Concept: Humanly Slate, an e-ink reader with open firmware
A sketch of a paperback-size e-ink reader with physical page buttons, weeks of battery and open firmware you can build, sign with your own key and flash over USB.
The Humanly Slate is a concept for an e-ink reader with open firmware: a paperback-size reading tablet that belongs to the person holding it. It has a warm front light, two physical page buttons and a battery that lasts weeks. It has no store and no account. The firmware is documented, you can build it yourself, and the only key the bootloader trusts is one you enrolled.
Like the Humanly Phone, this is a concept. We are a software studio, nothing here is for sale, and every number on this page is an estimate from public parts and teardowns rather than a prototype. We drew it because e-readers are one of the few devices where the hardware is already calm and the software is the part that gets in the way.
What it is for
Most e-readers are good at reading and quietly good at selling. The home screen shows recommendations, the lock screen sometimes shows adverts, and the books you bought live inside an account that can change its terms. None of that is evil. It is simply what happens when the device is a storefront with a screen attached.
The Slate starts from files. You copy EPUB, PDF or plain text onto it over USB-C or a microSD card, and it shows them in a list. Reading position, highlights and notes are stored as small text files next to the book, so they survive a firmware change and you can read them on a computer. There is no sync service because there is nothing to sync to. If you want your notes somewhere else, you plug in a cable.
- Screen. A 6 inch e-ink panel at around 300 pixels per inch, with a front light that mixes cool and warm LEDs so you can read in bed without a blue glare.
- Buttons. Two page-turn buttons on a wider right-hand bezel, plus power. Touch is there for menus, but you never need it to read.
- Storage. Internal flash for the firmware and a few hundred books, and a microSD slot for everything else.
- Radios. Wi-Fi and Bluetooth LE, both off by default. A switch in settings turns them on, and the status line tells you when they are.
Why open firmware matters
Firmware is the software that makes the hardware a product. On most consumer devices it is closed, updated on the maker's schedule, and it decides what the device will and will not do. When the company loses interest, the device slowly stops being useful, even though the screen and the battery are fine.
There is already a small hobbyist scene around open-firmware e-readers, where people flash community-built software onto cheap reading hardware and get something that feels more personal than the original. We like that energy. The Slate is what it could look like if the openness were designed in from the start instead of discovered by people with a soldering iron.
Open here means a few concrete things. The source for the firmware is published. There is a documented SDK with a display driver, a text layout engine, button and touch input, and a storage API. A small app model lets the community write things that are not reading at all: an RSS reader that fetches once a day and then turns Wi-Fi off, a notes app for plain text, a calendar that shows the week on one screen. And the update path is yours. Nobody can push a change to your reader that you did not build or choose to accept.
That last point is the one that changes how the device ages. A reader with open firmware can outlive its maker. If the file format of the year changes, or a better hyphenation library appears, somebody can add it. If a feature arrives that you dislike, you can stay on the version you have.
Verified boot you control
Open firmware has a security problem that is easy to wave away and should not be. If anyone can write new firmware, then anyone with a few minutes and your reader can write new firmware too. A modified image could copy your notes, log what you read, or quietly turn on Wi-Fi. For most people that risk is small. For some, such as journalists or people reading things their government dislikes, it is the whole question.
The usual answer is verified boot: a small, trusted bootloader checks a cryptographic signature on the firmware before running it. Closed devices use it to make sure only the manufacturer's code runs. The Slate uses the same mechanism, but the key belongs to the owner. A few Android phones already allow something similar, where the owner can enroll their own key for a custom operating system, and it is a good model.
The flow in the diagram is deliberately plain.
- Enroll once. On day one you send your public key over USB. The Slate asks for a long press on both page buttons to confirm, so a cable alone can never change the trusted key.
- Build. You build the firmware from source, or download a community build and check its signature before re-signing it yourself.
- Sign. You sign the image with your private key, which stays on your computer or a hardware security key.
- Flash. Holding both page buttons while powering on enters flash mode. The bootloader receives the image, checks the signature against your enrolled key and writes it to the inactive slot.
- Boot or refuse. A valid image boots from the new slot, and the old slot stays as a fallback until the new one has started cleanly. An invalid image is refused and nothing is written.
There are real trade-offs in that design, and we would rather name them than hide them.
Losing your key. If you lose the private key, you cannot sign new firmware. The Slate would allow a key reset, but only with physical presence and only by wiping your data first. That protects your notes from someone who borrows the device, and it means a lost key costs you a reinstall, not the hardware.
Rollback. Verified boot on its own does not stop someone from flashing an older signed image with a known bug. A rollback counter in the bootloader fixes that, but it also stops you from going back to a version you preferred. We would make rollback protection an option the owner turns on, with the default off, because on a reading device the ability to go back matters more to most people than the attack it prevents.
The bootloader itself. Everything depends on the first piece of code being honest. It should be tiny, read-only after manufacture, and published, so that anyone can check it matches the source. If it has a bug, the fix is a new batch of hardware, which is exactly why it has to be small enough to read in an afternoon.
A visible warning. Every boot shows the fingerprint of the enrolled key for a second. It is a small thing, but it means a swapped key cannot hide.
Inside the case
E-ink is kind to hardware design. The panel only draws power while the image changes, so the device can sleep almost all of the time. The chip that runs it does not need to be fast. It needs to wake quickly, lay out a page of text and go back to sleep. A low-power chip with Wi-Fi and Bluetooth built in is enough, and it keeps the board small.
The layers could add up like this. The front light is a thin light guide with LEDs along one edge. Under it sits the e-ink panel, then a metal frame that stops the whole thing flexing in a bag. The board and the cell sit side by side in the thickest layer. The back carries the flex cable for the page buttons.
The battery is where e-ink shines. With the radios off, the front light at a moderate level and an hour of reading a day, our rough estimate is four to six weeks between charges. Most of that energy goes to the light, not the screen. We will work through the arithmetic properly in a later post on power budgets, because the same method applies to phones and watches too.
Spec sheet, on paper
| Size | 112 × 158 × 7.5 mm (estimate) |
|---|---|
| Screen | 6 inch e-ink, about 300 PPI, warm and cool front light |
| Controls | Two physical page buttons, power, touch for menus |
| Storage | Internal flash plus microSD |
| Formats | EPUB, PDF and plain text; more through community apps |
| Battery | About 1,500 mAh, four to six weeks at an hour a day (estimate) |
| Connections | USB-C, Wi-Fi and Bluetooth LE (both off by default) |
| Software | Open firmware, documented SDK, owner-signed verified boot, no store, no account |
What we are unsure about
Buying books. Many ebooks are sold with DRM that ties them to a specific store and device. The Slate would not support that, so it suits people who buy DRM-free books, read public-domain classics, or mostly read documents. That is a real limit on who it is for.
PDF. A 6 inch screen is a poor place to read an A4 PDF. Reflowing PDFs is hard and never perfect. A larger panel would help and would cost battery, size and money.
Support. Open firmware means some owners will flash something broken. The A/B slots and the recovery mode help, but a device that invites tinkering also invites support email. We think that is a fair price for a reader that can still be improved in ten years.
If you would carry something like this, or you know the hobbyist firmware world better than we do and think we have the security model wrong, tell us on the contact page. The bootloader design in particular is the part we would most like someone to argue with.