FTDI removes counterfeit-bricking driver from Windows Update • Hacker News Board

Re: FTDI removes counterfeit-bricking driver from Windows Update

#121

Post by HeyLaughingBoy » Fri, Oct 24, 2014, 8:46 PM UTC

Alupis wrote: post #117

HeyLaughingBoy wrote: post #88

Earlier quoted context omitted.

The company I work for uses (genuine) FTDI USB-Serial converters in our $500,000 medical instruments. I have full confidence in our Supply Chain Management people, but mistakes happen. If we were to send out a field upgrade to the instruments, as happens periodically, and some of them had the counterfeit chips, then suddenly there are patients all over the world, many in Emergency Rooms or Intensive Care, that can't…

The scenario you present is a little "doomsday". You'd have to replace all of your deployed product's chips with cheap counterfeit ones for this to happen -- and you say you have complete confidence in your supply chain. My warehouse has a couple Sharp Max baggers w/ counter and sorter, which are just as expensive as your medical instruments. The electronics check to ensure you are using only the Sharp brand parts, o…

No. This is not a doomsday scenario.

All it takes is one bad chip in a critical location in one instrument and that instrument is down, or at least rolled back to "limp mode" depending on which feature the chip supports. That instrument may be processing hundreds or thousands of patients a day if it is installed in a large medical lab. Do you see the problem here?

Sure, an Emergency Service Call will take care of the problem, but that can take hours (over a day in some locations).

Re: FTDI removes counterfeit-bricking driver from Windows Update

#122

Post by HeyLaughingBoy » Fri, Oct 24, 2014, 8:48 PM UTC

JoeAltmaier wrote: post #118

Alupis wrote: post #117

Earlier quoted context omitted.

The scenario you present is a little "doomsday". You'd have to replace all of your deployed product's chips with cheap counterfeit ones for this to happen -- and you say you have complete confidence in your supply chain. My warehouse has a couple Sharp Max baggers w/ counter and sorter, which are just as expensive as your medical instruments. The electronics check to ensure you are using only the Sharp brand parts, o…

Steep discounts for volume are the norm. Its arguable that the consumer doesn't know nor care why the discount; as long as the vendor/product passes a qualification test.

Not to mention that he's assuming the cost was different. Many companies have to deal with counterfeit parts (we have) and often the only difference is that they either outright refuse to work (good!!) or fail early (very bad).

Re: FTDI removes counterfeit-bricking driver from Windows Update

#123

Post by raverbashing » Fri, Oct 24, 2014, 8:50 PM UTC

seanp2k2 wrote: post #85

raverbashing wrote: post #58

Earlier quoted context omitted.

" In their pre-bricking drivers, FDTI caused the counterfeits to fail in confusing and counterintuitive ways, rather than just telling the user that the chip is fake." Or maybe because the fake chip is not working in some corner case exactly as the original chip? It's probably not something deliberate. Edit: Do you really think the manufacturer should test their driver agains all fake chips and see how they behave? R…

I don't think the argument here is to test their drivers against fakes. I think the argument is against /intentionally harming/ fakes vs. throwing an error. I'm also against the "random malfunctions" feature, if that was also intentional, which it sounds like it was.

Sure, but see: I don't think manufacturers would go after fakes and deliberately test their drivers against it.

Why? How many fakes are there? How do you make sure that's the "most popular" fake?

It's possible they do it? Sure! That, or they add features to their silicon and drivers and don't care what happens to other chips.

Yes, I'm against bricking fakes or causing random malfunctions.

Re: FTDI removes counterfeit-bricking driver from Windows Update

#124

Post by spc476 » Fri, Oct 24, 2014, 9:34 PM UTC

kabdib wrote: post #44

Their best course of action: - unbrick devices they bricked, so the chips will at least work with drivers other than theirs - log something to the windows event log about a clone device being detected It's their choice whether they should work with the clone device or not; I would hope they would choose to. I understand their reluctance, but people are going to be only slightly less mad about a device not working tha…

How would they unbrick a device? By definition, to "brick" is to render the device inoperable.

A friend of mine, in the course of his work, bricked a BMW [1]. It took an engineer, flown in [2] to fix the issue.

[1] He worked at a company making automobile diagnostic tools for mechanics. He was reflashing the BMW when the power went out. That scrambled the on-board computer system enough to brick the car.

[2] South Florida (Miami/Ft. Lauderdale area) I'm sure the German engineer wasn't all that upset.

Re: FTDI removes counterfeit-bricking driver from Windows Update

#125

Post by welterde » Fri, Oct 24, 2014, 9:54 PM UTC

chrisBob wrote: post #111

the_ancient wrote: post #106

Earlier quoted context omitted.

It is however perfectly legal to make a hardware device that could make use of the Same API and driver i.e a clone. Provided it is not branded as a FTDI chip, but rather "FTDI Driver compatible" Now that may violate the terms and lic of the driver software on windows (not on linux because it is GPLv2) but that would not make it illegal to buy nor would it give them (FTDI) the legal right to modify that hardware

Using the FTDI vendor ID is branding it as an FTDI product. I would argue that it is even more important than the text printed on the chip since that is the part of the brand that the average end user is exposed to.

There doesn't appear to be any legal protection on USB vendor IDs though. It's just important if you want to follow the rules of the USB-IF, but that's no legal requirement.

Re: FTDI removes counterfeit-bricking driver from Windows Update

#126

Post by jameshart » Fri, Oct 24, 2014, 10:05 PM UTC

drzaiusapelord wrote: post #33

jameshart wrote: post #19

Earlier quoted context omitted.

What specific piece of equipment was affected? (not doubting - just curious, as I've not come across specific examples of people being affected by this driver)

This guy in /r/sysadmin claims 35 devices nuked: http://www.reddit.com/r/sysadmin/comments/2k6wjk/fyi_ftdi_de...

35 devices put together by students doing EE projects... well, that's annoying, but they are at least direct consumers/users of the counterfeit components - presumably they have the option/ability to replace the chip with a genuine one once they source one. I've yet to hear of any end user finding that a commercially purchased peripheral has been bricked by this driver because its manufacturer used counterfeit parts, though. Would be fascinated to hear about such an example.

Re: FTDI removes counterfeit-bricking driver from Windows Update

#127

Post by kabdib » Fri, Oct 24, 2014, 11:43 PM UTC

spc476 wrote: post #124

kabdib wrote: post #44

Their best course of action: - unbrick devices they bricked, so the chips will at least work with drivers other than theirs - log something to the windows event log about a clone device being detected It's their choice whether they should work with the clone device or not; I would hope they would choose to. I understand their reluctance, but people are going to be only slightly less mad about a device not working tha…

How would they unbrick a device? By definition, to "brick" is to render the device inoperable. A friend of mine, in the course of his work, bricked a BMW [1]. It took an engineer, flown in [2] to fix the issue. [1] He worked at a company making automobile diagnostic tools for mechanics. He was reflashing the BMW when the power went out. That scrambled the on-board computer system enough to brick the car. [2] South Fl…

To misquote The Princess Bride: "This device isn't bricked. It's just mostly bricked. There's a difference."

The device is still there, and it will talk, there's just no matching driver in the system for it now.

So you add PID=0x0000 to your existing driver (I think this is just an edit to the INF file on Windows) and sniff the device to see if it's one you've likely (semi) bricked, and make the attempt. You own the VID, so this operation should be safe in your namespace.

Brickness is a measure of the user's ability and motivation to restore a device. I've worked on systems where you have to unsolder really tiny devices in order to unbrick. It's a continuum of inconvenience, really. To most users, the evil FTDI driver made a brick because it was beyond their skill to do the repair (hey, you can write a driver for PID=0x0000 any time you want to, oaky?)

Re: FTDI removes counterfeit-bricking driver from Windows Update

#128

Post by aftbit » Sat, Oct 25, 2014, 2:58 AM UTC

bri3d wrote: post #22

Someone1234 wrote: post #2

Good for them. I mean that. If they want to redesign their driver so it fails to work with non-genuine FTDI chips, go for it. Nobody will judge them. Heck if they want to show a message that informs the user they're using a fake, that's fine too. I think most people seemed to agree that bricking fakes was too far (and also could be considered illegal in some countries/areas). It also negatively impacted innocent part…

What I don't understand is why they don't make the messaging more clear. In their pre-bricking drivers, FDTI caused the counterfeits to fail in confusing and counterintuitive ways, rather than just telling the user that the chip is fake. As a user, if my device stops working randomly, my first thought is certainly not "there was a counterfeit chip in the supply chain for this hardware and the drivers must be rejectin…

Part of the way that manufacturers convince customers that counterfeit chips are unacceptable is by pointing to a higher rate of glitches and failures. Perhaps FDTI wanted counterfeit chips to get an (at least partially undeserved) reputation for shoddiness rather than be seen as artificially refusing to work with counterfeits.

I have no idea about the bricking though.

Re: FTDI removes counterfeit-bricking driver from Windows Update

#129

Post by tw04 » Sat, Oct 25, 2014, 3:18 AM UTC

aftbit wrote: post #128

bri3d wrote: post #22

Earlier quoted context omitted.

What I don't understand is why they don't make the messaging more clear. In their pre-bricking drivers, FDTI caused the counterfeits to fail in confusing and counterintuitive ways, rather than just telling the user that the chip is fake. As a user, if my device stops working randomly, my first thought is certainly not "there was a counterfeit chip in the supply chain for this hardware and the drivers must be rejectin…

Part of the way that manufacturers convince customers that counterfeit chips are unacceptable is by pointing to a higher rate of glitches and failures. Perhaps FDTI wanted counterfeit chips to get an (at least partially undeserved) reputation for shoddiness rather than be seen as artificially refusing to work with counterfeits. I have no idea about the bricking though.

Right, except most consumers would write it off as shitty drivers. Not "this must not be working because it's a really good knockoff".

Re: FTDI removes counterfeit-bricking driver from Windows Update

#130

Post by nknighthb » Sat, Oct 25, 2014, 5:14 AM UTC

Alupis wrote: post #81

nknighthb wrote: post #69

Earlier quoted context omitted.

> reasonable doubt Even if such existed (it does not), this standard is not applicable to a civil case, only to the criminal trials for destruction of property/malicious mischief that every single person involved should have to go through.

For counterfeit/illegal property? This seems reminiscent of the guy who bought cocaine from his dealer, found out it was cut with flour, then tried to file a police report. I'd think you've had a tough time convincing a judge that you genuinely believed the chip/board you bought from some shady seller on eBay based in China for pennies on the dollar was a legit product. None-the-less, someone will try I'm sure. Then…

This has been thoroughly covered in an earlier thread[0]. The chips do not in themselves violate any law. To whatever extent there may be a trademark violation, that is between FTDI and whoever mislabeled them. None of this entitles FTDI to destroy anyone's property. That's a crime.

[0] https://news.ycombinator.com/item?id=8493849