See my thread, but answering "no periodic checks, no http stack, no SSL implementation, no http authentication" here: - having a constant connection isn't the best either. I feel like having a "once every 24h" check for new firmware should be sufficient and less costly. If there is already an MQTT connection, then getting a "there is new firmware for you" message which then uses HTTP to download would get rid of the delay. - the http stack is imho, much nicer than MQTT. I'm really not a fan of MQTT. - SSL isn't a requirement, but probably a good idea. If you have already an SSL MQTT connection then you could get the hash from there and then run the checksum over the data that you received via HTTP. - that's an interesting one. Artemis doesn't actually do any http authentication. It lets any device download firmware. Devices request firmware for their device UUID, so you could argue that the UUID serves as authentication token. Given an HTTPS connection that's even reasonable (since nobody can sniff that UUID).