United Kingdom to introduce security labelling on connected devices
No matter how great security labeling may be, I fear the incentives are completely and utterly in the wrong place.An individual consumer who purchases a poorly protected network device is unlikely to suffer any meaningful individual harm, like having their computer ransomwared.Rather, it makes things like botnets possible that can be used for all sorts of things, e.g. DoS attacks against a third party.So why should a consumer do anything but ignore the label? It's the rational choice if the less-secure product is cheaper.If we want security standards, they need to be legislated democratically and applied to all devices -- not left up to consumer choice.Now whether a legislature is capable of doing that effectively is certainly an open question. But I'm afraid labeling may be no more than an ineffective band-aid.