I expect you will find this column by Schneier interesting. He is not optimistic about a bunch of internet-enabled junk that cannot be updated manufactured by outfits that for whom security is an afterthought, if it is a thought at all.

The article first appeared in the New York Times, and Schneier reproduced it on his website.

https://www.schneier.com/blog/archiv...ware_and_.html

Yes, I read this when it was first published and have to agree with it. Sadly he's stating the obvious, but not really providing enough detail of the underlying problem.

Linux is seen as a cheap/free OS supported by "someone else", which can be flashed on to some embedded/IoT device, sold, warrantied for 1 year and then effectively abandoned. In the past, vendors had to write proprietary code at huge expense, maintain and develop that code and ensure it's security and stability - people in house had to work on it, were accountable and if it didn't work they were out of a job. Nowadays $SOMEONE_ELSE does the hard work and when some vulnerability emerges: it's "Linux's fault".

The devices are essentially throwaway and support is only token. But history tells us that most people will use a device until it falls apart, so billions of these insecure devices will be on the net, just waiting to be cracked. This is a serious problem for everyone and the web itself, not just the device owners. Domestic (disposable) routers given away by ISPs already tell us enough about this impending problem. You will still see today, if you scan for access points, many SSIDs being broadcast only supporting WEP or WPA (version 1). It's safe bet that these are also running some ancient Linux kernel and other open source software with old vulnerabilities. Nothing is done about this - it's just the sole problem of the blissfully unaware user of that "appliance".

And it's getting worse, with smart TVs, and smart refrigerators and smart cars and smart vibrators. There's also "novelty" devices such as the google "home". This "shiny stuff" sells, so they will sell it.

The definition between an "appliance" or "toy" and what is actually a "computer" with an OS installed is blurred in such cases.

Consider his audience. I doubt that the typical NYT readers, even the most sophisticated, know enough about Linux to relate--maybe even to understand--your quite valid technical points.

I think they are a symptom of a larger problem: The managements who foster such a climate.

The medical device industry is one of the worst, but the toy industry seems to be catching up.