Creating a ZigBee Chain Reaction
Security is expensive for vendors to implement, so they externalize the risks to their customers and society in general.  To reverse this dynamic, "insecure by default" needs to be more expensive than "secure by default".It seems simplest for the Govt to avoid trying to mandate detailed security standards for continuously changing tech, and rather simply make the vendors legally liable for damages and let the market evolve effective standards and practices.However, constructing effective legislation/regulation for doing so is a non-trivial legal challenge.  Simply proving when the vendor is liable vs a user could get tricky, as well as estimating damages and divying them up among multiple vendors if damages involved products from multiple vendors.  Among other things.Anyone, especially lawyers, have insight on best way to fix this problem?