"Wiring", which constitutes Arduino's primary API surface, was taken wholesale from Hernando Barragán's 2003 master's thesis project. It was a fork of processing for microcontrollers and was not written by the Arduino team: Massimo Banzi, David Cuartielles, David Mellis, Gianluca Martino, and Tom Igo.
Yeah, the software side is basically only an IDE, a build system and a package manager an another system API (basically an alternative to libc). Which is useful for C++, but far from being non-replaceable.
I recall AVR-GCC not only working just fine in 2005 but being the official method for compiling code for those chips. I used it before Arduino came out to target the same chips.
Arduino was a nice beginner friendly IDE for sure that eliminated the need for make files or reading documentation for GCC, but the existing ecosystem was definitely not closed source.
Maybe it was different in 2005, but now Arduino is just an IDE, that uses GCC under the hood. So it is still "the official method for compiling code for those chips".
Definitely, it's always used GCC under the hood, and also just been the IDE.
Arduino (the original AVR boards anyway) have always relied on GCC, and not just that but the entire open source chain that already existed for AVR-GCC. I'm sure they contribute back (I guess "sure" is an exaggeration), but it worked pretty darn well already.
Arduino, for me, replaced emacs for an IDE. The main reasons I use it are because I don't need to write a makefile, and the integrated serial port. Those are good enough features that I still use the IDE even though I haven't touched a real Arduino in a decade or more. But I work alone and don't usually have more than a few thousand lines of code so it's not too complex to manage.
That tracks with my experience, since I don't prefer the IDE, because I need a build system that generates unique IDs and conditionally compiles stuff and handles debug flags. Also it needs to be reproducible and run unattended. In addition a build system is way faster. Arduino almost spends half of the build time on reanalyzing the project files to find out, what it actually needs to do and then it creates build artifacts in a random location. That's all problems you don't have with a proper build system, so the build system ends up way faster. I think Arduino also doesn't support parallel compilation.
By the mid 2000s open-source hardware again became a hub of activity due to the emergence of several major open-source hardware projects and companies, such as OpenCores, RepRap (3D printing), Arduino, Adafruit, SparkFun, and Open Source Ecology. In 2007, Perens reactivated the openhardware.org website, but it is currently (February 2025) inactive. [0]
I think they should have worded this better, but what they are known for, more specifically, is pushing open source hardware forward and sticking with it on principle even though it caused many business challenges.
Arduino doesn't directly benefit from pretty much any of legacy unix barf-bag stuff.
It's just a HAL and an IDE, with a truckload of user/third party supplied libraries for various modules, sensors, etc.
Plus, every sizable MCU/dev-board vendor supplies a Arduino HAL implementation (so called Core) for their board/mcu/module (or it's done by enthusiastic community).
It's Atmel that derives massive benefit from GCC, or whoever implemented AVR backend for GCC.
Arduino doesn't - strictly speaking - depend on GCC, it could (and does) use any toolchain that is supplied by MCU vendor.
And it just happens so that many MCU vendors do often use GCC as part of their toolchain.
Arduino just bundles that with vendor supplied tools for flashing, etc, like avrdude.
Which is to say - it's the MCU vendors that derive the main benefit from GCC.
Arduino will just happily use whatever toolchain MCU vendors provide.
> 1989: Tim Berners-Lee invents the World Wide Web
I think ideas etc... existed before that, e. g. DARPA and what Alan Kay said.
Tim mostly pushed forward a simple protocol that worked. Would be interesting to see how much Tim really generated de-novo, but in general I disagree that he "invented" the world wide web as such. That would seem unfair to many other people - just like Alan Kay once said, you see further by standing on the shoulders of giants (translation: you benefitted from earlier inventions and ideas, made by other people).
> Would be interesting to see how much Tim really generated de-novo, but in general I disagree that he "invented" the world wide web as such.
Eh? What do you mean it would be interesting to see? It's well-documented. Not controversial or hidden.
The HTTP protocol yes. But also the browser/editor app, WorldWideWeb, a web server for it, and the URL scheme, are literal Berners-Lee inventions. HTML may be an SGML language but it's his SGML language.
He's not claiming and nobody is claiming he invented hypertext (he would say Ted Nelson and Alan Kay).
He absolutely invented the fundamentals of the end-to-end web technology as we use it. There was no functioning internet open-hypermedia system before 1990. It's just not in question and it's kind of disingenuous to imply he didn't do much.
(Defining down "invent" in this way is also disingenuous to all inventors, who all do their work in the context of prior art)
Complained about and already modified. However, what is "wrong" is that some "person" invented the internet. We live in a time of "followers" and in that paradigm we need some singular person to follow. But it was actually a bunch of original thinkers of whom TBL was one. But it was not a person. I suspect a closer answer is the IETF, but that is also a leaky abstraction.
The point is that if you want to do something, you are probably more likely to do it well with lots of other doers. Not followers.
If you walk into the head office of Qualcomm (in Sorrento Vally, San Diego, CA) and you see the the "Patent Wall" in the entrance covered with almost 1400 patents, it's kind of hard to wonder just how open Arduino will be.
You are right - the whole blog entry has zero names mentioned. An anonymous opinion piece indeed.
Could have almost been written by AI, but the content seemed so angry that I think it must have been a corporate spokesperson who just woke up, read people being concerned and angrily hacked away at the keys at the keyboard.
What I don't get is how what they do is even legally possible, since the libraries have all F/OSS licenses (MIT, LGPL, GPL, APL), and they don't even own the sole copyright to most things.
You'd have to sue them to enforce it. Good luck bringing a case against Qualcomm, perhaps one of the worst companies known for its intellectual property management
Why do I need to sue them, when it's me, who does things I think are granted in their licenses, that they try to forbid? Isn't that the other way around?
“ we have been open-source long before it was fashionable.”
That is a weird, weird claim for a firm that was founded off the back of a project that started in 2005.
It’s, what, over five years after the VA Linux IPO, two years after Microsoft arguably used Caldera as a weapon in a proxy war against IBM, seven years after one of the most famous software products of all time, Netscape Navigator, went open source.
Just a strange, facially implausible bit of appeal to tradition.
The license change isn't a dealbreaker, but Qualcomm still consists of 900000 insectoid lawyers pretending to be humans, and their hivemind thinks "open source" is some kind of disease.
The "best case scenario" was that Arduino would get Qualcomm as a whole to be more open to small devs. The "worst case scenario" was that Qualcomm would get Arduino to be as bad as Qualcomm, and you'd have to "talk to sales" to get an SDK for your development board.
So far, we're not getting the "best case scenario". So keep the pitchforks at hand.
It may be over already. I mean, the pitchforks will change what exactly? Looks like qualcom pwns I mean owns the arduino ecosystem now. Just like a killed-by-Google meme, qualcom may soon start its own killed-by-qualcom trend.
"we collect data for your privacy" they have no idea what words or actions mean anymore.
There is no such thing as being purchased by a large company while retaining anything non-evil. If anything this is the remaining employees who were lied to their face about remaining whatever they were
Anyone have any advice for Arduino replacement? I recently (unknowingly) bought a R4 for some LED projects but knowing now the background, I'm wondering if there's any other alternative for hobby (noob level) micro controller project
I've played with a lot of boards, including Teensy, Seeed XIAO family, some boards from Adafruit and SparkFun, and one Chinese copy of a Chinese ESP32 board.
For my work projects, I use Teensy because it's the screaming-est processor, and I use its computing power. The cost isn't exorbitant since it's typically re-usable unless you want to turn something into a permanent installation.
I suggest play with what you've got until you get sick of it, or run into a hardware need that would be better served by another processor or board. Or choose a new board when your R4 goes into something that you want to keep.
I've tried to maintain a "platform agnostic" approach, where I stick with the general Arduino API and processor-independent libraries as much as possible, and only drop down into the vendor-specific libraries when there's a real performance reason. This makes it easier to switch boards if needed -- a lifesaver during the chip shortage, and possibly important under present day supply chain uncertainty.
Doing it this way will give you the benefits of drawing from a broader range of tutorials and docs, while also providing a gentler learning curve on working with the low level chip-specific stuff.
Any ESP32, RP2040 or RP2350 board. The last two use external QSPI flash, so hobby projects only. There are no fuses to set to read protect the firmware.
Still can be reflashed if you have access to the right pins, but I believe there are more security features built into the later generations of these chips (plus some security fixed from the original 2350 design).
Just to be clear, some micros (STM32s come to mind) have what they call "on the fly decryption" for external flash. Basically, if the micros wanted to, they would. I think ESP32s are also using qspi flashes but they're integrated in package? Maybe that's changed but that's how I vaguely remember it
I believe only the ESP32 modules with 16M have QSPI flash, the 4M standard flash is on chip. For on the fly decryption you need on chip enclaves to store the keys. Anyway, it doesn't really matter for hobby projects and the ESP32 can also be used for commercial projects.
Indeed, the number of "non commercial" projects using these chips that are set up much less securely than even modest "hobbyist" projects boggles the mind.
I use a RP2040 in a commercial product, but it's for a niche portion of a niche industry and it's not intended to ever communicate with another device. Disabling USB mass storage and not adding a bootloader button is good enough for me.
Depending upon your project, perhaps the new MakerPort might be a good fit? https://makerport.fun
The basic kit comes with a built-in speaker, a bunch of LEDs, a servo, an LED matrix, and other goodies. The default firmware works with Scratch, Snap, and MicroBlocks, but I believe you can also use your own custom firmware.
Pine64 has products that are far more open than Raspberry Pi products, and still have good community support. They also have several RISC V products, which are quickly overtaking AVR, PIC, and ARM Cortex M0 microcontrollers.
Their definition of "the platform" in the TOS is verbose and has weird grammar. I can see how people came away with a different understanding.
> User shall not translate, decompile or reverse-engineer the Platform, or engage in any other activity designed to identify the algorithms and logic of the Platform’s operation, unless expressly allowed by Arduino or by applicable license agreements;
> The Site is part of the platform developed and managed by Arduino, which allows users to take part in the discussions on the Arduino forum, the Arduino blog, the Arduino User Group, the Arduino Discord channel, and the Arduino Project Hub, and to access the Arduino main website, subsites, Arduino Cloud, Arduino Courses, Arduino Certifications, Arduino Docs, the Arduino EDU kit sites to release works within the Contributor License Agreement program, and to further develop the Arduino open source ecosystem (collectively, the “Platform”).
I'm pretty sure that is the point. Legal ambiguity to say whatever they can vaguely in public but in court they will make it encompass the entire world.
Large companies have repeatedly demonstrated that they will pick whichever interpretation is most convenient at the time. When there are pitchforks they will claim that you are confused and misinterpreted the writing but when you get poisoned by food in their restaurant and try to sue them they will point at terms of service on their online video streaming service that your spouse agreed 5 years ago as if that's relevant (not a joke Disney tried that one). These things are supposed to be written by proffesionals, I dont think Hanlon's razor sufficiently explains it, terms of service are at least partially intentionally written as vague and unclear as possible for benefit of one side.
u/healsdata already gave a good answer to that. I may only add that
this could be the first step of increasing restrictions made by
qualcom. The future will show. If it happens, some who warned about
that may wisely nod their heads then, whereas others will be very
confused about "this sudden change" ...
"Let us be absolutely clear: we have been open-source long before it was fashionable"
This is a VERY bad attempt at self-promo, sorry.
Many other open source projects are much older, so "fashionable" is a very emotionally laden word. But, even aside from this: what matters is the now and future. You can not refer to a "glorious past" if the future just looks bleak and bad.
"The Qualcomm acquisition doesn’t modify how user data is handled or how we apply our open-source principles."
Everyone already sees that the Qualcomm take-over changed the project. There is no way to deny it. Now, perhaps it COULD lead to an improvement - who knows. But it can also lead to a stagnation or decline. We saw that with many other projects that suddenly became progressively starved down. Even without a corporate overlord that may happen, when users, hobbyists, devs, are no longer as interested. They may write fewer blog entries and so forth - decline happens.
"We periodically update our legal documents to reflect new features, evolving regulations, and best practices."
As does Mozilla - yet firefox keeps on dying and dwindling.
Sorry, but this just reads like a post mortem to me.
"Restrictions on reverse-engineering apply specifically to our Software-as-a-Service cloud applications"
Which open source licence typically were to include that? And, by the way - I am increasingly noticing how the "legal terms" try to provide provisions that aren't part of a licence. I noticed this some time ago with regard to RubyCentral slapping down meta-corporate rules on rubygems.org (see here https://blog.rubygems.org/2025/07/08/policies-live.html). So this is what corporations want to do. I don't see how this benefits the hobbyists or solo devs in any way, shape or form. And I don't agree that this "sets the record straight" either.
To me it reads like a corporate take-over of arduino. That's bad.
the carve out is weird and usually open-source does not say, no to the navy using it BUT, it's OK for DARPA ...
> Military Use: Use by or for any military organization or for any military purpose, including but not limited to projects sponsored or paid for by military organizations, or use by the U.S. Department of Defense (except for DARPA), U.S. Armed Forces, U.S. Department of Homeland Security, U.S. intelligence agencies, or any foreign counterparts of the foregoing.
Given the ambiguity of the phrase "military use" when the military does, in-fact, use it for things the military does - I am not confident in the slightest with Arduino's use of language here.
> Military Use: Use by or for any military organization or for any military purpose, including but not limited to projects sponsored or paid for by military organizations, or use by the U.S. Department of Defense (except for DARPA), U.S. Armed Forces, U.S. Department of Homeland Security, U.S. intelligence agencies, or any foreign counterparts of the foregoing.
Indeed. Also because any big organisation or corporation can both do evil and good. Often research projects with guarantees to release knowledge or some other improvements such as to software projects under a permissive licence.
i wrote the article, just go ahead and call me shady and leave out other people at the company. limor will be back online next week after recovering (just had a kid) and you can call her shady too.
But you did not sign the article? I don't understand this.
IMO it would have just been easier to simply sign it. (With signing I mean mentioning who specifically wrote a blog entry; and also ideally the time as well.)
those were previous blocks and a couple of banned people assumed it was that, it was not, and since then we mute and document blocks with our social team. regardless, a block from what, 4 years ago, hurt someone that bad, twitter really did hurt people.
Seems reasonable. I have a Duemilanove and an Uno R2 that I haven't used in ages but Arduino stuff has always been open as far as I remember. I really can't bring myself to pull out the pitchforks here. They've earned the trust from me. It's been over a decade now.
You are basically saying that "past experience means future trust". How does this relate? I mean, a company xyz can have been doing great in the past, but may go extinct lateron for any reason. See Sun and then who owns Java nowadays. I much preferred Sun over Oracle really.
I feel the parent. I assume what they refer to is good will accumulated over the years. But that by itself does not last forever and eventually disappears ( faster in some than others ). I personally learned to not get too comfy. Stuff changes, which means we have need to adjust as well. It is just hard sometimes.
"we have been open-source long before it was fashionable"
An abridged timeline:
1960s to 1980s: hobbyist and academic/research computing create thriving public domain software ecosystems (literally the birth of FOSS)
1983: The GNU Project begins
1989: The World Wide Web is created
1991: Linus Torvalds posts the first Linux kernel to USENET
1992: 386BSD is released; Slackware is created
1993: NetBSD is forked; Debian is created
1994: FreeBSD 2 is released
1995: Red Hat is created
[a decade of FOSS and the internet changing computing and research forever]
2005: A collection of low-cost microcontroller education tools, benefiting from half a century of FOSS, is formalized into something called "Arduino"
Also, didn't early Arduino heavily borrow from another open-source project, "Processing"?
Processing was/is graphics-centered, so that's where Arduino's term "sketch" come from, if you ever wondered.
https://en.wikipedia.org/wiki/File:Processing_screen_shot.pn...
https://en.wikipedia.org/wiki/File:Arduino_IDE_-_Blink.png
"Wiring", which constitutes Arduino's primary API surface, was taken wholesale from Hernando Barragán's 2003 master's thesis project. It was a fork of processing for microcontrollers and was not written by the Arduino team: Massimo Banzi, David Cuartielles, David Mellis, Gianluca Martino, and Tom Igo.
I have to dig around, I think I still have one of the original wiring boards from around 2006 (maybe)?
Yeah, the software side is basically only an IDE, a build system and a package manager an another system API (basically an alternative to libc). Which is useful for C++, but far from being non-replaceable.
Embedded in particular was mired in closed source vendor lock in toolchains and SDKs for decades.
And some industry players still are. Looking at you, Broadcom and Qualcomm.
I recall AVR-GCC not only working just fine in 2005 but being the official method for compiling code for those chips. I used it before Arduino came out to target the same chips.
Arduino was a nice beginner friendly IDE for sure that eliminated the need for make files or reading documentation for GCC, but the existing ecosystem was definitely not closed source.
Maybe it was different in 2005, but now Arduino is just an IDE, that uses GCC under the hood. So it is still "the official method for compiling code for those chips".
Definitely, it's always used GCC under the hood, and also just been the IDE.
Arduino (the original AVR boards anyway) have always relied on GCC, and not just that but the entire open source chain that already existed for AVR-GCC. I'm sure they contribute back (I guess "sure" is an exaggeration), but it worked pretty darn well already.
Arduino, for me, replaced emacs for an IDE. The main reasons I use it are because I don't need to write a makefile, and the integrated serial port. Those are good enough features that I still use the IDE even though I haven't touched a real Arduino in a decade or more. But I work alone and don't usually have more than a few thousand lines of code so it's not too complex to manage.
That tracks with my experience, since I don't prefer the IDE, because I need a build system that generates unique IDs and conditionally compiles stuff and handles debug flags. Also it needs to be reproducible and run unattended. In addition a build system is way faster. Arduino almost spends half of the build time on reanalyzing the project files to find out, what it actually needs to do and then it creates build artifacts in a random location. That's all problems you don't have with a proper build system, so the build system ends up way faster. I think Arduino also doesn't support parallel compilation.
[0]: https://en.wikipedia.org/wiki/Open-source_hardware
Arduino doesn't directly benefit from pretty much any of legacy unix barf-bag stuff.
It's just a HAL and an IDE, with a truckload of user/third party supplied libraries for various modules, sensors, etc.
Plus, every sizable MCU/dev-board vendor supplies a Arduino HAL implementation (so called Core) for their board/mcu/module (or it's done by enthusiastic community).
They derive a massive benefit from GCC even if they use nothing else at all.
The point of the GP was to refute the claim that they were started “before open source was cool”.
This isn't entirely true.
It's Atmel that derives massive benefit from GCC, or whoever implemented AVR backend for GCC.
Arduino doesn't - strictly speaking - depend on GCC, it could (and does) use any toolchain that is supplied by MCU vendor.
And it just happens so that many MCU vendors do often use GCC as part of their toolchain. Arduino just bundles that with vendor supplied tools for flashing, etc, like avrdude.
Which is to say - it's the MCU vendors that derive the main benefit from GCC.
Arduino will just happily use whatever toolchain MCU vendors provide.
> 1989: Tim Berners-Lee invents the World Wide Web
I think ideas etc... existed before that, e. g. DARPA and what Alan Kay said.
Tim mostly pushed forward a simple protocol that worked. Would be interesting to see how much Tim really generated de-novo, but in general I disagree that he "invented" the world wide web as such. That would seem unfair to many other people - just like Alan Kay once said, you see further by standing on the shoulders of giants (translation: you benefitted from earlier inventions and ideas, made by other people).
As I was writing it out, I knew someone was going to complain.
It's an abridged timeline. Brevity because the point is the date, not the fine detail.
But since I don't care to argue on the internet... edited.
There's always someone who has to be pedantic
> Would be interesting to see how much Tim really generated de-novo, but in general I disagree that he "invented" the world wide web as such.
Eh? What do you mean it would be interesting to see? It's well-documented. Not controversial or hidden.
The HTTP protocol yes. But also the browser/editor app, WorldWideWeb, a web server for it, and the URL scheme, are literal Berners-Lee inventions. HTML may be an SGML language but it's his SGML language.
He's not claiming and nobody is claiming he invented hypertext (he would say Ted Nelson and Alan Kay).
He absolutely invented the fundamentals of the end-to-end web technology as we use it. There was no functioning internet open-hypermedia system before 1990. It's just not in question and it's kind of disingenuous to imply he didn't do much.
(Defining down "invent" in this way is also disingenuous to all inventors, who all do their work in the context of prior art)
Complained about and already modified. However, what is "wrong" is that some "person" invented the internet. We live in a time of "followers" and in that paradigm we need some singular person to follow. But it was actually a bunch of original thinkers of whom TBL was one. But it was not a person. I suspect a closer answer is the IETF, but that is also a leaky abstraction.
The point is that if you want to do something, you are probably more likely to do it well with lots of other doers. Not followers.
The World Wide Web is not the Internet.
"We are Arduino. We are open. We’re not going anywhere."
-- statement from Qualcomm without a single human being's name on it
If you walk into the head office of Qualcomm (in Sorrento Vally, San Diego, CA) and you see the the "Patent Wall" in the entrance covered with almost 1400 patents, it's kind of hard to wonder just how open Arduino will be.
Wow that's tacky.
You are right - the whole blog entry has zero names mentioned. An anonymous opinion piece indeed.
Could have almost been written by AI, but the content seemed so angry that I think it must have been a corporate spokesperson who just woke up, read people being concerned and angrily hacked away at the keys at the keyboard.
> We are open.
Except that half their boards and the entire cloud platform aren't open source at all.
Yeah. This can also be the intro: "and so it begins".
E. g. qualcom stepwise swallowing the infrastructure and pulling the chair under the hobbyists community.
https://en.wikipedia.org/wiki/Resistance_Is_Futile
Sorry, you got bought by Qualcomm and that was suicide.
What I don't get is how what they do is even legally possible, since the libraries have all F/OSS licenses (MIT, LGPL, GPL, APL), and they don't even own the sole copyright to most things.
https://news.ycombinator.com/item?id=45978802
https://news.ycombinator.com/item?id=45985663
You'd have to sue them to enforce it. Good luck bringing a case against Qualcomm, perhaps one of the worst companies known for its intellectual property management
Why do I need to sue them, when it's me, who does things I think are granted in their licenses, that they try to forbid? Isn't that the other way around?
“ we have been open-source long before it was fashionable.”
That is a weird, weird claim for a firm that was founded off the back of a project that started in 2005.
It’s, what, over five years after the VA Linux IPO, two years after Microsoft arguably used Caldera as a weapon in a proxy war against IBM, seven years after one of the most famous software products of all time, Netscape Navigator, went open source.
Just a strange, facially implausible bit of appeal to tradition.
I don't get it, do we keep the pitchforks out, or do we stash the pitchforks?
Keep sharpening the pitchforks.
The license change isn't a dealbreaker, but Qualcomm still consists of 900000 insectoid lawyers pretending to be humans, and their hivemind thinks "open source" is some kind of disease.
The "best case scenario" was that Arduino would get Qualcomm as a whole to be more open to small devs. The "worst case scenario" was that Qualcomm would get Arduino to be as bad as Qualcomm, and you'd have to "talk to sales" to get an SDK for your development board.
So far, we're not getting the "best case scenario". So keep the pitchforks at hand.
It may be over already. I mean, the pitchforks will change what exactly? Looks like qualcom pwns I mean owns the arduino ecosystem now. Just like a killed-by-Google meme, qualcom may soon start its own killed-by-qualcom trend.
You can keep the pitchforks out, but you sadly need to assume Arduino is dead.
Of course, if you weren't already making that assumption when Qualcomm bought them, I don't know what to tell you ...
"we collect data for your privacy" they have no idea what words or actions mean anymore.
There is no such thing as being purchased by a large company while retaining anything non-evil. If anything this is the remaining employees who were lied to their face about remaining whatever they were
You can stash them.
Show me a time anyone has ever remained themselves after being purchased by Qualcomm.
It’s over for Arduino.
Anyone have any advice for Arduino replacement? I recently (unknowingly) bought a R4 for some LED projects but knowing now the background, I'm wondering if there's any other alternative for hobby (noob level) micro controller project
I've played with a lot of boards, including Teensy, Seeed XIAO family, some boards from Adafruit and SparkFun, and one Chinese copy of a Chinese ESP32 board.
For my work projects, I use Teensy because it's the screaming-est processor, and I use its computing power. The cost isn't exorbitant since it's typically re-usable unless you want to turn something into a permanent installation.
I suggest play with what you've got until you get sick of it, or run into a hardware need that would be better served by another processor or board. Or choose a new board when your R4 goes into something that you want to keep.
I've tried to maintain a "platform agnostic" approach, where I stick with the general Arduino API and processor-independent libraries as much as possible, and only drop down into the vendor-specific libraries when there's a real performance reason. This makes it easier to switch boards if needed -- a lifesaver during the chip shortage, and possibly important under present day supply chain uncertainty.
Doing it this way will give you the benefits of drawing from a broader range of tutorials and docs, while also providing a gentler learning curve on working with the low level chip-specific stuff.
(one of the best comments and advice so far)
Any ESP32, RP2040 or RP2350 board. The last two use external QSPI flash, so hobby projects only. There are no fuses to set to read protect the firmware.
The RP2354 has the flash stacked inside the chip; https://www.raspberrypi.com/news/rp2350-a4-rp2354-and-a-new-...
Still can be reflashed if you have access to the right pins, but I believe there are more security features built into the later generations of these chips (plus some security fixed from the original 2350 design).
Just to be clear, some micros (STM32s come to mind) have what they call "on the fly decryption" for external flash. Basically, if the micros wanted to, they would. I think ESP32s are also using qspi flashes but they're integrated in package? Maybe that's changed but that's how I vaguely remember it
I believe only the ESP32 modules with 16M have QSPI flash, the 4M standard flash is on chip. For on the fly decryption you need on chip enclaves to store the keys. Anyway, it doesn't really matter for hobby projects and the ESP32 can also be used for commercial projects.
Indeed, the number of "non commercial" projects using these chips that are set up much less securely than even modest "hobbyist" projects boggles the mind.
I use a RP2040 in a commercial product, but it's for a niche portion of a niche industry and it's not intended to ever communicate with another device. Disabling USB mass storage and not adding a bootloader button is good enough for me.
Depending upon your project, perhaps the new MakerPort might be a good fit? https://makerport.fun The basic kit comes with a built-in speaker, a bunch of LEDs, a servo, an LED matrix, and other goodies. The default firmware works with Scratch, Snap, and MicroBlocks, but I believe you can also use your own custom firmware.
Pine64 has products that are far more open than Raspberry Pi products, and still have good community support. They also have several RISC V products, which are quickly overtaking AVR, PIC, and ARM Cortex M0 microcontrollers.
nrF52
This is so full of vapid corporate speak, it’s ripe for one of those joke “translation” posts:
> We’ve heard some questions and concerns following our recent Terms of Service and Privacy Policy updates.
Translation: Y’all are angry about us changing what we stood for.
> We are thankful our community cares enough to engage with us and we believe transparency and open dialogue are foundational to Arduino.
Translation: You fuckers are loud and this is blowing up in our faces, so we need to do damage control fast or the acquisition will be worthless.
They say "privacy" a lot on that blog page, but that very page runs surveillance capitalism trackers from Facebook, Twitter, Google, and others.
Whoa there, you're in reverse-engineering territory of their website already!
They mean privacy for the author of that blog post - he is anonymous after all.
If the only restriction on reverse engineering is their cloud SaaS, why was everyone up in arms?
Or is this Arduino trying to save face?
Their definition of "the platform" in the TOS is verbose and has weird grammar. I can see how people came away with a different understanding.
> User shall not translate, decompile or reverse-engineer the Platform, or engage in any other activity designed to identify the algorithms and logic of the Platform’s operation, unless expressly allowed by Arduino or by applicable license agreements;
> The Site is part of the platform developed and managed by Arduino, which allows users to take part in the discussions on the Arduino forum, the Arduino blog, the Arduino User Group, the Arduino Discord channel, and the Arduino Project Hub, and to access the Arduino main website, subsites, Arduino Cloud, Arduino Courses, Arduino Certifications, Arduino Docs, the Arduino EDU kit sites to release works within the Contributor License Agreement program, and to further develop the Arduino open source ecosystem (collectively, the “Platform”).
I can only read this as the entirety of "Arduino open source ecosystem" being part of "the Platform".
I'm pretty sure that is the point. Legal ambiguity to say whatever they can vaguely in public but in court they will make it encompass the entire world.
Large companies have repeatedly demonstrated that they will pick whichever interpretation is most convenient at the time. When there are pitchforks they will claim that you are confused and misinterpreted the writing but when you get poisoned by food in their restaurant and try to sue them they will point at terms of service on their online video streaming service that your spouse agreed 5 years ago as if that's relevant (not a joke Disney tried that one). These things are supposed to be written by proffesionals, I dont think Hanlon's razor sufficiently explains it, terms of service are at least partially intentionally written as vague and unclear as possible for benefit of one side.
That's called motte and bailey.
u/healsdata already gave a good answer to that. I may only add that this could be the first step of increasing restrictions made by qualcom. The future will show. If it happens, some who warned about that may wisely nod their heads then, whereas others will be very confused about "this sudden change" ...
> why was everyone up in arms?
Engagement farming, clout chasing etc.
Faceless corpo speak at best
This allays my suspicions. I appreciate the response to this community’s concerns.
If you put the /s more people would understand.
But ... how?
It does?!
No money for software patent bullies like Qualcomm.
The need of an Arduino fork.
"Let us be absolutely clear: we have been open-source long before it was fashionable"
This is a VERY bad attempt at self-promo, sorry.
Many other open source projects are much older, so "fashionable" is a very emotionally laden word. But, even aside from this: what matters is the now and future. You can not refer to a "glorious past" if the future just looks bleak and bad.
"The Qualcomm acquisition doesn’t modify how user data is handled or how we apply our open-source principles."
Everyone already sees that the Qualcomm take-over changed the project. There is no way to deny it. Now, perhaps it COULD lead to an improvement - who knows. But it can also lead to a stagnation or decline. We saw that with many other projects that suddenly became progressively starved down. Even without a corporate overlord that may happen, when users, hobbyists, devs, are no longer as interested. They may write fewer blog entries and so forth - decline happens.
"We periodically update our legal documents to reflect new features, evolving regulations, and best practices."
As does Mozilla - yet firefox keeps on dying and dwindling.
Sorry, but this just reads like a post mortem to me.
"Restrictions on reverse-engineering apply specifically to our Software-as-a-Service cloud applications"
Which open source licence typically were to include that? And, by the way - I am increasingly noticing how the "legal terms" try to provide provisions that aren't part of a licence. I noticed this some time ago with regard to RubyCentral slapping down meta-corporate rules on rubygems.org (see here https://blog.rubygems.org/2025/07/08/policies-live.html). So this is what corporations want to do. I don't see how this benefits the hobbyists or solo devs in any way, shape or form. And I don't agree that this "sets the record straight" either.
To me it reads like a corporate take-over of arduino. That's bad.
> The Qualcomm acquisition doesn’t modify how user data is handled or how we apply our open-source principles.
That’s a lie. Perhaps they lie to themselves. I don’t know. I can only guess.
Adafruit acted a bit shady here. Their original post includes:
"Military weird things"
Reading the ToS, the two mentions of military are "don't use our AI product for military use" and in the export and trade controls section.
How are either of those weird?
the carve out is weird and usually open-source does not say, no to the navy using it BUT, it's OK for DARPA ...
> Military Use: Use by or for any military organization or for any military purpose, including but not limited to projects sponsored or paid for by military organizations, or use by the U.S. Department of Defense (except for DARPA), U.S. Armed Forces, U.S. Department of Homeland Security, U.S. intelligence agencies, or any foreign counterparts of the foregoing.
Given the ambiguity of the phrase "military use" when the military does, in-fact, use it for things the military does - I am not confident in the slightest with Arduino's use of language here.
How would you want to see this further clarified?
> Military Use: Use by or for any military organization or for any military purpose, including but not limited to projects sponsored or paid for by military organizations, or use by the U.S. Department of Defense (except for DARPA), U.S. Armed Forces, U.S. Department of Homeland Security, U.S. intelligence agencies, or any foreign counterparts of the foregoing.
Gee, I dunno, how about by not limiting its scope exclusively to AI usage by the military?
Also - given how many tech companies involved in AI have done an about-face on military usage of it, I'm increasingly seeing it as an empty promise.
Indeed. Also because any big organisation or corporation can both do evil and good. Often research projects with guarantees to release knowledge or some other improvements such as to software projects under a permissive licence.
Free Software's Freedom #0: Freedom of use.
[dead]
>Adafruit acted a bit shady here
what is new here?
i wrote the article, just go ahead and call me shady and leave out other people at the company. limor will be back online next week after recovering (just had a kid) and you can call her shady too.
But you did not sign the article? I don't understand this.
IMO it would have just been easier to simply sign it. (With signing I mean mentioning who specifically wrote a blog entry; and also ideally the time as well.)
? All the adafruit blog posts have author and date listed.
i am here now, phillip torrone, and i am holding my 7 day old doing speech to text :)
on linkedin, i think it just says "adafruit" i will learn more and see if i can go in and add it post-post..
how is that shady for ya.
[dead]
nah, rest of the company gets the shady label too, always has, always will.
remember when y'all both started blocking people on twitter for calling out data breaches? hrm, lmao.
those were previous blocks and a couple of banned people assumed it was that, it was not, and since then we mute and document blocks with our social team. regardless, a block from what, 4 years ago, hurt someone that bad, twitter really did hurt people.
Seems reasonable. I have a Duemilanove and an Uno R2 that I haven't used in ages but Arduino stuff has always been open as far as I remember. I really can't bring myself to pull out the pitchforks here. They've earned the trust from me. It's been over a decade now.
Does not really make a whole lot of sense to me.
You are basically saying that "past experience means future trust". How does this relate? I mean, a company xyz can have been doing great in the past, but may go extinct lateron for any reason. See Sun and then who owns Java nowadays. I much preferred Sun over Oracle really.
I feel the parent. I assume what they refer to is good will accumulated over the years. But that by itself does not last forever and eventually disappears ( faster in some than others ). I personally learned to not get too comfy. Stuff changes, which means we have need to adjust as well. It is just hard sometimes.
Did you miss the bit where they got bought by Qualcomm??