Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FTDI removes counterfeit-bricking driver from Windows Update

eevblog.com

Post reply on HN
Print view View original

71–80 of 131 posts

Re: FTDI removes counterfeit-bricking driver from Windows Update

#71

Post by cstross »

wpietri wrote: post #56
Someone1234 wrote: post #2

Good for them. I mean that. If they want to redesign their driver so it fails to work with non-genuine FTDI chips, go for it. Nobody will judge them. Heck if they want to show a message that informs the user they're using a fake, that's fine too. I think most people seemed to agree that bricking fakes was too far (and also could be considered illegal in some countries/areas). It also negatively impacted innocent part…

> and also could be considered illegal in some countries/areas Is there some country where it's legal to break somebody's property because you have a beef with a third party? Certainly in the US if somebody produced a virus that did this nobody would even blink at a federal prosecution. That FTDI slipped a bit of text into a document nobody reads doesn't strike me as relevant. If a piece of malware also popped up an…

In the UK this looks like a clear criminal offence under the Computer Misuse Act -- currently carries a maximum 10 year prison sentence.

Re: FTDI removes counterfeit-bricking driver from Windows Update

#72

Post by DannyBee »

Karunamon wrote: post #17
jerf wrote: post #10

Earlier quoted context omitted.

They really should. Class actions are an inferior mechanism for both parties anyhow. The lawyers sitting in the middle will make it so it's radically more expensive for the company, and the odds of the supposed "winners" of the class action suit will probably get uselessly small vouchers for service rather than actual replacement.

Class actions are less about compensation and more about forming big enough sticks to beat misbehaving corporations about the head with.

"Class actions are less about compensation and more about forming big enough sticks to beat misbehaving corporations about the head with. "

Class actions were never about this until recently . The original purpose was to make it easier to manage the case (vs 50 separate cases) for the justice system. It was about "the efficient administration of justice". Nothing more, nothing less.

When they were created (out of thin air) in the US, this was the goal. AFAIK, nobody thought about, or wanted, what has happened now. It's not even a good vehicle to accomplish "beating misbehaving corporations" , because when used for that purpose, it mostly makes money for lawyers, encourages nuisance suits, etc.

Re: FTDI removes counterfeit-bricking driver from Windows Update

#73

Post by justin66 »

Alupis wrote: post #11

Seems a lot of the posts on that thread are from HN visitors, many may not even have the equipment/chip in discussion. While it's great FTI reversed their decision (I'd hate to see this sort of thing become wide-spread), it's a little off-putting that so many non-users of the chip could force a company into something.

> While it's great FTI reversed their decision (I'd hate to see this sort of thing become wide-spread), it's a little off-putting that so many non-users of the chip could force a company into something.

A wide variety of non-users of the chip have a very strong interest in Windows Update not becoming a vector for malware. I doubt this situation would have gained the quick public notice it did if it had been the work of a driver available for download on FTDI's website.

Re: FTDI removes counterfeit-bricking driver from Windows Update

#74

Post by wpietri »

Alupis wrote: post #68
wpietri wrote: post #62

Earlier quoted context omitted.

I don't see why that would be more challenging than any other class-action suit. Indeed, this looks easier, in that you have widespread media coverage and plenty of experts speaking out publicly. It's not a question of trying to find experts qualified to testify; here, you can pick from a bunch. The technology here is also much more straightforward than, say, an automobile, and there are successful class-action suits…

there isn't really any media coverage, other than the forum posts and HN. Also, using your automobile example, an average-joe consumer can take their car into a mechanic and have it tested for a recall/defect. The average-joe with an arduino is far more likely to toss the defective unit out, rather than try to spend a while troubleshooting a $40 board. I just don't see a class-action really able to take off. Especial…

Ok. This looks like media coverage to me: http://www.zdnet.com/ftdi-admits-to-bricking-innocent-users-...

The line of argument "I, as some random anonymous person on the internet, can't see X" doesn't do much for me. Lots of people can't see lots of things, but most of the time that turns out to be about failures of knowledge or imagination, not evidence that that what they're talking about is impossible.

Further, I don't think it's really my job to make people see things. (Well, actually, it is, but I charge by the day for that.) If you don't see it, I can live with that.

Re: FTDI removes counterfeit-bricking driver from Windows Update

#75

Post by nraynaud »

jws wrote: post #66
nraynaud wrote: post #41

That's a good lesson for people always wanting the famous brands. FTDI chips are more expensive and not better than the other ones, they need a special driver and they are subject to counterfeiting. You take a no-name one, and you have a standard stuff. It's a stupid USB to RS232, not a rocket control system, there should be no famous brand, it's the lowest of the commodities. That said, I do have an FTDI USB to seri…

The FTDI chips and drivers also have the ability to toggle a few extra pins. If you are making a device this can be important enough to lure you away from just being a generic USB Communications Device Class profile. (Think a 'reset' function or a 'enter firmware update mode' function.) Given that as a consumer/purchaser I have no way of knowing if I have a counterfeit chip or if the next batch produced by a manufact…

Good remark. I didn't think about that, because I use a real USB chip for USB, I don't try to convert it to serial (I like the idea of having various communications going at once, the stall, etc.)

Re: FTDI removes counterfeit-bricking driver from Windows Update

#76

Post by wpietri »

cstross wrote: post #71
wpietri wrote: post #56

Earlier quoted context omitted.

> and also could be considered illegal in some countries/areas Is there some country where it's legal to break somebody's property because you have a beef with a third party? Certainly in the US if somebody produced a virus that did this nobody would even blink at a federal prosecution. That FTDI slipped a bit of text into a document nobody reads doesn't strike me as relevant. If a piece of malware also popped up an…

In the UK this looks like a clear criminal offence under the Computer Misuse Act -- currently carries a maximum 10 year prison sentence.

What's your opinion there on the odds of prosecution for something like this? I have the (possibly media-driven) notion that the UK has a stronger tradition of public service. But then you also have a more explicit class dynamic.

Re: FTDI removes counterfeit-bricking driver from Windows Update

#77

Post by elsjaako »

bri3d wrote: post #28
DigitalJack wrote: post #26

Earlier quoted context omitted.

I don't think that is very straight forward. It's easy to know how your device will operate in various conditions. counterfeits can fail in a million unpredictable ways.

FTDI have code which can tell with some high degree of certainty (at least enough that they trusted it to brick devices!) that a chip is fake. They've used this code to make counterfeits intentionally unpredictable in the last few versions of their driver, rather than simply stopping the device with an error code (like Prolific do) or notifying the user or client library (like all of these vendors should be doing). S…

Someone at the eevblog analyzed the file. It's setting the PID to 0 in a way that on genuine chips it will only buffer the change, and not actually apply it. If it wasn't a manufacturer with signed drivers pushing this on windows update but a guy at DEFCON explaining his trick I would find it very cool.

Re: FTDI removes counterfeit-bricking driver from Windows Update

#78

Post by chrisBob »

Igglyboo wrote: post #4

Good, destroying a device you legally purchased is unacceptable, whether you knew it was a counterfeit or not. It's not their job to police that kind of stuff. Failing to work with counterfeit devices is completely fine and would have been a much better approach than straight up bricking them.

In the US there isn't a legal way to purchase counterfeit goods. It may be different in other countries. Similar to stolen property, the person left holding the bag gets in trouble too.

Edit: after actually looking up the issue instead of guessing it turns out that in most places (other than France and Italy) there isn't much at stake for the end user, and almost all of the laws are written to stop the sale or manufacture of counterfeit items.

Re: FTDI removes counterfeit-bricking driver from Windows Update

#79

Post by wpietri »

welterde wrote: post #51
bri3d wrote: post #49

Earlier quoted context omitted.

The reverse-engineered reimplementations / clones would have to have been programmed with an FTDI VID (or included modified FTDI drivers) in order for the FTDI drivers to claim them, so I'm not so sure about the "not marked as being from FTDI" bit.

As far as I know that's perfectly legal.. you are just not allowed to put the USB logo onto the device if you clone the VID from another vendor. And you seemingly can buy FTDI clones that are not marked as FTDI on the casing.

That's an interesting question. Is the VID a signal of protocol compatibility? Or a brand name?

In a way it's both, but since end users almost never see the VID, I suspect a lawyer would have an easy time that under the law it's more the former than the latter, and therefore not covered under trademark and related laws.

Re: FTDI removes counterfeit-bricking driver from Windows Update

#80

Post by expr- »

otikik wrote: post #52
expr- wrote: post #12

I disagree with the consensus. It's their driver, it operates in a specific way, perhaps responding to possible device output. Using it with non-compatible parts advertising themselves as compatible and any resulting behaviour, including unwanted, is the responsibility of the user. To play it safe, don't use any drivers with incompatible hardware.

What is the limit there, then? Would it be ok for the chip to, say, install spyware to look for my credit card data and steal money from me? That is also "unwanted behavior". I would be ok if the driver simply refused to work. But making hardware unusable on purpose is too much.

Doing things not related to interacting with, or "driving", the hardware is the limit for a good device driver. For software in general, not all forms of spyware are illegal (but stealing money is, at least in my jurisdiction).

Whatever the code for changing the PID is, it (supposedly) would work as well for a malfunctioning but real product, as well as a counterfeit.

Post reply on HN