Somewhere along the way, "buying" a device stopped meaning what it used to mean. You pay for hardware. The manufacturer keeps the firmware, the keys, the parts supply chain, and the right to brick the thing they sold you. When the company decides your device is end-of-life — or when keeping it alive doesn't generate enough recurring revenue — the thing on your shelf becomes e-waste. People who never had a say in any of this end up paying for replacements they didn't need.
It's worth being specific about the patterns this has produced:
- Cloud-dependent products bricked by their manufacturers. Insteon shut down its servers in 2022 and bricked every customer's smart-home hub overnight. Spotify's Car Thing was disabled by a firmware update in 2024. Revolv smart hubs were killed by Google in 2016. Each time, customers who paid full price discovered they were renting hardware they thought they owned.
- Software locks and parts pairing. Replacement parts that won't function unless authenticated against the manufacturer's servers. Independent repair shops shut out of servicing products they used to fix. Repair documentation locked behind dealer-only portals.
- Firmware updates that remove features. What you paid for at the store isn't what you have on the shelf six months later. Sometimes the change is security-driven; often it's a business decision.
- Subscription stacks bolted onto hardware purchases. What used to be a product becomes a service contract — the device works as long as you keep paying, and the moment you stop, the hardware loses functionality you already paid for.
None of this is theoretical. Most people reading this have had it happen to them or know someone who has.
The pushback against all of this is the right-to-repair movement — a coalition of consumer advocates, independent repair shops, environmental groups, and ordinary people who think "I bought it, I own it" should still be a defensible position.
Some of what's happening right now:
- FULU Foundation. Founded in 2023 by Louis Rossmann and Eron Jokipii, FULU runs a $100,000 bounty program that pays coders and reverse-engineers to restore functionality on products manufacturers have abandoned or remotely disabled. Targets so far include Google Nest, Xbox, and other devices where the original owner's access has been deliberately removed. The foundation works on three fronts at once: legislative advocacy, public education, and direct legal action.
- EU Right to Repair Directive. Directive (EU) 2024/1799 was adopted by the European Parliament on 13 June 2024 and published in the Official Journal on 10 July 2024. EU member states have until 31 July 2026 to transpose it into national law. Manufacturers must make spare parts available to professional repairers — and to consumers directly for certain key parts like batteries and displays — for 5 to 10 years after a model is discontinued, with the exact duration depending on the product category and the applicable Ecodesign regulation. Repairs must be performed within a reasonable time-frame at a reasonable price; manufacturers must publish repair-service pricing. A related Ecodesign update added repairability and durability scores to energy labels for smartphones and tablets starting June 2025.
- United Kingdom. Outside the EU since Brexit, but with its own framework: the UK Ecodesign for Energy-Related Products and Energy Information Regulations came into force on 1 July 2021. Spare-parts availability for in-scope household appliances (washing machines, refrigerators, dishwashers, televisions) is mandated for 7 to 10 years after model discontinuation, with most parts available only to professional repairers. The UK rules do not cover laptops, tablets, or smartphones — a notable gap compared to the EU directive that consumer-advocacy groups have been pushing the UK government to address.
- US state legislation. Six states have passed comprehensive consumer-electronics right-to-repair laws to date: California (signed October 2023), New York (effective July 2023), Minnesota's Digital Fair Repair Act (effective July 2024), Colorado's HB 24-1121 (signed May 2024), Washington, and Oregon's SB 1596 (signed March 2024, effective January 1, 2025). Oregon's law is notable as the first US state law to explicitly ban parts pairing — the practice that makes replacement parts useless without manufacturer authentication. Per iFixit's legislative tracking, all 50 states have now introduced right-to-repair legislation in some form, with active bills in dozens of state legislatures.
- Repair Cafes. Over 2,500 Repair Cafes operate globally — community-run spaces where volunteers and visitors fix things together. Not a product launch, not a startup, not a foundation. Just people deciding that throwing things away isn't the only option and showing up regularly to prove it.
None of this fixes the closed-device problem on its own. Each piece chips at it from a different angle.
It would be easy to dismiss the open-versus-closed argument as ideology. The past few years have provided enough specific data points that it doesn't have to be.
- XZ Utils backdoor (CVE-2024-3094, March 2024). A multi-year supply-chain attack — planted via slow trust-building commits over almost three years — was caught by a single Microsoft engineer (Andres Freund) who was investigating a slightly-slower-than-expected SSH login. He was able to find the backdoor because he could read the source. The compromise would have given the attacker SSH root access to a vast portion of internet-connected Linux systems. Distributions patched within days; the Open Source Security Foundation coordinated the response across the ecosystem. The equivalent vulnerability in a closed proprietary stack would likely have shipped quietly to customers and stayed there for years.
- Log4Shell (CVE-2021-44228, December 2021). A serious bug. The fix landed within hours of disclosure because thousands of community contributors and downstream maintainers all had the source. Customers running open-source stacks could verify the patch was actually applied. Customers running closed-source products had to trust vendor statements.
- The Linux kernel, OpenSSH, OpenSSL, nftables. Each handles security-critical workloads at internet scale. Each is continuously audited by paid security firms, volunteer researchers, academic teams, and downstream distributions. The history of severe bugs is real — and so is the history of fast, transparent fixes customers can independently verify.
- CrowdSec's community defense model (2020-present). A more recent example, and one of the more interesting ones, because the open posture isn't just about audit — it's structural. CrowdSec is open-source threat-detection software where the user community contributes anonymized attack data and gets a real-time, machine-tailored blocklist in return. The engine, the parsers, the scenario library on the CrowdSec Hub — every part is open and auditable. Tens of thousands of devices participate. The result is a continuously-updated threat-intelligence feed that compares favourably to commercial feeds sold at four-to-five-figure annual subscriptions. The Defend-O-Tron's threat-intelligence layer is built directly on this.
- Broadcom's VMware acquisition (2023-2025). After acquiring VMware in late 2023, Broadcom raised license costs by 800–1,500% for many customers. Small businesses saw 350-450% increases due to a new 72-core minimum license — a single 8-core server now requires licensing for 72 cores. Perpetual licenses were discontinued. Authorized cloud service providers were reduced from over 4,500 to roughly 13 by mid-2025. Gartner forecasts 35% of VMware workloads will migrate to alternatives by 2028. Customers who built their virtualization strategy around VMware had no leverage when the bill changed.
- Insteon (April 2022). The company shut down its cloud servers without notice, bricking every customer's smart-home hub overnight. Tens of thousands of paying customers discovered the hardware they owned was useless because the cloud service it depended on no longer existed. A subsequent community-funded revival partially restored service; many of the original devices stayed dead.
- Spotify Car Thing (2024). Released as a $90 hardware product in 2022, disabled by firmware update in 2024. Customers received refunds. The hardware cannot be repurposed because the firmware is closed and the device authenticates against Spotify's servers — it works on no one's network anymore.
- Cisco Meraki. Documented by multiple market analyses: every Meraki hardware component requires a cloud license or it will not function properly. The hardware you paid for stops working when the recurring license check fails or the subscription lapses.
- John Deere tractors. Years of well-documented parts-pairing and software-lockout issues — replacement parts that will not function until authenticated by a dealer technician. The catalyst for much of the original US right-to-repair lobbying.
The pattern is consistent enough to predict. Closed devices and subscription stacks work fine — as long as the vendor's business model continues to align with the customer's interests. The day it stops aligning (corporate sale, market repositioning, an upstream vendor demanding margin), there is no recourse and no parallel ecosystem to switch to.
Open projects are not immune to disruption. Maintainers burn out, foundations close, projects fork badly. But the failure modes don't include "your hardware stopped working because someone in another company changed their pricing strategy."
We're a small project. We can't fund a $100K bounty program. We can't lobby legislatures. What we can do is build a device that doesn't add to the problem.
Concretely, that means:
- The hardware schematics are published. Board layout, pinouts, bill of materials — see the Open Hardware page. If you want to know what's inside, look. If you want to repair it yourself or build a derivative, you have what you need.
- The firmware is built on open-source components. Armbian, Debian, CrowdSec, Suricata, AdGuard Home, Cockpit, Grafana — open projects audited by their communities. If you don't trust us, you can fork. If you don't trust them, you can audit.
- No cloud kill switch. The device works without contacting our servers. Updates and telemetry endpoints exist and you can use them, but the appliance's core protection function does not depend on any cloud service we operate. If our company stopped existing tomorrow, your Defend-O-Tron keeps working.
- No DRM, no parts pairing, no software locks. The NVMe storage is a standard part you can replace. The bootloader is reflashable. The MASK ROM button means you can recover from any state we couldn't anticipate — including, if it ever comes to it, recovering from us.
- No subscription required to keep it running. Every capability the device ships with stays available for the life of the hardware. No renewal calendar, no expiry, no "your IDS signature subscription has lapsed" notices.
- Documented end-of-life behaviour. When this hardware reaches end-of-support, we'll publish the final firmware unencrypted along with everything else needed to keep the device running independently. That's a commitment, not a marketing line — and it's only credible because the rest of the list above is already true.
Worth being honest about: someone has to design the boards, write the integration code, run the build infrastructure, maintain the firmware, answer support tickets, and pay for warehouse space. The Defend-O-Tron is sold as a product because that's the model that lets us keep doing all of that.
What "open" means in our case is that the relationship between you and the device doesn't have hidden levers. You pay for hardware once. You get the appliance, the documentation, the recovery paths, and the right to keep using it without our involvement if you want to. That's the deal.
Beyond shipping the device, the project tries to contribute back to the open-source ecosystem it relies on:
- CrowdSec community. Every Defend-O-Tron contributes anonymized attack data back to the global CrowdSec community blocklist. The fleet is a node in the community, not a one-way consumer. CrowdSec themselves operate one of the more notable contemporary examples of open-source security working at scale — the engine, the rules hub, and the community CTI portal are all open and free to use, with a paid tier for organizations that need commercial support. That's a model the Defend-O-Tron benefits from and tries to be a good citizen within.
- Upstream projects we depend on. Bug reports, occasional patches, and (where it makes sense) code contributions to Armbian, CrowdSec, Suricata, and adjacent projects.
- Public documentation. The wiki you're reading. The packaging source. The boot-flag reference. The audit-evidence schema. Operators of the device should not have to reverse-engineer anything we ship.
This is small-scale stuff. It's not going to fix the broader closed-device problem on its own. But every project that ships open is one fewer project shipping the alternative — and that compounds over time, in roughly the same way that the closed-device pattern compounded into the mess we have now.
If you found this page because you care about this — thanks for paying attention. The companies that benefit from the closed-device model are betting that nobody does.
- Open Hardware — schematics, pinouts, bill of materials, and the upstream NanoPi R5s reference design.
- Why Defend-O-Tron — the home-page summary of how this device fits the SMB security market.