Is Arduino no longer open-source?
lists.oshwa.org
lists.oshwa.org
PDFs are not considered design files https://www.oshwa.org/definition/
If you apply this rule, you can exclude 90% of the "Open Source/Hardware" products on the market.
Also 99% are missing a BOM (Bill Of Materials). That's like shipping an open source software without the config files, forcing the users to figure out the settings by reading the sources. Unless they are buying the pre-compiled binaries from the author.
This is a very good point!
BTW, in that sense most Creative Commons work is not "open source", either.
For example, a typical Creative Commons video that is just released as webm or mp4 can only be remixed, but not improved upon - which would require access to the raw video material, raw audio material and the project file of the used video cut program.
Same for CC music distributes just as mp3/flac/opus, you'll need the samples, notes, music cut program file, and so on. One notable exception are tracker files (mod, s3m, it, ...), and in some sense also the MIDI files (as long as you have access to all instruments).
But yeah, music and graphics frequently also don't include the actual 'source' - just a rendered output. This is way better that having a propiatary license on the output, but does not fulfill the full potential.
Some of it has to so with the tools and proceses, which frequently aren't really built to make collaborating on the source materials easy. And often the formats and tools used are proprietary. Freeware VSTs abound for instance...
OSHWA are the FSF of hardware. As far as they're concerned, only their certification constitutes open hardware. Everyone else is wrong. Sound familiar?
As someone else pointed out, a lot of people don't provide BOM files, including people who have OSHWA certified hardware.
You jest, but actually, it might be an interesting problem to try to recreate program source from OCR'ed images. Using surrounding context, and then analyzing program flow, it might be possible to correct the inevitable transcription errors. The problem is just constrained enough to be interesting research.
The minute you get more than dual layer, things get hairy in a PDF. Also you can't really send PDFs to fabs to get boards built, as they miss info that you need in order to make a PCB.
I don't want to wish anyone ill, but the emergence and success of competitors that don't go so far out of the way to hide the complexity (and the need for good practice) of working with embedded systems and SBCs, wouldn't be such a bad addition to the ecosystem.
(As one of two developers who actually fool around with Arduinos and Pis a fair bit (although I detest the Arduino dev environment and 'sketches'), I'm tired of all the vandalism and graffiti in my cubicle, TBH).
My colleagues have developed a "spitting noise" ritual after any utterance of the word "PC" (<hock> ptui). As MAINFRAME developers attempting to teach others, they're not enamored of PC's burgeoning, and dominant, market of "people who want to do COMPUTER development but not learn anything about MAINFRAME development" sucking up all the oxygen. I know, that's an oversimplification, but not as much of one as I could wish.
I don't want to wish anyone ill, but the emergence and success of competitors that don't go so far out of the way to hide the complexity (and the need for good practice) of working with COMPUTERS systems and MAINFRAMES, wouldn't be such a bad addition to the ecosystem.
(As one of two developers who actually fool around with PC's and APPLES a fair bit (although I detest the APPLE dev environment and 'PRODOS'), I'm tired of all the vandalism and graffiti in my cubicle, TBH).
Am I suggesting that this is going to be how things turn out? No probably not. It baffles me that many people who code, have little to no understand of their mainframe roots and commit sins that were solved ages ago. However some of this reaction is to the simplification and replacement of technology with things that are more affordable and more in reach even if they aren't the same.
Neither of those things is true of the Arduino. I learned how to design simple control systems on Microsequence Controllers ancestral to the AVR more than thirty years ago. And the techniques I learned there still apply to the more sophisticated chips available now. Even the hobbyist platform stuff isn't new. I was wire-wrapping DIP 650*'s into perf-board in the early 1990's, and I built an HC11 model rocket launch controller for my kid the better part of two decades ago. And I know more than a dozen people, not all of them professional engineers, many with only two-year college diplomas who were doing sophisticated hobbyist projects well before the turn of the millennium.
The Arduino isn't analogous to the Apple ][. We had to learn how to program in BASIC and needed to know what a memory map was. It's analogous to Windows 95: a well-engineered product that completely dominates the market, establishes that you don't really need to know anything, and stifles innovation.
I'm really curious about this - what innovation does Arduino stifle?
From my position with some school level dabbling in embedded, it seems like the industry is quite healthy and that there is a lot of innovation happening in terms of hardware outside Arduino, especially on the commercial side of things, where the perception is that Arduino has next to no market share.
And the openness of Arduino was critical to starting my own company, when I built an Arduino compatible board with a fast processor and wireless radio.
One could argue computers weren't new - we had vacuum tubes for ages. But it was putting it all together in a certain way (and the associated maturity of certain tech) that led to a step change in what those things meant.
For me, arduino similarly created an explosion of hobbyists working with circuits for the first time, and I'm happy that people who know very little have something to work on. But I am sad that the openness has been falling by the wayside.
Today I use the Arduino IDE and one of the Teensy boards. I doubt I'd be happy with that setup for large projects, but it's perfect for what I'm doing right now, using the microcontroller practically as a glorified GPIO for a PC. You can use "pure" GCC to program the Teensy, but I'm not sure that I need to care at this point.
For the general population, I just like the idea that the Arduino and RPi ecosystems have practically revived the electronics hobby, and expanded the number of people who are interested in getting into programming. It's still a hobby, but it's a great hobby, and I admire hobbyists.
I don't think the Arduino is just for people who don't want to learn anything about embedded. Those people exist, but it's good that they can do stuff with hardware without learning. The people who do want to learn, will learn faster with the Arduino ecosystem than without it.
That said, the Dev environment sucks, PlatformIO all the way.
It's exactly the same problem. These platforms make it really easy (too easy?) for people who don't really know what they are doing, to quickly build up something that is functional, but without then understand the underlying concepts. Grab this library, copy and paste from this tutorial, change a few lines and boom! You have a blog or IoT weather station.
It also filter out precisely the people who tend to listen to advice.
Meanwhile, people who confidently do crap despite not knowing anything, make mistakes in the process, but can eventually learn to become good.
I don't have a good solution to that. Certainly a lot of the frameworks out there have security bolted on as an afterthought, or, at best, just don't make it easy to build things that are secure by default.
But ultimately it comes down to the author of the code to take responsibility for the security of the code they throw out there and promote as something people should use. And that's the crux of it: I want people to experiment and learn, but there needs to be a way to keep those sorts of people from building (or perhaps just distributing or promoting) things that (unintentionally) harm others, at least until they're knowledgeable enough to avoid doing that.
The way it works is that general advice I have seen many times is "don't do it". Finding how to code securely or comprehensive list of insecure patterns is much harder. So, people inclined not to follow advice and the ones with huge ego are the ones attempting to create security related software.
I am not saying that I have instant solution, but strategy of discouraging people from trying does not work well. Promoting good beginer level write ups would work better.
----------
Nevertheless, the original topic was arduino and doing circuits while being unable to read schematic. That is seen as a problem, because they did not learned theory before doing 5V dummy circuits.
And I think it is as good start for learning or getting interest as any.
The problem is not only secure coding, actually, I'd argue that it's not even the biggest concern. You can produce the most secure code on the whole world, but that won't matter if your device has an unprotected or easily brute forced telnet access by default. Loose default security settings and permissive access is the key concern imho.
Kali Linux and the tutorials for that are the Arduino of hacking.
Also that around 95% of arduino projects are useful in educating & encouraging people around small microprocessor / electronics projects.
These days, however, I recommend the ESP8266, not so much the Arduino. You lose the shields' flexibility, which may put people off with the steeper learning curve, but you gain a lot in capability.
Isn't that the same argument for using xml over html?
I don't think oxygen is the finite resource your colleagues think it is in this metaphor. Why in the world would they not want something that lowers the barrier to getting more people involved with things like embedded development? Some of those people may even go on to start learning more about embedded development. It's so much better than keeping the barrier to entry high, thus discouraging people to get into it and learning more about how the world around them works. Would we rather people continue to have no context about what we do and treating electronics like a black box?
And who cares if they don't actually want to learn more than they need to about embedded development? Just as your colleagues spent their lives becoming experts and doing embedded development for a living (I'm presuming), others chose rather to spend their careers elsewhere. Everyone has different priorities and tradeoffs to consider vying for their time. Any time we can allow people to accomplish more with less, possibilities open up with the time we do have.
On the other hand if you are in the business of selling embedded development education to newbies, then you need to realize that Arduino is outcompeting you - like iPhone destroyed the old Windows smartphones.
Just a detail, I know, but as far as I remember, I changed few Symbian devices before the iPhone came out and I hopped over Android soon after.
I can't really recall there being any Windows phones back then. This is just how popular Symbian was in that period of time. If there were any Windows devices (forgive my ignorance), they were definitely not nearly as popular to make a mention of iPhone killing them instead of e.g Symbian ones.
Just my 2¢, but the crux of your argument doesn't change, so you got a +1 from me for it. :)
Edit: maybe a more valid example is the O2 XDA "Windows Mobile" phone/PDA (2003)
Could you say a bit about what you mean by this? It's not at all clear to me why it matters to those who do "real" embedded development that there are hobbyists out there using a simplified platform (and, yes, perhaps developing some bad habits).
This is not to say I disagree, necessarily, that a competing platform that better introduces users to the complexities of embedded systems would be a bad thing. Though I'll also add that, as someone whose day-to-day work is very from from embedded development (I'm a lawyer), the Arduino platform has been great for leading me slowly into this world. I'm still a newb, but I've learned far more about embedded systems (and electrical engineering) than I think I ever would have otherwise. Personally, I think Arduino is a great way to learn both the basics and the complexities--you can accomplish something in a "rough and ready" way very very quickly, and then incrementally delve into the complexities as your interests (and needs of your project) demand.
Of course embedded sucks and is hard: people think this brittle, shitty mess is a sign of cleverness and that this is how it should be.
Don't shit on Arduino for being old tech and attracting the plebs. It contributes to increasing the size of the audience which might in turn mean the embedded world becomes more professionalized when it comes to software. Because it sure as fuck is no fun to rewrite stuff all the time because the embedded industry tends to hire shit software people.
Here is my blog post from more than 2 years ago regarding the status of the Arduino Yùn:
http://www.wifi4things.com/arduino-yun-what-is-under-the-hoo...
And here is my clarification request on the Arduino forum, which is still unanswered:
So, this actually is an exception to Betteridge's law; the answer to the question is "yes, arduino is no longer open source".
OSHW certification is a self-certification process. Individual products are certified, not companies. What Torrone is doing is conflating Arduino the company (or foundation, or companies, or whatever it is this week, guys please stahp) and Arduino the product series, and individual Arduino products. He knows what he's doing, but in this email does it anyway. Perhaps for good cause, but it's what he's doing.
There is no requirement for Arduino to certify all of it's hardware with OSHWA. In fact given the explosion of things-that-are-branded-arduino it would be unsurprising to see hardware that cannot be certified as open due to commercial agreements that override open licences. Whether this affects Arduino or not long term is a different matter but the Uno, Nano and Pro Mini are all still open.
OSHWA is an attempt to define what constitutes Open Source Hardware and to define some (hopefully) sane defaults. It's the hardware equivalent of the FSF, and it's licence is the maker equivalent of the GPL. It is not the only fruit.
My project[1] uses the V-USB library, which comes with an open licence[2]. The project is derived from another project, the digispark[3]. We're operating within the licence constraints, and consider our project to be open hardware (we're posting our board designs when we ship at the end of this month).
To further complicate things, when Arduino uses the term Open Source it rarely clarifies what that means. It may be referring to the software stack. It might be (but probably isn't in this day and age) referring to new hardware.
Either way, while it is right to pressure Arduino to clarify their position, I think it's unfair to mandate that every product they ever produce must comply with OSHWA's definition of Open Source Hardware, or that only OSHWA certified hardware can be considered "open hardware".
[1] - https://hidiot.com/
[2] - https://www.obdev.at/products/vusb/license.html
[3] - https://digistump.com/
https://partofthething.com/thoughts/?p=1327
Thanks for asking!
We often run (open-source) Linux on a (closed-source) Intel processor and even a lot of diehard FOSS warriors are okay with that.
Arduino Unos are a bunch of (open-source) wiring and components plugged into a (closed-source) Atmel microcontroller and people seemed to be okay with that.
How does an ESP8266 differ from an ATMega in this regard? If we consider it a basic component just like the ATMega, it's not particularly any different.
It doesn't mean "open source all the way to the materials mined."
It means "open source to what I used to produce this.*
Such that another person could replicate your work.
The times where making custom silicon is desirable is way more rare. But hopefully open-source will be standard there too, one day.
I just tried it out this week to make battery powered wireless temperature and humidity sensors. Sleep current for the whole system is not that great (~80uA of which 40-50 are used by ESP32 module). However, the simplicity and ease of use outweigh having to charge the battery every 3 months (3Ah li-ion cell).
I haven't looked really deep at what power modes are available for each power/clock domain- at the moment I just have the ESP waking up from RTC timer every 15 minutes and it can also be woken up manually with GPIO. It's entirely possible that I have left some peripherals at non-optimal state.
A lot of easy-to-use modules come with a USB-serial converter and a 5v-to-3.3v converter. These will draw a few microamps even when there's no USB connected - and depending on the precise hardware, some will draw far more than that.
You should plan on buying a few different modules and de-soldering a few components if you want to achieve the absolute minimum current consumption :)
It is like having a PC1512 that fits on the pocket, there are already lots of programming languages that would fit on it.
Also, some of the SSL support is in the closed-source firmware, and it's incompatible with Mozilla's 'Modern Compatibility' ciphersuite list.
I used the ESP8266 anyway - it's not ideal, but for my application it was the best thing available. There's room for improvement, though.
You know what I'd love to see? An Espressif with a gaggle of RISC-V cores in it. I don't know how much they pay Tensilica. I think they could do a lot with that.
Xtensa is a bit of a mess on the toolchain side, seems to require compiler flag customization for any given model, or it might not even run. For example, endianness is configurable at the architectural level.
https://developer.mbed.org/platforms/
Some are very cheap, e.g. the Nucleo ones:
http://uk.farnell.com/stmicroelectronics/nucleo-l432kc/dev-b...
To me it feels like Arduino (both sides) has been trying to recapture lightning in a bottle.
The Tre was in the same situation for a while. It's no longer even listed on their products page...
I still think arduino is a great way for interested people to break into electronics but there is no clear 'line in the sand' when they should stop learning that way
The IDE is terrible for large, multi-file projects. It just doesn't have the level of integration of, e.g., Visual Studio (that Atmel Studio is based on).
It's a fantastic beginner tool and a great source of ultra-cheap hardware, but the IDE runs out of steam pretty quickly.
http://www.eclipse.org/community/eclipse_newsletter/2017/apr...
I tinker with Arduinos and Arduino-likes that have the atmega32u4 chip with built-in USB controller, write the firmware in C with the LUFA library providing USB support, avrgcc to compile, and avrdude or dfu-programmer to flash.
IMHO, it is not a war, just a childish fight that is mostly positive.
If you have copyright.
(Now if there is a Free version under a contracted-for rather than gratuitous license, that's a bit more secure, though there are ways that could go away, too.)
Given the way Linux is copyrighted (with many holders), it'd be an absurd situation if any copyright holder could just decide, after the fact, that they don't want their code being distributed under that license anymore. In fact...I think that's been litigated in SCO vs. IBM. So...what are you basing your legal theory on here?
However, the widespread assumption is certainly that it doesn't require a contributor license agreement to keep this whole open source thing from crashing down. Which it would if an arbitrary developer could threaten pulling out their code from some project N years later. In today's climate, it's pretty reasonable to assume that if no one has pulled that sort of blackmail, no one thinks it has legs.
Even leaving aside general issued on the revocability of licenses that aren't special to copyright law, the US has a special provision making all licenses and transfers of rights by authors under copyright revocable by written notice, during a 5 year window 35 years from when they occurred; see 17 USC Sec. 203.
> So...what are you basing your legal theory on here?
The general American (Anglo-American, I think, as I'm fairly certain the principle is a common law one which is older than the US) of licenses.
Further, revocation of copyright on works with multiple authors must be signed off on by a majority of copyright holders, per the law you've cited. That's literally impossible with something like Linux (but maybe not with something like Arduino, if it only has a tiny number of authors, I don't know).
If it's so simple and obvious, why has it never happened in 30+ years of GPL software, when billions of dollars are at stake?
"The general American (Anglo-American, I think, as I'm fairly certain the principle is a common law one which is older than the US) of licenses."
Many things in "common law" have been replaced by written legislation and case law. Modern copyright bears no resemblance, and only has only tenuous connections, to common law. Copyright is among the most debated and litigated categories of law in the modern world, with legislation, legal precedent, and even international treaties covering it. If your position is that it is as you say because common law is as you say, that just sounds really shaky. Now, I need to ask you to back up the assertion that "common law" is the law in force on copyright in any developed Western nation, because that seems to be the crux of your interpretation of the law.
I don't know, man. I'm not an expert, by any means, but I'm just not following your reasoning here, at all.
My understanding of the GPL is that it is a one way street for released code. New releases can be under a new license if all of the authors agree to it, but once something is out there under the GPL, it is always under the GPL. Nothing you've said makes me think otherwise because the weight of precedent seems to disagree with you.
Wow, that's rather incredible. It's enheartening to see a US copyright law that seems biased toward authors rather than publishers.
The provisions of section 203 safeguard[] authors against unremunerative transfers. A provision of this sort is needed because of the unequal bargaining position of authors, resulting in part from the impossibility of determining a work’s value until it has been exploited.
http://www.sfwa.org/2013/08/second-bite-apple-termination-ri...
As far as i'm aware, legally, giving attribution attribution in exchange for a thing has been held to be plenty consideration since nearly the dawn of time.
(Even giving up the right to sue for warranty claims would likely be sufficient consideration, but no open source license explicitly says that, they just disclaim there are warranties, which is not quite the same)
There are some that are significantly more problematic. WTFPL is a good example of a maybe-gratuitous license.
Common ones have clear consideration (agreements to do certain things with your patent rights for downstream users, etc).
I have not yet found anyone who believes you would have a strong argument that most open source licenses are gratuitous.
Agreement to do a thing you didn't have to do (give attribution, include a copy of a license, whatever) in exchange for something, is plenty consideration.
Real question. I am not a lawyer, but would assume arbitrary revocation would essentially be a breach of contract. (But I guess it's not technically a contract since it's one sided?)
The law governing licenses (of all kinds.)
> If you grant rights to someone, in what legal way can you simply revoke those rights?
If the grant is gratuitous (not contracted for) you generally have no legal obligation not to simply revoke those rights (it is exactly the same case as inviting someone into your house and then ejecting them when you decide they've worn out their welcome, which is also a case of gratuitous license.)
> Real question. I am not a lawyer, but would assume arbitrary revocation would essentially be a breach of contract.
Right, if there was a contract, then revocation inconsistent with its terms would generally be a breach, which would still least present a cause of action for damages and may permit an equitable remedy extending the license.
Most F/OSS license scenarios are not contract licenses, and even when they are, publication with an offer of a license isn't a contract, the offer must be accepted without the offer having expired or having been revoked first for a contract to exist.
If I agree that my neighbor can have 5 feet on my side of the property line in perpetuity and put the offer in writing, I can simply change my mind later and take it back?
But if you instead gave your neighbor that 5 feet then you would not be able to revoke it.
A key part of most open source licenses is that the author is not giving up ownership of the code. This is why many projects require a copyright reassignments for contributions to avoid being hamstrung by an author revoking their right to use that contribution sometime in the future.
This is explicit in GPLv3: "All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met."
There's also a legal theory that the GPL is, or can be depending on the circumstance of a particulsr case, a contract license rather than a gratuitous license [0], but even in that case the contract offer would be revocable, and the GPL itself only irrevocable with respect to licensees with whom a contract was formed prior to the offer being revoked (because FOSS licenses are sublicensable, that licensee could offer sublicenses to the original work, but might not, e.g., if they chose not to do any of the acts which required such an offer.)
[0] which may not actually save the day, either, since some courts have held that contract licenses are revocable, but that revocation in violation of the terms of the contract makes available damaged for breach of contract rather than compulsory extension of the license.
I'm not sure why concern would be raised with respect to the original contract offer. It seems entirely irrelevant given that any participant has full rights under the contract terms.