Eclipse Paho 1.1.0 Release Review

End Date of the Review Period

Reviews run for a minimum of one week. The outcome of the review is decided on this date. This is the last day to make comments or ask questions about this review.




There are three new components in this release:

1) an Android Service based on the Paho Java MQTT client library, which sends and receives messages on behalf of an Android client application when the application's main Activity may not be running.

2) MQTT and MQTT-SN client libraries in C for embedded devices with limited resources - for instance mbed and Arduino microcontrollers.

3) An MQTT client for .Net and WinRT, written in C#

along with updated (bug-fixed) versions of the existing components: MQTT client libraries for Java, C/C++, Python and JavaScript.

API Certification

The project leadership certifies that the APIs in this release are "Eclipse Quality".

Architectural Issues

Paho is different to many other Eclipse projects in that each component is a completely separate entity, with no relation to the others except that they all focus on MQTT.    Most of the components are APIs for a specific language or runtime environment.  The MQTT specification governs the protocol between clients and servers, and says nothing about what APIs that implement the protocol should look like.  We could try and make the APIs look as similar to each other as possible, or instead let them be tailored for or native to, the particular environment they are running in.   We are taking the latter approach, to allow the APIs to be comfortable to the developers in the language or environment they are targeted at.

So in this release we have three new components, targeted at .Net and WinRT, Android and embedded microcontrollers.  The .Net client is entirely separate code, written in C#.   The Android service is a wrapper around the existing Java client.  The embedded C APIs are entirely new code, separate from the existing C client, which is too tied to Windows and Linux to be a good starting point.

Security Issues

MQTT uses TCP as its underlying transport.  Each of the APIs allows the TCP connection to be secured with TLS/SSL using the facilities available on that  platform.  For example:

  • Java - JDK standard TLS/SSL libraries
  • .Net framework standard TLS/SSL libraries
  • Python built-in TLS/SSL libraries
  • C - OpenSSL
  • Embedded C - no TLS support included, but supports the use of any TLS library

No TLS/SSL support is directly included in the Paho components, they use what is available in the external environment.  That external environment needs to be updated with recent TLS software to ensure TLS vulnerability fixes are included.

Non-Code Aspects

The Paho web pages have been updated to have a separate getting started page for each component:   Links to articles, the project plan and wiki have been added.

All of the APIs have samples demonstrating the use of the API and reference documentation in a form suitable for that language (JavaDoc, Doxygen, etc).

The community website has been updated with links to all the Paho components.


Usability Details

Each of the APIs in any of the languages has a similar look and feel, with one operation for each of the MQTT commands, connect, subscribe, unsubscribe, publish and disconnect.   The success or failure of these operations is reported either synchronously via a return code, or asynchronously in a callback, depending on the API.  

The basic styles of API have been developed over 8 years or more, from before Paho's existence, and continued within Paho, so we are confident of their basic usability. 

We continue to get feedback and improve where necessary, for instance with the new embedded APIs, which were designed in consultation with experienced developers.


Each of the MQTT components supports the MQTT v3.1.1 standard version of the protocol (  Some may also support the older 3.1 specification.

The MQTT-SN components implement version 1.2 of the MQTT-SN specification (



At the time of writing, there are 259 resolved/closed bugs for Paho, and 73 unresolved for released components.  Bug and mailing list activity has consistent external contributions and interest.

As of December 2013, Paho has the second highest website traffic of any Eclipse IoT project.  Mosquitto is highest -- (an MQTT server derived from RSMB).    This means that the MQTT projects have over 50% of all Eclipse IoT measured website traffic.

Paho has second highest measured downloads of any Eclipse IoT project.  This statistic also omits many downloads of Paho which can be obtained in other ways (source, for instance).

These figures show continuing increase in activity and interest around Paho and MQTT year on year.  They are only a rough guide, but show that there is consistent interest in MQTT and Paho.

We are collaborating with the mbed ( community on embedded MQTT clients: The master source resides in the Paho project.