7 ms·

Avoid all links to kicad-pcb.org – Use kicad.org

177 points by 1MachineElf 5y ago

dplarson 5y ago
In case it's helpful, here's the first paragraph from the post: "The original KiCad domain name (kicad-pcb.org) was recently sold to an unnamed third party that is not affiliated with the KiCad Project or members of the KiCad Development Team. This sale was unexpected and may pose a risk to KiCad users. The new owners may simply post advertisements or (worst-case scenario) they may host malicious versions of the KiCad software for download."
- cookiengineer 5y ago
  > they may host malicious versions of the KiCad software for download Imagine someone using this as an attack vector to smuggle in exfiltration appliances in the form of hardware circuits in the KiCad software itself, so that the generated PCB files contain spyware in hardware form. That would be a first of its kind: Supply chain attack at hardware level.
  - londons_explore 5y ago
    pcb's today contain too much 'made by hand' to hide much without the designer noticing... It would be like photoshop trying to sneak extra people into photos without the photographer noticing.
    - cookiengineer 5y ago
      > pcb's today contain too much 'made by hand' to hide much without the designer noticing... Doesn't mean the layers have to be rendered with the modified/malicious version of KiCAD. They could just try to hide it if they detect a layer with id=spyware. I'm just saying that this would be a very sneaky way to infiltrate the hardware industry, because currently all installed versions rely on the old domain - and that's where they will pull their updates from, too. So pushing out a newer release with that "spyware" modification would be super easy to realize.
      - okl 5y ago
        What kind of spyware do you imagine? Rogue copper traces? Any extra parts to populate suddenly appearing on the BOM, that would be obvious.
        cookiengineer 5y ago
        Well, depends on how the Q&A process is in the pipeline after the design. What I thought of is maybe it might be feasible to sneak in some circuits that reroute e.g. a network port's traffic to a specific public IP/CnC. Depending on how complex the PCB layout is, it could be feasible to encode or modify the modulation of easy network busses (aside from ethernet). But I guess that would involve deployment of malicious firmware or availability of a specific "malicious" chipset, too, because ethernet is quite complex in the sense that there are too many physical parts necessary to implement it in hardware form. I was just thinking about the Q&A pipelines in the industrial process. Usually they never validate anything because of proprietary/protected intellectual property contracts, so suppliers down the line always claim it's according to specifications and that is blindly trusted by the manufacturers. Identifying something like this is much harder in the organizational sense, because it involves a lot of time for verification down the line, and involves a lot of organizational blamestorm before anything really happens to fix it.
        okl 5y ago
        If you are willing to go that far, just sell them fake ICs. No need to meddle with PCB layouts.
        londons_explore 5y ago
        There are a few neat and potentially evil things you can do with copper traces alone. For example, you might be able to make a spy radio emitter[1]. Despite this, I very much doubt any software is going to be inserting those into designs automatically anytime soon! [1]: https://en.wikipedia.org/wiki/The_Thing_(listening_device) https://en.wikipedia.org/wiki/The_Thing_(listening_device)
    - josefx 5y ago
      So probably trivial with any shot that contains more than a dozen people the photographer barely knows?
  - rcxdude 5y ago
    Extremely difficult to achieve undetected. Firstly just successfully smuggling a working design for spyware into the PCB design would require an impressive feat of CAD engineering, then there's no way to achieve this just with copper traces, you would need to add new components to the board. Both changes in the traces and new components would be extremely obvious in all but the most automated workflows (getting a PCB manufactured is a very manual process). It's typical to inspect the output gerber files manually for any errors, as well as for PCB manufacturers to offer a preview of their interpretation of the gerber. Similarly with the BOM, which has a different flow with a lot of human touch. Also, the techniques which would allow hiding the components within the PCB itself (which do exist) are extremely rare. The only places with the slightest chance of this working (massive organisations with a huge amount of siloing) aren't using KiCAD as a tool.
    - exporectomy 5y ago
      Perhaps there's some chip that has some functionality enabled by a logic input. The designer intended it to be off but KiCad tied it high or low or open to turn it on instead. That functionality might enable a serial interface or reading or writing some sensitive memory or whatever that might become a vulnerability.
    - dTal 5y ago
      You're correct of course. It's wildly infeasible, prone to rapid detection, and there's no plausible profit to sneaking subtle backdoors into random KiCAD projects. Now let's brainstorm possible vectors anyway... You could manipulate PCB traces in such a way as to leak data over RF? No topological change to the circuit and very hard to pin down.
      - polishdude20 5y ago
        Any data leaked would just leak more than it already does. If your data is encrypted, it would just be encrypted but louder.
  - ameminator 5y ago
    I imagine it would be much more likely to have a "backdoor"-ed version of kicad that would phone in with intellectual property rather than PCB spyware. Making a PCB is too much like writing assembly for it to go unnoticed...
    - gmueckl 5y ago
      Exfiltrating KiCAD project files and manually designing a subtly backdoored version is a much more likely attack. An automatically inserted backdoor has a high risk of detection, dragging the entire plot out into the open. Stealthily phoning home is harder to detect and most small operations that would use KiCAD are probably not well equipped to detect such network traffic. The downside is of course that physical access to the product is required to install the backdoored electronics.
Tomte 5y ago
It's kind of funny that the submission points to yet another domain.
- Crosseye_Jack 5y ago
  The forums have always been user ran projects. Chris setup the kicad.info forum about 5 years ago. I personally doubt Chris will go rogue, he has been preaching kicad for far too long, I would say he has well and truely "drank the kool-aid" (Not the correct term, but was the first term that came to mind, what I mean is that he is extremely passionate about the project so I don't see him doing it any harm.), but I see your point that the forums could be another point of failure as they are user ran. The annoucment is also on the kicad.org domain. https://www.kicad.org/blog/2021/10/Avoid-links-to-former-kicad-domain/ https://www.kicad.org/blog/2021/10/Avoid-links-to-former-kic...
  - ChrisGammell 5y ago
    Delicious, delicious kool-aid
  - Ciantic 5y ago
    I found this amusing myself too. Though, if they have any working relationship, why not point subdomain like forum.kicad.org to Chris's forum? It's cheap and easy, and noticeable who controls it.
    - Crosseye_Jack 5y ago
      Because its not the only forum nr is it the official forum. Dave at eevblog also runs one https://www.eevblog.com/forum/kicad/ https://www.eevblog.com/forum/kicad/ (Chris and Dave both host The Amp Hour podcast), There is the Subreddit, there are also Chinese and Spanish forums on differnt domains too. The kicad site also states that in order to have your forum listed on the kicad site "You do not misrepresent yourself as being an official KiCad entity". Having a subdomain for it could imply its "official" and break its own rule. https://www.kicad.org/community/forums/ https://www.kicad.org/community/forums/
PostThisTooFast 5y ago
WTF? Why didn't the guy respond to the new maintainer's attempts to acquire the domain, and then let some rando buy it? Seems like a dick move.
willvarfar 5y ago
> When the KiCad Project formally became a registered project under the Linux Foundation, we attempted to secure the rights to the original domain name from Dick without success. And then > Please do not contact Dick about this. He cannot undo the damage at this point There's got to be more to this story. What happened?
- PinguTS 5y ago
  He simply sold it. What's more to need to know about? Nothing.
  - throwaway81523 5y ago
    Well some Freenode-like madness from the new owner could make things more interesting.
  - londons_explore 5y ago
    He probably got and accepted one of those "we'll buy your domain for $500" emails.
  - cowsandmilk 5y ago
    It expired. He didn’t sell.
    - delfinom 5y ago
      It was registered until 2023. He even announced after the fact he was selling the .com. Don't defend the asshole. https://lists.launchpad.net/kicad-developers/msg45358.html https://lists.launchpad.net/kicad-developers/msg45358.html
      - forgotpwd16 5y ago
        >the asshole *Dick
      - segfaultbuserr 5y ago
deleted 5y ago
[deleted]
andi999 5y ago
What is the 12 doing in 'kicard.org 12'?
- csmattryder 5y ago
  It's part of the Discourse forum software, it can show you how many people have clicked on a link.
chuckee 5y ago
What about trademark issues? E.g. if I buy coca-cola.net (assuming Coca-Cola forgot to register that domain) and use it to sell watered-down Coca-Cola (or software with adware tacked-on..), doesn't Coca-Cola have a valid case against me? What if I don't sell watered-down cola, but Pepsi? Would they still have a case, and could the resolution of that case include me losing the domain?
- ZiiS 5y ago
  You would 100% certainly lose the domain. However every other trademark in the world is weaker then Coke. KiCAD are working on having the best software not the best lawyers.
oefrha 5y ago
> recently sold to an unnamed third party Judging by whois and what's currently served at kicad-pcb.org, it simply expired (on October 15) and is currently parked by GoDaddy.
- 542458 5y ago
  The selling was well-publicized. https://lists.launchpad.net/kicad-developers/msg45358.html https://lists.launchpad.net/kicad-developers/msg45358.html
  - delfinom 5y ago
    He posted that after he did it.
- dwild 5y ago
  I think you got the misread: > Updated Date: 2021-10-15T19:11:24Z > Registry Expiry Date: 2023-04-12T13:37:29Z It has been updated on the 15, sure, most probably the date it has been sold, but the expiry is in 2 years.
taf2 5y ago
It seems like a good lawyer would be very helpful in getting this straightened out?
tsar_nikolai 5y ago
Searching for "kicad", "kicad pcb" or "kicad-pcb" on DDG, Google, Bing and Brave, only Brave still shows a link to kicad-pcb.org on the first page, so the campaign seems to be going in the right direction
lume 5y ago
The links to the documentation should also be updated https://docs.kicad.org/5.1/en/getting_started_in_kicad/getting_started_in_kicad.html https://docs.kicad.org/5.1/en/getting_started_in_kicad/getti...
PragmaticPulp 5y ago
The former project lead refused to surrender the domain names and instead is selling them via the KiCad mailing list: https://lists.launchpad.net/kicad-developers/msg45358.html https://lists.launchpad.net/kicad-developers/msg45358.html DigiKey is the real hero of this story: > When the KiCad Project formally became a registered project under the Linux Foundation, we attempted to secure the rights to the original domain name from Dick without success. > In the meantime, Digikey Corporation purchased the kicad.org domain name from squatters and donated it to the KiCad Project. It’s too bad they didn’t start migrating to the kicad.org domain name earlier. Changing domains is always hard but they should have started the migration at first signs of trouble with the old domain holder, not after he had sold it away.
- alangibson 5y ago
  One more reason to love DigiKey
- delfinom 5y ago
  We migrated in 2020. The post is badly worded. We updated the vast majority of links in our control at the time. Third party links however are always a pita.
- sethhillbrand 5y ago
  > The former project lead refused to surrender the domain names We actually offered to purchase the domain names from him. We don't know how much he sold them for but we were not given the chance to bid against whoever eventually bought them.
forgotpwd16 5y ago
>Can Google, Bing, & Duckduckgo also try to avoid links to the bogus site? All three show in their results only kicad.org (Google: https://archive.md/07hCs https://archive.md/07hCs, Bing: https://archive.md/vFb0V https://archive.md/vFb0V, DDG: https://archive.md/fpOHO https://archive.md/fpOHO).

177 points by 1MachineElf 5y ago

In case it's helpful, here's the first paragraph from the post: "The original KiCad domain name (kicad-pcb.org) was recently sold to an unnamed third party that is not affiliated with the KiCad Project or members of the KiCad Development Team. This sale was unexpected and may pose a risk to KiCad users. The new owners may simply post advertisements or (worst-case scenario) they may host malicious versions of the KiCad software for download."

cookiengineer 5y ago
> they may host malicious versions of the KiCad software for download Imagine someone using this as an attack vector to smuggle in exfiltration appliances in the form of hardware circuits in the KiCad software itself, so that the generated PCB files contain spyware in hardware form. That would be a first of its kind: Supply chain attack at hardware level.
- londons_explore 5y ago
  pcb's today contain too much 'made by hand' to hide much without the designer noticing... It would be like photoshop trying to sneak extra people into photos without the photographer noticing.
  - cookiengineer 5y ago
    > pcb's today contain too much 'made by hand' to hide much without the designer noticing... Doesn't mean the layers have to be rendered with the modified/malicious version of KiCAD. They could just try to hide it if they detect a layer with id=spyware. I'm just saying that this would be a very sneaky way to infiltrate the hardware industry, because currently all installed versions rely on the old domain - and that's where they will pull their updates from, too. So pushing out a newer release with that "spyware" modification would be super easy to realize.
    - okl 5y ago
      What kind of spyware do you imagine? Rogue copper traces? Any extra parts to populate suddenly appearing on the BOM, that would be obvious.
      - cookiengineer 5y ago
        Well, depends on how the Q&A process is in the pipeline after the design. What I thought of is maybe it might be feasible to sneak in some circuits that reroute e.g. a network port's traffic to a specific public IP/CnC. Depending on how complex the PCB layout is, it could be feasible to encode or modify the modulation of easy network busses (aside from ethernet). But I guess that would involve deployment of malicious firmware or availability of a specific "malicious" chipset, too, because ethernet is quite complex in the sense that there are too many physical parts necessary to implement it in hardware form. I was just thinking about the Q&A pipelines in the industrial process. Usually they never validate anything because of proprietary/protected intellectual property contracts, so suppliers down the line always claim it's according to specifications and that is blindly trusted by the manufacturers. Identifying something like this is much harder in the organizational sense, because it involves a lot of time for verification down the line, and involves a lot of organizational blamestorm before anything really happens to fix it.
        okl 5y ago
        If you are willing to go that far, just sell them fake ICs. No need to meddle with PCB layouts.
      - londons_explore 5y ago
        There are a few neat and potentially evil things you can do with copper traces alone. For example, you might be able to make a spy radio emitter[1]. Despite this, I very much doubt any software is going to be inserting those into designs automatically anytime soon! [1]: https://en.wikipedia.org/wiki/The_Thing_(listening_device) https://en.wikipedia.org/wiki/The_Thing_(listening_device)
  - josefx 5y ago
    So probably trivial with any shot that contains more than a dozen people the photographer barely knows?
- rcxdude 5y ago
  Extremely difficult to achieve undetected. Firstly just successfully smuggling a working design for spyware into the PCB design would require an impressive feat of CAD engineering, then there's no way to achieve this just with copper traces, you would need to add new components to the board. Both changes in the traces and new components would be extremely obvious in all but the most automated workflows (getting a PCB manufactured is a very manual process). It's typical to inspect the output gerber files manually for any errors, as well as for PCB manufacturers to offer a preview of their interpretation of the gerber. Similarly with the BOM, which has a different flow with a lot of human touch. Also, the techniques which would allow hiding the components within the PCB itself (which do exist) are extremely rare. The only places with the slightest chance of this working (massive organisations with a huge amount of siloing) aren't using KiCAD as a tool.
  - exporectomy 5y ago
    Perhaps there's some chip that has some functionality enabled by a logic input. The designer intended it to be off but KiCad tied it high or low or open to turn it on instead. That functionality might enable a serial interface or reading or writing some sensitive memory or whatever that might become a vulnerability.
  - dTal 5y ago
    You're correct of course. It's wildly infeasible, prone to rapid detection, and there's no plausible profit to sneaking subtle backdoors into random KiCAD projects. Now let's brainstorm possible vectors anyway... You could manipulate PCB traces in such a way as to leak data over RF? No topological change to the circuit and very hard to pin down.
    - polishdude20 5y ago
      Any data leaked would just leak more than it already does. If your data is encrypted, it would just be encrypted but louder.
- ameminator 5y ago
  I imagine it would be much more likely to have a "backdoor"-ed version of kicad that would phone in with intellectual property rather than PCB spyware. Making a PCB is too much like writing assembly for it to go unnoticed...
  - gmueckl 5y ago
    Exfiltrating KiCAD project files and manually designing a subtly backdoored version is a much more likely attack. An automatically inserted backdoor has a high risk of detection, dragging the entire plot out into the open. Stealthily phoning home is harder to detect and most small operations that would use KiCAD are probably not well equipped to detect such network traffic. The downside is of course that physical access to the product is required to install the backdoored electronics.

Tomte 5y ago

It's kind of funny that the submission points to yet another domain.

Crosseye_Jack 5y ago
The forums have always been user ran projects. Chris setup the kicad.info forum about 5 years ago. I personally doubt Chris will go rogue, he has been preaching kicad for far too long, I would say he has well and truely "drank the kool-aid" (Not the correct term, but was the first term that came to mind, what I mean is that he is extremely passionate about the project so I don't see him doing it any harm.), but I see your point that the forums could be another point of failure as they are user ran. The annoucment is also on the kicad.org domain. https://www.kicad.org/blog/2021/10/Avoid-links-to-former-kicad-domain/ https://www.kicad.org/blog/2021/10/Avoid-links-to-former-kic...
- ChrisGammell 5y ago
  Delicious, delicious kool-aid
- Ciantic 5y ago
  I found this amusing myself too. Though, if they have any working relationship, why not point subdomain like forum.kicad.org to Chris's forum? It's cheap and easy, and noticeable who controls it.
  - Crosseye_Jack 5y ago
    Because its not the only forum nr is it the official forum. Dave at eevblog also runs one https://www.eevblog.com/forum/kicad/ https://www.eevblog.com/forum/kicad/ (Chris and Dave both host The Amp Hour podcast), There is the Subreddit, there are also Chinese and Spanish forums on differnt domains too. The kicad site also states that in order to have your forum listed on the kicad site "You do not misrepresent yourself as being an official KiCad entity". Having a subdomain for it could imply its "official" and break its own rule. https://www.kicad.org/community/forums/ https://www.kicad.org/community/forums/

PostThisTooFast 5y ago

WTF? Why didn't the guy respond to the new maintainer's attempts to acquire the domain, and then let some rando buy it? Seems like a dick move.

willvarfar 5y ago

> When the KiCad Project formally became a registered project under the Linux Foundation, we attempted to secure the rights to the original domain name from Dick without success. And then > Please do not contact Dick about this. He cannot undo the damage at this point There's got to be more to this story. What happened?

PinguTS 5y ago
He simply sold it. What's more to need to know about? Nothing.
- throwaway81523 5y ago
  Well some Freenode-like madness from the new owner could make things more interesting.
- londons_explore 5y ago
  He probably got and accepted one of those "we'll buy your domain for $500" emails.
- cowsandmilk 5y ago
  It expired. He didn’t sell.
  - delfinom 5y ago
    It was registered until 2023. He even announced after the fact he was selling the .com. Don't defend the asshole. https://lists.launchpad.net/kicad-developers/msg45358.html https://lists.launchpad.net/kicad-developers/msg45358.html
    - forgotpwd16 5y ago
      >the asshole *Dick
    - segfaultbuserr 5y ago

deleted 5y ago

[deleted]

andi999 5y ago

What is the 12 doing in 'kicard.org 12'?

csmattryder 5y ago
It's part of the Discourse forum software, it can show you how many people have clicked on a link.

chuckee 5y ago

What about trademark issues? E.g. if I buy coca-cola.net (assuming Coca-Cola forgot to register that domain) and use it to sell watered-down Coca-Cola (or software with adware tacked-on..), doesn't Coca-Cola have a valid case against me? What if I don't sell watered-down cola, but Pepsi? Would they still have a case, and could the resolution of that case include me losing the domain?

ZiiS 5y ago
You would 100% certainly lose the domain. However every other trademark in the world is weaker then Coke. KiCAD are working on having the best software not the best lawyers.

oefrha 5y ago

> recently sold to an unnamed third party Judging by whois and what's currently served at kicad-pcb.org, it simply expired (on October 15) and is currently parked by GoDaddy.

542458 5y ago
The selling was well-publicized. https://lists.launchpad.net/kicad-developers/msg45358.html https://lists.launchpad.net/kicad-developers/msg45358.html
- delfinom 5y ago
  He posted that after he did it.
dwild 5y ago
I think you got the misread: > Updated Date: 2021-10-15T19:11:24Z > Registry Expiry Date: 2023-04-12T13:37:29Z It has been updated on the 15, sure, most probably the date it has been sold, but the expiry is in 2 years.

taf2 5y ago

It seems like a good lawyer would be very helpful in getting this straightened out?

tsar_nikolai 5y ago

Searching for "kicad", "kicad pcb" or "kicad-pcb" on DDG, Google, Bing and Brave, only Brave still shows a link to kicad-pcb.org on the first page, so the campaign seems to be going in the right direction

lume 5y ago

The links to the documentation should also be updated https://docs.kicad.org/5.1/en/getting_started_in_kicad/getting_started_in_kicad.html https://docs.kicad.org/5.1/en/getting_started_in_kicad/getti...

PragmaticPulp 5y ago

The former project lead refused to surrender the domain names and instead is selling them via the KiCad mailing list: https://lists.launchpad.net/kicad-developers/msg45358.html https://lists.launchpad.net/kicad-developers/msg45358.html DigiKey is the real hero of this story: > When the KiCad Project formally became a registered project under the Linux Foundation, we attempted to secure the rights to the original domain name from Dick without success. > In the meantime, Digikey Corporation purchased the kicad.org domain name from squatters and donated it to the KiCad Project. It’s too bad they didn’t start migrating to the kicad.org domain name earlier. Changing domains is always hard but they should have started the migration at first signs of trouble with the old domain holder, not after he had sold it away.

alangibson 5y ago
One more reason to love DigiKey
delfinom 5y ago
We migrated in 2020. The post is badly worded. We updated the vast majority of links in our control at the time. Third party links however are always a pita.
sethhillbrand 5y ago
> The former project lead refused to surrender the domain names We actually offered to purchase the domain names from him. We don't know how much he sold them for but we were not given the chance to bid against whoever eventually bought them.

forgotpwd16 5y ago

>Can Google, Bing, & Duckduckgo also try to avoid links to the bogus site? All three show in their results only kicad.org (Google: https://archive.md/07hCs https://archive.md/07hCs, Bing: https://archive.md/vFb0V https://archive.md/vFb0V, DDG: https://archive.md/fpOHO https://archive.md/fpOHO).