8 ms·

Really Prolific?

100 points by wbraun 4y ago

teaearlgraycold 4y ago
MS should take away their keys.
- ungamedplayer 4y ago
  I thought MS verified the drivers on their server ?
- throwaway0x7E6 4y ago
  that would set an inconvenient precedent for the future, when MS/Apple themselves start bricking your hardware for using unapproved software or failing to comply with Disinformation Governance Board regulations
- MBCook 4y ago
  I feel like they should do something. I’m not really sure what. Revoking the driver keys seems a little extreme but I’m not sure what else they would be able to do.
  - josephcsible 4y ago
    My suggestion: remove the malicious driver from Windows Update, push another update to all affected victims that puts them back on the old legitimate driver, and warn Prolific that if they ever do something like this again, that next time the consequence will be revocation.
- salawat 4y ago
  This sets a marvelous precedent. Also, the user is left with a device that is NFG. Gee, I remember an age where you didn't have all of this signed driver bs that puts you, the end consumer, at the mercy of a supply chain, and at least left you with the option of writing your own. Those were the days... But no... Computing must be gatekept through the supply chain for the benefit of cloud providers, malicious IC/HW fabs, and software companies! I'd take having to scan and recompute hashes on my drivers on a regular basis for this stupid driver signature enforcement and trusted computing BS to either get ripped out wholesale, or be changed to be opt-in instead of "there really is no opt-out for non-developers. After all, as long as it's the default, there is no incentive to making turning it on or off an easier process. Again though. That's industry's goal. Let us lock down your computing experience! It's too dangerous to have an Unwashed User with an unvetted computing environment!
- manicdee 4y ago
  Why?
bsilvereagle 4y ago
> PPS: In meantime, you can download the older driver (v3.8.39.0 worked for me) and use it instead. This implies that the fake IC isn't being bricked and will work with Linux, etc. after the new Windows driver has communicated with it. It appears the Windows driver refuses to communicate with the IC.
- bogantech 4y ago
  So unlike the FTDI driver that really did brick clone devices this could even be some change that inadvertently causes issues for third party clones. Do people expect them to QA against clones?
  - josephcsible 4y ago
    Given that the effect of using a clone is that the device name is replaced with the message "THIS IS NOT PROLIFIC PL2303. PLEASE CONTACT YOUR SUPPLIER.", it seems pretty clear that this is intentional sabotage.
    - bogantech 4y ago
      That's what I get for not reading the article I guess.
    - manicdee 4y ago
      Your definition of sabotage is quite broad and creative. There is no damage to the hardware. The driver is simply not operating with hardware that Prolific didn’t get paid to support.
      - josephcsible 4y ago
        If a disgruntled employee went into the office one night and changed all of the computers to not try to boot from the hard drive anymore, would that not be sabotage, just because it's possible to undo?
deleted 4y ago
[deleted]
tablespoon 4y ago
> PS: And yes, FTDI did say they saw the error of their ways back in 2014. Only to pull the same shit again in 2016. They learned nothing. Chances are neither will Prolific. Corporate institutional memories can be remarkably short.
DrAwesome 4y ago
Unless I'm misunderstanding, this isn't bricking the device. The driver is refusing to allow it to work, sure, but it doesn't damage the chip itself in any way. The reason the FTDI incident back in 2014 blew up was because the FTDI driver didn't just refuse to work - it reprogrammed the USB PID on counterfeit/cloned chips to 0, which actually prevented them from working on any host (looking back at articles from that time, it looks like you could fix it by downloading the FT32 config tool from FTDI, but the important point is that the driver was effectively damaging the chips). I really don't see the issue with drivers developed by a hardware company to support their hardware refusing to work with other hardware. I recognize that it creates problems for innocent end users when they do it, but Prolific just doesn't have any obligations to the end-users of other manufacturers' chips. Refusing to operate (rather than reprogramming the chips like FTDI's solution did) seems like a completely reasonable path to me.
- deleted 4y ago
  [deleted]
- josephcsible 4y ago
  > Prolific just doesn't have any obligations to the end-users of other manufacturers' chips To me, this would excuse a change that was actually somehow beneficial for their own chips and just happened to break clones, but it doesn't excuse a change that does nothing for their own chips and breaks clones on purpose.
  - manicdee 4y ago
    It is beneficial for their chips: the driver will work exactly as advertised and tested. The drivers do not break clones on purpose, the drivers simply don’t enable clones to work. Write your own driver if you want to use the clones. It is not Prolific’s job to support hardware they didn’t design, build and test. Even more importantly it is not Prolific’s job to support competitors who are not going to respect Prolific’s IP.
    - josephcsible 4y ago
inferiorhuman 4y ago
Yawn. The author ditched Prolific because the drivers were garbage. They went with FTDI. Then went back to Prolific because FTDI was bricking fake chips. The impression I got is that the author has no intent of even trying to return the counterfeit. Perhaps instead of whinging about the drivers he should be engaging whatever vendors about their subpar supply chain.
- manicdee 4y ago
  Or perhaps investing that effort into writing open source drivers for these chips and providing support for all the various issues the clones have collectively and individually.
deleted 4y ago
[deleted]
mritun 4y ago
Fake and counterfeit chips & products are scourge of our industry. Their shady manufacturers put the customers at risk and put the original manufacturers in an impossible position. I don’t envy the position Prolific is in. Whatever we can do to put the fakers out of business is good!
- josephcsible 4y ago
  > Whatever we can do to put the fakers out of business is good! Not if it means hurting innocent third parties, who didn't know the chips were fake and now they're all in the field and not working.
  - manicdee 4y ago
    “Innocent” third parties who scored a great deal on discount “Prol1fic” chips on AliBaba? Provenance is an important part of logistics which you lose as soon as you source parts from third party sites like Amazon, eBay, AliBaba and so forth.
    - josephcsible 4y ago
      This change isn't punishing the people who scored a great deal on discount “Prol1fic” chips on AliBaba. It's punishing the people whose supplier's supplier's supplier did so.
- xeyownt 4y ago
  I suggest displaying a banner saying "DO NOT USE CLONE!" every time you use the device. This worked very well for DVDs...
  - muro 4y ago
    You don't get on the original, only on clones - I think that's a win.
mmoskal 4y ago
I believe macOS, Linux, and Windows now all come with standard CDC (USB Serial) drivers built-in, so typically there's no need to install drivers from FTDI, Prolific or anyone else. Or am I missing something here?
- josephcsible 4y ago
  Microsoft lets hardware vendors use Windows Update to automatically push their own drivers onto the computers of anyone who uses said hardware, even if they were already working just fine with a generic driver.
- inferiorhuman 4y ago
  I think there is a driver bundled with OSX but (and I don't remember why) I did end up having to get a driver from Prolific. My use case is mostly running proprietary apps in an ancient Windows VM. In any case both Prolific and FTDI have open source mac and Linux drivers (can't speak to the Windows drivers). This would all be a lot less contentious if the clones would use non-official USB vendor and product IDs. For all the teeth gnashing about drivers not working with clones I think there ought to be more focus on the people trying to pawn off crappy clones as the real deal.
bmitc 4y ago
I'd just be happy to find a USB to RS-232 adapter using either a Prolific or FTDI chip that just worked. Even non-fake chips are famously flaky. It sort of blows my mind that the supposedly "better" serial evolution in USB can't even get RS-232 communication right. In my experience, it's best if the RS-232 communication is done on hardware as much as possible and then communicated to a computer with Ethernet or another device's actually usable USB driver than to rely on a Prolific or FTDI chip. Relying on these USB to RS-232 converters for anything other than desktop prototyping is a recipe for something not working.
- josephcsible 4y ago
  Maybe you should go the path that the Arduino UNO and Mega use, and use an ATmega16U2 programmed to do just that. The code they use lives here: https://github.com/arduino/ArduinoCore-avr/tree/master/firmwares/atmegaxxu2 https://github.com/arduino/ArduinoCore-avr/tree/master/firmw...
  - bmitc 4y ago
    Most of my industrial career, I've used things like this for actual systems beyond prototyping: https://www.ni.com/en-us/support/model.ni-9870.html https://www.ni.com/en-us/support/model.ni-9870.html They go through an FPGA and then exposed via drivers over Ethernet or USB and are rock solid. You can access the serial data on the FPGA or you can use a default driver/personality for them that makes the module plug and play. There are other products I've used that expose RS-232 over Ethernet or fiber that work decently well. There's also the Pmod interface: https://digilent.com/reference/pmod/pmodrs232/start https://digilent.com/reference/pmod/pmodrs232/start I'll take a look at what you linked. I have often thought about doing something in this area, because it's amazing how reliable serial communication over RS-232, RS-422, and RS-485 can be, within their operation constraints.
dathinab 4y ago
> For me the concept of bricking device owned by an unsuspected user is a bridge too far. Its also highly illegal, in the EU, at least as far as I know. (Assuming they brick instead of just block the device) It's destruction of the user property, nothing less. If it's "just" deciding to make their driver not work with 3rd party devices then it's legal, though. But highly offensive anyway as even the producer of the device using the USB chip might not know they are using a potential copyright/patent infringing chip.
- muro 4y ago
  Buying or importing clones/fakes is also illegal in the EU.
  - dathinab 4y ago
    Yes but you need a court order to destroy them and the destruction has to be in a well controlled way. More important interfaces are in general not protected by copyright or patent law. As such the chips _might_ be fully legal chips which just happen to have the same interface. Lastly the manufacturer of the device which includes the chips might have bought the chips for which the driver was made and someone else in the supply chain might have switched them out, potentially creating the situation where there is no fault with anyone hit by this. And idk. but punishing random persons which metaphorically speaking have just been at the crime scene but are innocent and didn't even know there was a crime going on is _never_ ok.
quickthrower2 4y ago
This sort of problem inspired GNU
grishka 4y ago
Why is it technically possible for Microsoft to update drivers without user consent? This is a deliberate RCE vulnerability with kernel privileges.
- a1369209993 4y ago
  > Why is it technically possible [...]? This is a deliberate RCE vulnerability I think you answered your own question right there.
- teddyh 4y ago
  Yes. Some call these “universal backdoors”: https://www.gnu.org/proprietary/po/proprietary-back-doors.pt-br-en.html https://www.gnu.org/proprietary/po/proprietary-back-doors.pt...
TwoNineFive 4y ago
Josip is being hyperbolic. This does not brick or change his devices. I am going to defend Prolific here and say they are probably doing the right thing. I use FTDI, Prolific, and other similar serial adapters on a daily basis and Chinese ripoffs are a problem. I want to know right away if the device I bought is a fake. The people selling the devices, usually Chinese vendors on Aliexpress or Amazon, DON'T CARE that they are selling fakes, and probably even know they are selling fakes. The only way Prolific can get these guys to stop is to get the end-user pissed off enough to do returns and leave negative reviews. Aliexpress sure isn't going to take their listings down, and Amazon has proven they don't care either (actually they demand bribes to take fake merch down). Josip's anger is misdirected. He bought a cheap fake chip, knows it, and wants his free ride.
- josephcsible 4y ago
  > I want to know right away if the device I bought is a fake. This is definitely a reasonable thing to want, but Prolific could have done that in a much better way, either by just giving a warning and still allowing the clone to work, or by only triggering when a device is first set up, not just suddenly after it's been in the field and working fine for years. > The only way Prolific can get these guys to stop is to get the end-user pissed off I'm not okay with being used as collateral damage for some company's brand enforcement efforts. > He bought a cheap fake chip, knows it, and wants his free ride. The article says "I bought device without knowing it has a fake chip in it." Are you accusing him of lying?
teekert 4y ago
Ah yes, in our lab we have a 250k eur whole microscope slide scanner stuck on some old win 7 version (and consequently isolated from the network) because of this (it’s now 8 y/o?). Really nice experience.

Really Prolific?

100 points by wbraun 4y ago

teaearlgraycold 4y ago

MS should take away their keys.

ungamedplayer 4y ago
I thought MS verified the drivers on their server ?
throwaway0x7E6 4y ago
that would set an inconvenient precedent for the future, when MS/Apple themselves start bricking your hardware for using unapproved software or failing to comply with Disinformation Governance Board regulations
MBCook 4y ago
I feel like they should do something. I’m not really sure what. Revoking the driver keys seems a little extreme but I’m not sure what else they would be able to do.
- josephcsible 4y ago
  My suggestion: remove the malicious driver from Windows Update, push another update to all affected victims that puts them back on the old legitimate driver, and warn Prolific that if they ever do something like this again, that next time the consequence will be revocation.
salawat 4y ago
This sets a marvelous precedent. Also, the user is left with a device that is NFG. Gee, I remember an age where you didn't have all of this signed driver bs that puts you, the end consumer, at the mercy of a supply chain, and at least left you with the option of writing your own. Those were the days... But no... Computing must be gatekept through the supply chain for the benefit of cloud providers, malicious IC/HW fabs, and software companies! I'd take having to scan and recompute hashes on my drivers on a regular basis for this stupid driver signature enforcement and trusted computing BS to either get ripped out wholesale, or be changed to be opt-in instead of "there really is no opt-out for non-developers. After all, as long as it's the default, there is no incentive to making turning it on or off an easier process. Again though. That's industry's goal. Let us lock down your computing experience! It's too dangerous to have an Unwashed User with an unvetted computing environment!
manicdee 4y ago
Why?

bsilvereagle 4y ago

> PPS: In meantime, you can download the older driver (v3.8.39.0 worked for me) and use it instead. This implies that the fake IC isn't being bricked and will work with Linux, etc. after the new Windows driver has communicated with it. It appears the Windows driver refuses to communicate with the IC.

bogantech 4y ago
So unlike the FTDI driver that really did brick clone devices this could even be some change that inadvertently causes issues for third party clones. Do people expect them to QA against clones?
- josephcsible 4y ago
  Given that the effect of using a clone is that the device name is replaced with the message "THIS IS NOT PROLIFIC PL2303. PLEASE CONTACT YOUR SUPPLIER.", it seems pretty clear that this is intentional sabotage.
  - bogantech 4y ago
    That's what I get for not reading the article I guess.
  - manicdee 4y ago
    Your definition of sabotage is quite broad and creative. There is no damage to the hardware. The driver is simply not operating with hardware that Prolific didn’t get paid to support.
    - josephcsible 4y ago
      If a disgruntled employee went into the office one night and changed all of the computers to not try to boot from the hard drive anymore, would that not be sabotage, just because it's possible to undo?

deleted 4y ago

[deleted]

tablespoon 4y ago

> PS: And yes, FTDI did say they saw the error of their ways back in 2014. Only to pull the same shit again in 2016. They learned nothing. Chances are neither will Prolific. Corporate institutional memories can be remarkably short.

DrAwesome 4y ago

Unless I'm misunderstanding, this isn't bricking the device. The driver is refusing to allow it to work, sure, but it doesn't damage the chip itself in any way. The reason the FTDI incident back in 2014 blew up was because the FTDI driver didn't just refuse to work - it reprogrammed the USB PID on counterfeit/cloned chips to 0, which actually prevented them from working on any host (looking back at articles from that time, it looks like you could fix it by downloading the FT32 config tool from FTDI, but the important point is that the driver was effectively damaging the chips). I really don't see the issue with drivers developed by a hardware company to support their hardware refusing to work with other hardware. I recognize that it creates problems for innocent end users when they do it, but Prolific just doesn't have any obligations to the end-users of other manufacturers' chips. Refusing to operate (rather than reprogramming the chips like FTDI's solution did) seems like a completely reasonable path to me.

deleted 4y ago
[deleted]
josephcsible 4y ago
> Prolific just doesn't have any obligations to the end-users of other manufacturers' chips To me, this would excuse a change that was actually somehow beneficial for their own chips and just happened to break clones, but it doesn't excuse a change that does nothing for their own chips and breaks clones on purpose.
- manicdee 4y ago
  It is beneficial for their chips: the driver will work exactly as advertised and tested. The drivers do not break clones on purpose, the drivers simply don’t enable clones to work. Write your own driver if you want to use the clones. It is not Prolific’s job to support hardware they didn’t design, build and test. Even more importantly it is not Prolific’s job to support competitors who are not going to respect Prolific’s IP.
  - josephcsible 4y ago

inferiorhuman 4y ago

Yawn. The author ditched Prolific because the drivers were garbage. They went with FTDI. Then went back to Prolific because FTDI was bricking fake chips. The impression I got is that the author has no intent of even trying to return the counterfeit. Perhaps instead of whinging about the drivers he should be engaging whatever vendors about their subpar supply chain.

manicdee 4y ago
Or perhaps investing that effort into writing open source drivers for these chips and providing support for all the various issues the clones have collectively and individually.

deleted 4y ago

[deleted]

mritun 4y ago

Fake and counterfeit chips & products are scourge of our industry. Their shady manufacturers put the customers at risk and put the original manufacturers in an impossible position. I don’t envy the position Prolific is in. Whatever we can do to put the fakers out of business is good!

josephcsible 4y ago
> Whatever we can do to put the fakers out of business is good! Not if it means hurting innocent third parties, who didn't know the chips were fake and now they're all in the field and not working.
- manicdee 4y ago
  “Innocent” third parties who scored a great deal on discount “Prol1fic” chips on AliBaba? Provenance is an important part of logistics which you lose as soon as you source parts from third party sites like Amazon, eBay, AliBaba and so forth.
  - josephcsible 4y ago
    This change isn't punishing the people who scored a great deal on discount “Prol1fic” chips on AliBaba. It's punishing the people whose supplier's supplier's supplier did so.
xeyownt 4y ago
I suggest displaying a banner saying "DO NOT USE CLONE!" every time you use the device. This worked very well for DVDs...
- muro 4y ago
  You don't get on the original, only on clones - I think that's a win.

mmoskal 4y ago

I believe macOS, Linux, and Windows now all come with standard CDC (USB Serial) drivers built-in, so typically there's no need to install drivers from FTDI, Prolific or anyone else. Or am I missing something here?

josephcsible 4y ago
Microsoft lets hardware vendors use Windows Update to automatically push their own drivers onto the computers of anyone who uses said hardware, even if they were already working just fine with a generic driver.
inferiorhuman 4y ago
I think there is a driver bundled with OSX but (and I don't remember why) I did end up having to get a driver from Prolific. My use case is mostly running proprietary apps in an ancient Windows VM. In any case both Prolific and FTDI have open source mac and Linux drivers (can't speak to the Windows drivers). This would all be a lot less contentious if the clones would use non-official USB vendor and product IDs. For all the teeth gnashing about drivers not working with clones I think there ought to be more focus on the people trying to pawn off crappy clones as the real deal.

bmitc 4y ago

I'd just be happy to find a USB to RS-232 adapter using either a Prolific or FTDI chip that just worked. Even non-fake chips are famously flaky. It sort of blows my mind that the supposedly "better" serial evolution in USB can't even get RS-232 communication right. In my experience, it's best if the RS-232 communication is done on hardware as much as possible and then communicated to a computer with Ethernet or another device's actually usable USB driver than to rely on a Prolific or FTDI chip. Relying on these USB to RS-232 converters for anything other than desktop prototyping is a recipe for something not working.

josephcsible 4y ago
Maybe you should go the path that the Arduino UNO and Mega use, and use an ATmega16U2 programmed to do just that. The code they use lives here: https://github.com/arduino/ArduinoCore-avr/tree/master/firmwares/atmegaxxu2 https://github.com/arduino/ArduinoCore-avr/tree/master/firmw...
- bmitc 4y ago
  Most of my industrial career, I've used things like this for actual systems beyond prototyping: https://www.ni.com/en-us/support/model.ni-9870.html https://www.ni.com/en-us/support/model.ni-9870.html They go through an FPGA and then exposed via drivers over Ethernet or USB and are rock solid. You can access the serial data on the FPGA or you can use a default driver/personality for them that makes the module plug and play. There are other products I've used that expose RS-232 over Ethernet or fiber that work decently well. There's also the Pmod interface: https://digilent.com/reference/pmod/pmodrs232/start https://digilent.com/reference/pmod/pmodrs232/start I'll take a look at what you linked. I have often thought about doing something in this area, because it's amazing how reliable serial communication over RS-232, RS-422, and RS-485 can be, within their operation constraints.

dathinab 4y ago

> For me the concept of bricking device owned by an unsuspected user is a bridge too far. Its also highly illegal, in the EU, at least as far as I know. (Assuming they brick instead of just block the device) It's destruction of the user property, nothing less. If it's "just" deciding to make their driver not work with 3rd party devices then it's legal, though. But highly offensive anyway as even the producer of the device using the USB chip might not know they are using a potential copyright/patent infringing chip.

muro 4y ago
Buying or importing clones/fakes is also illegal in the EU.
- dathinab 4y ago
  Yes but you need a court order to destroy them and the destruction has to be in a well controlled way. More important interfaces are in general not protected by copyright or patent law. As such the chips _might_ be fully legal chips which just happen to have the same interface. Lastly the manufacturer of the device which includes the chips might have bought the chips for which the driver was made and someone else in the supply chain might have switched them out, potentially creating the situation where there is no fault with anyone hit by this. And idk. but punishing random persons which metaphorically speaking have just been at the crime scene but are innocent and didn't even know there was a crime going on is _never_ ok.

quickthrower2 4y ago

This sort of problem inspired GNU

grishka 4y ago

Why is it technically possible for Microsoft to update drivers without user consent? This is a deliberate RCE vulnerability with kernel privileges.

a1369209993 4y ago
> Why is it technically possible [...]? This is a deliberate RCE vulnerability I think you answered your own question right there.
teddyh 4y ago
Yes. Some call these “universal backdoors”: https://www.gnu.org/proprietary/po/proprietary-back-doors.pt-br-en.html https://www.gnu.org/proprietary/po/proprietary-back-doors.pt...

TwoNineFive 4y ago

Josip is being hyperbolic. This does not brick or change his devices. I am going to defend Prolific here and say they are probably doing the right thing. I use FTDI, Prolific, and other similar serial adapters on a daily basis and Chinese ripoffs are a problem. I want to know right away if the device I bought is a fake. The people selling the devices, usually Chinese vendors on Aliexpress or Amazon, DON'T CARE that they are selling fakes, and probably even know they are selling fakes. The only way Prolific can get these guys to stop is to get the end-user pissed off enough to do returns and leave negative reviews. Aliexpress sure isn't going to take their listings down, and Amazon has proven they don't care either (actually they demand bribes to take fake merch down). Josip's anger is misdirected. He bought a cheap fake chip, knows it, and wants his free ride.

josephcsible 4y ago
> I want to know right away if the device I bought is a fake. This is definitely a reasonable thing to want, but Prolific could have done that in a much better way, either by just giving a warning and still allowing the clone to work, or by only triggering when a device is first set up, not just suddenly after it's been in the field and working fine for years. > The only way Prolific can get these guys to stop is to get the end-user pissed off I'm not okay with being used as collateral damage for some company's brand enforcement efforts. > He bought a cheap fake chip, knows it, and wants his free ride. The article says "I bought device without knowing it has a fake chip in it." Are you accusing him of lying?

teekert 4y ago

Ah yes, in our lab we have a 250k eur whole microscope slide scanner stuck on some old win 7 version (and consequently isolated from the network) because of this (it’s now 8 y/o?). Really nice experience.