10 ms·

FTDI FT232RL: Real vs. Fake (2014)

45 points by buran77 5y ago

kencausey 5y ago
(2014)
- resonanttoe 5y ago
  This would have been nice in the title of the post here. I was getting slightly worried about some of my tools until I saw the "Update 25th of October 2014:" at the bottom (Cause I missed the date header at the top).
mbreese 5y ago
This was likely submitted (again?) because it was used as an example in this recent ArsTechnica article: https://arstechnica.com/gadgets/2021/06/chip-shortages-lead-to-more-counterfeit-chips-and-devices/ https://arstechnica.com/gadgets/2021/06/chip-shortages-lead-... (which was posted to HN here: https://news.ycombinator.com/item?id=27506662 https://news.ycombinator.com/item?id=27506662)
squarefoot 5y ago
Some context about the what happened years ago with fake (but compatible and working) FT232 chips that were intentionally bricked by FTDI updated Windows driver, that is, hitting (often unaware) users instead of counterfeiters. https://www.microchip.com/forums/m828027.aspx https://www.microchip.com/forums/m828027.aspx Luckily Open Source drivers were unaffected. One more point in favor of Open Source, and a good argument to stay away from products by FTDI.
- makomk 5y ago
  In this particular case, the commonly-available FT232 clones supposedly worked better than the original - the bit banging mode actually worked reliably on the knock-offs, whereas not so much on the actual FTDI chips. (The difference that FTDI used to brick the clones was that writing to the EEPROM one byte at a time, which wasn't allowed according to the datasheet, worked on the clones but not their own chips.)
  - Syonyk 5y ago
    Unfortunately, the clones also weren't clock stable at all - they were fine at 115200 and such, but if you pushed them up to 3Mbaud or so, they mostly read/wrote garbage. I put a few of them on a good scope and the timing was just all over the place. The legit FTDIs are rock solid on their timing even up at high baud rates. So I got some legit chips and just did the surface mount rework to replace the fakes with the legit ones and solved my problem. I had no idea when I got the adapters that they had fake chips on them. :/
    - marcan_42 5y ago
      Bit bang mode is the opposite. The clones work fine. The legit ones don't work at all (completely random timing) except at 3Mbaud (the official workaround), but at that speed you can't keep the buffer fed via USB so it's useless. https://twitter.com/marcan42/status/695292366639378433?s=19 https://twitter.com/marcan42/status/695292366639378433?s=19
- taneq 5y ago
  Yeah, I used FTDI back when they first came out and there was nothing else like it on the market (that I know of, anyway). Would never use them again after that little stunt.
- marcan_42 5y ago
  And amusingly, the bricking worked because again the clones worked better. The clones had implemented FTDI's EEPROM interface as designed, 16 bits at a time, while FTDI apparently had used a 32bit array for the internal FT232 EEPROM, and so would buffer 16 bits and only write all 32 bits when you issue writes to odd addresses. FTDI's bricking code uses writes to even addresses only (including computing a preimage attack on their checksum algorithm, as the checksum is at an odd address so they can't change it), which is why it doesn't affect the real ones.
- mdip 5y ago
  This is incredibly interesting. From the articles I've been able to dig up, it sounds as though they've outright admitted to breaking the counterfeit products and it was not an accident[0]. Rather than simply state "We've detected a counterfeit product. If our driver works at all with this product, it will probably be unreliable. It may also break it, entirely. We recommend buying a replacement from (xyz) and requesting a refund from the retailer your purchased it from" Maybe allow them to continue "at their peril", but intentionally break it? That's just stupid. Consider that this is a device that is probably being used by a company, a developer or otherwise power-user who will likely purchase more than one, did intentionally breaking the one they had make them want to purchase a genuine one or any future product from you? Or did you just cause a poor sysadmin to make it their mission in life to cause your future bankruptcy? It'd make me investigate any alternative to an FTDI product for any future purchase, and they did that, not the counterfeit-maker. This is such an awesome "punch the customer" response; it's like the RIAA/MPAA are moonlighting in management over there. I loved the FTDI official response, somewhere highlighted is how awful counterfeits are for their business. It's really difficult to feel sympathy for a company who so recklessly disregarded my business by destroying something I owned that they didn't make -- trademark/counterfeit law aside, the only person who got victimized twice was the person who thought they purchased an FTDI product. [0] https://arstechnica.com/information-technology/2014/10/ftdis-anti-counterfeiting-efforts-sit-between-a-rock-and-a-hard-place/ https://arstechnica.com/information-technology/2014/10/ftdis...
bombcar 5y ago
Counterfeit but working seems a whole different ballgame than counterfeit and absolutely not even possible to work. It’s interesting that they went to the bother to mimic the chip without simply duplicating the entire chip and layout.
- kjs3 5y ago
  Not necessarily. I'll take "doesn't work at all" over "works great but counterfeiter didn't copy any safety controls so at some point it's gonna burst into flames".
- makomk 5y ago
  As it turns out, apparently it's easier to develop an exact protocol-level clone of an existing USB to serial chip which already has working drivers than it is to write reliable, high-quality serial drivers for a new chip. This may say something about the state of software these days.
  - dmatech 5y ago
    It's presumably for the same reason that people make knock-offs of chips like the MPU-401 UART and the ELM327. There's a large installed base of applications for them. The drivers themselves can't possibly be that complex. But getting a USB-IF vendor ID as well as drivers in Windows is probably a bit harder. Not only does Linux have its own drivers, they can unbrick the damaged devices. https://www.mail-archive.com/linux-usb@vger.kernel.org/msg50762.html https://www.mail-archive.com/linux-usb@vger.kernel.org/msg50...
    - bombcar 5y ago
      Also Windows isn’t the only system out there - I suspect that being able to be used in various embedded solutions is also important.
    - mdip 5y ago
      > Not only does Linux have its own drivers, they can unbrick the damaged devices. Thanks for that. I haven't used my counterfeit FTDI cable in probably 2 years, but I was trying to figure out how I had not encountered any issues with it. I only happened to find out it was counterfeit due to the fact that I purchased it via a link in a forum recommended by "some user", and later, when I had this stupid looking cable and no idea where to plug the ends into my Pi, I revisited the forum, scrolled down a few replies, and found out that all of the "FTDI" products from the manufacturer of my cable were fakes. Once I read that, I had intended on replacing it, but decided to wire it up anyway to see if it would work. I run OpenSUSE Tumbleweed on my main computer, and I don't remember having to do anything unusual, or encountering any warnings/errors at the time trying to use it[0], I'm guessing that's why... [0] I was trying to connect into a headless RPi and that was the most convenient way sometimes.
deleted 5y ago
[deleted]
CamperBob2 5y ago
The FTDI debacle may be old news, but lots of companies are probably faced with similar risks now, having been forced to turn to unfamiliar Asian brokers and other unofficial sources for parts that used to be commonly available but now have lead times of a year or more. That includes me. :( Do I recommend that the company order thousands of STM32 MCUs from a place in Shenzhen that they've never heard of, and that our EMS facility won't have anything to do with? Assuming the parts even show up, will they be counterfeits? Recycled? Handled and stored inappropriately? Is it OK to ship hardware built with dubiously-sourced parts to customers? Can we rationalize the quality risk away? Or is it more ethical to sit around and starve because we can't ship products for a year...?
- technothrasher 5y ago
  Being in the exact same boat as you, wondering whether to order STM32 MCUs from who knows who in China, we punted the questions you ask directly to our customers. Do they want to risk the quality issues or wait a year for their product?
officialchicken 5y ago
It's worth mentioning that FTDI's response to this was to update their windows drivers [1] - which caused the fake devices to be bricked - and that affected a lot of companies who unknowingly had used the fake chips on their PCB designs. Eventually they reversed course but a lot of HW was essentially sent to the landfill. [1] https://arstechnica.com/information-technology/2014/10/ftdis-anti-counterfeiting-efforts-sit-between-a-rock-and-a-hard-place/ https://arstechnica.com/information-technology/2014/10/ftdis...
- RicoElectrico 5y ago
  > a lot of HW was essentially sent to the landfill. I mean, you could replace fake with the original quite easily as a drop-in replacement? 5-minute soldering job.
  - Klinky 5y ago
    Rework is extremely expensive, especially if you imported the devices and don't have manufacturing facilities of your own, plus the potential cost of retrieving units in the field. The soldering is the easy part. Labor and logistics are the hard part.
  - comfydragon 5y ago
    Not quite, at least not necessarily. One feature of FTDI chips is an EEPROM that can be used to customize the enabled features, enumeration strings, and other things. That programming could probably be done in a separate jig, or in-circuit. So yes, 5 minutes of hardware work, but more potential rework at a higher level. Not to mention the possibility of sealed cases/enclosures or potted PCBs.
  - CamperBob2 5y ago
    Instructions unclear, accidentally built Dropbox
  - x0 5y ago
    5-minute job for someone with a hot air rework station and experience soldering SOICs. Assuming no conformal coating or anything weird.
ohazi 5y ago
TIL FTDI converters use a 600-800 nm node... that's almost a micron! The fact that they sell their chips for five fucking dollars a pop has always been kind of obscene, but on such an old node, they really shouldn't cost more than a dollar, tops. No wonder they're so heavily cloned.
- lmilcin 5y ago
  The process is irrelevant and it is stupid to complain about it. Most chips are not general purpose CPUs and don't need and would not benefit from 5nm transistors. Larger components are actually preferable when talking signal noise, ESD susceptibility, etc.
  - Dylan16807 5y ago
    The complaint is about price, not process. But I'm also surprised something so large is being used. Isn't 130/180nm cheap for any kind of significant volume?
    - deleted 5y ago
      [deleted]
    - yjftsjthsd-h 5y ago
      Sure, but what's the benefit?
      - vardump 5y ago
        Lower power consumption.
        lmilcin 5y ago
        These chips already consume next to nothing.
      - Dylan16807 5y ago
        The benefit is getting like 5x as many chips per wafer.
zelon88 5y ago
Probably an unpopular opinion, but if you have a bricked device with counterfeit components you should go to the manufacturer of the device and demand they make you whole. Also call into question their quality control mechanisms and supply chain security. They bought defective components. It is insane to blame the chip marker. They have a reputation to uphold. How can they be expected to continue operating if they not only have to compete with shoddy knockoffs, but basically support them with QA as well? If China can't afford to play with closed source, maybe they should invest in open source.
- Dylan16807 5y ago
  > They bought defective components. The genuine chips can also be bricked by a very similar command sequence. Are they also defective? > It is insane to blame the chip marker. They have a reputation to uphold. How can they be expected to continue operating if they not only have to compete with shoddy knockoffs, but basically support them with QA as well? So refuse to operate with the fake chips. Bricking is unnecessary and deserving of blame. And as the article points out, a chip that's merely compatible and not counterfeit might also get bricked.
  - rvnx 5y ago
    You use a driver of a manufacturer on a device not manufactured by this manufacturer. This driver is licensed to you only to be used with such devices. "The licence only allows use of the Software with, and the Software will only work with Genuine FTDI Components (as defined in the Licence Terms). Use of the Software as a driver for a component that is not a Genuine FTDI Component MAY IRRETRIEVABLY DAMAGE THAT COMPONENT. It is your responsibility to make sure that all chips you use the Software as a driver for are Genuine FTDI Components. If in doubt then contact FTDI. The Software is provided “as is”. There are no warranties (or similar) in relation to the quality of the Software." Seems pretty clear to me.
    - Dylan16807 5y ago
      Putting "this software kicks puppies" into the EULA doesn't morally absolve you for doing the puppy kicking. I still get to blame them for designing a puppy kick module! Edit: Someone made a reply quoting this comment https://www.eevblog.com/forum/microcontrollers/ftdi-gate-2-0/msg854411/#msg854411 https://www.eevblog.com/forum/microcontrollers/ftdi-gate-2-0... and I already wrote a response so I'm going to put it here: Linux kernel? Really? The whole point of that is to reuse code as much as possible. Even for Windows, the point of getting things into Windows Update is to make hardware just work, not to advantage one company over another. But sure, they can make a reasonable argument toward making the driver incompatible. (If they're also willing to hurt people that tried to buy genuine parts.) It still doesn't justify the bricking. > slightly higher sales price Ha! I'm pretty sure it isn't "slightly".
bobsmooth 5y ago
I used a fake arduino for my capstone project and just before we had to present, I needed to update the code. I didn't have my laptop, so I used my partner's which did not have the fake(?) driver. Just as I plugged it in I realized my mistake and bricked the arduino. We weren't able to demonstrate our project. I can totally understand the driver not working, but to brick other people's hardware with an automatic driver update will forever make my blood boil.
- ohazi 5y ago
  If they had a case, it would have been against the Chinese manufacturers of the copycat chips, or against product manufacturers who (often inadvertently) used the mislabeled, fraudulently sold chips in designs that called for real FTDI chips. If suing a Chinese company is hard, they could have also worked with law enforcement to conduct the same sort of "find and destroy inventory" sting operations that the police sometimes do for counterfeit handbags. Instead they went rogue and did the equivalent of personally barging into everybody's home and shooting up their appliances. What if they had bricked life support equipment, or part of an airliner? It was so unbelievably reckless -- I don't understand how any of their lawyers could have possibly signed off on such a stunt. They should have been sued into oblivion for it.
  - buran77 5y ago
    > What if they had bricked life support equipment, or part of an airliner While I agree that was a bad strategy, even more so from a PR standpoint, I'd like to believe critical industries like medical electronics or avionics would do a better job not only validating components (even at the individual level) but also subsequent software updates. Electronics are less a wear part than mechanical parts where counterfeits have an easier time sneaking in (the occasional counterfeit screw let's say). Any scenario involving any kind of failure looks more dire when you attach it to "life support", "airplane", or "nuclear facility".
    - maztaim 5y ago
      Don’t believe that, please. Medical equipment used for ventilation and sleep apnea contain foam that blows carcinogenic fumes and bits of carcinogenic foam directly into your lungs: https://www.usa.philips.com/healthcare/e/sleep/communications/src-update https://www.usa.philips.com/healthcare/e/sleep/communication...
throwaway81523 5y ago
Is this FTDI stuff still of interest to hardware people, now that every jellybean microcontroller has USB and UARTs built in? I see that an FTDI usb-to-serial cable is still around $20 but a Raspberry Pi Pico is $4 and and this board ( https://www.seeedstudio.com/CH551G-Development-board-p-4764.html https://www.seeedstudio.com/CH551G-Development-board-p-4764.... ) (also available from Digikey if you don't want to order from China) is $1.49. Can I do the same things with those, easily enough?
- exmadscientist 5y ago
  FTDI-style chips are still extremely relevant to hardware development, because they're plug-and-play. They just go. No buggy software to work around or kLOC to write yourself. The time and effort saved there is real and valuable. That's for one-offs and debugging connections, though. If you're shipping a product, then suddenly the economics change and the software-heavy solutions start to look good again.
  - throwaway81523 5y ago
    Thanks, what I'm wondering is whether you can program one of those boards as a USB converter one time and be done with it. It really shouldn't take KLOC, I hope, and it even seems likely that such code is already out there. The idea then is that you can use a board with that code instead of an FTDI cable from then on.
    - exmadscientist 5y ago
      Unfortunately USB stacks are pretty heavyweight. On a Cortex-M3 class part they end up around 6kB compiled. You have three basic options for getting them going: 1. Trust your vendor's libraries/ROM drivers/example code. This is the fastest to bring up, the least flexible, the buggiest (it's vendor code!) and the hardest to debug. (Trust me on the debugging part.) 2. Use a library like tinyUSB. This can actually go pretty quickly, since you've got full source control. If your part is popular enough that someone else has already done most of the work, this is by far the best choice. Even if you have to get personal with the hardware, I still like this option. (tinyUSB is much better than what came before... I wish it'd been around last time I had to do this.) 3. Write your own. Don't do this. (You might have to do parts of this if you tried #1 and it isn't panning out.) All of these are doable. Any of them are enough work that if you're only making one, just put the FTDI down and call it done.
dng88 5y ago
Just like the chinese nuclear plant that is reaching failure stage, the strategy one is bog enough and large enough can get away of everything. No one can stop it. Instead all should help it to continue to run unsafely or illegally. Just like the virus, we cannot investigate, cannot stop it, cannot even name (but can say for others abd even now x.x mostly from Uk etc.). Humanity not just your serial driver is actually at stake. Have to stop or start somewhere. Wrong is wrong. Say it, do it abd actively buy only real and legal one. Please.
FounderBurr 5y ago
Queue the entitled prats lining up to punch FTDI because they feel entitled to FTDI drivers and software be free to them and not damage their Chinese knockoff chips. But their time and labor? Nobody can understand how valuable it is!
- lloydatkinson 5y ago
  Ah yes, the "entitled prats" such as the hundreds of organisations that had no idea their products were even using fake chips or the student in the comments who wasn't able to demo their project because they had to use a cheaper Arduino board that had a fake chip on it. Yeah, really "entitled". /s
MrBuddyCasino 5y ago
> What's the economic reason of making software fake of well-known chip instead of making new one under your own name? This way they don't need to buy USB VID, sign drivers in Microsoft, no expenses on advertisement. I thought this was a great example of second order effects at work.
A1kmm 5y ago
The fake FT232RL device in this article is actually a lot better than some of the devices on the market now. I bought an FT232RL breakout on eBay a year or so back, planning to use it in bit bang mode, and it turned out that while it worked for talking to UARTs, the bit bang mode was completely broken - and the EEPROM (needed to configure it the way I wanted it) was not even writable at all (probably not real EEPROM). In my case, it was a counterfeit - the product was explicitly advertised as FTDI FT232 but wasn't. I was fortunately able to get a refund for it through eBay. Sadly it is very hard to know what you are actually getting due to the prevalence of identically branded clones, and beyond refunding me eBay doesn't seem to have done much despite me pointing out that these devices are being advertised as FTDI FT232 but are actually significantly below the advertised specs. As discussed elsewhere here, FTDI pushed an update that deliberately tries to brick FT232 clones by writing bad data to their EEPROM - which obviously non-configurable devices would be immune from and might be one reason (alongside cost) which the people creating clones have cut out the real EEPROM now. I agree with those here the bricking was a very bad idea - not all clone chips were necessarily even counterfeits (it bricks based on PID / VID, and can't see what is actually written on the face of the chip; reusing a USB PID/VID registered by someone else to enable compatibility without using another company's trademark isn't counterfeiting). Given they deliberately destroyed other people's property because it contains a chip that might not even be counterfeit deeply embedded in it by the manufacturer, I think they are lucky not to have faced any lawsuits or prosecution.

45 points by buran77 5y ago

kencausey 5y ago

(2014)

resonanttoe 5y ago
This would have been nice in the title of the post here. I was getting slightly worried about some of my tools until I saw the "Update 25th of October 2014:" at the bottom (Cause I missed the date header at the top).

mbreese 5y ago

This was likely submitted (again?) because it was used as an example in this recent ArsTechnica article: https://arstechnica.com/gadgets/2021/06/chip-shortages-lead-to-more-counterfeit-chips-and-devices/ https://arstechnica.com/gadgets/2021/06/chip-shortages-lead-... (which was posted to HN here: https://news.ycombinator.com/item?id=27506662 https://news.ycombinator.com/item?id=27506662)

squarefoot 5y ago

Some context about the what happened years ago with fake (but compatible and working) FT232 chips that were intentionally bricked by FTDI updated Windows driver, that is, hitting (often unaware) users instead of counterfeiters. https://www.microchip.com/forums/m828027.aspx https://www.microchip.com/forums/m828027.aspx Luckily Open Source drivers were unaffected. One more point in favor of Open Source, and a good argument to stay away from products by FTDI.

makomk 5y ago
In this particular case, the commonly-available FT232 clones supposedly worked better than the original - the bit banging mode actually worked reliably on the knock-offs, whereas not so much on the actual FTDI chips. (The difference that FTDI used to brick the clones was that writing to the EEPROM one byte at a time, which wasn't allowed according to the datasheet, worked on the clones but not their own chips.)
- Syonyk 5y ago
  Unfortunately, the clones also weren't clock stable at all - they were fine at 115200 and such, but if you pushed them up to 3Mbaud or so, they mostly read/wrote garbage. I put a few of them on a good scope and the timing was just all over the place. The legit FTDIs are rock solid on their timing even up at high baud rates. So I got some legit chips and just did the surface mount rework to replace the fakes with the legit ones and solved my problem. I had no idea when I got the adapters that they had fake chips on them. :/
  - marcan_42 5y ago
    Bit bang mode is the opposite. The clones work fine. The legit ones don't work at all (completely random timing) except at 3Mbaud (the official workaround), but at that speed you can't keep the buffer fed via USB so it's useless. https://twitter.com/marcan42/status/695292366639378433?s=19 https://twitter.com/marcan42/status/695292366639378433?s=19
taneq 5y ago
Yeah, I used FTDI back when they first came out and there was nothing else like it on the market (that I know of, anyway). Would never use them again after that little stunt.
marcan_42 5y ago
And amusingly, the bricking worked because again the clones worked better. The clones had implemented FTDI's EEPROM interface as designed, 16 bits at a time, while FTDI apparently had used a 32bit array for the internal FT232 EEPROM, and so would buffer 16 bits and only write all 32 bits when you issue writes to odd addresses. FTDI's bricking code uses writes to even addresses only (including computing a preimage attack on their checksum algorithm, as the checksum is at an odd address so they can't change it), which is why it doesn't affect the real ones.
mdip 5y ago
This is incredibly interesting. From the articles I've been able to dig up, it sounds as though they've outright admitted to breaking the counterfeit products and it was not an accident[0]. Rather than simply state "We've detected a counterfeit product. If our driver works at all with this product, it will probably be unreliable. It may also break it, entirely. We recommend buying a replacement from (xyz) and requesting a refund from the retailer your purchased it from" Maybe allow them to continue "at their peril", but intentionally break it? That's just stupid. Consider that this is a device that is probably being used by a company, a developer or otherwise power-user who will likely purchase more than one, did intentionally breaking the one they had make them want to purchase a genuine one or any future product from you? Or did you just cause a poor sysadmin to make it their mission in life to cause your future bankruptcy? It'd make me investigate any alternative to an FTDI product for any future purchase, and they did that, not the counterfeit-maker. This is such an awesome "punch the customer" response; it's like the RIAA/MPAA are moonlighting in management over there. I loved the FTDI official response, somewhere highlighted is how awful counterfeits are for their business. It's really difficult to feel sympathy for a company who so recklessly disregarded my business by destroying something I owned that they didn't make -- trademark/counterfeit law aside, the only person who got victimized twice was the person who thought they purchased an FTDI product. [0] https://arstechnica.com/information-technology/2014/10/ftdis-anti-counterfeiting-efforts-sit-between-a-rock-and-a-hard-place/ https://arstechnica.com/information-technology/2014/10/ftdis...

bombcar 5y ago

Counterfeit but working seems a whole different ballgame than counterfeit and absolutely not even possible to work. It’s interesting that they went to the bother to mimic the chip without simply duplicating the entire chip and layout.

kjs3 5y ago
Not necessarily. I'll take "doesn't work at all" over "works great but counterfeiter didn't copy any safety controls so at some point it's gonna burst into flames".
makomk 5y ago
As it turns out, apparently it's easier to develop an exact protocol-level clone of an existing USB to serial chip which already has working drivers than it is to write reliable, high-quality serial drivers for a new chip. This may say something about the state of software these days.
- dmatech 5y ago
  It's presumably for the same reason that people make knock-offs of chips like the MPU-401 UART and the ELM327. There's a large installed base of applications for them. The drivers themselves can't possibly be that complex. But getting a USB-IF vendor ID as well as drivers in Windows is probably a bit harder. Not only does Linux have its own drivers, they can unbrick the damaged devices. https://www.mail-archive.com/linux-usb@vger.kernel.org/msg50762.html https://www.mail-archive.com/linux-usb@vger.kernel.org/msg50...
  - bombcar 5y ago
    Also Windows isn’t the only system out there - I suspect that being able to be used in various embedded solutions is also important.
  - mdip 5y ago
    > Not only does Linux have its own drivers, they can unbrick the damaged devices. Thanks for that. I haven't used my counterfeit FTDI cable in probably 2 years, but I was trying to figure out how I had not encountered any issues with it. I only happened to find out it was counterfeit due to the fact that I purchased it via a link in a forum recommended by "some user", and later, when I had this stupid looking cable and no idea where to plug the ends into my Pi, I revisited the forum, scrolled down a few replies, and found out that all of the "FTDI" products from the manufacturer of my cable were fakes. Once I read that, I had intended on replacing it, but decided to wire it up anyway to see if it would work. I run OpenSUSE Tumbleweed on my main computer, and I don't remember having to do anything unusual, or encountering any warnings/errors at the time trying to use it[0], I'm guessing that's why... [0] I was trying to connect into a headless RPi and that was the most convenient way sometimes.

deleted 5y ago

[deleted]

CamperBob2 5y ago

The FTDI debacle may be old news, but lots of companies are probably faced with similar risks now, having been forced to turn to unfamiliar Asian brokers and other unofficial sources for parts that used to be commonly available but now have lead times of a year or more. That includes me. :( Do I recommend that the company order thousands of STM32 MCUs from a place in Shenzhen that they've never heard of, and that our EMS facility won't have anything to do with? Assuming the parts even show up, will they be counterfeits? Recycled? Handled and stored inappropriately? Is it OK to ship hardware built with dubiously-sourced parts to customers? Can we rationalize the quality risk away? Or is it more ethical to sit around and starve because we can't ship products for a year...?

technothrasher 5y ago
Being in the exact same boat as you, wondering whether to order STM32 MCUs from who knows who in China, we punted the questions you ask directly to our customers. Do they want to risk the quality issues or wait a year for their product?

officialchicken 5y ago

It's worth mentioning that FTDI's response to this was to update their windows drivers [1] - which caused the fake devices to be bricked - and that affected a lot of companies who unknowingly had used the fake chips on their PCB designs. Eventually they reversed course but a lot of HW was essentially sent to the landfill. [1] https://arstechnica.com/information-technology/2014/10/ftdis-anti-counterfeiting-efforts-sit-between-a-rock-and-a-hard-place/ https://arstechnica.com/information-technology/2014/10/ftdis...

RicoElectrico 5y ago
> a lot of HW was essentially sent to the landfill. I mean, you could replace fake with the original quite easily as a drop-in replacement? 5-minute soldering job.
- Klinky 5y ago
  Rework is extremely expensive, especially if you imported the devices and don't have manufacturing facilities of your own, plus the potential cost of retrieving units in the field. The soldering is the easy part. Labor and logistics are the hard part.
- comfydragon 5y ago
  Not quite, at least not necessarily. One feature of FTDI chips is an EEPROM that can be used to customize the enabled features, enumeration strings, and other things. That programming could probably be done in a separate jig, or in-circuit. So yes, 5 minutes of hardware work, but more potential rework at a higher level. Not to mention the possibility of sealed cases/enclosures or potted PCBs.
- CamperBob2 5y ago
  Instructions unclear, accidentally built Dropbox
- x0 5y ago
  5-minute job for someone with a hot air rework station and experience soldering SOICs. Assuming no conformal coating or anything weird.

ohazi 5y ago

TIL FTDI converters use a 600-800 nm node... that's almost a micron! The fact that they sell their chips for five fucking dollars a pop has always been kind of obscene, but on such an old node, they really shouldn't cost more than a dollar, tops. No wonder they're so heavily cloned.

lmilcin 5y ago
The process is irrelevant and it is stupid to complain about it. Most chips are not general purpose CPUs and don't need and would not benefit from 5nm transistors. Larger components are actually preferable when talking signal noise, ESD susceptibility, etc.
- Dylan16807 5y ago
  The complaint is about price, not process. But I'm also surprised something so large is being used. Isn't 130/180nm cheap for any kind of significant volume?
  - deleted 5y ago
    [deleted]
  - yjftsjthsd-h 5y ago
    Sure, but what's the benefit?
    - vardump 5y ago
      Lower power consumption.
      - lmilcin 5y ago
        These chips already consume next to nothing.
    - Dylan16807 5y ago
      The benefit is getting like 5x as many chips per wafer.

zelon88 5y ago

Probably an unpopular opinion, but if you have a bricked device with counterfeit components you should go to the manufacturer of the device and demand they make you whole. Also call into question their quality control mechanisms and supply chain security. They bought defective components. It is insane to blame the chip marker. They have a reputation to uphold. How can they be expected to continue operating if they not only have to compete with shoddy knockoffs, but basically support them with QA as well? If China can't afford to play with closed source, maybe they should invest in open source.

Dylan16807 5y ago
> They bought defective components. The genuine chips can also be bricked by a very similar command sequence. Are they also defective? > It is insane to blame the chip marker. They have a reputation to uphold. How can they be expected to continue operating if they not only have to compete with shoddy knockoffs, but basically support them with QA as well? So refuse to operate with the fake chips. Bricking is unnecessary and deserving of blame. And as the article points out, a chip that's merely compatible and not counterfeit might also get bricked.
- rvnx 5y ago
  You use a driver of a manufacturer on a device not manufactured by this manufacturer. This driver is licensed to you only to be used with such devices. "The licence only allows use of the Software with, and the Software will only work with Genuine FTDI Components (as defined in the Licence Terms). Use of the Software as a driver for a component that is not a Genuine FTDI Component MAY IRRETRIEVABLY DAMAGE THAT COMPONENT. It is your responsibility to make sure that all chips you use the Software as a driver for are Genuine FTDI Components. If in doubt then contact FTDI. The Software is provided “as is”. There are no warranties (or similar) in relation to the quality of the Software." Seems pretty clear to me.
  - Dylan16807 5y ago
    Putting "this software kicks puppies" into the EULA doesn't morally absolve you for doing the puppy kicking. I still get to blame them for designing a puppy kick module! Edit: Someone made a reply quoting this comment https://www.eevblog.com/forum/microcontrollers/ftdi-gate-2-0/msg854411/#msg854411 https://www.eevblog.com/forum/microcontrollers/ftdi-gate-2-0... and I already wrote a response so I'm going to put it here: Linux kernel? Really? The whole point of that is to reuse code as much as possible. Even for Windows, the point of getting things into Windows Update is to make hardware just work, not to advantage one company over another. But sure, they can make a reasonable argument toward making the driver incompatible. (If they're also willing to hurt people that tried to buy genuine parts.) It still doesn't justify the bricking. > slightly higher sales price Ha! I'm pretty sure it isn't "slightly".

bobsmooth 5y ago

I used a fake arduino for my capstone project and just before we had to present, I needed to update the code. I didn't have my laptop, so I used my partner's which did not have the fake(?) driver. Just as I plugged it in I realized my mistake and bricked the arduino. We weren't able to demonstrate our project. I can totally understand the driver not working, but to brick other people's hardware with an automatic driver update will forever make my blood boil.

ohazi 5y ago
If they had a case, it would have been against the Chinese manufacturers of the copycat chips, or against product manufacturers who (often inadvertently) used the mislabeled, fraudulently sold chips in designs that called for real FTDI chips. If suing a Chinese company is hard, they could have also worked with law enforcement to conduct the same sort of "find and destroy inventory" sting operations that the police sometimes do for counterfeit handbags. Instead they went rogue and did the equivalent of personally barging into everybody's home and shooting up their appliances. What if they had bricked life support equipment, or part of an airliner? It was so unbelievably reckless -- I don't understand how any of their lawyers could have possibly signed off on such a stunt. They should have been sued into oblivion for it.
- buran77 5y ago
  > What if they had bricked life support equipment, or part of an airliner While I agree that was a bad strategy, even more so from a PR standpoint, I'd like to believe critical industries like medical electronics or avionics would do a better job not only validating components (even at the individual level) but also subsequent software updates. Electronics are less a wear part than mechanical parts where counterfeits have an easier time sneaking in (the occasional counterfeit screw let's say). Any scenario involving any kind of failure looks more dire when you attach it to "life support", "airplane", or "nuclear facility".
  - maztaim 5y ago
    Don’t believe that, please. Medical equipment used for ventilation and sleep apnea contain foam that blows carcinogenic fumes and bits of carcinogenic foam directly into your lungs: https://www.usa.philips.com/healthcare/e/sleep/communications/src-update https://www.usa.philips.com/healthcare/e/sleep/communication...

throwaway81523 5y ago

Is this FTDI stuff still of interest to hardware people, now that every jellybean microcontroller has USB and UARTs built in? I see that an FTDI usb-to-serial cable is still around $20 but a Raspberry Pi Pico is $4 and and this board ( https://www.seeedstudio.com/CH551G-Development-board-p-4764.html https://www.seeedstudio.com/CH551G-Development-board-p-4764.... ) (also available from Digikey if you don't want to order from China) is $1.49. Can I do the same things with those, easily enough?

exmadscientist 5y ago
FTDI-style chips are still extremely relevant to hardware development, because they're plug-and-play. They just go. No buggy software to work around or kLOC to write yourself. The time and effort saved there is real and valuable. That's for one-offs and debugging connections, though. If you're shipping a product, then suddenly the economics change and the software-heavy solutions start to look good again.
- throwaway81523 5y ago
  Thanks, what I'm wondering is whether you can program one of those boards as a USB converter one time and be done with it. It really shouldn't take KLOC, I hope, and it even seems likely that such code is already out there. The idea then is that you can use a board with that code instead of an FTDI cable from then on.
  - exmadscientist 5y ago
    Unfortunately USB stacks are pretty heavyweight. On a Cortex-M3 class part they end up around 6kB compiled. You have three basic options for getting them going: 1. Trust your vendor's libraries/ROM drivers/example code. This is the fastest to bring up, the least flexible, the buggiest (it's vendor code!) and the hardest to debug. (Trust me on the debugging part.) 2. Use a library like tinyUSB. This can actually go pretty quickly, since you've got full source control. If your part is popular enough that someone else has already done most of the work, this is by far the best choice. Even if you have to get personal with the hardware, I still like this option. (tinyUSB is much better than what came before... I wish it'd been around last time I had to do this.) 3. Write your own. Don't do this. (You might have to do parts of this if you tried #1 and it isn't panning out.) All of these are doable. Any of them are enough work that if you're only making one, just put the FTDI down and call it done.

dng88 5y ago

Just like the chinese nuclear plant that is reaching failure stage, the strategy one is bog enough and large enough can get away of everything. No one can stop it. Instead all should help it to continue to run unsafely or illegally. Just like the virus, we cannot investigate, cannot stop it, cannot even name (but can say for others abd even now x.x mostly from Uk etc.). Humanity not just your serial driver is actually at stake. Have to stop or start somewhere. Wrong is wrong. Say it, do it abd actively buy only real and legal one. Please.

FounderBurr 5y ago

Queue the entitled prats lining up to punch FTDI because they feel entitled to FTDI drivers and software be free to them and not damage their Chinese knockoff chips. But their time and labor? Nobody can understand how valuable it is!

lloydatkinson 5y ago
Ah yes, the "entitled prats" such as the hundreds of organisations that had no idea their products were even using fake chips or the student in the comments who wasn't able to demo their project because they had to use a cheaper Arduino board that had a fake chip on it. Yeah, really "entitled". /s

MrBuddyCasino 5y ago

> What's the economic reason of making software fake of well-known chip instead of making new one under your own name? This way they don't need to buy USB VID, sign drivers in Microsoft, no expenses on advertisement. I thought this was a great example of second order effects at work.

A1kmm 5y ago

The fake FT232RL device in this article is actually a lot better than some of the devices on the market now. I bought an FT232RL breakout on eBay a year or so back, planning to use it in bit bang mode, and it turned out that while it worked for talking to UARTs, the bit bang mode was completely broken - and the EEPROM (needed to configure it the way I wanted it) was not even writable at all (probably not real EEPROM). In my case, it was a counterfeit - the product was explicitly advertised as FTDI FT232 but wasn't. I was fortunately able to get a refund for it through eBay. Sadly it is very hard to know what you are actually getting due to the prevalence of identically branded clones, and beyond refunding me eBay doesn't seem to have done much despite me pointing out that these devices are being advertised as FTDI FT232 but are actually significantly below the advertised specs. As discussed elsewhere here, FTDI pushed an update that deliberately tries to brick FT232 clones by writing bad data to their EEPROM - which obviously non-configurable devices would be immune from and might be one reason (alongside cost) which the people creating clones have cut out the real EEPROM now. I agree with those here the bricking was a very bad idea - not all clone chips were necessarily even counterfeits (it bricks based on PID / VID, and can't see what is actually written on the face of the chip; reusing a USB PID/VID registered by someone else to enable compatibility without using another company's trademark isn't counterfeiting). Given they deliberately destroyed other people's property because it contains a chip that might not even be counterfeit deeply embedded in it by the manufacturer, I think they are lucky not to have faced any lawsuits or prosecution.