6 ms·

Espressif have not released the sources of the WiFi implementation, just binaries. I would define that as "security through obscurity".

joezydeco 7y ago
"avoiding patent infringement lawsuits via opacity"
- wysifnwyg 7y ago
  Has there been any successful patent infringement lawsuits over the last three years that targets a Chinese company that has infringed upon a US company? Isn't that part of the issue in the current trade deal talks with China?
  - CDSlice 7y ago
    Not a US company being infringed, but Lego has gotten a Chinese court to order Lepin to stop making imitations of Lego products. [1] Since arrests have been made over Lepin not complying [2], it seems like the ruling has teeth. [1] https://www.brothers-brick.com/2018/11/05/lepin-ordered-to-stop-making-and-selling-lego-imitation-products-by-chinese-court-news/ https://www.brothers-brick.com/2018/11/05/lepin-ordered-to-s... [2] https://www.brothers-brick.com/2019/04/28/arrests-made-in-lepin-raid-over-the-continued-manufacture-of-counterfeit-lego-products-news/ https://www.brothers-brick.com/2019/04/28/arrests-made-in-le...
    - monocasa 7y ago
      Doesn't look like they've actually stopped. https://lepinworld.com/ https://lepinworld.com/
  - jbarham 7y ago
    Several years ago Scottish chip company FTDI took matters into their own hands by releasing a driver that would brick counterfeits of their USB to serial converter chip: https://en.wikipedia.org/wiki/FTDI#Driver_controversy https://en.wikipedia.org/wiki/FTDI#Driver_controversy
monocasa 7y ago
And honestly it's a little harder than Broadcom's to reverse. Xtensa doesn't have nearly the same support in reversing tools as ARM and MIPS. On the plus side though you do get unstripped binaries since it's a static library.
- gioscarab 7y ago
  I agree, it is for sure harder to reverse, on the other side without releasing the source, it is also much easier to hide in and keep secret vulnerabilities and or zero-days.
fra 7y ago
While it is true that the core WiFi code is not open source, the ESP-IDF is significantly more open than anything else on the market today. This is not to say that Espressif is the bee's knees. I personally wouldn't use their hardware in production. But by making their product easily accessible, and much of the source code open, they have made it easier for white hats to raise security issues.
fri_sch 7y ago
At least they seem to be working on opening parts of the code and have already released the supplicant code for example. https://github.com/espressif/esp32-wifi-lib/issues/2 https://github.com/espressif/esp32-wifi-lib/issues/2 https://github.com/espressif/esp-idf/commit/c1396830243b4c8fbea255a04d8a04ed2cb9f3d7 https://github.com/espressif/esp-idf/commit/c1396830243b4c8f...
- dbuder 7y ago
  And then they said that users should only buy products with reputably sourced chips, like my mom is opening up her electronics and trying to figure out whether or not the USB to serial chip is a fake or not.

joezydeco 7y ago

"avoiding patent infringement lawsuits via opacity"

wysifnwyg 7y ago
Has there been any successful patent infringement lawsuits over the last three years that targets a Chinese company that has infringed upon a US company? Isn't that part of the issue in the current trade deal talks with China?
- CDSlice 7y ago
  Not a US company being infringed, but Lego has gotten a Chinese court to order Lepin to stop making imitations of Lego products. [1] Since arrests have been made over Lepin not complying [2], it seems like the ruling has teeth. [1] https://www.brothers-brick.com/2018/11/05/lepin-ordered-to-stop-making-and-selling-lego-imitation-products-by-chinese-court-news/ https://www.brothers-brick.com/2018/11/05/lepin-ordered-to-s... [2] https://www.brothers-brick.com/2019/04/28/arrests-made-in-lepin-raid-over-the-continued-manufacture-of-counterfeit-lego-products-news/ https://www.brothers-brick.com/2019/04/28/arrests-made-in-le...
  - monocasa 7y ago
    Doesn't look like they've actually stopped. https://lepinworld.com/ https://lepinworld.com/
- jbarham 7y ago
  Several years ago Scottish chip company FTDI took matters into their own hands by releasing a driver that would brick counterfeits of their USB to serial converter chip: https://en.wikipedia.org/wiki/FTDI#Driver_controversy https://en.wikipedia.org/wiki/FTDI#Driver_controversy

monocasa 7y ago

And honestly it's a little harder than Broadcom's to reverse. Xtensa doesn't have nearly the same support in reversing tools as ARM and MIPS. On the plus side though you do get unstripped binaries since it's a static library.

gioscarab 7y ago
I agree, it is for sure harder to reverse, on the other side without releasing the source, it is also much easier to hide in and keep secret vulnerabilities and or zero-days.

fra 7y ago

While it is true that the core WiFi code is not open source, the ESP-IDF is significantly more open than anything else on the market today. This is not to say that Espressif is the bee's knees. I personally wouldn't use their hardware in production. But by making their product easily accessible, and much of the source code open, they have made it easier for white hats to raise security issues.

fri_sch 7y ago

At least they seem to be working on opening parts of the code and have already released the supplicant code for example. https://github.com/espressif/esp32-wifi-lib/issues/2 https://github.com/espressif/esp32-wifi-lib/issues/2 https://github.com/espressif/esp-idf/commit/c1396830243b4c8fbea255a04d8a04ed2cb9f3d7 https://github.com/espressif/esp-idf/commit/c1396830243b4c8f...

dbuder 7y ago
And then they said that users should only buy products with reputably sourced chips, like my mom is opening up her electronics and trying to figure out whether or not the USB to serial chip is a fake or not.