> Manufacturers have never had to care about security because no Gov agency would ever mandate secure firmware.

The problem is that "secure firmware" is a relativistic statement. You ship something with no known bugs and then someone finds one.

What you need is not a government mandate for infallibility, it's updates. But then vendors want to stop issuing them after 3 years, meanwhile many consumers will keep using the device for 15. And "require longer support" doesn't fix it because many of the vendors will go out of business.

What you need is the ability for consumers to replace the firmware.

That solves the problem in three ways. First, when the company goes out of business you can still put a supported third party firmware on the device. Second, you can do that immediately, because the open source firmwares have a better security record than the OEMs to begin with. And third, then the device is running a widely used open source firmware instead of a custom device-specific proprietary black box, which makes it easier for the government or anyone else who is so inclined to find vulnerabilities and patch them.

> What you need is not a government mandate for infallibility, it's updates

So, we don't need an electrical code to enforce correct wiring. We just need a kind soul driving by our house to notice the company who built our house wired it up wrong. Then that kind person can inform the company of the bad wiring.

And if the company agrees it's their wiring at fault, we can wait 3 months for a fix. Then the next month another kind soul finds more bad wiring. And we just have to hope there is an army of kind strangers out there checking every building built by every company. And hope in the meantime that the building doesn't burn down.

Meanwhile, people have to live with bad wiring for years, that could have been completely prevented to begin with, by an electrician following the electrical code we all already agree on.

> What you need is the ability for consumers to replace the firmware.

I don't think that's enough. Most people aren't going to replace the firmware on their device with an open source replacement made by someone else. Now if the firmware was required to be open source, and automatic updates could be seamlessly switched over to a non-profit or government agency in the event of the company going out of business, you might have something. But there would be a lot of details to work out.

> And "require longer support" doesn't fix it because many of the vendors will go out of business.

Which is not a real issue in practice. It's like arguing that warranty doesn't matter because the vendor might go out of business.

The government obviously cares less about citizens running firmware China can hack than it does about citizens potentially running firmware the government can't hack.

The concept of community firmware seems like a huge cop-out that allows companies to externalize costs. And it probably won't help security because 99% of devices will never get the third-party firmware installed anyway.

Why not just put the onus on ISPs? 99% of users lease their router from their ISP. If updates stop after three years, looks like you're getting a complimentary service appointment to get a new router.

> But then vendors want to stop issuing them after 3 years

Tough shit. You provide updates for the mandated amount of time, or you lose access to the market. No warnings, you're just done.

> And "require longer support" doesn't fix it because many of the vendors will go out of business.

Source code escrow plus a bond. The bond is set at a level where a third party can pay engineers to maintain the software and distribute updates for the remainder of the mandated support period. And as time passes with documented active support, the bond requirements for that device go down until the end of the support period.

Requiring that the customer be allowed to replace the firmware is essential, I agree, but not for this reason. That requirement, by itself, just externalizes the support costs onto open source communities. Companies that sell this sort of hardware need to put up the resources, up front, irrevocably, to ensure the cost of software maintenance is covered for the entire period.

Personally I don't buy consumer router hardware that I can't immediately flash OpenWRT on, but that option is not suitable for the general public.

That’s a technical solution to a business and incentives problem.

How does one ensure the support for the devices is funded?

> What you need is the ability for consumers to replace the firmware.

> That solves the problem in three ways.

That alleviates the problem, but definitely doesn't solve it. Updates are still required, and most people will never update devices they don't directly interact with.

"You ship something with no known bugs and then someone finds one."

You managed to say that with a straight face!

Let's keep this ... non partisan. You might recall that many vendors have decided to embed static creds in firmware and only bother patch them out when caught out.

How on earth is embedded creds in any way: "no known bugs"?

I think we are on the same side (absolutely) but please don't allow the buggers any credibility!

Somebody has to pay for the support. There is no free meal.

Enterprise must be able to pay for support for as long as they use devices. Solved.

I can only think of requiring the devices to be serviceable, as you say. The absolute only way I can think of charging the consumers, ie the owners, is to charge a tax on internet connections. Then the government would pay somehow vulnerability hunters working along patchers, who can oversee each other.

Consumers are tricky: if you include support in the sale price, the company will grab the money and run in 3 or 5 years; and some companies will sell cheaper because they know they won't provide support.

>The problem is that "secure firmware" is a relativistic statement.

No it isn't, software formally verified to EAL7 is guaranteed to be secure.