It's not insecure code that's the problem, it's an insecure system, driven by project managers, information security departments, and box ticking.

For large companies, infosec will never allow some POS IOT device on their network without a 50 page form and large amounts of funding. The business however needs this to happen for whatever goals they have.

So the project manager goes back to the supplier, who recommend sticking it on a 4g simcard with a public IP address, and "install this app" to manage it

The project manger finishes the project, gives the app to the store manager, and rides off into the sunset, and nobody actually owns the equipment or even knows its there.

For small companies they likely don't have a technology provider at all, and just use the ISP's router.

▲

baobabKoodaa an hour ago | parent [-]

> nobody actually owns the equipment

Unsure what you mean by this. Somebody definitely owns the equipment.

	▲	wtch98 32 minutes ago \| parent [-]
		A company might, but if it's a large company, nobody in that company will have actual ownership, it will always be someone elses responsibility.