Because it's the customers fault manufacturers sell insecure routers that go out of service 2 years later?
Car analogies are always fun, so here's one: The catalytic converter on my car is sawzalled off in the middle of the night. I drive around with the missing cat for a couple months. Then I fail a smog check, or get a ticket for loud exhaust. Is it my fault the cat was stolen? No, but I still have a responsibility to everyone else to not pollute (fumes or noise).
If the ISP supplies the router, then of course they should correct it. But if the subscriber brings their own equipment, then they take on the responsibility of maintaining it. Including replacement if it turns out not to be fit for purpose.
Not, it is a fault of thieves. And maybe a police who prefer to generate ticketing revenue rather then go after real criminals.
Car manufacturers are required to do recalls on cars that have airbags that explode rather than inflate. Even 20 year old clunkers. They widely publicize cars they think aren't actually safe anymore so customers can choose to update.
When food is shipped out to customers full of listeria, they don't say "you should have kept a full pcr lab in the kitchen and tested every bite, this is obviously the eater's fault", they flood the news with recall notices and take the food back and offer a refund. (and often are still sued because they too have responsibility).
The firewall stopped doing it's job, if it had done it's job properly the device wouldn't have been owned. Why shouldn't firewall manufacturers be required to have some responsibility when the firewall is shown to not actually firewall?
> Why shouldn't firewall manufacturers be required to have some responsibility when the firewall is shown to not actually firewall?
They should! I'm not arguing against holding companies responsible for their crap products. I'm arguing that the ISP shouldn't be forced to keep an attack vector on their network.
If a shitty home router becomes a bot in a DDOS botnet, that's not the ISP's responsibility. From their perspective, it's on the subscriber. From the subscriber's perspective, it's on the maker of that shitty router. (ISP-provided equipment is obviously different)
They all pay their ISP a hefty "rental" fee for their crap modem. It's only fair to hold the ISPs responsible in such cases.
Yes, everyone could be more responsible about their consumption but why should that free the manufacturers from the responsibility of making competent products to begin with?
I don't know how to tell whether my router is vulnerable, or what I could even do about it. If I'm not savvy enough for your proposed rules, which does seem quite possible, I don't think most people have much hope.
It is the job of the techies to fix techie problems. When a bridge shakes beyond specs, it is the job of engineers to fix it, bridge building is not crowdsourced to society.