The Locked Bike: How Echelon's Firmware Update Kills Ownership and Third-Party Innovation

For five years, QZ (qdomyos-zwift) stood as a beacon of user freedom in the often-walled garden of fitness hardware. Created by developer Roberto Viola in 2020, the open-source app solved a critical pain point: expensive Echelon bikes, treadmills, and rowers were locked into the company's proprietary ecosystem. QZ acted as a crucial bridge, enabling these devices to communicate seamlessly with popular third-party platforms like Zwift, Peloton, and Kinomap, often delivering a better experience than the official integrations.

"QZ started by adding compatibility with Echelon bikes. But I didn’t stop there," Viola writes. "I added auto-resistance, letting users enjoy full integration with Zwift or Peloton—sometimes with a smoother experience than Peloton Bike+ itself." This innovation wasn't just a hobbyist project; it demonstrably boosted Echelon's sales, with Viola himself becoming an advocate for their hardware precisely because QZ unlocked its potential.

The Brick Wall: Mandatory Cloud Authentication Arrives

That mutually beneficial relationship shattered abruptly in July 2025. Echelon deployed a seemingly routine firmware update with a devastating hidden feature: a mandatory server authentication system. This wasn't an enhancement; it was a lockdown.

Here's the technical breakdown of the new system:
1. Boot-Time Handshake: On startup, the device must connect to Echelon's servers and authenticate.
2. Rotating Key: The server sends back a temporary, rotating unlock key.
3. Bricked Without It: Without this successful handshake, the device is completely non-functional. No manual workout mode. No Bluetooth pairing. Nothing.

This architecture creates severe, user-hostile consequences:

• No Internet, No Workout: Basic offline functionality is eliminated. A dropped connection or ISP outage renders your expensive equipment useless.
• Server Shutdown = Hardware Death: If Echelon ever ceases operations or sunsets the service (a common occurrence in tech), the device becomes a permanent brick.
• Third-Party App Blockade: Apps like QZ are completely cut off. The device refuses to communicate locally unless explicitly permitted by Echelon's servers.

"QZ was built to give users freedom and compatibility," Viola states. "This new system gives them dependence and risk."

A Wider IoT Crisis: When the Cloud Swallows Your Hardware

Echelon's move is a stark, high-profile example of a pervasive problem plaguing the Internet of Things (IoT): the deliberate design of hardware that becomes useless without constant vendor cloud dependency. Viola points to a grim roster of precedents:

• Hive (UK): Smart cameras and sirens will cease functioning in August 2025 due to backend shutdowns.
• Insteon (US): Smart home hubs went dark overnight in 2022, leaving users stranded.
• VanMoof: Bankrupt smart bikes were bricked, losing remote unlock and tracking features.
• Google Android Things: The flagship IoT platform was quietly deprecated and shut down by 2022.

These cases underscore a fundamental betrayal of consumer trust and the concept of ownership. Purchasing expensive hardware should not come with an invisible expiration date tied to the vendor's financial health or strategic whims.

A Modest Request and a Stark Warning

Viola isn't asking Echelon for open-source code or deep system access. His request is a matter of basic user rights and responsible product design: Implement a local fallback mechanism. Allow the device to send encrypted data locally, enabling basic functionality even without an internet connection. This preserves user control and prevents the device from becoming landfill fodder if Echelon's servers vanish.

Crucially, Viola issues an urgent warning to existing Echelon users:

⚠️ Do Not Update Your Firmware!

If your Echelon bike, rower, or treadmill still works with QZ:

• AVOID ALL FIRMWARE UPDATES.
• DISABLE AUTOMATIC UPDATES.
• STAY ALERT.

The recent updates introduce a non-reversible lockout system. Once installed, your device will require constant internet, refuse to work without server validation, and block third-party apps forever. There is no rollback.

The Ownership Imperative

Viola built QZ with passion, empowering users to maximize their hardware investment and fostering an open fitness ecosystem. Echelon's new path represents the antithesis: transforming purchased hardware into a subscription-less service, dependent on a corporate lifeline. As Viola, an Italian craftsman at heart, poignantly argues: beautiful, functional things must last, and they must genuinely be yours. This firmware lockout isn't just a blow to QZ; it's a stark reminder of the precarious future of consumer hardware in an increasingly cloud-dependent, vendor-locked world. The fight for the right to truly own and control the devices we buy is far from over.

Source: Roberto Viola - How I Built QZ and How Echelon is Now Breaking It