When reading this, I always ask myself: Why should the keys to devices owned by customers not be held by the customers? I know the answer, of course, but it’s disheartening.

You need the keys to sign firmware - would you expect customers to write firmware?

I expect customers to sign custom firmware that they download. Some advanced users will write their own.

To address the point about companies also needing to deploy firmware — you can have two keys on the device:

1. For company firmware.

2. Included key with the device.

This is a key for company firmware, so the second point has nothing to do with it, except the easier it is for a user to write their own firmware, the easier it is for malicious actors to do the same.

This is exactly the reasoning behind Purism: https://news.ycombinator.com/item?id=24463347.

As a developer with expertise elsewhere, such write ups always amaze me. I used to think of hardware as unmodifiable black boxes, but over time my point of view changed to consider almost all consumer electronics hackable to various degrees, you just have to know how.

On this note, I wish someone hacked the Shimano Di2 firmware to enable the RD shift amount of gears different to the stock value (10,11,12 and so on). Judging by this video [1], the hardware is capable of that (or was, the RD-6770 was superseded a while ago).

[1] https://www.youtube.com/watch?v=hAW5DvLSkak

I’ve been tempted multiple times to try hacking my Di2 but it’ll be a costly mistake if it goes wrong…

A small style nit: I am surprised that a journal like the CACM (not a general audience publication) would think that common acronyms like JTAG, UART, and FIFO need be spelled out at first use.

I’m not the journal’s editor, so perhaps it is appropriate to assume the audience will be unfamiliar with the terms. But in that case merely expanding the acronym is mostly useless (e.g. a JTAG port is an extremely low level debugging interface and knowing the name of the standards body doesn’t help explain that).

I think that it's a standard writing device to always fully spell out acronyms in case someone who isn't familiar happens across the post.

It would be bad if someone who might enjoy the post or be inspired by it were to get frustrated or confused by an acronym and get pushed back from the field by it.

However "learning" that the JTAG port was named after its standards body doesn't teach such a reader anything at all.

Better always spell it at first use than never. I find this a mark of respect.

One of the things I love about the Economist is they do this. Also when mentioning companies: Tesla (a car company).

It also future-proofs your text a bit more.

Reading things like this make me wonder why the company did not hire someone like this person to check their code + hardware + processes first.

But sigh, doing the right thing that costs $ ahead of disaster is rare. Over time I've seen this too many times...

Is the device in question a Garmin?

Nice read :)