I'm very glad they're going to be more transparent rather than try to lock things down more. I've been impressed with Espressif over the years and I'm glad they're continuing to impress.
The DIY market (at least in the west) came later. I still remember reading the hackaday article about them being discovered back in the day - https://hackaday.com/2014/08/26/new-chip-alert-the-esp8266-w... and back then all the documentation was in Chinese.
I remember a ton of cheap Chinese wifi enabled stuff would come with an esp for a good while, until even cheaper wifi chips hit the market.
As our industry is so fond of forgetting and rediscovering, if your product is easy and accessible to home hackers, it will be used in those hackers' real jobs.
But also they're so goddamn cheap. Espressif somehow scaled production super fast and got the price way below any of the competition.
They sold 25% of their shares in a 2019 IPO that valued the company at $716m
Market cap is about $3.5b now
They have responded very openly by publishing the vendor specific diagnostic commands.
This whole dog and pony show is very unfortunate, really, since the irresponsible security firm used the term backdoor in a completely inappropriate and misleading way, and the blogosphere and tech press just parroted their claim without bothering to read the disclosure, apparently.
The headlines should have been:
“Security firm Tarlogic makes specious “backdoor” claim at rootCon about popular Bluetooth/Wifi microcontroller deployed in billions of devices.”
A Hildebrand IHD (reads the smart meters and pops the readings onto an MQTT topic). The Octopus Home Mini, and finally, a Tado wireless controller.
Is that really all it is? I’ve got multiple IOT devices from major vendors that use esp32. I’ve also seen multiple EV chargers that leverage the platform.
> Espressif will provide a fix that removes access to these HCI debug commands
Very annoying for researchers and tinkerers who would like to play with those commands.
> Espressif will provide a fix that removes access to these HCI debug commands through a software patch for currently supported ESP-IDF versions
ESP-IDF is the "SDK" for these chips – I read that as "you'll get a new function that you call to disable these commands until you reset the chip, to limit attack surface for the rest of your app".