[voakbasda]

I have never accepted the “separate VLAN” approach as safe. You must assume those devices are actively hostile, so you must maintain perfect security and constant vigilance.

To borrow an idea I first heard uttered about male birth control: it makes less sense to put on a bulletproof vest than it does to take the bullets out of the gun.

Why allow hostile devices on your network at all? How does this not end up with you eventually shooting yourself in the foot?