8 ms·

> This anti-consumer behavior on behalf of companies I strongly disagree with this. I see no way to rationalize that a company should be responsible for ensur

> This anti-consumer behavior on behalf of companies I strongly disagree with this. I see no way to rationalize that a company should be responsible for ensuring that counterfeit devices work correctly by releasing drivers that are tolerant of them or do not stop them from functioning. FTDI's products are the combination of their hardware with their drivers. Both are required in order to delivery functionality and reliability to meet their specifications. Imagine your drivers are used in some sort of a critical application and a counterfeit device causes a failure that, in turn, causes harm to someone. An example might be a wired remote control for an industrial machine. It seems to met that bricking that device as soon as possible before harm is done is what we would want from a company that delivers a quality product. Another way to put it is: Let the counterfeiters engineer a real product and be responsible for their own drivers, quality and safety. The way to see clearly through some of these problems is to extend the definition towards extremes. Let's forget FTDI for a moment and generalize the problem to a microprocessor and a vendor-provided RTOS used to run the flight system of an airliner. This is a contrived hypothetical, forgive me for taking artistic license. Imagine counterfeit processor make it into the supply chain. Should the avionics OS do its best to work with every possible fake or should it brick it on power-up before that potentially dangerous aircraft gets off the ground? Another hypothetical could be one where we eliminate hardware completely. Imagine someone creates a fake Amazon, Facebook, NY Times or online brokerage site. Imagine proposing that the real companies would be anti-consumer if they created software that revealed the impostors. I could not imagine anyone who would propose they allow the fakes to continue to deceive consumers. From my perspective this isn't anti-consumer at all. It's as pro-consumer as you can get: You work hard to ensure quality, consistency, performance and reliability. The real anti-consumers are the counterfeit manufacturers. They, quite literally, could not care less. All they care about is tricking engineers and consumers into thinking they are designing and buying a quality product when, in reality, they might be dealing with dangerous junk.

teruakohatu 6y ago
> I strongly disagree with this. I see no way to rationalize that a company should be responsible for ensuring that counterfeit devices work correctly They destroyed devices that worked perfectly well, but maybe (or maybe not) had a fake FTDI branding on a chip inside the device. Even the manufacturer may have been a victim of commingled inventory. For this reason I stopped buying anything with FTDI in it, because I didn't want to take the chance it would be bricked because the smalltime seller on Tindie.com bought from a bad supplier. I would hate to think what you would have Apple do to Hackintosh hardware.
- robomartin 6y ago
  > I would hate to think what you would have Apple do to Hackintosh hardware. You are looking at it precisely backwards. The key question here goes something like this: Is Apple responsible for ensuring that fakes function correctly as it issues software updates for its own hardware? In other words, just because someone decided to make a Hackintosh or a fake iPhone is Apple now instantly saddled with having to support this hardware for the lifetime of the fake products? And this is the case whether there's just one clone or 100 different variants? As I have asked others, in what alternate reality does this make any sense? My guess is that none of you have ever designed or manufactured hardware products at scale and don't fully comprehend the implications of what you so vehemently believe. No hardware manufacturer would ever take the side of having to ensure fakes work correctly; this would be sheer insanity.
  - teraflop 6y ago
    Nobody's complaining that FTDI didn't make their drivers compatible with counterfeit hardware. They're complaining that FTDI deliberately took actions in their driver code to damage any supposedly counterfeit devices that were plugged into a system. To use your example, imagine if Apple released an update to iOS that would scan any jailbroken iPhones on the same network, and if it detected one, would use a backdoor to send it malware that wipes the device's bootloader.
    - robomartin 6y ago
      One bad example after another. Why is this so hard for folks to grasp. The proper example would be fake iPhones made in Switzerland sold in the US as through they were real iPhones. If that's the case, then, YES, Apple would be right to brick them with an update. Absolutely. I ask again: In what alternate reality would Apple be required to allow fake iPhones, look the other way and just let them be?
      - kd5bjo 6y ago
        Your example is also off, because we’re talking about an internal component rather than an entire device. If a repair shop doesn’t use a Genuine Apple replacement screen, does Apple have to support it? No. Is going out of their way to physically destroy these replacement screens anti-consumer behavior? Yes. A key point here is that it’s impossible for the malicious driver to know what representation the seller made to the consumer— the presence of a nonoriginal part doesn’t necessarily mean there was any fraud involved. Edit to add: > ... fake iPhones made in Switzerland sold in the US as through they were real iPhones. If that's the case, then, YES, Apple would be right to brick them with an update. Absolutely. Only after obtaining a court order to that effect. Destroying someone else’s property without due process is generally not acceptable, regardless of how right you are. To step away from technology for a moment, is it ok for a glassmaker to go around town breaking windows because they’re allegedly made with counterfeit glass?
kbenson 6y ago
> I strongly disagree with this. I see no way to rationalize that a company should be responsible for ensuring that counterfeit devices work correctly by releasing drivers that are tolerant of them or do not stop them from functioning. There's a difference between not taking steps to ensure counterfeit devices function, and purposefully causing hardware to fail on a remote system. For example, I'm pretty sure purposefully causing the problem is illegal, if the user didn't request it, as it seems the same as hacking to me. > Imagine counterfeit processor make it into the supply chain. Should the avionics OS do its best to work with every possible fake or should it brick it on power-up before that potentially dangerous aircraft gets off the ground? Refusing to function is acceptable. Bricking the hardware is not.
- S_A_P 6y ago
  >Refusing to function is acceptable. Bricking the hardware is not. In some/most cases there is no difference.
  - IAmEveryone 6y ago
    Intend is 99% of the law (and commonly understood ethics). That's why you can kill someone and be either glorified as a war hero, hanged by a jury of your peers, or ordered to retake your driving exam.
wegs 6y ago
Let's work through this example. You're a manufacturer of devices using FTDI chips. You make an emergency system for airplanes which e.g. releases breathing equipment, or life rafts, or similar. Or a backup avionics system. Due to a supply chain slip-up, a small number of counterfeit devices slipped in. An emergency comes up, and the instant the emergency system comes up, it turns out to have been bricked. People die. Is this a good outcome? If I were a manufacturer, I'd want to know about this ASAP. Would I want devices to stop working? Especially the examples you gave where people's lives are on the line? Absolutely not. I'd want them to work as well as possible until a replacement can go out. Pro-consumer would be a pop-up letting the user know they received a counterfeit devices. I can then contact whoever sold me the device, and ask for a replacement. During cross-shipping, I can keep working. Anti-consumer is having my business trip and fall on its face when all the pen tablets which allow people to work from home are bricked during a pandemic. Of course the counterfeit manufacturers are the bad guys. But FTDI is a company I'd never do business with either. If I'm an FTDI partner, and I got the wrong product, we were both cheated. I'm no more at fault than FTDI. Should FTDI smack me and my customers upside the head for it? Well, that means we're not really partners.
- robomartin 6y ago
  You are making the mistake of arguing against a hypothetical. It's just a fabricated example to convey an idea, not something to argue against. As an aerospace engineer I assure you that sourcing components for aerospace isn't as simple as your hypothetical to my hypothetical. > Pro-consumer would be a pop-up letting the user know they received a counterfeit devices. This from driver code? The party at fault here is whoever sourced the devices. If the design engineer called for FTDI and they put in FunTDI instead, well, they didn't build what they were contracted to build. Period. Something as simple as a driver revision to, for example, improve performance, could break a fake chip. Is the legitimate manufacturer supposed to now be aware of every fake and design their drivers forever more to ensure fakes work perfectly? C'mon, that's preposterous. If I design a board and someone decides to use a cloned version in their machine and somebody gets killed because of a software update I can assure you that the case wouldn't even get to court. The instant it is discovered that the board was a fake the entire thing would be thrown out. There is no way anyone is going to hold the manufacturer responsible for ensuring that clones work property. That is not what they are in business to do.
LeifCarrotson 6y ago
I agree that anyone who built a device and knowingly used a counterfeit FTDI chip deserved to be punished. However, the FTDI debacle didn't punish those people, they're not the consumers. It punished end users who have no idea what an FTDI chip is or does or that one exists in the products they buy. In your airliner microcontroller example, you have much more informed consumers. They could reasonably be expected to know what processor is in their hardware, and to want to validate it. That's not the same. It would be more like a good packaging manufacturer finding that their packaging was being counterfeited and their proprietary plastic blend was somehow being leaked up the supply chain. If they changed their recipe to something toxic, but using good plastic internally, and when people started dying said "they should have bought potato chips packaged in genuine FoodSafeStuff bags". People don't know what their packaging is made from or who it's made by. They have no way to verify it prior to purchase, and even after purchase, it would take an expert to identify. And there's no customer loyalty based on the plastic bag, after the food manufacturer switches away from the counterfeit they won't be significantly harmed. But everyone who innocently bought those bags and got poisoned suffered real harm.
- toohotatopic 6y ago
  >People don't know what their packaging is made from or who it's made by. They have no way to verify it prior to purchase, and even after purchase, it would take an expert to identify. For food, you can't change the game without prior notice, but if it is clear that faked goods are toxic, people would start buying from trusted providers themselves. For electronics, I don't see a problem. If a device is bricked, go to your dealer and let him replace it. He will do the same for his supplier, etc. Somebody in the chain will discover that his supplier is a fraud. He will have to swallow the costs, but has learned a valuable lesson. If people have brought the product from some unstable source, then they most likely got it cheaper and they are now paying the price for the increased risk they took. It doesn't feel good but I don't think that it is unfair.
  - pastage 6y ago
    The counterfeit FTDIs are ok. How drivers are created is a much bigger problem, the windows model specifically where hardware takes a long time, if ever, to be included in the default installation. Getting hardware to just work on windows was a mess (not sure if they have corrected this).
woah 6y ago
Why are the two options you present either to a) fully engineer and qa the driver to work with every possible counterfeit, or b) to insert malicious code to brick counterfeits? Seems like kind of a false dilemma.
- robomartin 6y ago
  There are a bunch of permutations, sure. What you are calling "malicious code" could --and likely is-- quality control code. The fact that fakes fail isn't the responsibility of the legitimate manufacturer. I don't know how many hypothetical examples I have to concoct to drive the point home. OK, here's another one. Fake Tesla. The real Tesla writes code that bricks the entire fake car. This is 100% pro-consumer. The fake Tesla could literally kill people. What you guys are arguing for is that Tesla should ensure that fakes are able to function. And, at the extremes, that Tesla is responsible for their proper function and safety. Think about that for a moment.
  - erdo 6y ago
    Sure, and fake Tesla just happens to be bricked while it's driving in the fast lane of a motorway, or is accidentally bricked because a bug triggered the kill switch. Think about that for a moment.
    - robomartin 6y ago
      ...and it never occurred to you that a hypothetical is just a thinking tool rather than an absolute. OK, I'll play your game. The car would not turn on after being parked somewhere for four hours. Only an idiot software developer would brick it at high speed on the Autobahn.
      - 0x0 6y ago
        That's what FTDI did though. They pushed the malicious bricking driver through an automatic Windows Update to systems already running in production, no? That's pretty much the equivalent of going at high speed on the Autobahn.
erdo 6y ago
You're presenting this as a binary choice: a) > company should be responsible for ensuring that counterfeit devices work correctly or b) > bricking [the counterfeit] device as soon as possible The answer is almost always c) let it be, if it works fine, if not, not your problem. Adding any kind of bricking code anywhere, unnecessarily introduces the possibility that it will be unintentionally (or maliciously) activated. Personally I don't have that kind of confidence in software or the people that write it (and I am one of those people)
- robomartin 6y ago
  Here's another choice: Go ask the manufacturer of the fake chip to support it with their own driver. Really. As a hardware manufacturer, if you use a fake version of my product and demand that my software work with it you will hear the loud sound of the phone being hung up forcefully. The legitimate manufacturer can do anything it wants with the software and their hardware. If someone wants support for fakes they can provide it themselves. We are talking about encouraging or tolerating theft of intellectual property here. Having been the victim of this I am quite sensitive to the idea.
  - indiv0 6y ago
    Your last comment brings this quote to mind: > It is difficult to get a man to understand something when his salary depends upon his not understanding it. No one is suggesting encouraging or tolerating theft of intellectual property. People are _discouraging_ vigilante justice against IP thieves. In this instance, because it harms consumers (an innocent party). You're arguing against strawmen when you claim that people are arguing for FTDI to support these chips. Instead what people are arguing for is for FTDI to not brick them _intentionally_.
    - robomartin 6y ago
      If you really take the time to think it through you should conclude that the forcing FTDI to back off is actually as anti-consumer as you can get. It guarantees long-lasting harm to consumers as counterfeiters now know they can continue to push their devices --of any kind, not just FTDI-- without suffering any consequences. In other words, when viewed with a long term perspective the mob actually succeeded at protecting the counterfeiters rather than consumers. That's what people disagreeing with my perspective are missing in this argument. Show me a legitimate scenario where giving counterfeiters a free pass leads to long term (decades) protections for consumers and there might be something to argue about. My quote is far better, BTW: "A man holding a cat by the tail learns something he can learn in no other way" --Mark Twain Most everyone voicing opinions on this thread has zero experience manufacturing products at scale and perhaps even running a non-trivial company. Nobody has held any of these cats by the tail and yet everyone seems to think they understand market and business dynamics. As my wife puts it (she is a doctor): A google search isn't a medical degree.
mrob 6y ago
It is impossible for the FTDI driver to reliably determine if a chip is counterfeit. The difference between a counterfeit and a compatible part is trademark violation, and that can only be detected by looking at the physical packaging and the marketing materials.
kire456 6y ago
You are advocating willful destruction of property. Property that is neither yours nor FTDI's. This is illegal, and broadly considered bad taste. A counterfeiter commiting crimes against FTDI does not excuse FTDI committing crimes against a third party (i.e. the consumer). The world being safer without the counterfeit products also does not excuse the FTDI destroying things that aren't theirs. The justice system being ineffective at addressing counterfeiters is also no excuse for FTDI to take matters into their own hands. Vigilante justice is usually illegal. Programmers make mistakes. A bug in your counterfeit detection code may end up destroying legit products. In addition, you can not be sure destroying a product will be safe - if the chip is in a medical device, you might be killing someone. The entire idea of destroying a product without explicitly being told to do so is fraught with peril. You deal in false binaries. The third, imo correct, option is for FTDI to design software that works correctly with their own product, and spend no effort on the counterfeits - neither to get them to work correctly, nor to brick them on purpose. A fourth option, if you want to spend some effort on something other than destruction of property, is to take option three, and also alert the user that they are using a counterfeit chip with unpredictable behaviour, and in your airplane example, advise the user they should probably not take off. If you want to be pro-consumer, this is a better way to go about it than smashing their stuff. From the consumer's perspective, they had a working device, and a firmware update bricked it on purpose. It is possibly out of warranty, in which case they end up footing the bill (or experiencing frustration) for replacement and downtime. It takes Olympic levels of mental gymnastics to view that as 'pro-consumer', imo.
robomartin 6y ago
Some hours later, reviewing all responses... The primary counter argument to mine requires an inversion of responsibilities and ascribes criminality to the victim. Devices got bricked because counterfeiters committed a crime in the first place. Along the same lines, there are supply chain questions that are impossible to answer: How many of these device manufacturers knowingly used fake chips because they cost less? How many distributors knowingly shipped fake components because, again, they cost less and delivered higher margins? How many device manufacturers were true innocent victims who did not know fake devices had been substituted for the real thing? How many failures of import controls led to consumers receiving devices with fake chips? I have had the experience of having major US electronics parts distributors knowingly substitute defective --yet genuine-- parts instead of the top grade parts we ordered. The effect was what the hardware sector generally refers to as "infant mortality", where your hardware fails early or becomes unreliable due to substandard components. It took months for these effects to come out into the open and for the major US distributor to own up to this against the threat on our part of legal action. Not only did they replace all components with legitimate top grade parts, they also paid the costs involved in replacing the affected systems for our customers. My guess is that the context lacking most, if not all, who disagree with my position perspective that comes from having "skin in the game" in the domain we are discussing. The knee-jerk reaction is to think bricking these devices is bad for consumers, as if that would have been the end of the story. No, in a properly functioning economy and legal system this would and should lead to tracing through levels of responsibility as far as possible, with consumers being made whole with properly engineered and manufactured devices. The end result of forcing FTDI to not protect their product from counterfeiters is that not one consumer today can be assured the devices they purchase has quality reliable parts that will function according to specifications. A chip can, quite literally, go up in flames (I had this happen to me with a cheap Chinese device) because we did not support FTDI in disallowing fake chips from the market. Sure, there would have been short term pain and a bunch of companies and suppliers fixing their pipelines and designs. Yet, we would have emerged with an above-average guarantee of quality and performance and counterfeiters thinking real hard before doing what they do. Instead the feedback we gave counterfeiters is "you win". And the result we obtained for consumers is "you lose, forever". This incident extends well past FTDI. Because the mob won and forced FTDI to accept fakes it now means nobody is going to take similar steps towards protecting their products. Which, in turn, means counterfeiters know they won and know they can get away with it. Consumers, once more, lose, big and in unknown ways. We are swimming in a sea of fake products. The only way to stop this is if fake products become losing propositions for producers, suppliers, manufacturers and consumers. I mentioned I had a chip go up in flames. A while back I bought a little humanoid robot directly from a vendor in China. One of these things with 15 to 20 servos and, typically, a mobile phone class processor powering it and the touch screen on the chest. I bought several of them as part of a business venture. A couple of days after receiving them one of my kids was working with it on the table in the garage. As the robot walked, it failed to take a step and fell. It just planked onto the table, a 90 degree rotation from the toes, nothing too dramatic. In an instant flames were shooting out of the chest. Flames, not smoke. Since we were in the garage it was an easy matter to open the door and toss the thing onto the driveway. Upon inspection we found a crater at the center of the ARM processor on the main board. It failed and took a bunch of other parts with it. I contacted the company and very specifically asked about the source of this processor. We were actually considering importing and modifying this robot in quantity for educational purposes. In other words, we had established an engineering relationship with this company, this wasn't a case of just another consumer buying their product. They pretty much told me they bought the cheapest ARM processor clone they could source in China. This was and was not a revelation to me. Having done business with China for some time, as well as having a number of friends and business acquaintances doing business in China, nothing surprises me any more. The degree of supervision and cross checking you have to engage in when doing business with China is impossible for someone outside of manufacturing to grasp. It takes a lot of work to ensure safe products are landed in Europe and the US. When you deal with European or US companies this requirement almost disappears because you can generally trust they will deliver what they agreed to supply at the required level of quality. Taking the case of this real product, this robot, as an example, it would have been far better if --through whatever mechanism-- the thing had been bricked by the processor manufacturer before it got into the hands of any consumer. I cringe to think that this company likely sold tens of thousands of these units into homes and schools that could, due to fake chip issues and low component quality, go up in flames any time. We got lucky in that the robot ignited while we were there and under circumstances that were easy to control. This could have happened in the middle of the night and the story would have been potentially horrific. Be careful to think that allowing consumers to be fed fake products of unknown quality and traceability equates to having a pro-consumer stance. Due to this FTDI event it is likely consumers today have no clue what quality and safety has gone into the products they are using. This is not a good outcome. The right path would have been to take the pain of fixing the real problem and make consumers whole through both corporate responsibility and the legal system. In other words, FTDI is a victim and consumers are now even larger victims because the fake chip content of their devices is likely to go well beyond a little USB chip. No way to know how far and wide this has gone. A clear case of good intentions actually causing more damage to consumers. OK, I'm done. I don't expect to change anyone's mind. Just stating a perspective I think many don't have because they don't have practical experience at scale in the world of hardware manufacturing and support. If it makes even one person think this through, research and perhaps understand, I am satisfied. Be tolerant of contrasting perspectives...you might just be wrong and not know it...or, even worse, one day you will be correct and the mob will dismiss you just as you have to others when you think you are right. Tolerance is important. Don't punish, dismiss and ignore those who you do not agree with because one day that person could be you.

teruakohatu 6y ago

> I strongly disagree with this. I see no way to rationalize that a company should be responsible for ensuring that counterfeit devices work correctly They destroyed devices that worked perfectly well, but maybe (or maybe not) had a fake FTDI branding on a chip inside the device. Even the manufacturer may have been a victim of commingled inventory. For this reason I stopped buying anything with FTDI in it, because I didn't want to take the chance it would be bricked because the smalltime seller on Tindie.com bought from a bad supplier. I would hate to think what you would have Apple do to Hackintosh hardware.

robomartin 6y ago
> I would hate to think what you would have Apple do to Hackintosh hardware. You are looking at it precisely backwards. The key question here goes something like this: Is Apple responsible for ensuring that fakes function correctly as it issues software updates for its own hardware? In other words, just because someone decided to make a Hackintosh or a fake iPhone is Apple now instantly saddled with having to support this hardware for the lifetime of the fake products? And this is the case whether there's just one clone or 100 different variants? As I have asked others, in what alternate reality does this make any sense? My guess is that none of you have ever designed or manufactured hardware products at scale and don't fully comprehend the implications of what you so vehemently believe. No hardware manufacturer would ever take the side of having to ensure fakes work correctly; this would be sheer insanity.
- teraflop 6y ago
  Nobody's complaining that FTDI didn't make their drivers compatible with counterfeit hardware. They're complaining that FTDI deliberately took actions in their driver code to damage any supposedly counterfeit devices that were plugged into a system. To use your example, imagine if Apple released an update to iOS that would scan any jailbroken iPhones on the same network, and if it detected one, would use a backdoor to send it malware that wipes the device's bootloader.
  - robomartin 6y ago
    One bad example after another. Why is this so hard for folks to grasp. The proper example would be fake iPhones made in Switzerland sold in the US as through they were real iPhones. If that's the case, then, YES, Apple would be right to brick them with an update. Absolutely. I ask again: In what alternate reality would Apple be required to allow fake iPhones, look the other way and just let them be?
    - kd5bjo 6y ago
      Your example is also off, because we’re talking about an internal component rather than an entire device. If a repair shop doesn’t use a Genuine Apple replacement screen, does Apple have to support it? No. Is going out of their way to physically destroy these replacement screens anti-consumer behavior? Yes. A key point here is that it’s impossible for the malicious driver to know what representation the seller made to the consumer— the presence of a nonoriginal part doesn’t necessarily mean there was any fraud involved. Edit to add: > ... fake iPhones made in Switzerland sold in the US as through they were real iPhones. If that's the case, then, YES, Apple would be right to brick them with an update. Absolutely. Only after obtaining a court order to that effect. Destroying someone else’s property without due process is generally not acceptable, regardless of how right you are. To step away from technology for a moment, is it ok for a glassmaker to go around town breaking windows because they’re allegedly made with counterfeit glass?

kbenson 6y ago

> I strongly disagree with this. I see no way to rationalize that a company should be responsible for ensuring that counterfeit devices work correctly by releasing drivers that are tolerant of them or do not stop them from functioning. There's a difference between not taking steps to ensure counterfeit devices function, and purposefully causing hardware to fail on a remote system. For example, I'm pretty sure purposefully causing the problem is illegal, if the user didn't request it, as it seems the same as hacking to me. > Imagine counterfeit processor make it into the supply chain. Should the avionics OS do its best to work with every possible fake or should it brick it on power-up before that potentially dangerous aircraft gets off the ground? Refusing to function is acceptable. Bricking the hardware is not.

S_A_P 6y ago
>Refusing to function is acceptable. Bricking the hardware is not. In some/most cases there is no difference.
- IAmEveryone 6y ago
  Intend is 99% of the law (and commonly understood ethics). That's why you can kill someone and be either glorified as a war hero, hanged by a jury of your peers, or ordered to retake your driving exam.

wegs 6y ago

Let's work through this example. You're a manufacturer of devices using FTDI chips. You make an emergency system for airplanes which e.g. releases breathing equipment, or life rafts, or similar. Or a backup avionics system. Due to a supply chain slip-up, a small number of counterfeit devices slipped in. An emergency comes up, and the instant the emergency system comes up, it turns out to have been bricked. People die. Is this a good outcome? If I were a manufacturer, I'd want to know about this ASAP. Would I want devices to stop working? Especially the examples you gave where people's lives are on the line? Absolutely not. I'd want them to work as well as possible until a replacement can go out. Pro-consumer would be a pop-up letting the user know they received a counterfeit devices. I can then contact whoever sold me the device, and ask for a replacement. During cross-shipping, I can keep working. Anti-consumer is having my business trip and fall on its face when all the pen tablets which allow people to work from home are bricked during a pandemic. Of course the counterfeit manufacturers are the bad guys. But FTDI is a company I'd never do business with either. If I'm an FTDI partner, and I got the wrong product, we were both cheated. I'm no more at fault than FTDI. Should FTDI smack me and my customers upside the head for it? Well, that means we're not really partners.

robomartin 6y ago
You are making the mistake of arguing against a hypothetical. It's just a fabricated example to convey an idea, not something to argue against. As an aerospace engineer I assure you that sourcing components for aerospace isn't as simple as your hypothetical to my hypothetical. > Pro-consumer would be a pop-up letting the user know they received a counterfeit devices. This from driver code? The party at fault here is whoever sourced the devices. If the design engineer called for FTDI and they put in FunTDI instead, well, they didn't build what they were contracted to build. Period. Something as simple as a driver revision to, for example, improve performance, could break a fake chip. Is the legitimate manufacturer supposed to now be aware of every fake and design their drivers forever more to ensure fakes work perfectly? C'mon, that's preposterous. If I design a board and someone decides to use a cloned version in their machine and somebody gets killed because of a software update I can assure you that the case wouldn't even get to court. The instant it is discovered that the board was a fake the entire thing would be thrown out. There is no way anyone is going to hold the manufacturer responsible for ensuring that clones work property. That is not what they are in business to do.

LeifCarrotson 6y ago

I agree that anyone who built a device and knowingly used a counterfeit FTDI chip deserved to be punished. However, the FTDI debacle didn't punish those people, they're not the consumers. It punished end users who have no idea what an FTDI chip is or does or that one exists in the products they buy. In your airliner microcontroller example, you have much more informed consumers. They could reasonably be expected to know what processor is in their hardware, and to want to validate it. That's not the same. It would be more like a good packaging manufacturer finding that their packaging was being counterfeited and their proprietary plastic blend was somehow being leaked up the supply chain. If they changed their recipe to something toxic, but using good plastic internally, and when people started dying said "they should have bought potato chips packaged in genuine FoodSafeStuff bags". People don't know what their packaging is made from or who it's made by. They have no way to verify it prior to purchase, and even after purchase, it would take an expert to identify. And there's no customer loyalty based on the plastic bag, after the food manufacturer switches away from the counterfeit they won't be significantly harmed. But everyone who innocently bought those bags and got poisoned suffered real harm.

toohotatopic 6y ago
>People don't know what their packaging is made from or who it's made by. They have no way to verify it prior to purchase, and even after purchase, it would take an expert to identify. For food, you can't change the game without prior notice, but if it is clear that faked goods are toxic, people would start buying from trusted providers themselves. For electronics, I don't see a problem. If a device is bricked, go to your dealer and let him replace it. He will do the same for his supplier, etc. Somebody in the chain will discover that his supplier is a fraud. He will have to swallow the costs, but has learned a valuable lesson. If people have brought the product from some unstable source, then they most likely got it cheaper and they are now paying the price for the increased risk they took. It doesn't feel good but I don't think that it is unfair.
- pastage 6y ago
  The counterfeit FTDIs are ok. How drivers are created is a much bigger problem, the windows model specifically where hardware takes a long time, if ever, to be included in the default installation. Getting hardware to just work on windows was a mess (not sure if they have corrected this).

woah 6y ago

Why are the two options you present either to a) fully engineer and qa the driver to work with every possible counterfeit, or b) to insert malicious code to brick counterfeits? Seems like kind of a false dilemma.

robomartin 6y ago
There are a bunch of permutations, sure. What you are calling "malicious code" could --and likely is-- quality control code. The fact that fakes fail isn't the responsibility of the legitimate manufacturer. I don't know how many hypothetical examples I have to concoct to drive the point home. OK, here's another one. Fake Tesla. The real Tesla writes code that bricks the entire fake car. This is 100% pro-consumer. The fake Tesla could literally kill people. What you guys are arguing for is that Tesla should ensure that fakes are able to function. And, at the extremes, that Tesla is responsible for their proper function and safety. Think about that for a moment.
- erdo 6y ago
  Sure, and fake Tesla just happens to be bricked while it's driving in the fast lane of a motorway, or is accidentally bricked because a bug triggered the kill switch. Think about that for a moment.
  - robomartin 6y ago
    ...and it never occurred to you that a hypothetical is just a thinking tool rather than an absolute. OK, I'll play your game. The car would not turn on after being parked somewhere for four hours. Only an idiot software developer would brick it at high speed on the Autobahn.
    - 0x0 6y ago
      That's what FTDI did though. They pushed the malicious bricking driver through an automatic Windows Update to systems already running in production, no? That's pretty much the equivalent of going at high speed on the Autobahn.

erdo 6y ago

You're presenting this as a binary choice: a) > company should be responsible for ensuring that counterfeit devices work correctly or b) > bricking [the counterfeit] device as soon as possible The answer is almost always c) let it be, if it works fine, if not, not your problem. Adding any kind of bricking code anywhere, unnecessarily introduces the possibility that it will be unintentionally (or maliciously) activated. Personally I don't have that kind of confidence in software or the people that write it (and I am one of those people)

robomartin 6y ago
Here's another choice: Go ask the manufacturer of the fake chip to support it with their own driver. Really. As a hardware manufacturer, if you use a fake version of my product and demand that my software work with it you will hear the loud sound of the phone being hung up forcefully. The legitimate manufacturer can do anything it wants with the software and their hardware. If someone wants support for fakes they can provide it themselves. We are talking about encouraging or tolerating theft of intellectual property here. Having been the victim of this I am quite sensitive to the idea.
- indiv0 6y ago
  Your last comment brings this quote to mind: > It is difficult to get a man to understand something when his salary depends upon his not understanding it. No one is suggesting encouraging or tolerating theft of intellectual property. People are _discouraging_ vigilante justice against IP thieves. In this instance, because it harms consumers (an innocent party). You're arguing against strawmen when you claim that people are arguing for FTDI to support these chips. Instead what people are arguing for is for FTDI to not brick them _intentionally_.
  - robomartin 6y ago
    If you really take the time to think it through you should conclude that the forcing FTDI to back off is actually as anti-consumer as you can get. It guarantees long-lasting harm to consumers as counterfeiters now know they can continue to push their devices --of any kind, not just FTDI-- without suffering any consequences. In other words, when viewed with a long term perspective the mob actually succeeded at protecting the counterfeiters rather than consumers. That's what people disagreeing with my perspective are missing in this argument. Show me a legitimate scenario where giving counterfeiters a free pass leads to long term (decades) protections for consumers and there might be something to argue about. My quote is far better, BTW: "A man holding a cat by the tail learns something he can learn in no other way" --Mark Twain Most everyone voicing opinions on this thread has zero experience manufacturing products at scale and perhaps even running a non-trivial company. Nobody has held any of these cats by the tail and yet everyone seems to think they understand market and business dynamics. As my wife puts it (she is a doctor): A google search isn't a medical degree.

mrob 6y ago

It is impossible for the FTDI driver to reliably determine if a chip is counterfeit. The difference between a counterfeit and a compatible part is trademark violation, and that can only be detected by looking at the physical packaging and the marketing materials.

kire456 6y ago

You are advocating willful destruction of property. Property that is neither yours nor FTDI's. This is illegal, and broadly considered bad taste. A counterfeiter commiting crimes against FTDI does not excuse FTDI committing crimes against a third party (i.e. the consumer). The world being safer without the counterfeit products also does not excuse the FTDI destroying things that aren't theirs. The justice system being ineffective at addressing counterfeiters is also no excuse for FTDI to take matters into their own hands. Vigilante justice is usually illegal. Programmers make mistakes. A bug in your counterfeit detection code may end up destroying legit products. In addition, you can not be sure destroying a product will be safe - if the chip is in a medical device, you might be killing someone. The entire idea of destroying a product without explicitly being told to do so is fraught with peril. You deal in false binaries. The third, imo correct, option is for FTDI to design software that works correctly with their own product, and spend no effort on the counterfeits - neither to get them to work correctly, nor to brick them on purpose. A fourth option, if you want to spend some effort on something other than destruction of property, is to take option three, and also alert the user that they are using a counterfeit chip with unpredictable behaviour, and in your airplane example, advise the user they should probably not take off. If you want to be pro-consumer, this is a better way to go about it than smashing their stuff. From the consumer's perspective, they had a working device, and a firmware update bricked it on purpose. It is possibly out of warranty, in which case they end up footing the bill (or experiencing frustration) for replacement and downtime. It takes Olympic levels of mental gymnastics to view that as 'pro-consumer', imo.

robomartin 6y ago

Some hours later, reviewing all responses... The primary counter argument to mine requires an inversion of responsibilities and ascribes criminality to the victim. Devices got bricked because counterfeiters committed a crime in the first place. Along the same lines, there are supply chain questions that are impossible to answer: How many of these device manufacturers knowingly used fake chips because they cost less? How many distributors knowingly shipped fake components because, again, they cost less and delivered higher margins? How many device manufacturers were true innocent victims who did not know fake devices had been substituted for the real thing? How many failures of import controls led to consumers receiving devices with fake chips? I have had the experience of having major US electronics parts distributors knowingly substitute defective --yet genuine-- parts instead of the top grade parts we ordered. The effect was what the hardware sector generally refers to as "infant mortality", where your hardware fails early or becomes unreliable due to substandard components. It took months for these effects to come out into the open and for the major US distributor to own up to this against the threat on our part of legal action. Not only did they replace all components with legitimate top grade parts, they also paid the costs involved in replacing the affected systems for our customers. My guess is that the context lacking most, if not all, who disagree with my position perspective that comes from having "skin in the game" in the domain we are discussing. The knee-jerk reaction is to think bricking these devices is bad for consumers, as if that would have been the end of the story. No, in a properly functioning economy and legal system this would and should lead to tracing through levels of responsibility as far as possible, with consumers being made whole with properly engineered and manufactured devices. The end result of forcing FTDI to not protect their product from counterfeiters is that not one consumer today can be assured the devices they purchase has quality reliable parts that will function according to specifications. A chip can, quite literally, go up in flames (I had this happen to me with a cheap Chinese device) because we did not support FTDI in disallowing fake chips from the market. Sure, there would have been short term pain and a bunch of companies and suppliers fixing their pipelines and designs. Yet, we would have emerged with an above-average guarantee of quality and performance and counterfeiters thinking real hard before doing what they do. Instead the feedback we gave counterfeiters is "you win". And the result we obtained for consumers is "you lose, forever". This incident extends well past FTDI. Because the mob won and forced FTDI to accept fakes it now means nobody is going to take similar steps towards protecting their products. Which, in turn, means counterfeiters know they won and know they can get away with it. Consumers, once more, lose, big and in unknown ways. We are swimming in a sea of fake products. The only way to stop this is if fake products become losing propositions for producers, suppliers, manufacturers and consumers. I mentioned I had a chip go up in flames. A while back I bought a little humanoid robot directly from a vendor in China. One of these things with 15 to 20 servos and, typically, a mobile phone class processor powering it and the touch screen on the chest. I bought several of them as part of a business venture. A couple of days after receiving them one of my kids was working with it on the table in the garage. As the robot walked, it failed to take a step and fell. It just planked onto the table, a 90 degree rotation from the toes, nothing too dramatic. In an instant flames were shooting out of the chest. Flames, not smoke. Since we were in the garage it was an easy matter to open the door and toss the thing onto the driveway. Upon inspection we found a crater at the center of the ARM processor on the main board. It failed and took a bunch of other parts with it. I contacted the company and very specifically asked about the source of this processor. We were actually considering importing and modifying this robot in quantity for educational purposes. In other words, we had established an engineering relationship with this company, this wasn't a case of just another consumer buying their product. They pretty much told me they bought the cheapest ARM processor clone they could source in China. This was and was not a revelation to me. Having done business with China for some time, as well as having a number of friends and business acquaintances doing business in China, nothing surprises me any more. The degree of supervision and cross checking you have to engage in when doing business with China is impossible for someone outside of manufacturing to grasp. It takes a lot of work to ensure safe products are landed in Europe and the US. When you deal with European or US companies this requirement almost disappears because you can generally trust they will deliver what they agreed to supply at the required level of quality. Taking the case of this real product, this robot, as an example, it would have been far better if --through whatever mechanism-- the thing had been bricked by the processor manufacturer before it got into the hands of any consumer. I cringe to think that this company likely sold tens of thousands of these units into homes and schools that could, due to fake chip issues and low component quality, go up in flames any time. We got lucky in that the robot ignited while we were there and under circumstances that were easy to control. This could have happened in the middle of the night and the story would have been potentially horrific. Be careful to think that allowing consumers to be fed fake products of unknown quality and traceability equates to having a pro-consumer stance. Due to this FTDI event it is likely consumers today have no clue what quality and safety has gone into the products they are using. This is not a good outcome. The right path would have been to take the pain of fixing the real problem and make consumers whole through both corporate responsibility and the legal system. In other words, FTDI is a victim and consumers are now even larger victims because the fake chip content of their devices is likely to go well beyond a little USB chip. No way to know how far and wide this has gone. A clear case of good intentions actually causing more damage to consumers. OK, I'm done. I don't expect to change anyone's mind. Just stating a perspective I think many don't have because they don't have practical experience at scale in the world of hardware manufacturing and support. If it makes even one person think this through, research and perhaps understand, I am satisfied. Be tolerant of contrasting perspectives...you might just be wrong and not know it...or, even worse, one day you will be correct and the mob will dismiss you just as you have to others when you think you are right. Tolerance is important. Don't punish, dismiss and ignore those who you do not agree with because one day that person could be you.