BRITISH SCHOOL KIDS AND CAR HACKERS: THE WIDESPREAD APPEAL OF OPEN SOURCE

In product development, choosing open versus closed hardware and software platforms requires careful consideration. Selecting open source hardware has advantages and limitations, concisely described in this blog post by Simplexity CTO Doug Harriman. From a marketing point of view, however, there is no doubt that the term “open source” generates positive connotations and still generates buzz. This was in evidence at the recent ARM TechCon (October 25-27, Santa Clara, CA), where keynote speakers and expo vendors alike embraced open source and its encouragement of social rewards, reputation, and education over pure financial gain.

Eben Upton, the man behind the Raspberry Pi, told of his love for the British Broadcasting Corporation (BBC) Micro. These microcomputers were ubiquitous in British schools while Upton was growing up in the late 1980s. He got his hands on one and this led him to a career in computer science. Upton launched the ARM-based Raspberry Pi single-board computer in 2012 with modest hopes, and the story of the unprecedented response – millions of units shipped – has been thoroughly documented. To be clear, Raspberry Pi is not fully open-source, as several of the drivers are proprietary. Meanwhile, BBC’s legacy of computing continues with the Micro:Bit, an ARM-based embedded system to be given away to every 11-year-old student in Britain. Following the nationwide rollout, BBC chose to open-source the Micro:Bit’s hardware and much of the software. The Micro:Bit was designed to work alongside Raspberry Pi, bringing the story full circle.

Another keynote speaker, Charlie Miller – who now serves as senior security engineer at Uber – gave a fascinating presentation on automotive security. Miller was inspired to become a car hacker by researchers at the University of California at San Diego and the University of Washington. In 2010 they published a paper describing their hijacking of a car via the on-board diagnostics (OBD-II) connector, and the following year described a remote take-over of a sedan – including control of its brakes, door locks, and radio. In his keynote, Miller pointed out that the “academics” chose not to publicly divulge the details of their exploit, sharing their code and their method of exploiting the OnStar communications system only with General Motors. The result was that it took GM nearly five years to patch the vulnerability. Miller, working with Chris Valasek, showed in 2015 they could hijack a Jeep to an even greater extent, gaining the ability to take over the steering because the Jeep had auto-parking capabilities. Miller and Valasek decided to publish their methodology and code. Within days Chrysler, the parent company of Jeep, had recalled 1.4 million vehicles and patched the exploitable infrastructure. Miller argued that “open sourcing” the exploit forced the automotive industry to react with unprecedented speed.

In his keynote, “The Wonderful World of Open Source,” Jon Masters enumerated the benefits of open source software, which include that it’s free and customizable, having many sets of eyes on the source code means that any bug is fixable, and developers are not locked into proprietary standards or vendors that may discontinue their products. Linux is the best-known and most-used open source operating system, but Masters surprised many in the audience by telling that Microsoft now has the most open-source contributors on the repository hosting service GitHub. In fact, Microsoft has positively embraced open source, supporting Linux on its Azure cloud computing platform. This is interesting, as Jon Masters works at Red Hat, an enterprise IT platform that charges a subscription fee for use of Linux. He openly admitted that other Linux developers instead choose Fedora, a free distribution. Although Red Hat loses customers to Fedora, the total user base expands, and it’s preferable to have 50% of a large pie than 100% of a very small pie.

The same philosophy is espoused at the Arduino booth, where a banner declares, “We love open source.” When Arduino started selling its boards, it made not only the firmware but also the hardware open source. Arduino’s designs were immediately knocked off in China and sold for a fraction of the price. As was the case with Fedora and Red Hat, however, the adoption of Arduino grew tremendously due to the low cost barrier.

At the Arduino booth, I heard that one of the big ongoing pushes is using open source to bridge the gap between prototyping and production. The new Arduino Primo features a Nordic Semiconductor nRF52832 System-on-Chip (SoC) for BLE and NFC and an Espressif ESP8266 for Wi-Fi. Primo, and several other new Arduino models, use 32-bit MCUs, which are smaller and less expensive than CPUs in tablets and smartphones, but cannot run Linux. At the booth adjacent to Arduino was Runtime, a contributor to Apache Mynewt – a production-ready, open-source, real-time operating system – that serves as an alternative to Linux that can run on 32-bit MCUs. Apache Mynewt is for devices that must be operated for long periods of time, but are constrained in terms of power, memory, and storage. Apache Mynewt is hardware-agnostic, and includes the world’s first open-source BLE implementation for MCUs —down to the controller level. Its focus on production readiness was evidenced in the following: secure bootloader, logging modules, console, flash file system, version control, remote upgrades, unit tests, and simulation.

Another product designed to make prototyping simple yet close to production-ready is Hexiwear. Developed by MikroElektronika, the Hexiwear wearable hardware is powered by a rechargeable battery and completely open-source. The base module uses three NXP sensors: a 6-axis accelerometer and magnetometer, a 3-axis gyroscope, and an absolute digital pressure sensor. The Hexiwear platform is also expandable, with 200 modules to choose from. The Hexiwear software includes open-source application software, drivers, and its own applications for Android and iOS for cloud connectivity. Hexiwear uses FreeRTOS, a real-time operating system kernel for embedded devices.

I departed the ARM TechCon with the clear impression that open source as a methodology gets results, whether it be granting schoolchildren access to powerful learning tools or forcing car manufacturers to quickly fix security breaches. Because time to market continues to shrink – especially in consumer electronics and the rapidly expanding Internet of Things (IoT) space – companies are now turning to open source as a resource for quickly bridging the gap from prototyping to production. Arduino is packing more functionality into its boards, Apache Mynewt offers a real-time operating system for low-power products, and Hexiwear provides a configurable hardware platform with cloud connectivity. It will be exciting to see which approaches will save the most time and money.