They should try investing a single dollar into their shit app.

Looking at specific vulnerabilities or breaches in a complex, interconnected system wouldn’t be particularly helpful in the context I was aiming for. I was thinking more along the lines of generational education in secure practices. Thinking and acting securely on a global scale to ingrain that mindset in future engineers. Security and ethics courses for high school and engineering college undergrads.

Of course, this all comes down to market forces. Manufacturers don’t have an incentive to do more than the bare minimum QA…

Heres an example of the sorry current state: my son just graduated from a Big 10 school with a degree in robotics and electronics engineering. It was very heavy in programming. He’s continuing on to a Ph.D program. He had exactly ONE lecture regarding secure coding and programming ethics. He is required to have no more. In a 7-8 year program, 1.5 hours of formal instruction on secure coding practices and ethics.

No matter what tool is used, if you don’t start from a foundation of security first, your code will not be inherently secure. I can accept that some tools have more guardrails than others, but we are not teaching foundational security skills and principles, privacy and ethics even at the college level. Until that is addressed at a large scale and applied at the lowest layers to the silicon, we’re doomed to this security hell hole dystopia we’re living in.