A quick look at the Ikea Trådfri lighting platform
I dont get everyones gripe about the lack of HTTPS as long as there&#x27;s firmware signing.<p>HTTPS as a protocol ages extremely fast, trust anchors always change, and there&#x27;s no guarantee that today&#x27;s state of the art won&#x27;t be completely incompatible with TLS implementations in 5 years.<p>For HTTPS to work properly on an embedded device, it needs to have an up to date OpenSSL library and updated certificate anchors. These are always packed as part of the firmware image itself, so any update to certificate anchors or OpenSSL would require an entire new image to be deployed.<p>This isn&#x27;t a problem for websites because updating is usually as simple as apt-get upgrade, but this is a massive problem for embedded devices because publishing a new firmware image usually means pumping a few hundred hours of QA time into the image, then back and forthing with your manufacturer to get them to use the new image on newly minted units.<p>This isn&#x27;t even considering the changes in OpenSSL over time. Many older routers simply cannot use HTTPS for updates because newer versions of OpenSSL simply won&#x27;t fit on the flash.<p>Then there&#x27;s the question of how end-of-life will be handled. People often use products long after they&#x27;ve gone EOL. You have to ask yourself what happens when someone plugs in a lighting unit that has an old firmware version on it, and the unit can&#x27;t communicate with the update server because the product was EOL&#x27;d 5 years ago. There won&#x27;t be a transition firmware for such an old product, and the people who know how to roll the firmware images probably don&#x27;t even work there any more. That user is now SOL unless you have a method for manually updating firmware.