In today’s Coredump Session, the team reunites to unpack the behind-the-scenes lessons from their time building firmware at Pebble. This episode dives into the risks, decisions, and sheer grit behind a near-disastrous OTA update—and the ingenious hack that saved a million smartwatches. It’s a candid look at the intersection of rapid development, firmware stability, and real-world consequences.
Key Takeaways:
- Pebble’s open approach to developer access often came at the cost of security best practices, reflecting early startup trade-offs.
- A critical OTA update bug almost bricked Pebble devices—but the team recovered using a clever BLE-based stack hack.
- Lack of formal security measures at the time (e.g., unsigned firmware) unintentionally enabled recovery from a serious update failure.
- Static analysis and test automation became top priorities following the OTA scare to prevent repeat incidents.
- The story reveals how firmware constraints (like code size and inline functions) can lead to high-stakes bugs.
- Investing in robust release processes—including version-to-version OTA testing—proved vital.
- Real security risks included impersonation on e-commerce platforms and potential ransom via malicious OTA compromise.
- The importance of "hiring your hackers" was humorously noted as a de facto security strategy.
Chapters:
00:00 Episode Teasers & Welcome
01:22 Why Pebble’s Firmware Was Open (and Unsigned)
05:01 The Security Tradeoffs That Enabled Speed
11:00 The OTA Bug That Could Have Bricked Everything
15:26 Hacking Our Way Out with BLE Stack Overflow
17:47 Lessons Learned: Test Automation & Static Analysis
26:30 How Pebble Built a Developer Ecosystem
29:56 CloudPebble, Watchface Generator & Developer Tools
42:55 Backporting Pebble 3.0 to Legacy Hardware
49:02 The Bootloader Rewrite & Other Wild Optimizations
53:31 Simulators, Robot Arms & Debugging in CI56:40 Firmware Signing, Anti-Rollback & Secure Update
1:06:10 Coding in Rust? What We’d Do Differently Today
1:08:28 Where to Start with Open Source Pebble Development
Follow Memfault
Other ways to listen:
Popular Podcasts
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
New Heights with Jason & Travis Kelce
Football’s funniest family duo — Jason Kelce of the Philadelphia Eagles and Travis Kelce of the Kansas City Chiefs — team up to provide next-level access to life in the league as it unfolds. The two brothers and Super Bowl champions drop weekly insights about the weekly slate of games and share their INSIDE perspectives on trending NFL news and sports headlines. They also endlessly rag on each other as brothers do, chat the latest in pop culture and welcome some very popular and well-known friends to chat with them. Check out new episodes every Wednesday. Follow New Heights on the Wondery App, YouTube or wherever you get your podcasts. You can listen to new episodes early and ad-free, and get exclusive content on Wondery+. Join Wondery+ in the Wondery App, Apple Podcasts or Spotify. And join our new membership for a unique fan experience by going to the New Heights YouTube channel now!