Why open firmware is a buyer's protection
A binary you cannot read is a bet on one vendor staying in business, staying honest, and staying interested.
By Lethal Solutions
There is one way this market fails that nobody warns first-time buyers about. You buy a device, it works, and eighteen months later the vendor is gone. The hardware and the board are both fine, but the only image that runs on it was a signed blob handed out from a Telegram channel that no longer exists. The flashing tool was one unsigned program with no source. Nobody else can build a replacement, because nobody knows what the device expects. The board becomes a paperweight for reasons that have nothing to do with the board.
What open actually buys you
Not a belief system. Four practical things, in the order they are likely to matter to you.
| Property | With open firmware | With a closed blob |
|---|---|---|
| Recoverability | Source plus a documented flash procedure means someone can rebuild an image after the original author stops. | When distribution stops, the last copy you downloaded is the last copy that will ever exist. |
| Portability | A design targeting a documented MCU or FPGA part can be retargeted to a new board revision. | A blob is bound to whatever the author compiled it for, including silicon revisions they never told you about. |
| Inspection | You, or anyone you trust, can read what the device does on the wire and what it reports about itself. | You are trusting a vendor's description of their own product with nothing to check it against. |
| Community repair | Bugs get fixed by whoever hits them. Issue trackers accumulate real diagnostic knowledge. | Bugs get reported into a support channel and either get fixed or do not, with no record either way. |
The input-device side is the clearest example
Input devices have gone further towards open than anything else in the stack. MAKCM is a published ESP32-S3 firmware project. It uses two microcontrollers, provides USB passthrough and parses HID report descriptors for you, with source on GitHub under GPL-3.0. It is a community project rather than a shop product, and because it is open, a second project picks up the unfinished example firmware, fixes it and writes down what was broken and why.
Now compare the FPGA side. The public base designs are open, but nearly every paid image on top of them is a closed binary with no published change list. That is not dishonest on its own, because a firmware vendor has a fair reason to keep a device identity private when anti-cheat vendors can diff a published one. But price the difference in: a closed image buys you a relationship, not a thing you own.
Flashing tools here are often one unsigned program, sent as a direct download or a chat attachment. They ask for admin rights because they need low-level USB access. That mix is exactly what malware looks like, so "it triggered Defender" tells you nothing either way. Prefer tools with published source, and where you cannot get that, check the file hash against what the vendor published. Run it on the second PC rather than the machine that holds anything you care about, and never run a build that arrived from a stranger in a group chat.
Questions worth asking before you pay
- 1Is the source of the flashing tool published? If not, is there at least a hash for the binary you are being sent?
- 2If this vendor vanished tomorrow, could a skilled outsider reflash this board? With what?
- 3What does this firmware change, against the public base design? A vendor who will not answer at all is not the same as one who answers in broad terms for a reason.
- 4Is there a documented recovery path for a failed flash, or does a bad write mean a dead board?
- 5Which board revisions is this image built for, and how will you know if yours differs?
None of this says closed firmware is wrong to sell. It says the closed part is the part you take on faith, so it should be the part you ask the most questions about. A vendor who treats those questions as an attack has told you something useful.
Read next
Questions about this? Ask on Discord
All posts