Embed Notice

@dalias @dymaxion I don't generally subscribe to statements that ignore nuance.

While I accept that there's generally some responsibility to prevent machiens from themselves turning into threat vectors (e.g. it's not great to have your iot device be easily made part of a botnet), I am also not going to suggest there's an oversized onus on the authors of e.g. a Thread flashlight to make sure their little uC that's too slow to render its own confiugration UI and which could last maybe five minutes as a slow-as-hell active threat before its battery ran out is protected from the other devices on the theoretically-bridgable Thread network

especially when the time is better spent e.g. understanding that the best solution to most problems that could include many devices is to improve the UI so people stop using insecure defaults

this is why threat modeling is important and nothing is just an implicit "responsibility' with its priority fixed to '1'