Skip to the content
COREDUMP #006: Pebble’s Code is Free: Three Former Pebble Engineers Discuss Why It's Important (PART 2/2)
Chapters
-
| Episode Teasers & Welcome
-
| Why Pebble’s Firmware Was Open (and Unsigned)
-
| The Security Tradeoffs That Enabled Speed
-
| The OTA Bug That Could Have Bricked Everything
-
| Hacking Our Way Out with BLE Stack Overflow
-
| Lessons Learned: Test Automation & Static Analysis
-
| CloudPebble, Watchface Generator & Developer Tools
-
| Backporting Pebble 3.0 to Legacy Hardware
-
| The Bootloader Rewrite & Other Wild Optimizations
-
| Simulators, Robot Arms & Debugging in CI
-
| Firmware Signing, Anti-Rollback & Secure Updates
-
| Coding in Rust? What We’d Do Differently Today
-
| Where to Start with Open Source Pebble Development
Listen to the Podcast
About the webinar
In today’s Coredump Session, the team reunites to unpack the behind-the-scenes lessons from their time building firmware at Pebble. This episode dives into the risks, decisions, and sheer grit behind a near-disastrous OTA update—and the ingenious hack that saved a million smartwatches. It’s a candid look at the intersection of rapid development, firmware stability, and real-world consequences.
Key Takeaways:
- Pebble’s open approach to developer access often came at the cost of security best practices, reflecting early startup trade-offs.
- A critical OTA update bug almost bricked Pebble devices—but the team recovered using a clever BLE-based stack hack.
- Lack of formal security measures at the time (e.g., unsigned firmware) unintentionally enabled recovery from a serious update failure.
- Static analysis and test automation became top priorities following the OTA scare to prevent repeat incidents.
- The story reveals how firmware constraints (like code size and inline functions) can lead to high-stakes bugs.
- Investing in robust release processes—including version-to-version OTA testing—proved vital.
- Real security risks included impersonation on e-commerce platforms and potential ransom via malicious OTA compromise.
- The importance of “hiring your hackers” was humorously noted as a de facto security strategy.
Speakers
Co-Founder and Head of Engineering, Beeper
Brad Murray
CEO & Founder, Memfault
François Baldassari
