Re: Why does this stuff need to update ?
"If IoT can only work with a hardware portal to the Internet, then it is those things that can handle the security. The router could very well be configured so as to 1) not allow general interaction from the Internet or the local network to the IoT thingies, and 2) handle updates from the Internet to a given IoTmabob, on condition that said update is properly signed and comes from the proper domain (no use BitTorrenting an update here)."
Because, given the wireless nature of it all, what's to stop an interloper: someone inserting THEIR router into your network, masquerading as yours, and hijacking your devices? How do you reconcile this problem while at the same time making it easy enough for Joe Computer-Illiterate to use?