In our company we currently have a disagreement about imperfect security.
Our current main project is an embedded device with a web server running on it. One of our customers wants HTTPS for that web server, but because of the setup and the use case, there is no way to run it using anything but self-signed certificates, which is a security problem, because they can easily be circumvented using a man in the middle attack.
So the current discussion is about if that is a security gain. The one side says, it is better to have imperfect security than no security (e.g. a fence without barbed wire on top at least keeps the dogs from pooping on the lawn) while the other side says, imperfect security would only lead to a false sense of security (e.g. if I know my front door has no lock, I would adjust to that and better hide my stuff).
Which side is right? Is it better to have imperfect security or no security at all?
Edit: This question is not meant only for HTTPS/TLS, that's only an example, since we had this discussion about a few other things as well. I am asking about the basic concept behind the whole thing. Another way to put the question would be "Do the dangers of a false sense of security outweigh the benefits of imperfect security?"