Comment by amluto

There really ought to be a market for a little device that goes between the IoT/industrial device and the rest of the world and that acts like a fancy, self-updating proxy.

Conceptually, you have a physical plant and a PLC and maybe an HMI. Quite sensibly, no one wants to modify this once it works. But you also have a remote access system, and all the remote part should be through a proxy that is continuously updated and only grants access to authorized users. And preferably logs everything and also can act as a sort of web application firewall.

Tailscale is fairly close, and they should consider selling a secured (attested boot, tamper resistant) device with two Ethernet ports (PoE on the uplink side) and WiFi client device capability. Stick a serial number on it, let it be added to a tailnet, and make it impossible for anyone to add anyone else’s device to their own tailnet.

BOM cost would be maybe $20 - we’re talking higher end ESP32-class hardware plus the Ethernet hardware. 100Mbps would be adequate.

Hmm, startup idea: anyone could sell this. The device has a little bootloader and two modes. In provisioning mode, it attests to the mothership (mothership is the vendor, but enterprise plans give an air gapped mode where the vendor can provide a signed config blob and the device can fetch it over TFTP, PXE-style) for configuration. In provisioned mode, it does what it’s configured to do, and it can attest to its firmware + config for purposes of authenticated to, say, Tailscale.