Posts with «announcements» label

Announcing Arduino’s Coordinated Vulnerability Disclosure Policy

A little less than a month ago, I joined Arduino as their Chief Information Security Officer. I’ve been in touch with the team for the past couple of months and feel incredibly lucky to be part of such a talented and driven group of people.

We’re working hard on developing a robust, well-rounded security program that fits our organisation and busy improving our security posture across all departments. I am a true believer that it all starts from introducing a strong culture of security awareness — where employees feel confident and empowered to take action against security issues.  

Today, I’m thrilled to announce the first release of Arduino’s Coordinated Vulnerability Disclosure (CVD) Policy.

We used some great references when putting it together and we’d like to give them a shout out here: HackerOne’s VDP guidelines, CEPS’ report on “Software Vulnerability Disclosure in Europe,” and the US DoJ Cyber Security unit’s VDP framework. We also took into consideration recent Senate testimony of experts in vulnerability disclosure in the role hackers can play in strengthening security, Dropbox’s announcement on protecting researchers and 18F’s own policy. I even wanted to publicly thank Amit Elazari Bar On, a doctoral law candidate (J.S.D.) at UC Berkeley School of Law and a Lecturer at UC Berkeley School of Information Master in Cybersecurity program for her useful advices and for providing the amazing “#legalbugbounty” standardisation project.

We’re also happy to announce that all of the text in our policy is a freely copyable template. We’ve done this because we’d like to see others take a similar approach. We’ve put some effort in to this across our teams and if you like what you see, please use it. Similarly, if you have improvements to suggest, we’d love to hear from you.

What is CVD?

Coordinated vulnerability disclosure (CVD) is a process aimed at mitigating/eradicating the potential negative impacts of vulnerabilities. It can be defined as “the process of gathering information from vulnerability finders, coordinating the sharing of that information between relevant stakeholders, and disclosing the existence of vulnerabilities and their mitigation to various stakeholders, including the public.”

Figure 1: Relationships among actors in the CVD process. Source: “The CERT Guide to Coordinated Vulnerability Disclosure,” Software Engineering Institute, Carnegie Mellon University

Why is it important for us?

At Arduino, we consider the security of our systems and products a top priority. No technology is perfect, and Arduino believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We want security researchers to feel comfortable reporting vulnerabilities they’ve discovered, as set out in this policy, so that we can fix them and keep our information safe.

If you believe you’ve found a security issue in our products or services, we encourage you to notify us. We welcome working with you to resolve the issue promptly.

This policy describes how to send us vulnerability reports and how long we ask security researchers to wait before publicly disclosing vulnerabilities.

Where can I find it?

A copy of the policy is published on our Vulnerability Disclosure Policy page. The official document lives in GitHub. If you would like to comment or suggest a change to the policy, please open a GitHub issue.

Thank you for helping keep Arduino and our users safe!

— Gianluca Varisco

Say hello to the next generation of Arduino boards!

We’re excited to kick off Maker Faire Bay Area by expanding our IoT lineup with two new boards: the MKR Vidor 4000 and the Uno WiFi Rev 2.

The MKR Vidor 4000 is the first-ever Arduino based on an FPGA chip, equipped with a SAM D21 microcontroller, a u-blox Nina W102 WiFi module, and an ECC508 crypto chip for secure connection to local networks and the Internet. MKR Vidor 4000 is the latest addition to the MKR family, designed for a wide range of IoT applications, with its distinctive form factor and substantial computational power for high performance. The board will be coupled with an innovative development environment, which aims to democratize and radically simplify access to the world of FPGAs.

“The new MKR Vidor 4000 will finally make FPGA accessible to makers and innovators,” said Massimo Banzi, Arduino co-founder. “And we are looking forward to changing the game yet again.”

“Maker Faire Bay Area is always an unparalleled opportunity to interact with the Arduino community and makers,” added Fabio Violante, Arduino CEO. “This year I’m extremely excited about the launch of the most flexible Arduino ever, the MKR Vidor 4000 and the development environment vision around it. With this new product we aim at putting in the hands of professionals, makers and educators the electronic equivalent of a resourceful Swiss Knife to bring their creativity to the next level. The applications are countless.”

Co-developed with Microchip, the Uno WiFi Rev 2 is built around the new ATmega4809, u-blox Nina W102 WiFi module, and an integrated IMU. The Uno WiFi will make it even easier to deploy products that need connectivity using the classic Arduino form factor, and is ideal for emerging IoT industries such as automotive, agriculture, consumer electronics, smart home, and wearables. Among its other features, the ATmega4809 provides 6KB of RAM, 48KB of Flash, three UARTS, Core Independent Peripherals (CIPs), and an integrated high-speed ADC. Combined with Microchip’s ECC608 crypto chip on the Uno board, the microcontroller also provides hardware-based security for connecting projects to the cloud including AWS and Google.

“As we grow, partner and invest, we will fuel the vast IoT and software markets across the industry,” said Banzi. “Inspiring the Arduino community with easy to deploy solutions that enable our users to have access to larger both flash and RAM memory for more demanding IoT projects.”

“Arduino aims at supporting professional developers, makers and educators during the entire lifecycle of IoT product development, from the initial learning phases to mass deployment,” noted Violante. “Being based on the popular AVR technology, but on steroids, and with an enhanced WiFi connectivity, the UNO WiFi Rev 2 is a big step forward for all users that want to leverage the vast ecosystem of shields and libraries available for the traditional UNO form factor, in connected use cases.”

Those heading to Maker Faire this weekend are invited to attend Massimo Banzi’s semi-annual ‘State of Arduino’ talk, where you can learn more about our latest developments including the MKR Vidor 4000, Uno WiFi Rev2, and our Arduino Day releases.

Both the MKR Vidor 4000 and Uno WiFi Rev2 will be available on the Arduino online store at the end of June.

You can now use Arduino to program Linux IoT devices

Today, at Embedded Linux Conference 2018, Arduino announced the expansion of the number of architectures supported by its Arduino Create platform for the development of IoT applications. With this new release, Arduino Create users can manage and program a wide range of popular Linux® single-board computers like the AAEON® UP² board, Raspberry Pi® and BeagleBone® as if they were regular Arduino boards. Multiple Arduino programs can run simultaneously on a Linux-based board and interact and communicate with each other, leveraging the capabilities provided by the new Arduino Connector. Moreover, IoT devices can be managed and updated remotely, independently from where they are located.

To further simplify the user journey, Arduino has also developed a novel out-of-the-box experience for Raspberry Pi and BeagleBone boards, in addition to Intel®  SBCs, which enables anyone to set up a new device from scratch via the cloud without any previous knowledge by following an intuitive web-based wizard. Arduino plans to continue enriching and expanding the set of features of Arduino Create in the coming months.

“With this release, Arduino extends its reach into edge computing, enabling anybody with Arduino programming experience to manage and develop complex multi-architecture IoT applications on gateways,” said Massimo Banzi, Arduino CTO. “This is an important step forward in democratizing access to the professional Internet of Things.”

“At Arduino we want to empower anyone to be an active player in the digital world. Being able to run Arduino code and manage connected Linux devices is an important step in this direction, especially for IoT applications that need more computing power, like AI and computer vision,” added Fabio Violante, Arduino CEO.

New search engine and Arduino reference!

The Arduino web team has working hard behind the scenes improving our legacy systems. Now, it’s time to work on something more interesting for the team and more useful for our community! From here on out, we will update you every month on the latest and greatest activities…

Today, we are announcing a pair of major features that are only a mere preview of what you can expect to see from an Arduino user’s point of view:

  • The blog has a new search engine that is much faster, more precise, and allows readers to filter results.
  • The Arduino reference is now quicker,  mobile-friendly, and completely open to contributions. You can check out our GitHub reference repo here.

Let’s look at how those two features work and how they are implemented. The search engine is powered by our provider Algolia, offering an impressively fast search engine and enhanced UX. Our goal is to integrate it with each of our websites and finally have a unified search for all Arduino-related content.

We are going to be testing the search engine for a bit on the blog and eventually roll it out to our websites.

Perhaps what we are most proud of, though, is the new reference engine:

  • Arduino users can directly contribute to the reference by creating a pull request here.
  • We are going to support multiple languages. In fact, some users have already helped us in creating French, German, Korean, Italian, Japanese, Portuguese, and Spanish versions.
  • As soon as a new pull request has been merged, the system deploys to our website automatically, and if someone modifies the English version of the reference, all other language repositories are going to be notified as well.

This is just the beginning with much more to come. Stay tuned!

Arduino Blog 14 Dec 16:28

Be among the first to try the Arduino IDE 1.9 Beta

Today we’re very excited (and a bit nervous) to announce the new development cycle of the Arduino IDE.

As you may have noticed, we’ve been continuously removing functionality from the Java package, and migrating them to a collection of external tools. We began this project by moving the build logic to arduino-builder, which now also powers the Arduino Create infrastructure.

We think that this split will keep the tools manageable, while giving a chance for third parties to integrate them into their products without the burden of a full-blown IDE.

Moreover, we are introducing another couple of tools:

One is arduino-cli, which we’ll uncover in the next few weeks as soon it comes out of pre-pre-alpha stage.

The other is arduino-preprocessor, which supersedes ctags in the sketch preprocessing phase. Moving to a different tool has been a necessary step for many reasons, the most important being the ctags’ limited parsing of complex C++ sketches.

arduino-preprocessor is based on libclang, statically compiled for zero dependencies execution; it uses clang’s superpowers to extract the prototypes we need, directly from the AST. As a (really nice) side effect, this engine can even be used for context-aware completion, probably the most required feature from the beginning of Arduino.

Since we’re unveiling such a big feature, it will surely impact the overall performance. To avoid keeping it out-of-tree for too long, we decided to open the beta branch.

This branch will be a playground for new ideas and implementations, including more collaborators with push powers. The branch has just been populated with all the IDE-related pull requests scheduled for the next release.

The beta branch is quite peculiar as well, because precompiled binaries generated from this branch will be available directly from the arduino.cc download page. We noticed that nightly (or hourly) builds are insufficient to spot a whole class of bugs, which may harm non-developers, users with non-latin charsets, and so on.

Being marked as experimental, the beta branch will not be ready for large-scale deployment (although it will probably be okay for everyday use); thus, we won’t provide a Windows exe or a signed OSX app. However, we hope that many people will test it and report bugs and impressions, so we can merge it safely into master in the near future.

A short curated list of the beta branch’s improvements over the latest 1.8.x IDE:

  • Initial support for autocompletion (activate it using CTRL+space)
    • Attention: Launching for the first time is quite slow and will freeze the UI. Don’t worry, simply wait for it to unstick.
  • Initial work on daemonized builder (using file watchers, will be able to spot if compilation can be avoided, partially or totally).
  • AVR core has been moved to its own repo.
  • Tabs are scrollable. 🙂
  • The serial monitor is html-aware and clickable (if steady).
  • Initial work on Library dependencies UI.
  • Initial work on Hi-DPI support on Linux.
  • Find/replace window is always on top of its own editor window.
  • Library/Board manager show buttons on mouseover.

Arduino announces Arm partnership

Dear Arduino Community,

Back in July, we announced that the original Arduino founders regained full control of Arduino as a company. It was the culmination of a project that lasted several months, which required a tremendous amount of effort in finding the right partner that could help us make it happen while keeping the spirit of Arduino true to itself.

Throughout the litigation we dreamed of reclaiming control of the company, bringing it back to its original principles while designing a strategy that would allow us to tackle the challenges of the contemporary IoT world.

In order to make his a reality, we needed a partner that would provide us with the resources to regain full ownership of Arduino as a company while keeping it independent and true to its values of openness.

It wasn’t easy, but more than a year ago, in the middle of the litigation, we started a conversation with an important technology company that is an essential building block of today’s digital world: Arm.

During a very hot day in spring I visited California to meet with Arm. It was a great meeting of minds and we determined that such a partnership was the right fit for us. Arm is an extremely innovative company whose processors can be found inside virtually every mobile device on the planet; but they don’t actually build silicon. Instead, they have created an ecosystem of a thousand-plus partners, some of whom compete with each other, but Arm works in harmony with all of them.

Arm recognized independence as a core value of Arduino. This was very important for us, as it meant full understanding of our need to work with multiple silicon vendors and architectures as long as they make sense for Arduino—without any lock-in with the Arm architecture.

Following the meeting with Arm, I was thrilled. I shared my excitement with our new CEO Fabio Violante and my cofounders: Arduino could again be 100% ours, with the help of a supportive partner that leaves complete autonomy to our team and our community.

We worked very hard for many months to make this happen, and Arm graciously agreed to support us to complete the operation.

What should you expect from us in the future? A stronger Arduino, free to innovate with more firepower, and plenty of enthusiasm for future challenges and opportunities.

We will continue to work with all technology vendors and architectures moving forward. We stay independent; we stay open, and we still provide the most loved microcontroller development platform that has changed the lives of so many people around the world.

Arduino IDE 1.8.5: Hotfix for macOS High Sierra Users

In case you haven’t noticed, our team has just released Arduino IDE 1.8.5This time the changelog is fairly small, as it mainly solves a (rather important) problem being encountered by macOS users who just updated to High Sierra (10.13).

If you are not using English as system language, any version of Arduino you launch will lack the menu in the system bar. Every Java application is experiencing the same problem, so it will probably be solved by Apple in the near future.

In the meantime, IDE 1.8.5 recognizes when the menu bar is not being displayed and replaces it with a Windows-style one. It may not be the prettiest thing, but at least it works!

If you want to recover the old menu bar while keeping the whole system in your normal language, you can issue a single command on Terminal:

defaults write cc.arduino.Arduino AppleLanguages '(en)'

 

Thank @AdrianBuza for the workaround. Issuing this command will make Arduino IDE in English, however you can still change the language under “Preferences” without losing the macOS integration.

Introducing the Arduino MKR WAN 1300 and MKR GSM 1400!

First unveiled over the weekend at World Maker Faire New York, Arduino has introduced a pair of new IoT boards with embedded LoRa and GSM capabilities.

The Arduino MKR WAN 1300 and MKR GSM 1400 are designed to offer a practical and cost-effective solution for developers, makers and enterprises, enabling them to quickly add connectivity to their projects and ease the development of battery-powered IoT edge applications.

Both of the highly compact boards measure just 67.64 x 25mm, together with low power consumption, making them an ideal choice for emerging battery-powered IoT edge devices in the MKR form factor for applications such as environmental monitoring, tracking, agriculture, energy monitoring and home automation.

Offering 32-bit computational power similar to the Arduino MKR ZERO board, the MKR WAN 1300 is based around the Murata LoRa low-power connectivity module and the Microchip SAM D21 microcontroller, which integrates an ARM Cortex-M0+ processor, 256KB Flash memory and 32KB SRAM. The board’s design includes the ability to be powered by either two 1.5V AA or AAA batteries or an external 5V input via the USB interface – with automatic switching between the two power sources.

In addition, the MKR WAN 1300 offers the usual rich set of I/O interfaces expected with an Arduino board, and ease of use via the Arduino IDE software environment for code development and programming. Other features  include an operating voltage of 3.3V; eight digital I/Os; 12 PWM outputs; and UART, SPI and I2C interfaces.

Like the MKR WAN 1300, the Arduino MKR GSM 1400 is based on the SAM D21, but integrates a u-blox module for global 3G communications. The board features automatic power switching, however, it uses either a 3.7V LiPo battery or an external Vin power source delivering 5V to 12V. While the USB port can also be used to supply 5V to the board, the MKR GSM 1400 is able to run with or without the battery connected.

The MKR GSM 1400 provides a rich set of I/O interfaces including: eight digital I/Os; 12 PWM outputs; UART, SPI and I2C interfaces; analog I/O including seven inputs and one output; and eight external interrupt pins.

Both boards are now available for pre-order on the Arduino Store.

A new era for Arduino begins today

BCMI, the company founded by Massimo Banzi, David Cuartielles, David Mellis and Tom Igoe, co-founders of Arduino, announces that today it has acquired 100% ownership of Arduino AG, the corporation which owns all of the Arduino trademarks.

Following the acquisition, Mr. Massimo Banzi becomes the new Chairman and CTO of Arduino. Dr. Fabio Violante will be appointed as the new CEO, replacing Mr. Federico Musto who will pursue other opportunities outside Arduino AG.

“This is the beginning of a new era for Arduino in which we will strengthen and renew our commitment to open source hardware and software, while in parallel setting the company on a sound financial course of sustainable growth. Our vision remains to continue to enable anybody to innovate with electronics for a long time to come,” said Mr Banzi.

“I’m really excited and honoured to join Massimo, the co-founders and the amazing Arduino team as CEO. In the past two years we have worked very hard to get to this point. We envision a future in which Arduino will apply its winning recipe to democratize the Internet of Things for individuals, educators, professionals and businesses,” said Dr. Violante.

Arduino Blog 28 Jul 18:01

New IDE for all Arduino boards!

Following the announcement at this year’s World Maker Faire, we’re excited to reveal the release of Arduino IDE 1.8.0—the new official desktop editor for all Arduino boards, both .org and .cc alike.

This should come as great news to the entire Arduino community, representing a key milestone in our journey moving forward.

You will now be able to use the desktop IDE 1.8.0 when working with any Arduino board from .org or .cc family. The latest and greatest unified Arduino Software can be downloaded here.

Arduino IDE 1.8.0 works out of the box with AVR boards, like the Uno, Mega, Yun, and Micro, among the most popular. Additionally, it supports the Leonardo Ethernet, Yun Mini, Industrial 101, and Uno WiFi.

The updated SAMD core will provide support for the M0, M0 PRO, and Tian, completing the product line that includes the Zero, MKR1000, and the newly-launched Primo and MKRZero.

More tech notes: You can run the IDE on Linux directly in command line, no longer requiring the X11 display. Also on the Arduino Builder paths with strange UTF8 chars are now correctly handled.

Release after release, the community continues to play an integral role in our development. Be sure to check the entire revision log for a complete list of changes and credits. As always, don’t forget to report any issues you may find, either on the Arduino Forum or by writing to support@arduino.cc and support@arduino.org. Your help is very much appreciated. And while in the holiday giving spirit, please consider supporting the Arduino Software by contributing to its progress!

A special thanks to all developers and management team for their efforts in making this big step forward. Happy Holidays!