[tptacek]

I'd like it if there were some sort of non-profit Underwriters Laboratories for software security. But what we're more likely to get is a captured cartel of government-supported commercial labs.

For IOT, the bigger problem is that most of this stuff is getting deployed on BOM constrained designs, so they can't take advantage of safe programming environments, but instead pretty much have to link random C libraries together.