-incorporate under a new name. You don't even need to move the factory because the seller was just leasing it from your shell incorporated in the Bahamas.

>>Companies like Microsoft, Apple, and Google spend a lot of time testing their code before it's released, and quickly patch vulnerabilities when they're discovered. Those companies can support such teams because those companies make a huge amount of money, either directly or indirectly, from their software­ -- and, in part, compete on its security. This isn't true of embedded systems like digital video recorders or home routers.
...
>I have read "government is the only solution" at least 6 times in that short article, without exaggeration. Looks a lot like fearmongering and propaganda to me.

Did you just not get on the internet this Friday or what? It isn't fear mongering, we're living in a world right now where there are millions of cheaply made IoT devices with hard-coded telnet ports wide-open. They can't ever be fixed because they weren't made with any ability to update the firmware. Their owners don't even know they are infected.

What mechanism are you proposing to magically make the manufacturers or consumers a) give a shit and b) gain the capability to evaluate products on a security basis?

This is a classic tragedy of the commons situation. Each individual makes a rational decision for themselves (saving money) but it results in a massively bad outcome for the whole world.