The question a teardown can answer "Does the OpenWrt One deliver GPL compliance?" is the wrong first question for a forensic auditor, because a source download page is a claim, not a finding. The device is a useful worked example precisely because it publishes more than most routers: a per-build source archive and a hardware how-to that documents serial, JTAG, and a NOR-based full recovery path. What a teardown can establish is narrower and more useful: whether the published artifacts map to the shipped firmware, whether the physical access needed to verify and exercise that firmware exists, and where the gaps are that a vendor must close. I treat the OpenWrt One here as a specimen for a repeatable audit method, not as a compliance verdict. The retrieved sources do…

The artwork is a ring of text around four smiling root vegetables. LET'S ROOT FOR EACH OTHER AND WATCH EACH OTHER GROW runs around the outside; inside sit a carrot, a radish, a beet, and an onion, each with a face and each with its roots drawn down into visible soil. The pun is doing two jobs at once. Root is what the vegetables do underground, and root is what a supporter does from the sidelines. The shirt asks the reader to hold both meanings at the same time. I want to take the design seriously as a piece of visual argument, because the two halves of the sentence are not saying the same kind of thing. The first half is a commitment: let us support one another. The second…

Editorial note: This publication and Quirky Cotton Collective share an owner. The notification banner is the first thing I see: a white rounded rectangle, a small bell glyph at the left, and the sentence There is motion at your front door set in a clean sans-serif. Below it, a circular frame holds a green-tinted view of an orange tabby pressed absurdly close to the lens, whiskers distorted, eyes wide, porch siding and a light fixture receding behind it. The whole composition is a doorbell-camera alert, rendered as a shirt graphic. The object is the There Is Motion At Your Front Door shirt, and the design is doing something more specific than repeating a meme phrase. I keep coming back to the banner. It is not a speech bubble. It is…

Editorial note: This publication and Quirky Cotton Collective share an owner. The garment preview shows a dark shirt with very small, centered lowercase meh. lettering. No animal illustration is present. That is the whole design. There is no diagram, no mascot, no secondary line of text, no gradient, no distressed texture. The period is there, and it is doing more work than the word. I want to read this closely, because the scale is not incidental. On a dark shirt, a few lowercase letters at that size do not function as a slogan. They function as a label. A slogan is addressed outward — it wants to be read across a room, it wants to start a conversation, it wants to be a position. This does not. At this scale,…

The printed artwork reads I WEAR THIS SHIRT PERIODICALLY, and beneath or beside that sentence sit four periodic-table-style tiles: 53 I, 74 W, 22 Ti, 16 S. The tile symbols are I W Ti S. They are not a literal spelling of the sentence above them. That gap is the whole design, and it is worth reading carefully rather than laughing past. Here is the obvious layer first. The sentence uses periodically in its ordinary adverbial sense: now and then, from time to time. The tiles use periodic in its chemistry sense: the periodic table, the arrangement of elements by atomic number. The shirt is a pun built on one word carrying two jobs. That much is visible on the garment and does not require a citation. The less obvious…

Editorial note: This publication and Quirky Cotton Collective share an owner. The composition notebook shirt is not a notebook. It is a printed rectangle that borrows the notebook's most recognizable features: a black-and-white speckled field, a dark binding strip down the left edge, and a white ruled label headed COMPOSITION. Inside that label, an outlined ghost and pumpkin sit where a student's name and subject would normally go. The design is a costume, but its real subject is the surface itself — the cheap, familiar object that generations of students have covered in equations, lab notes, and half-finished diagrams. That surface is worth reading closely. A composition notebook is not a premium object. It is glue-bound, usually 100 sheets, and sold in multipacks for less than the cost of a…

Editorial note: This publication and Quirky Cotton Collective share an owner. The graphic is almost aggressively plain. Across the chest, in white capitals, the words I HAD POTENTIAL sit above a curved ramp that descends from left to right. At the upper left, a dashed empty circle rests on a small ledge. At the lower right, a solid white ball sits on a flat ledge. The ramp is not a straight diagonal; it bows downward, like a slide or a shallow parabola. That curve is the whole joke, and it is worth reading closely. In physics, a ball on a curved ramp is a classic potential-energy diagram. The ball at the top has gravitational potential energy; as it rolls down, that potential converts to kinetic energy. The dashed circle at…

The Bananapi BPI-R3 showed up in a static bag marked "MT7986A 2GB DDR4." One of dozens of Filogic-based router boards now landing in consumer mesh kits, industrial gateways, and the white-label WiFi 6 access points cluttering Amazon under invented brand names. The vendor publishes a GPL tarball. Most buyers never open it. I did. I pulled the SPI flash over a physical clip, tried a byte-identical rebuild of the boot chain, and the tarball does not produce the binary on the chip. What follows is what I found, what the vendor left out, and why it violates GPLv2. The MT7986 Boot Chain as Evidence Before touching the flash, I mapped every component in the boot chain and classified it by license. The MT7986 SoC boots from an internal mask ROM…

Most of my working week is spent on the receiving end of other people's board decisions. On a recent Monday I clipped a Pomona 5250 onto the SOP-8 flash of a consumer router whose vendor had ignored a source request for seven months, read out 16 MiB over SPI with flashrom and a CH341A, and started comparing the extracted bootloader against upstream U-Boot tags. Every obstacle in that workflow — a shield can over the flash, unpopulated and undocumented UART pads, a WP# pin strapped hard to ground — was a schematic-level decision made years earlier, almost certainly without a thought given to GPL compliance. This guide is for the people who make those decisions, because they decide, months before firmware ships, whether a board can be audited at all.…

Firmware freedom, the way I use the term on this blog, is the practical ability to read the software off a device you own, rebuild it from source, fix it, update it, and share the result without asking a vendor for permission. It sits where right-to-repair advocacy, GPL compliance enforcement, and low-level hardware work — SPI, UART, SWD, JTAG — meet. Most of what I audit is Linux-based: consumer routers, Android TV boxes, single-board computers, industrial IoT gateways, and, increasingly, medical devices. For that class of hardware, firmware freedom is the precondition for durable repair. You can stock every capacitor and MOSFET on the planet, but when the failure is a bricked bootloader or a kernel that stopped getting CVE fixes years ago, spare parts alone won’t bring the device…