You are arguing against something I did not say. I never said we need to do it "at all costs right now so just fix this!!!". I am saying that I value the risk of human lives over the risk of some startups not being created.

You didn't specify which part of my positions makes me extreme, so I will just address your a) and b), and your last sentence.

b) is what I would call extreme. Yes, people die. But in the discussion "we should protect people" vs "we should't stiffle business", if one of your arguments is "we can deal with it if people dying" is pretty cold (this is me seeing the implied "but we can deal with it worse if startups fail" in this context, so you might want to correct me here)

as for a) as far as I can tell, people have not died yet. But we see scenarios on how they could. I'll give examples with real life incidents as inspiration

1. Hacker wants to extort municipality, shuts of heating in winter: http://metropolitan.fi/entry/ddos-attack-halts-heating-in-fi...

2. Foreign interest wants to sabotage infrastructure, civilians get caught in collateral damage (also stuxnet)
https://www.bloomberg.com/news/articles/2014-12-10/mysteriou...

3. Competitor or hacker wants to extort company:
https://www.wired.com/wp-content/uploads/2015/01/Lagebericht...

I would ask you, how many people have to die or how much damage needs to be caused before we but some basic security standards as regulation onto companies? Will one person suffice before I can make that argument?

As for this:

>Neither of us has considered all of the possible effects of either action, so we should both carefully examine the consequences of our respective opinions.

1. Yes we should, and then we will run out of lifetime because we cannot possibly think of everything. But I'll assume you didn't mean it literally.

2. Considering all relevant consequences I can think of(feel free to add any I forget):

If we create a lower bound on security, mandate that all "consumer/industry grade" devices need to live up to that lower limit or face heavy fines, I see the following tings happening:

* lots of stuff will not get created, because the margin would be gone.

* there will be a new market for security middle ware, or a strengthening of the existing one

* there would be a halt in the incrase of power of DDoS attacks

* certifying your procuct as consumer or industry grade would need to be an efficient process and would probably add onto the cost of developing a product

* GPl and open source software would have to be treated carefully. But if you start in IoT and not touch "classic" software, that can be managed. Probably the distinction between "consumer/industry grade" doesn't make sense for server software and would have to be shifted to the process, i.e. a company can use any software they want in their server AS LONG AS they make use of certain key technologies and industry best practices and have a good process in place. (yes this means no more SaaS without a security team...or a founder willing to learn that shit, or an new company providing that service. You could make an exception for revenue below 50k /year or something if you really want)

That are the rough consequences I can see from regulation. Nothing too negative imo

On your side, we have the status quo. With dishwashers running linux and having directory traversal vulns
https://www.theregister.co.uk/2017/03/26/miele_joins_interne...
companies ROUTINELY storing passwords, possibly without any good crypto and facing no consequences if stuff just stops working https://www.wired.com/2016/04/nests-hub-shutdown-proves-your... or if your data gets stolen because of their shitty practices