FTDI Removes Driver From Windows Update That Bricked Cloned Chips

New submitter weilawei writes: Last night, FTDI, a Scottish manufacturer of USB-to-serial ICs, posted a response to the ongoing debacle over its allegedly intentional bricking of competitors' chips. In their statement, FTDI CEO Fred Dart said, "The recently release driver release has now been removed from Windows Update so that on-the-fly updating cannot occur. The driver is in the process of being updated and will be released next week. This will still uphold our stance against devices that are not genuine, but do so in a non-invasive way that means that there is no risk of end user's hardware being directly affected." This may have resulted from a discussion with Microsoft engineers about the implications of distributing potentially malicious driver software.

If you design hardware, what's your stance on this? Will you continue to integrate FTDI chips into your products? What alternatives are available to replace their functionality?

Comments

No FDTI

[Anonymous Coward]

This is why I love PICs

Re:No FDTI

[Anonymous Coward]

I know I would be thinking twice about a FTDI purchase. If you get counterfeit they may decide to brick your device. How do you know? You dont.

They managed to wipe out years of good will in 1 day.

from a discussion with Microsoft engineers probably went along the lines of you do not get to use our system to break hardware fix it or get out.

Re:No FDTI

[Z00L00K]

I don't have a problem with FTDI technology itself, the problem is with the hardware clones.

But FTDI could have taken a different route and instead show an annoying pop-up or only allow 300bps on counterfeit chips. That would work until the counterfeit chip makers goes so far in their work to create a clone that it would cost as much as the real thing at which time it's useless.

Re:No FDTI

[Z00L00K]

And all of them suffer clones, FTDI today, the rest tomorrow.

I also understand their stance since the clones do cost them reputation when they don't work as they should.

Re:No FDTI

[Khyber]

"That would work until the counterfeit chip makers goes so far in their work to create a clone that it would cost as much as the real thing"

Did you even read the prior article? The counterfeit chip is in fact MORE COMPLEX (two banks of SRAM, some other stuff) and should already cost more.

That doesn't stop Chinese knockoff outfits from undercutting.

Re:No FDTI

[tibit]

The counterfeit chip is an off-the-shelf microcontroller. That's why it's cheaper. Whoever packages it didn't have to do all the silicon and driver R&D. They wrote a little bit of firmware that makes it behave like an FTDI chip and that's it.

Re:No FDTI

[Khyber]

You very clearly didn't see the die exposure article.

The counterfeit chip is in fact WAY more complex. It's not off the shelf, so to speak. They custom-modified. It's obvious once you start looking at the physical silicon.

Re:No FDTI

[Z00L00K]

More complex does not make it better. The point is to create something with as few components as possible to get a high level of reliability and performance.

The high complexity is most likely a sign of someone using standard generally available mask components and configure them to emulate the FTDI chip, or even a FPGA, PIC or similar. It does in no way make it better.

Re:No FDTI

[Dahan]

You very clearly didn't see the die exposure article.

The counterfeit chip is in fact WAY more complex. It's not off the shelf, so to speak. They custom-modified. It's obvious once you start looking at the physical silicon.

Oh, Khyber, Khyber... when will stop pretending to know things? It's "off the shelf" in the sense that they didn't have to design anything... they just grabbed an existing microcontroller design and added an extra module or two to it. tibit didn't say that it was cheaper because it's less complex; he said it's cheaper because, "Whoever packages it didn't have to do all the silicon and driver R&D." Just like there are software libraries that a software developer can grab and use without having to do a lot of work, there are hardware libraries that hardware designers can grab and use without having to do a lot of work. You need to do some AES encryption? No need to design that yourself; grab an AES core. You need to do some low-pass digital filtering? Get a filter core. There's even a site that has open-source hardware cores you can use: OpenCores

Re:No FDTI

[Khyber]

"they just grabbed an existing microcontroller design and added an extra module or two to it"

AND somehow implemented a feature-size shrink on top of that, with another mask. Did you even read the tear-down?

They didn't grab shit. This was a new FABRICATION MADE AS A COUNTERFEIT.

I've got the semiconductor experience to tell you that for a fact.

Re: No FDTI

[CarpeDiem1992]

Agreed. If they want to disable updates for detected clones, that is a risk taken when purchasing comes. A user notice should be sent, so the user is informed (presuming an innocent user) and correct the problem. Clone users will do as they will regardless. Best to work with the good actors and let the clones play alone.

Re:No FDTI

[tibit]

Huh? Why on Earth would there be all the unused pads then? It looks to me like a bog-standard USB microcontroller, although I haven't look at all that much die pictures in my life.

Re:No FDTI

[Joce640k]

A.... the clones do cost them reputation.

As opposed to bricking innocent people's devices, which doesn't?

Re:No FDTI

[Joce640k]

I don't have a problem with FTDI technology itself, the problem is with the hardware clones.

But FTDI could have taken a different route and instead show an annoying pop-up or only allow 300bps on counterfeit chips.

As an eBay buyer, how am I supposed to know what I'm going to receive?

Re:No FDTI

[Joce640k]

I just checked Windows update and my "update" is still there...

Computer Missues Act 1990

[jabuzz]

They are a Scottish firm subject to U.K. Law (specifically Scottish law). As such unauthorised modification of computer materials is a criminal offence punishable with a maximum sentence of six months in jail or a 5000GBP fine.

Stopping their device driver working with clone/counterfeit chips is fine. Making modifications to data help on such chips is outright illegal.

Re:Computer Missues Act 1990

[queazocotal]

Ten years, if it's decided to be more serious and is handed over to thehigher courts to prosecute.

Re:Computer Missues Act 1990

[khasim]

And even without the law it seems fairly simple.

You do not INTENTIONALLY break equipment that you do not own. You do not do that. No matter how you feel about that equipment. Particularly when the person who now owns said equipment has no idea that there is a problem.

And I'd be wary of any company that could not understand that.

Re:Computer Missues Act 1990

[g0tai]

Why would FTDI have to ensure their driver doesn't break chips that aren't theirs? There's no agreement, licensing, or goodwill.

The cloners took their chances with the FTDI PID:VID because they were too lazy to buy their own and make their own drivers, or license. Simply trying to make more money because they could con people into thinking their chips were genuine when they were not, *OR* simply getting out of making their own drivers and submitting to microsoft for windows update (all of which costs).

Basically, it's theft from the cloners. FTDI put a stop to it as trying to raise copyright infringement in china is laughable and next to impossible as no-one over there cares.

Re:Computer Missues Act 1990

[g0tai]

And an amusing part from the UK law on counterfeit goods: http://www.legislation.gov.uk/...

* It is an offence for a person to use an instrument which is, and which he knows or believes to be, false, with the intention of inducing somebody to accept it as genuine, and by reason of so accepting it to do or not to do some act to his own or any other person’s prejudice.

So now, all the people with PIDs of 0, and know about this fiasco, are breaking the law by continuing to use their fake device? (IANAL)

Re:Computer Missues Act 1990

[jabuzz]

Two wrongs don't make a right, was hopefully something that your parents taught you when you where quite small.

The issue is that the FTDI driver is deliberately reprogramming a chip that is not theirs and for which they have no authorisation to do so. This is an unauthorised modification and illegal.

You cannot stick something in a license agreement that allows you to break the law, because the courts will hold that part of the license agreement null and void.

As many many people have said the right and legal thing was to simply stop working and post a message to the user that the chip is a counterfeit/clone.

Re:Computer Missues Act 1990

[cdrudge]

Why would FTDI have to ensure their driver doesn't break chips that aren't theirs? There's no agreement, licensing, or goodwill.

FTDI doesn't have to ensure that their driver doesn't break chips. It sounds however that FTDI went out of their way to detect whether the chip was a counterfeit or not, and if it was, specifically write to it to disable it when it could have just as easily done nothing (as disabling the driver from functioning).

Re:Computer Missues Act 1990

[DutchUncle]

Not recognizing a clone, or rather recognizing it and not allowing it to work on the system, would be one thing. Breaking people's devices so they never work anywhere is another. They're not hurting the cloners; they're hurting the downstream accidental or incidental purchasers who were, themselves, defrauded by the device manufacturer or the parts supplier.

Re:Computer Missues Act 1990

[Racemaniac]

but you forgot, it's authorized. they clearly stated it in their EULA!

what do you mean you didn't read it?

Re:Computer Missues Act 1990

[g0tai]

Which is what they've likely now started to do in the next update, however :-)

However, the counterfeit chips *chose* to use FTDI drivers by using FTDI's licenced (and payed for PID/VID). That's not FTDI's problem. And FTDI have moved those chips off their USB id.

The chips and device still work, just not with FTDI's drivers. Nothing was 'broken'.

Re:Computer Missues Act 1990

[GoddersUK]

So now, all the people with PIDs of 0, and know about this fiasco, are breaking the law by continuing to use their fake device? (IANAL)

Only if you intend to fool someone into thinking it's real (say you hire them out). Otherwise it's fine. (also IANAL)

Re:Computer Missues Act 1990

[g0tai]

They didn't disable it though, they simply moved the PID off their allocated range.

The chip still works, just not with FTDI's drivers. Nothing was broken.

Re:Computer Missues Act 1990

[g0tai]

Again (as per previous posts) :) FTDI didn't break anything - they moved the USB ID off their allocated(and payed for/licensed range) and that was that

The chip still works. However, not with FTDI's drivers. this would be the case if the chip was blocked by their drivers or the device ID was changed.

For example linux has a patch that allows the chips to work as a PID of 0. This is the driver that's been updated to recognise it. FTDI have no such obligation in their drivers

Re:Computer Missues Act 1990

[Goaway]

Why would FTDI have to ensure their driver doesn't break chips that aren't theirs?

It's not that they didn't ensure that. It's that they ensured it did break them, very intentionally.

Re:Computer Missues Act 1990

[g0tai]

No, not broken - you see the chip still works, but the drivers don't see it as the PID has changed.

And FTDI have no obligations to make their drivers work with that chip.

Linux has already a patch to update /their opensource/ drivers work with the PID of 0. FTDI has no such obligation or intention of letting their drivers work with those devices however, which in windows may mean you have to hack about to recognise the new PID, or get new drivers.

The device itself and chip are fine. You simply have no drivers that recognise the device ids (unless you use linux with the patch)

Re:Computer Missues Act 1990

[itzly]

If the chips no longer work as designed, they are not "fine".

Re:Computer Missues Act 1990

[__aajfby9338]

They certainly don't have to ensure that their drivers don't accidentally break chips that aren't theirs. The problem here is that they deliberately broke chips that aren't theirs. If their driver refused to service chips identified as counterfeits, that would be fine, with the caveat that they risk angering their real customers if there are false positives in their counterfeit detection method. If the driver also informed the user that the chip was a fake, that would be much better. But by intentionally borking the chip, they may well have violated laws, and they certainly created a serious trust issue with both end users (like me) and engineers who may reevaluate whether to design in FTDI parts (like me).

With FTDI's announcement that they've seen the error of their ways, I'm cautiously optimistic that I will be able to continue using their parts in my designs. I am interested in addressing the real problem of counterfeit parts, but let's do so in a manner which doesn't target the wrong parties. Silently bricking finished goods bought by unsuspecting end users isn't very constructive, even though I can see how it was very tempting. Their previous statement that users should make sure that they buy their FTDI parts only from authorized distributors suggests to me that FTDI was buried too deep in their frustrating problem of countering the counterfeiters, and that they thus lost sight of the overall problem. End users of finished goods generally have no way of knowing what parts are in their products or where they came from, so a scheme which directly targets them is missing the point and just causes more problems.

Re:Computer Missues Act 1990

[Andy Dodd]

"The issue is that the FTDI driver is deliberately reprogramming a chip that is not theirs"

Except they're only doing this to their USB VID/PID - which IS THEIRS.

If you use FTDI's VID/PID, you're trying to pass yourself off as an FTDI chip, and it is YOUR FAULT ALONE if an operation that does not cause issues on genuine FTDI hardware does bad things to your own.

(If you look at the decompiled code, the driver attempts to write the EEPROM on all hardware. However, genuine FTDI hardware won't actually START the write operation until the driver does "additional stuff" - but clones will immediately write the new EEPROM value.)

Re:Computer Missues Act 1990

[AmiMoJo]

The driver writes a value into EEPROM that sets the device's PID to zero, after which it doesn't work. The write fails on real hardware because the EEPROM doesn't accept writes to even addresses, only odd ones. Fake hardware accepts the write.

On the surface it looks malicious. FTDI's statement was all about the merits of genuine ICs, not "oops we bricked some fake devices, sorry".

Re:Computer Missues Act 1990

[bickerdyke]

Why would FTDI have to ensure their driver doesn't break chips that aren't theirs? There's no agreement, licensing, or goodwill.

Like we don't have an agreement or licensing or other kind of contratc that I will NOT burn down your house or otherwise cause damage to you or your property.

But that does NOT give me the right to burn down your house.

We're talking about intentionally damaging a device.

It would be a different matter for unintentional damage after someone uses your product , but even then you have to apply a sensible measure of care to avoid damage through wrong or careless handling. (A warning label is the simplest measure, selling bleach in bottles with a child-proof lock another one)

Re:Computer Missues Act 1990

[ledow]

"As many many people have said the right and legal thing was to simply stop working and post a message to the user that the chip is a counterfeit/clone."

As lots of OBD2 software does if you don't use a genuine ELM327 chip.

Re:Computer Missues Act 1990

[Dredd13]

No, they moved it to "0" ie, unassigned.

Re:Computer Missues Act 1990

[g0tai]

They didn't break the chips though - they moved the PID to 0 which stopped it using FTDIs drivers. You'd have the same situation if the driver simply refused to work (and you can't use the old drivers as technically you're breaking the license agreement).

This means that someone needs to write drivers for devices witha PID of 0. Fairly simple. and then pay M$ to distribute them (as FTDI did with /their/ drivers)

Linux has this sorted in a patch, and things work again.

Re:Computer Missues Act 1990

[Impy the Impiuos Imp]

As far as IP goes, the chips *are* theirs.

Let the counterfeiters take them to court over it if they disagree.

Re:Computer Missues Act 1990

[Dredd13]

They work.

There's just no driver for them.

Re:Computer Missues Act 1990

[Hotawa Hawk-eye]

Is that one offense total (distributing the driver) or one offense _per bricked chip_ (unauthorized modification of the code in the chip itself that renders it unusuable?)

With the UK proposing life sentences for people who cause economic damage that threatens national security, I suppose it's good (for them) that they pulled this now rather than when or if that proposal is approved and enacted. After all, can they be SURE that this didn't affect some computer used by a security agency?

Re:Computer Missues Act 1990

[g0tai]

The biggest issue with the ELM327 clones is that they're very very flakey - the bain of my life! :)

Some have issues with timing on serial data, resulting in garbled output
Some have issues with canbus systems and causing the canbus itself to have internal comms problems (causing your car to complain)
Some don't work on all the protocols (a PCB design issue)
Some get hot and reset
Some have dry joints (ok not a chip issue, but a build quality)

I warn the user (but don't stop them) if they have a clone unit (as it's not too helpful), but my stuff gets a *lot* of flak because the OBD adapter is kaput or doing crappy things (the above). :'-(

Re:Computer Missues Act 1990

[g0tai]

They didn't break chips though - they simply moved them off their USB id.

All you need to do is get new drivers for the USB ID of 0. then things will work again. The clone chip isn't ever going to work with FTDI's drivers though, so you're going to need the clone chip manufacturer to release drivers for their device (instead of using FTDI's which they had no agreement to use)

Linux sorted this out in a patch pretty quick. their ftdi driver works with those devices now, so all you'd need to do is release and pay for a driver to be sent out over windows update.

Re: Computer Missues Act 1990

[Lokni]

You talk like lack of care about copyright in china is a choice about breaking international laws rather than an attitude that has been ingrained in their culture for thousands of years. Copyright protection is a modern invention.

Re:Computer Missues Act 1990

[g0tai]

You mean the USB ID was reset to un-allocated because the non-ftdi chip was using a licensed PID that it had no right to.

The devices were not damaged, they still work - they have no driver. This would be the case even if FTDI didn't change the ID, and simply refused to work. You would be in *exactly* the same situation with a device you could no longer talk to as you have no driver.

Get a driver for the device, and it'll work. Won't be an FTDI driver though.

Re:Computer Missues Act 1990

[RingDev]

Is that per offense?

-Rick

Re: Computer Missues Act 1990

[g0tai]

It is, and it is evidently not working in this instance, is it as FTDI would have already pursued this (and the costs would likely have been prohibitive for little recompense).

Some people have looked at the driver and it writes the EEPROM for every device (I am told). Clone chips apparently are broken by this. Malicious or not, they shouldn't have been using FTDI's driver (they have had every opportunity to have written their own and even use their own device IDs, or license from FTDI properly)

Re:Computer Missues Act 1990

[Holi]

First, you do know that FTDI is a Chinese company, right?
Second, it's not that they have to ensure they don't break chips, but that they were intentionally breaking chips.

Re:Computer Missues Act 1990

[Holi]

Well since no OS will mount a USB device with an ID 0 the chips and devices no longer work.

Re:Computer Missues Act 1990

[Holi]

No they set it to 0 making it unusable in any OS

Re:Computer Missues Act 1990

[Anonymous Coward]

And that argument would absolve them if the bricking was accidental due to the VID/PID issue. Unfortunately their subsequent blog post on the topic has them admit it was intentional. This makes their actions illegal.

Re:Computer Missues Act 1990

[g0tai]

But the USB PIDs are explicitly licensed, so does that not negate it in this instance?

Re:Computer Missues Act 1990

[RingDev]

My understanding is that in this case, if you had a non-FTDI driver on one computer, and a FTDI driver on another computer, that after plugging the device into the computer with the FTDI driver, the device would no longer function on the computer with the non-FTDI driver (assuming that it also did not account for PID 0).

Which means that they did in fact break it (as in intentionally misconfiguring it such that it would no longer function on any known systems).

-Rick

Re:Computer Missues Act 1990

[Z00L00K]

Not in the UK. One instance or multiple don't usually cause a multiplicatory effect.

Re:Computer Missues Act 1990

[Holi]

My bad, Scottish company

Re:Computer Missues Act 1990

[Z00L00K]

Until someone writes a driver for it.

Re:Computer Missues Act 1990

[Z00L00K]

So are the FTDI and Prolific clones. Extremely flakey.

Re:Computer Missues Act 1990

[Z00L00K]

However it was their ID to use and work with as they like.

Re:Computer Missues Act 1990

[TheGratefulNet]

just yesterday, there was a linux kernel patch (on the usb drivers mailing list) that now allows a 0000 pid for ftdi devices.

also, there was a tool by mark lord that allows you to write back any pid value you want, for example, when I ran it, I got this output (and it 'fixed' the chip again, too):

% ./ft232r_prog --old-pid 0x0000 --new-pid 0x6001

ft232r_prog: version 1.24, by Mark Lord.
              eeprom_size = 128
                  vendor_id = 0x0403
                product_id = 0x0000
            self_powered = 0
          remote_wakeup = 1
suspend_pull_downs = 0
          max_bus_power = 90 mA
            manufacturer = FTDI
                      product = FT232R USB UART
                  serialnum = (elided...)
      high_current_io = 0
    load_d2xx_driver = 0
            txd_inverted = 0
            rxd_inverted = 0
            rts_inverted = 0
            cts_inverted = 0
            dtr_inverted = 0
            dsr_inverted = 0
            dcd_inverted = 0
              ri_inverted = 0
                      cbus[0] = TxLED
                      cbus[1] = RxLED
                      cbus[2] = TxDEN
                      cbus[3] = PwrEn
                      cbus[4] = Sleep
Rewriting eeprom with new contents.

Re:Computer Missues Act 1990

[Z00L00K]

In which case the customer will turn back to the shop where they bought the device and claim it to be faulty. Is this within the usual 12 month warranty period (which is mandatory in many countries) a lot of customers would come back to that supplier with warranty claims.

After that - well, can't get everything.

Re:Computer Missues Act 1990

[itzly]

This is about FTDI reprogramming clone chips so they no longer work with any driver. Since FTDI made this choice on purpose, they are liable.

Re:Computer Missues Act 1990

[itzly]

Funny definition of "work" you have.

Re:Computer Missues Act 1990

[tshawkins]

You do know that the routine inside thier drivers as assertained from the symbol tables in the driver code was called "BrickClonedDevices" I think that is a smoking gun, and shows intent. How much chance does 99% of the population have of recovering the functionality of a bricked device, even if pid 0 is rewritable. Its like telling a comsumer that a phone that has scrambled its eeprom is still perfectly ok, all they have to Do is buy a JTAG interface, hook it up, learn several years of embedded systems knowledge. But its not bricked is it. For all intentive purposes it is Bricked as far as a consumer is concerned who has never heard of FTDI.

Re:Computer Missues Act 1990

[QuasiSteve]

Except they're only doing this to their USB VID/PID - which IS THEIRS.

That may be a matter of interpretation.

They are changing a number which is theirs (not sure if they'd have IP law on their side, or only the USB association's 'hear, hear!').

However, this change occurs by actually modifying EPROM states, said EPROM most not being theirs.

Of course then there's the bit about them not knowing that because it identifies itself as being theirs, thus it being the counterfeiters' fault for not counterfeiting it well enough to match the genuine article when sent this particular set of instructions, and the counter-issue that there doesn't appear to be any good reason to use those instructions except for targeting counterfeits, but that plain warnings don't seem to stem the tide of counterfeits, and whether counterfeits really are as big of an issue in the markets where they get most actively used anyway, and you've got a bit of a clusterfornication.

Re:Computer Missues Act 1990

[Anonymous Coward]

The legal system takes a very dim view to people who feign ignorance. If that EEPROM write instruction does nothing to the original chips, then there's no reason for it to be in the driver other than to brick the clones. That is intentional, not accidental. FTDI has been wronged, but that does not give them the right to retaliate, and certainly not to retaliate against people who have no idea they have counterfeit hardware. Bringing criminals to justice is exclusively the job of law enforcement, not of some company gone vigilante. This isn't the movies.

Re:Computer Missues Act 1990

[tshawkins]

In most cases consumers have never heard of FTDI, and would not understand what it did anyway. In thier eyes they did a windows update and thier device broke, and even if the use a rollback point, and unwind tje update its still broke. Microsoft is going to take the heat.

Re:Computer Missues Act 1990

[Anonymous Coward]

What? No, I own that part. It's not their part, it's my part. I paid for it, I own it.
It's their design/label identifying it as their design.

Imagine if you slid in a Disney DVD and it found that a sector of your hard dive was storing one of "THEIR" movies. How pissed would you be if it decided to just fry those sectors of your HDD? You know, because they owned it.

Sure, sure, counterfeiting is bad and all that jazz. But burning your customers is a heavy handed iron fist way of doing things that is just plain wrong.

Re:Computer Missues Act 1990

[Dredd13]

Not at all. It's completely accurate. The chip is still very capable of performing the task it was designed and marketed to do.

Someone just needs to write a driver that will talk to it, and it can happily do it.

Re: Computer Missues Act 1990

[tshawkins]

And to make matters worse, even if they roll back to a restore point and an older driver it still does not work. Consumer given no notification, no choice as to the disposition of thier device, something that does not belong to FTDI.

Re:Computer Missues Act 1990

[Khyber]

If something will no longer work, it is broken, no matter how technical or semantical you try to get.

This was INTENTIONAL DESTRUCTION OF PROPERTY.

No Os will mount a device with a 0 PID. Therefore it is fucking broken.

"For example linux has a patch that allows the chips to work as a PID of 0"

And for the rest of us non-Linux users? Oh, you didn't bother to think of that because you're too busy shilling for FTDI.

Re:Computer Missues Act 1990

[Anonymous Coward]

> Except they're only doing this to their USB VID/PID - which IS THEIRS.

Oh? They have some kind of exclusive right to a 16-bit number?

While the USB-IF considers itself the "official" entity for allocating IDs, I'm not aware of any law which actually grants them any kind of authority in this regard.

Unless the manufacturer actually prints "FTDI" on their product or describes it as such in advertising, their chips aren't "counterfeit", and using a VID which USB-IF allocated to FTDI doesn't change that.

Re:Computer Missues Act 1990

[tshawkins]

Many os's including windows wont allow connections to pid0 at the low level, below the driver, setting pid to 0 effectivly bricks the device as far as windows is concered, thays why they can only be fixed on a mac or linux system that does not have that restriction.

Re:Computer Missues Act 1990

[Khyber]

And in what magical world of yours does a device NOT need a driver?

That's what the fuck I thought.

Hence, it is broken.

Re:Computer Missues Act 1990

[Khyber]

"pay for"

And here is where you demonstrate yourself to truly be an FTDI shill.

Re:Computer Missues Act 1990

[tlambert]

Again (as per previous posts) :) FTDI didn't break anything - they moved the USB ID off their allocated(and payed for/licensed range) and that was that

The chip still works. However, not with FTDI's drivers. this would be the case if the chip was blocked by their drivers or the device ID was changed.

For example linux has a patch that allows the chips to work as a PID of 0. This is the driver that's been updated to recognise it. FTDI have no such obligation in their drivers

Actually, the Linux patch is to put things back, and to recognize an illegal PID (per the USB spec.) anyway.

FTDI doesn't own the PID, they own the VID; they weren't changing the VID (it would have been OK if they had changed the VID to 6666, which is the recognized experimental device VID, rather than effectively bricking the device until there's semi-substantial driver changes to allow an otherwise illegal PID to be used).

It was an intentional bricking that requires bit-bang mode to correct the EEPROM contents, which they overwrote with the invalid PID, before it can be used again.

Re:Computer Missues Act 1990

[Anonymous Coward]

However, the counterfeit chips *chose* to use FTDI drivers by using FTDI's licenced (and payed for PID/VID). That's not FTDI's problem.

Actually, it's not theirs if it's a counterfeit chip. You can't use those numbers when you make a certified USB product, but this very likely wasn't a certified USB product, it just happened to work like a USB device if you plug it into a USB port. FTDI may have had an agreement with whoever owns the USB IP and keeps track of those numbers, but outside that agreement they have no rights to it. The makers of the counterfeit chips very likely have no contract with whoever licenses USB so they don't break any terms if they use a number already used by someone else.

And FTDI have moved those chips off their USB id.

The chips and device still work, just not with FTDI's drivers. Nothing was 'broken'.

No, that was exactly the problem. They rewrote the PID/VID to 0, which makes the device inaccessible because that's an invalid ID.

Re:Computer Missues Act 1990

[Megane]

Except for the little fact that the "IP" probably isn't theirs. While there may be trademark violations, both with the VID, and some (but not all) chips having counterfeit labeling, there isn't much else. Sure, they're register compatible (no problem there, that's just like a software API), and illicitly using the FTDI drivers, but the silicon itself generally contains no FTDI IP. And there is no way for the driver to see what is engraved on the chip, just that it isn't 100% bug-compatible.

However, I expect to see this cause some changes in the clone chips. The most obvious one is "don't allow the PID to be changed to zero". Or they may move to cloning another type of chip other than FTDI and Prolific. All it takes is for one smart guy in China to come up with a new design, and suddenly everyone is using it.

Re:Computer Missues Act 1990

[Dredd13]

Ah, so just because you haven't installed a working driver for that new hardware you just bought, the hardware is "broken"?

No, of course not.

Contact the manufacturer of the hardware and ask them for the driver. If they cop out and say "use FTDI's", say "FTDI's driver doesn't work with your hardware, where's YOUR driver?"

Re:Computer Missues Act 1990

[gweihir]

Actually, it is not. "Their" USB VID/PID can legally be used by anybody, it just means that the USB logo may not be used. AFAIK (and just checked on some FT232 I have), there is no USB logo on these chips.

Re:Computer Missues Act 1990

[gweihir]

They are not. What is licensed is the USB logo and that license has a condition about these IDs. As soon as you do not use the logo, you can use whatever IDs you want on your chips.

Re:Computer Missues Act 1990

[gweihir]

Actually, that is not what is being discussed here. What is being discussed here is the criminal act of identifying a chip and then intentionally making it unusable.

Re:Computer Missues Act 1990

[gweihir]

They modified hardware with malicious intent. That is a bit different. If they know it is not theirs, they have to keep their fingers off it.

Re:Computer Missues Act 1990

[tibit]

So far, we know that the FTDI clones are just generic mask-ROM microcontrollers. Probably the Prolific ones are similar. No counterfeiter would go as far as duplicating the functionality at the level of silicon, unless they wanted to go against the copyright and simply copy the masks. They must be somewhat flaky because it's just a microcontroller with its GPIO packaged to look "like" an FTDI chip. The electrical specs don't quite match, the behavior doesn't quite match, it can't but be flaky.

Re:Computer Missues Act 1990

[tibit]

FTDI owns the entire PID range. You're thinking of the VID. They didn't change the VID.

Re:Computer Missues Act 1990

[tibit]

It was their chip in as much as the chip tried very hard to be detected by their driver. IMHO at that point all the bets are off. I've been thinking about it a lot and FTDI did the right thing. The people who say "ooh we won't use FTDI chips anymore" aren't really their customers. They have no real grasp of who is who in the supply chain, and they themselves will gladly purchase counterfeit chips without even realizing it. FTDI can piss those off without any loss of revenue. I've been using FTDI for a long time - since their first A revision hardware came out. I see no reason to stop using their products. If any of our product stops working, I have the mainstream vendor invoices to back up all of my purchases, and I'll gladly ship the nonworking chips back to the vendor, and demand damages/downtime compensation from them as well.

Re:Computer Missues Act 1990

[bickerdyke]

OK. Thanks for the clarification.

Re:Computer Missues Act 1990

[bill_mcgonigle]

Except they're only doing this to their USB VID/PID - which IS THEIRS.

No. They're doing it to property that other people own. Just because that property advertises a fraudulent USB ID does not transfer ownership of that property to FTDI. They are intentionally breaking other peoples' property and even crowing about it.

FTDI is taking an end-justifies-the means stance, and implementing a vigilante approach. It's drinking the imaginary property Kool-Aid that gets people drunk on ideas like this, and they seem to lose all judgment.

"If I want to deprive you of your watch, I shall certainly have to fight for it; if I want to buy your watch, I shall have to pay you for it; and if I want a gift, I shall have to plead for it; and, according to the means I employ, the watch is stolen property, my own property, or a donation. Thus we see three different results from three different means. Will you still say that means do not matter?" - MK Gandhi

Re:Computer Missues Act 1990

[djdanlib]

The problem with that, as I understand it: On Windows, you can change the drivers' INF files to use PID 0 with any text editor. You could do something similar on any OS. The problem is, the OS won't even try to load drivers for devices with PID 0. So you can't write a driver for that unless you intend to write a new driver for the USB chipset itself that remaps PID 0 devices to something else.

Re:Computer Missues Act 1990

[djdanlib]

I want to know if my ELM327 is a clone or not. Is there any way to tell?

Re:Computer Missues Act 1990

[Microlith]

They did disable it. For a large number of people, it'd be indistinguishable from broken.

Why are people defending malicious behavior?

Re:Computer Missues Act 1990

[Chelloveck]

If you use FTDI's VID/PID, you're trying to pass yourself off as an FTDI chip, and it is YOUR FAULT ALONE if an operation that does not cause issues on genuine FTDI hardware does bad things to your own.

Similarly, I note that all major web browsers masquerade as Mozilla by starting their User-Agent strings with "Mozilla/5.0". I suppose it'd be okay for Mozilla to publish some JavaScript on their site that has no effect on Firefox but causes Chrome, IE, and Safari to permanently delete their User-Agent strings? After all, if you use Mozilla's User-Agent, you're trying to pass yourself off as a Mozilla browser, and it is YOUR FAULT ALONE if an operation that does not cause issues on a genuine Mozilla browser does bad things to your own.

These chips may or may not contain stolen IP. They may simply be engineered to mimic the interface of the FTDI chips to be used as replacements. That's perfectly legal. Chip manufacturers often make work-alikes of other manufacturer's designs, from individual transistors up to full CPUs. Think of the non-Intel x86 CPUs, made to work with the x86 interface and instruction set but containing no stolen x86 IP. Or hell, think of the whole automotive after-market industry. If auto companies could legally prevent third parties from making replacement parts, you bet your life they would.

Nope. It's fine (but dickish) to detect the other guy's product and refuse to work with it. It's a regrettable accident if a legitimate operation on your own device permanently alters a third-party replacement, but I'd consider that to be the fault of a crappy replacement part. It's not at all acceptable to go looking for such an exploit with the intent of rendering the competitor's device unusable. Intent matters, and FTDI performed an obviously malicious action which has no use other than to deliberately break a competitor's product. Whether the competitor stole the design or manufactured a clean-room work-alike makes no difference. You can take them to court but you can't play vigilante.

Re:Computer Missues Act 1990

[ChumpusRex2003]

Why would FTDI have to ensure their driver doesn't break chips that aren't theirs? There's no agreement, licensing, or goodwill. The problem is that this was not accidental. The FTDI anti-clone code in the driver is very sophisticated and actually performs a "preimage" cryptographic attack, to ensure that the clone chip doesn't detect the invalid configuration and auto-reset to factory defaults. Deliberately and with premeditation setting out to "damage" (which in legal terms includes temporary malfunction or impaired function) hardware is not legal without a court order or similar legal basis. The 2nd issue, is that of ensuring that they do not inconvenience wholly innocent parties. They failed at this. The FTDI anti-clone code will also deactivate genuine FTDI chips which have been configured with an external configuration memory in certain circumstances. This has been reported by a company which build development boards with numerous FTDI chips in different configurations; they found that the chip with an external EEPROM would get corrupted by new driver, even though the components were obtained from an authorized distributor.

Re:Computer Missues Act 1990

[amicusNYCL]

Particularly when the person who now owns said equipment has no idea that there is a problem.

What if the person who now owns the equipment knows exactly what it is and did it on purpose?

Re:Computer Missues Act 1990

[amicusNYCL]

However, this change occurs by actually modifying EPROM states, said EPROM most not being theirs.

But the driver doesn't necessarily know the hardware is not theirs, and it seems like the clones lose a lot of credibility by requesting that the operating system uses FTDI's driver for their hardware. That sort of sounds like the clones are taking responsibility for whatever the driver does to their hardware. In this case, the driver is sending a command to change the EEPROM that the geniune FTDI chips will not immediately perform, but the clones will. Once the clones give the wrong ID to the OS, it seems like they are giving permission for the driver to do whatever it wants to do to the hardware. If the hardware didn't want the driver to do things like that, then why is it telling the OS that it uses that driver?

Re:Computer Missues Act 1990

[amicusNYCL]

No. They're doing it to property that other people own. Just because that property advertises a fraudulent USB ID does not transfer ownership of that property to FTDI. They are intentionally breaking other peoples' property and even crowing about it.

Why shouldn't the driver be allowed to do that? If the hardware tells the operating system that it uses that driver, then why can they bitch when the driver starts telling the hardware to do things? If they didn't want their hardware to do those things, then why are they telling it to use that driver instead of their own driver?

Re:Computer Missues Act 1990

[davester666]

Only applies to individuals, never corporations.

Re:Computer Missues Act 1990

[amicusNYCL]

It's a regrettable accident if a legitimate operation on your own device permanently alters a third-party replacement, but I'd consider that to be the fault of a crappy replacement part.

That's what happens. The driver tells all devices to change the PID to 0. The real FTDI devices wait for a follow-up command (which may never come) to actually do the write operation. Other devices don't wait. So the devices don't actually work the same, but the clone is telling the operating system to use that driver. It's not the fault of the driver if the hardware tells the OS to use the driver, the driver tells the hardware to do a write, and the hardware does the write.

Re:Computer Missues Act 1990

[amicusNYCL]

Why are people defending malicious behavior?

I don't know, I don't really see anything defensible about counterfeiting and selling other people's work, but a lot of people seem to think that it shouldn't be touched.

Re:Computer Missues Act 1990

[bsolar]

I doubt they fear lawsuit from the counterfeiters, but a customer which ends up with a device bricked due to a driver being explicitly engineered to sabotage it is another story.

Re:Computer Missues Act 1990

[0100010001010011]

I want to know why no one has made an ELM327 replacement.

With CAN, USB, Bluetooth all becoming ubiquitous I think it's time to update the old ODB chip.

Re:Computer Missues Act 1990

[sjames]

Simple reason, the people who get screwed that way are not the people who wronged FTDI in the first place.

Because when the FTDI driver is bricking counterfeits but you can't tell the counterfeit from legit until that happens, the most rational approach to avoid trouble is to use anything but an FTDI chip.

In other words, they stopped because they realized they weren't just shooting themselves in the foot, they were emptying the magazine.

Re:Computer Missues Act 1990

[QuasiSteve]

Yes, I think I covered that in my last run-on parasentencegraph :)

I highly doubt there would be any court case as a result of this (especially since it's now pulled, anybody who cares enough to un'brick' their device can follow steps readily provided, etc.) Which is a bit of a shame, as I think it would make for interesting arguments from both sides.

Re:Computer Missues Act 1990

[sjames]

No. The PIDs are just a number. The one and only control is that honoring the voluntary allocation is a requirement for licensing the USB logo. If you don't use the logo, there is nothing at all to legally compel you to voluntarily honor the ID allocations.

It's like choosing some random already assigned /24 for your home network. Nobody cares, the police will not be visiting. At worst, you will create a problem for yourself.

Re:Computer Missues Act 1990

[sjames]

Their intent was to punish end users who probably won't have any idea how to re-program the ID (not an end user procedure anyway).

Re:Computer Missues Act 1990

[Demonantis]

I think that is the point of the VID. FTDI only tested the driver with their chips. They are now being coerced into supporting other chips that are not under their control. That is why it is a bad idea to use someone else's VID when designing a product. They won't be testing the driver to ensure it doesn't break your hardware.

Re:Computer Missues Act 1990

[AmiMoJo]

The chips don't work at all with any driver under Windows 7/8, because those operating systems correctly enforce the "no PID 0" rule of the USB standard. Linux and Windows XP don't.

Re:Computer Missues Act 1990

[Vapula]

Someone bought a device for their kid... that may be a complete device (toy for example) or one of these wonderful Arduino kits that you may find on EBay (with lots of sensors, components, ... a nice storage box, ...) That don't mean that he does know anything about electronics... My grand-father bought me my Tandy (Radio-Shack) Electronic kit when I was a boy and he didn't know anything about electronics (only basic electric circuits : mains -> switch -> light bulb).

And YOU (or FTDI) expect that he'll understand that if it stops working, it's because of a clone IC when he don't even know what is the difference between a resistor and a capacitor ?

Someone other bought a 800$ 3D printer... and suddently, it stops working because a 3$ chip inside is not a genuine one... And YOU expect that he'll be able to understand the issue and that he won't be angry at YOU for bricking his 800$ tool ???

The damage done to the clone is made intentionnally (doing something knowing that it'll hurt a clone and not affect an official IC is clearly intentionnal)... And the damage is not done to the vendor but to the consumer...

The move is clearly made with the intent to hurt the final (unknowing) consumer and not someone really responsible for the use of a clone. What is destroyed is not only one component but the whole thing it is enclosed into... And given the form factor, it's often beyond possible repair. Most people don't even have a soldering Iron, you except that they have a reflow oven to solder a new SMD part ?

What if Samsung (or Motorola) got a way to disable all radio subsystems in iPhones because iPhone non compliance with their mobile patent portfolio, making suddently all iPhone unable to connect to mobile network ?

Re:Computer Missues Act 1990

[meerling]

They did it intentionally by including code in their driver that doesn't actually function on their their chips, but will function on chips that actually follow instructions more accurately, which will brick the device by changing it's PID and causing it to have an invalid checksum. (Short summary from some hardware hackers that found the offending piece of code.)

Of course their is no way for an enduser to even know what chips are in their devices before purchasing, much less if they are alleged copyright violators.

Intentionally making the devices that belong to other people non-functional is destruction of private property. You can make a case that maybe they didn't have to make their driver work with the alleged violators, but no company has the right to destroy or otherwise impair them. They intentionally created destructive malware that punishes the end user. If they had tried legal means, like identifying the alleged counterfeit items and throwing rabid lawyers at the source of those chips, they would have been fine, but these morons decided to trash innocent peoples stuff.

It's like if you bought an awesome Hawaiian shirt, and then sent it to be dry-cleaned. Little did you know that the dry-cleaner was using a special cleaning solution sent to them by the maker of certain buttons used in many shirts, including yours. If the cleaner is exposed to buttons that aren't imbedded with the companies secret sauce but are of the same shape as the companies buttons, it causes them to burst into flames, destroying portions of your precious Hawaiian shirt, and anything in the pockets of the clothes you are actually wearing.
Now, does that company have the right to destroy your stuff because you didn't know it might have an unauthorized button? NO Fing WAY!

Now stop trying to protect the malicious weasels that are too Fing lazy to sick lawyers and cops on the source of the counterfeits and instead decided to use malware to attack everyone that unknowingly got some.

Re:Computer Missues Act 1990

[Hamsterdan]

"Why would FTDI have to ensure their driver doesn't break chips that aren't theirs?"

There''s a difference between not testing and breaking stuff.

Re: Computer Missues Act 1990

[Vapula]

Except that in their driver, they intentionally wrote the code to brick the clones. It's not accidental but intentional and, AFAIK, THAT makes a huge difference in court.

It's the difference between accidental injuries and murder.

Re:Computer Missues Act 1990

[cdrudge]

But in the mean time, your product looks bad, which makes your company look bad. You may suffer far more than what your vendor will, or their vendor, or however far up it goes in the supply chain.

Another thing is that FTDI may hurt their actual customers that inadvertently received the fake chips. If I'm a manufacturer I wouldn't be happy that somehow my supplier got the fake chips, and I'd understand the actual company not supporting the fakes, but I would rethink whether I want to use a company that harmed me in the process of protecting themselves.

Re:Computer Missues Act 1990

[DamnOregonian]

It's not the fault of the driver if the hardware tells the OS to use the driver, the driver tells the hardware to do a write, and the hardware does the write.

Legally, it actually is. As your parent poster pointed out, intent matters. In this case, intent is entirely critical for determining if an act was malicious (did you intend to cause harm?) or negligent (you caused harm, but did not intend to)

It will be difficult to justify an operation with no use, that would be catastrophic to any device listening that performed it, and your devices conveniently did not. If some national-level prosecutor gets a wild hair up his ass, and is unencumbered enough with campaign contribution obligations, this would be easy pickings in a criminal court.

Re:Computer Missues Act 1990

[Damarkus13]

This will does not affect consumer devices. Almost all devices containing this chip will ship with the manufacturers VID/PID. Those that ship with FTDI's VID will (if they're complying with FTDI's Iicense) ship with a different PID than the raw chip.

Re:Computer Missues Act 1990

[DamnOregonian]

They do not own that 16-bit field in the USB protocol. It is absolutely acceptable (and common) for hobbyists to use VID/PID combos that are USB-IF licensed. As long as they're not selling their product with a USB logo, it's entirely legal. It is, however, entirely illegal to push a software update to everyone's Tesla that causes any non-Tesla chargers they're plugged into to stop functioning. What FTDI did was criminal. They have every right not to support knock-off hardware with their drivers, but to disable them causes harm. It's doubtful they'll ever be prosecuted, being a large player, but it is nonetheless criminal. Scream as loud as you like, you can't change that.

Re:Computer Missues Act 1990

[DamnOregonian]

You keep repeating the same bullshit. Stop it.
Any USB device has any right to use any VID/PID it wants. It's licensing of the USB trademark that carries restrictions on VID usage.
Having a USB-IF licensed VID does not give you the right to touch other hardware that use it.
FTDI wrote code designed to hurt someone else's hardware. That is by every definition, legal and rational, malicious.

Re:Computer Missues Act 1990

[Damarkus13]

I think you are seriously overestimating the products affected by this issue. If you're shipping a finished product you're using your own VID & PID, right? If you're not you're already changing the PID to one issued by FTD for your product (you did read the license didn't you?) This (admittedly boneheaded) moved is aimed at the $1 USB to serial adapters being sold on eBay with counterfeit chips. It doesn't affect consumer products at all, but it's got the maker community hopping mad.

Re:Computer Missues Act 1990

[DamnOregonian]

That's some good spin!
If your hypothetical daughter tells her to kill herself, ultimately, there's 2 things that will happen.
She will either do it, or she will not.
Don't loose your anger upon the man who said it if she does though, because he's got the chuckugly defense of "only a defective human would have behaved in such a defective manner"

Re:Computer Missues Act 1990

[Man On Pink Corner]

These things are seldom as black-and-white as they appear at first. From what I've seen in the US, courts often apportion the blame across multiple parties in a civil lawsuit. Let's say that on the way home from the bar, I drive over a curb and kill someone walking on the sidewalk. If the victim's family files a wrongful death suit, the court might decide that I'm 95% responsible, the pedestrian is 2% responsible for wearing dark clothing at 2 AM, and the city is 3% responsible for failing to follow regulations on curb height. The resulting damage award will be split accordingly.

So it's very believable that a court might find FTDI partially responsible for any damages that occur as a result of their deliberate attack against other peoples' hardware. Even a 1% share of the blame for a serious-enough malfunction could be enough to bankrupt the company. They may be morally right, they may be legally right from a criminal-law standpoint, but nevertheless, under US law, they may have cut their own throats if any innocent parties were harmed by their actions.

This was an incredibly stupid move on FTDI's part.

Re:Computer Missues Act 1990

[DamnOregonian]

*daughter's boyfriend

Re:Computer Missues Act 1990

[Wookact]

You expect the end users to know that? Really?

Re:Computer Missues Act 1990

[Curate]

To use a car analogy, it is considered broken in the same way that a car without gas is considered broken.

Disclaimer: This analogy excludes electric cars.

Re:Computer Missues Act 1990

[sl149q]

The problem is that there is no way for the driver to "post a message".

What you get is a device that doesn't work. If you use Device manager you'll find out that the device is using the XYZ driver from FTDI and that there is a "problem". Possibly with a cryptic windows error code.

Re:Computer Missues Act 1990

[sl149q]

FTDI should just allocate a PID under their VID for the counterfeit chips.

Then reprogram counterfeit chips to that PID. The device would then still work anywhere with another driver that supported THAT vid/pid (e.g. linux.)

I just wouldn't work with the stolen vid/pid to access unlicensed software.

Re:Computer Missues Act 1990

[Chelloveck]

You're right, "persistent" would have been a better word. By "permanent" I simply wanted to be clear that I was talking about a change that lasted beyond the current session, not necessarily something irreversible. A change that survives a power cycle or reboot and requires specific intervention to reverse like the VID/PID change does.

Your more generic example is the situation I was describing when I said "accidental". The action has a purpose on the intended platform and inadvertently causes damage to the clone. This is as opposed to a malicious change which is specifically designed to cause the damage. It's the intent to cause harm that differentiates between accident and potentially criminal act.

Re:Computer Missues Act 1990

[sl149q]

No there are os's out there that can be used to reprogram the device.

Re:Computer Missues Act 1990

[sl149q]

No it is the act of identifying criminal chips and disabling them.

Re:Computer Missues Act 1990

[amicusNYCL]

That's hardly the point.

Re:Computer Missues Act 1990

[sl149q]

The pid is subsidiary to the vid.

Just like Slashdot owns slashdot.org and you don't get to create and use tlambert.slasdot.org.

The vid (vendor id) defines a space of 65535 possible pid's (product ids.)

There is some conjecture as well that using another vendors id may be illegal under DMCA.

Google usb vendor id dmca.

Re:Computer Missues Act 1990

[sl149q]

It is NOT legal to use a vid/pid for your device and plug it into Windows expecting to use somebody else's driver that you have no license for.

You are creating a device that pretends to be something that allows you to be liable for theft of services. At least if you bought it the manufacturer would be the one on the hook.

Re:Computer Missues Act 1990

[sl149q]

And in what magical world do you expect somebody else to provide a driver for your device.

The manufacturer of YOUR device did not and does not provide a driver and you are complaining that FTDI is to blame?

Even if (sounds like when as they are going to release another update) a new FTDI driver arrives that simply doesn't work, how will that help the vast majority of end users whose devices will no longer work (except for the very small number that have Linux systems...)

So you are right. If it doesn't work it is BROKEN.

And that is NOT FTDI's problem.

Re:Computer Missues Act 1990

[Wookact]

No that is the point. You are trying to justify bricking the end users equipment, claiming that they know what they are doing. It is obvious that they don't know what is going on, it is just a gadget they bought off amazon. Soft bricking the device is shady and underhanded. What they should have done was pop up a message stating the device is counterfeit and asked for the user to inform them of where they got the device so FTDI could take action.

I know I would be glad to rat out the counterfeiters because I don't want counterfeit chips in my gadgets. If they were to ask me I would give them the information on where I got the gadget so FTDI could either help the manufacturer fix their supply chain, or follow it to the actual culprit.

Punishing the end user is passive aggressive. They know their gadget is broken, but not why it is broken. Frankly I hope they become the subject of a class action. They have no right to destroy hardware.

Re:Computer Missues Act 1990

[amicusNYCL]

No, it's not the point. I was responding to this statement:

You do not INTENTIONALLY break equipment that you do not own. You do not do that. No matter how you feel about that equipment. Particularly when the person who now owns said equipment has no idea that there is a problem.

Notice how there is no mention of FTDI, or USB, or drivers, or whatever else. It's an abstract point I'm trying to argue. If someone has a piece of equipment which is a counterfeit of what you make, and they know it's counterfeit (or they made it themselves), are you within your rights to destroy it? It wasn't legal for them to make or buy it in the first place. I'm not talking about making something which does a similar or the same task as something else, I'm talking counterfeiting. Buying cloth, sewing a jersey, and putting the NFL logo on it. Counterfeiting. If you walk into a warehouse and see a bunch of people assembling cheap widgets and slapping the name Wookactron on them, with the logo of Wookact Corp., are you within your rights to take one of those and smash it to pieces?

They have no right to destroy hardware.

In this case, they haven't "destroyed" anything. The hardware is still there, with all of the capabilities it used to have, as long as you can find a driver for it. They just changed the ID on it, and you can change it back.

Re:Computer Missues Act 1990

[DamnOregonian]

You literally have no fucking idea what you're talking about.

There's no legality involved with your piece of hardware using unlicensed bits in a protocol field. None. Zero. Nada.
There's no legality involved with a device driver talking to your hardware. None. Zero. Nada.

Legality didn't even enter the picture until FTDI wrote malicious software that disabled end-user devices. Were this a mistake, they could be off the hook by replacing them, by civil court order if necessary. Since it was intentional, that makes it criminal as well.

Re:Computer Missues Act 1990

[DamnOregonian]

It again depends entirely on intent whether it is criminal, or simply tort.
If the girl knew the boy was likely to do it because he was mentally unstable, she'd likely be brought up on some sort of manslaughter charge.
If it couldn't be shows that she had any expectation of it actually happening, the best anyone could likely hope for would be damages in a wrongful death civil suit.

The situation is really pretty analogous.

Re:Computer Missues Act 1990

[knorthern knight]

> In this case, they haven't "destroyed" anything. The hardware is still there,
> with all of the capabilities it used to have, as long as you can find a
> driver for it. They just changed the ID on it, and you can change it back.

OK, so how does Grandma change the ID and install an older driver? Note that changing the ID to 0 means that it is *NOT* treated as a USB device by any standard software. You are looking at specialized programming-to-the-hardware to be able to interact with it, in order to try unbricking it.

Re:Computer Missues Act 1990

[knorthern knight]

> They are now being coerced into supporting other chips that are not under their control.

I call bull****. They are not being coerced to do anything, except follow the law. If they detect a clone, they have every right to program their driver to throw an error/exception saying that it's an unsupported device. When they deliberately start bricking hardware, that crosses the line.

An example of "doing it right" is MS Windows checking whether it's a valid copy. If it decides it's not, it goes into reduced functionality mode, and gives you time to verify. It does not go around wiping the hard drive and flashing the BIOS to all zeros. And I'm a linux user, so I'm not exactly an MS fanboi.

Re:Computer Missues Act 1990

[thegarbz]

The chip still works, just not with FTDI's drivers. Nothing was broken.

False. All OSes do not like receiving a PID of zero, and the OSes can not automatically assign a driver to it.

Have to manually force two drivers to be used with a device every time it is plugged into a PC is a good definition of something that is broken. Windows doesn't remember the driver if the PID is zero.

Re:Computer Missues Act 1990

[thegarbz]

Again (as per previous posts) :) FTDI didn't break anything - they moved the USB ID off their allocated(and payed for/licensed range) and that was that

So what you're saying is that FTDI intentionally took a device that wasn't theirs, detected it as not theirs, and then modified firmware on the device even though it wasn't theirs with the specific purpose of setting a PID from one they own, to another they own (PIDs can be anything except 0, they are not licensed), but one that is guaranteed to not work on any machine even if the driver on another machine hasn't changed?

Got it. Totally not malicious. Definitely didn't break something. No sirrree. Nothing to see here. Move along please.

Also as an aside Windows doesn't handle PID of 0. You can't write a driver for a PID of zero. You need to manually force the driver on the hardware every time it's plugged in.

Re:Computer Missues Act 1990

[thegarbz]

Why would FTDI have to ensure their driver doesn't break chips that aren't theirs? There's no agreement, licensing, or goodwill.

They don't but I invite you to look at the driver they proposed for Linux: https://lkml.org/lkml/2014/10/23/129
I especially like the line with the comment: "/* Attempt to set Vendor ID to 0 */"

That is the exact opposite of ensuring it doesn't break. That is actively and maliciously breaking something. Also the cloners are producing a product that is perfectly legal when they use that VID/PID pair. It's against the USB spec to use another vendor's ID and then use the USB logo on your device, but I've never seen a USB logo on these devices, so it's all ok.

The only thing illegal here is they are printing FTDI's logo and model number on the chip. If they didn't do that it would be a 100% legitimate product.

Re:Computer Missues Act 1990

[Mr Z]

I recently built a big pile of boards with an FTDI USB chip on them, as part of my retrogaming hobby. I bought from a reputable source, I think. But if it turns out that I got an illegitimate batch of FTDI chips, I now own a pile of bricks until I pay to get them reworked. I don't know yet, since I haven't tested them in Windows with the latest driver.

Counterfeiting harms the original producer of the chips, and this extends the harm to OEMs that use the chips (who may or may not be innocent), and their customers (who most certainly are innocent).

I can't see how this is a good thing for anyone.

As someone said recently at work: "Deposits to the 'trust bank' are always small. Withdrawals are always large." In other words, it takes years to build trust, but you can obliterate it in seconds. FTDI may have done just that.

Re:Computer Missues Act 1990

[Mr Z]

You're technically correct that the chip hasn't been physically damaged. However, it's effectively dead, and FTDI's EULA revision makes it clear that they intend to render non-functional any clones they detect:

Use of the Software as a driver for, or installation of the Software onto, a component that is not a Genuine FTDI Component, including without limitation counterfeit components, MAY IRRETRIEVABLY DAMAGE THAT COMPONENT.

Re:Computer Missues Act 1990

[Mr Z]

Vigilanteism, in other words. May fill a sense of personal justice, but that doesn't make it legal.

Re:Computer Missues Act 1990

[spongman]

it's not that they're not supporting the work-alike chips, they're actively damaging them. they specifically detect non-ftdi chips and overwrite the IDs.

Re:Computer Missues Act 1990

[spongman]

because the operating system automatically detects the VID, downloads and installs the driver, which bricks the hardware.

I'm pretty sure that's why Microsoft put a stop to it, since they realized they would probably also be named in any class action.

Re:Computer Missues Act 1990

[spongman]

the routine inside thier drivers as assertained from the symbol tables in the driver code was called "BrickClonedDevices"

do you have a link for that? curious.

Re:Computer Missues Act 1990

[spongman]

consumer devices that do not have the USB logo can use whatever VID/PIDs they like. there's no law governing this except the trademark of USB's logo.

Re:Computer Missues Act 1990

[Goaway]

Of course the liability is with FTDI, they intentionally modified the chip to make it stop working!

They are well within their rights to make their driver detect counterfeit chips and refuse to use them.

That is nowhere near the same as actually maliciously writing invalid configuration settings to the chip.

Re: Computer Missues Act 1990

[Goaway]

True, however, are they supposed to test /their/ driver for /their/ hardware on everyone elses chips? No.

No. But it turns out they did. Because they actually spent quite a bit of effort to write code that permanently breaks counterfeit chips and not their own. They did lots of testing on everyone else's chips.

Re:Computer Missues Act 1990

[petteyg359]

And there's absolutely nothing wrong with it being intentional, unless you're claiming that parasites deserve to leech FTDI's work.

Re:Computer Missues Act 1990

[petteyg359]

Defense is not malicious. They have every right to not let parasites leech off of their work.

Re:Computer Missues Act 1990

[petteyg359]

Defense is not malicious. They have every right to not let parasites leech off of their work.

Re:Computer Missues Act 1990

[petteyg359]

Defense is not criminal. They have every right to not let parasites leech off of their work.

Re:Computer Missues Act 1990

[stoatwblr]

"Again (as per previous posts) :) FTDI didn't break anything - they moved the USB ID off their allocated(and payed for/licensed range) and that was that"

According to the computer misuse act in the UK, they performed a criminal act by making unauthorised modifications to devices they didn't own.

The fact that utilities exist to reprogram the soft-bricked devices is irrelevant to the law at hand.

There _will_ be legal fallout from this. In the UK the unfair terms in consumer contracts act will wipe outthe clauses that FTDI are relying on and I wouldn't be at all surprised if whoever signed off on it in the UK (it's a scottish company) ends up in court on criminal charges.

Re:Computer Missues Act 1990

[tibit]

My vendors have pockets deep enough that if push came to shove, I'm sure we could extract sufficient damages. Again, if you understand your supply chain, there won't be surprises.

Re:Computer Missues Act 1990

[LiENUS]

I dont believe that driver is from FTDI. A) Russ Dill is a known kernel developer. B) from what I udnerstand that patch would actually brick legit FTDI FT232RL devices as well. He submitted the patch as a joke but it looks like it just overwrites the checksum located at an even address rather than using a collission by modifying only odd addresses. That even address write would cause a write on the real FTDI chips as well.

Re: Computer Missues Act 1990

[countach]

Ever since Compaq made the first IBM clone back in the 80s, the entire industry is built on cloning at the functional level, which sounds like what is going on here.

If a court could establish that this code was designed to deliberately written to damage hardware, that's a lot different to merely failing to make their code work with clones.

Re:Computer Missues Act 1990

[amicusNYCL]

OK, so how does Grandma change the ID and install an older driver?

I don't know. How does Grandma fix a blown head gasket in her car? How does Grandma fix her air conditioner compressor or hot water heater when it breaks? If a capacitor in Grandma's TV burns out, how does she replace that? I guess she just gets a soldering iron and goes for it, right?

Re:Computer Missues Act 1990

[amicusNYCL]

because the operating system automatically detects the VID

...which the manufacturer sets. So, if the manufacturer did not want their hardware to use the driver for the particular device that they are claiming to be, then why are they using that device's VID?

Re:Computer Missues Act 1990

[LinuxIsGarbage]

The biggest issue with the ELM327 clones is that they're very very flakey - the bain of my life! :)

Some have issues with timing on serial data, resulting in garbled output
Some have issues with canbus systems and causing the canbus itself to have internal comms problems (causing your car to complain)
Some don't work on all the protocols (a PCB design issue)
Some get hot and reset
Some have dry joints (ok not a chip issue, but a build quality)

I warn the user (but don't stop them) if they have a clone unit (as it's not too helpful), but my stuff gets a *lot* of flak because the OBD adapter is kaput or doing crappy things (the above). :'-(

My cheap bluetooth ELM327 works okay, with a couple notable issues:
-It has to be re-paired everytime it's power cycled
-Bluetooth MAC is obviously fraudulent. Like 11:22:33:44:55:66

Re:Computer Missues Act 1990

[g0tai]

Similar thing with other clones - the bluetooth mac is the most duplicated. there's a valid-looking one (which has basically been used /everywhere/ for that paticular bluetooth module

The re-pairing issue may be an android/bluetooth as well as a combination with the adapter (or it may have been worked around in later versions of android) I'm not sure. Again, it's another headache that developers have to deal with :-)

Must have been a fun conference call...

[fuzzyfuzzyfungus]

I can only imagine that the lucky guy who picked up the call from Redmond about 'so, we understand that you...made a few changes...to the behavior of your WHQL drivers that frankly don't make Windows Update look very good...' got quite an earful.

Even if MS thinks FTDI is on the crusade of the righteous, it certainly isn't to their advantage to have Windows Update involuntarily pulled into the fiasco.

Re:Must have been a fun conference call...

[Anonymous Coward]

At least this was a nice test to see if Microsoft cares about the quality of the WHQL driver pool.

Alternatives? Same problem..

[Daemonik]

FTDI's chip is popular, and heavily counterfeited. Right or wrong they felt they had to go to these lengths to protect their business, and it has had the effect of bringing counterfeited chips into the public consciousness.

The problem however, is that switching to another chipset won't eliminate the counterfeiters and the people who slip these chips into the supply chain to save a few bucks.

So the better question is how can we improve the system to ensure that counterfeit chips aren't being secretly swapped into our products.

Re:Alternatives? Same problem..

[Forgefather]

I can think of a few ways, but the best would be to not manufacture in China.

Re:Alternatives? Same problem..

[queazocotal]

It would have been quite reasonable to - on plug-in, put up a 'this device is using a counterfeit chip'. Banner.
(though if the chips merely reimplement the API -and do not copy the chip, and are not sold as made by the company - it is questionable if it's really counterfeit)

Re:Alternatives? Same problem..

[DutchUncle]

If they're re-using FTDI's manufacturer ID, then they're counterfeit. I agree that blocking use and announcing why is very different from vandalism.

Re:Alternatives? Same problem..

[King_TJ]

Fake copies of hardware are a growing problem all over the electronics industry. Historically, the problem tended to resolve itself when the poor copies prematurely failed on enough people that a conscious effort was made to avoid them.

It seems to me the problem that's happening now is, the counterfeits are getting good enough that they're actually becoming a good value for consumers. As just one example of this? I was just shopping for an off-road LED light bar to put on my Jeep. The traditional name brand light bars tend to sell in the $800 - $1000 price range, but a flood of Asian knock-offs have arrived which sell on eBay or Amazon for as little as $99 or so each. Big name vendors and some of the heavy users have decried them as "junk" compared to the others because of such things as less quality control ensuring each LED outputs the same intensity and color of light, and complaints about water leaking into the enclosures of the cheap ones and leaving condensation on the inside lens. A few people express concerns that cheaper circuit boards inside will cause the knock-offs to fail prematurely too -- pointing out that it could be REAL bad for you if your light fails you in the middle of the night, out on some trail, and you can't see to get back out of the woods again.

All fine and good, EXCEPT people can fix the water/condensation problems with a tube of silicone caulk and 5 minutes of time, sealing up the plastic lens after taking a light bar apart. The other issues simply mean you could buy a spare (or three!) to keep with you -- and heck, probably even toss out one if you feel the LED lights on it are inconsistent enough to annoy you, and STILL pay far less than one of the original name brands!

I don't know much about FTDI's chip ... but it sounds like they designed something that was relatively easy to clone, and now they're stuck trying to sell something that many manufacturers don't see as differentiated enough from the copy-cats to try too hard to buy the original part? Trying to actively destroy the competition is NOT the solution. Perhaps more R&D to offer a superior update to the original chip would be?

Re:Alternatives? Same problem..

[poetmatt]

There is no part of "right" here, and is 100% wrong. You don't combat counterfeit items by destroying them, that doesn't do anything. You build a better product and accept that counterfeit exists because you aren't serving some part of the market. Serve that part, or deal with that the market has routed around your shortcomings via counterfeits.

Re:Alternatives? Same problem..

[OzPeter]

So the better question is how can we improve the system to ensure that counterfeit chips aren't being secretly swapped into our products.

That's easy .. quality control on your part to verify that the chips in your product are genuine.

Remember the old saying:

Trust in God, but tie your camel

Re:Alternatives? Same problem..

[queazocotal]

It is not complying with the USB associations rules on VID/PID.
This is not quite the same thing as being counterfeit.

If it is represented to the customer as a genuine chip - then sure.

Re:Alternatives? Same problem..

[eclectro]

So the better question is how can we improve the system to ensure that counterfeit chips aren't being secretly swapped into our products.

And here we have the question FTDI needed to ask before nuking people's equipment to deal with a crime that already took place.

Re:Alternatives? Same problem..

[Andy Dodd]

"are not sold as made by the company" - They use FTDI's USB VID/PID - this is representing yourself as an FTDI chip.

The tough thing is HOW to do it on first plug-in. The only method I can see that would work is to perform the same alteration the driver is doing, but instead of changing the PID to 0, change it to one reserved for fake chips. Then have the driver spit out lots of warnings if the "fake chip" PID is seen.

(As to how their driver is doing its thing - from what I've read of decompiled code, it attempts to change the PID to 0 on all chips. However, genuine hardware needs additional steps to actually start the EEPROM write, while clone hardware immediately writes out the EEPROM.)

Re:Alternatives? Same problem..

[fuzzyfuzzyfungus]

In this case, it is not questionable at all. They don't have any right to use the vendor ID (VID) assigned to FTDI.

Why not? The USB IF won't be happy about it, and not being able to trust VID/PID pairs makes driver devs sad and prone to resort to ugly fingerprinting heuristics; but none of that establishes a legal monopoly on "0x0403" for FTDI.

Re:Alternatives? Same problem..

[Impy the Impiuos Imp]

So jokers around here expect the driver to write nice, useful changes to the chip and OS, even if counterfeit, if part of the update?

But not to write changes so their driver won't work with it?

So the frauds get to shove their hands down your pants but you can't return the favor?

"You may shove your hamd into our pants to do good things, but not pinch us in the ball."

Myyyyyy, how magnanimous everyone ie with other peoples' efforts.

Re:Alternatives? Same problem..

[Impy the Impiuos Imp]

They. Are. Not. Destroying. It.

They are refusing to work with it, correcting a bug in their earlier software.

Neither the counterfeit chip maker, nor the counterfeit chip-using device maker, nor you have any expectation to use their unlicensed software.

Sucks to be you, the end user, but your beef is with the device maker, who should produce their own driver.

Re:Alternatives? Same problem..

[ColdWetDog]

I can tell you're not an American.

Here, it goes:

"In Gold we trust, all others pay cash."

Re:Alternatives? Same problem..

[Anonymous Coward]

If they're re-using FTDI's manufacturer ID, then they're counterfeit.

No, at most it is a trademark violation.

If the counterfeiter has signed with USB.org then it might be a contract violation but people who haven't signed with USB.org has no contractual obligation to respect their VID:PID assignments.

It is completely legal to make products that talk the same protocol as USB products and that uses a VID:PID combination of your choice. You just can't use the USB-certified logotype since that would be a trademark violation.
There are technical problems that might come from selecting your VID:PID yourself, especially if you pick a pair that is used by someone else and in particular if you use two different products with the same VID:PID combination in the same computer, but it is not illegal.

The big issue here is that the counterfeit chips actually are counterfeit chips and the buyer is tricked into thinking that it is FTDI product. If some other logotype had been stamped on them and they didn't claim to be USB certified it would be completely legal.

Re:Alternatives? Same problem..

[poetmatt]

Wha?

Wrong.

Cite:

https://www.techdirt.com/artic...

Re:Alternatives? Same problem..

[Zalbik]

Right or wrong they felt they had to go to these lengths to protect their business,

There is no right here. FTDI had no business trying to modify any data on these devices.

This story would have been very different had FTDI just disabled the DRIVER software if a counterfeit device been detected. FTDI is under no obligation to provide drivers or driver updates that are guaranteed to work with counterfeit devices.

Yes, people could have easily gotten around this by rolling back the update, but at least it would have brought attention to the fact that the device was counterfeit.

A much more effective (and justifiable IMHO) solution would have been to write the driver so that it:
1) Put up a warning that the device was counterfeit.
2) Worked fine with the counterfeit...for a while
3) Started producing intermittent failures with counterfeit devices after a few weeks
4) Randomly stopped working entirely with counterfeit devices after 3-6 months

FTDI is under no obligation to provide drivers that function properly with counterfeit (or even a clone).

Re:Alternatives? Same problem..

[JesseMcDonald]

They use FTDI's USB VID/PID - this is representing yourself as an FTDI chip.

Only to the computer, which doesn't really count. These IDs could reasonably be considered part of the interface to the hardware; exceptions have been granted for both copyright and trademarks in the past when the infringement was required for the sake of compatibility. The real question is whether the buyer was misled to believe that these chips were manufactured by FTDI. It seems that this was indeed the case, but that's a separate issue from the USB VID/PID.

Re:Alternatives? Same problem..

[queazocotal]

This was not a case of the driver accidentally not coping with the format of the noncompatible chips.
There would be no issue whatsoever then.
And indeed - refusing to work with the chip would be just fine.
Actively disabling the chip in such a manner that it does not work even in other computers without the driver installed was what happened.
It's only fraud if the vendor of the chip claimed to their customer it was a genuine computer chip.
A computer cannot tell if that happened automatically.

Re:Alternatives? Same problem..

[jabuzz]

No they changed something that they where not authorised to change. That in the UK is flat out illegal. The Computer Misuse Act 1990 is quite clear on this and they are a U.K. company.

Re:Alternatives? Same problem..

[QuasiSteve]

In terms of positive PR, they could have gone with:

1) Put up a warning that the device is counterfeit and will only work for another N times (after which, simply refuse to work with it - don't modify it outright, though given the technique a temporary modification may be required).
2) Ask users to take a picture and name the vendor and product in a tweet using hashtag #fakechip (or whatever marketing comes up with)
3) Every first tweet of the vendor/product combination is rewarded with a free genuine FTDI replacement chip.
4) Sit back, collect the list of naughty companies (pass on to legal if bored), watch the build of goodwill, the discussion of fake vs genuine swell.

Instead, the discussion is now much less about counterfeit vs genuine chips, but about FTDI doing something that apparently is hugely polarizing (some people supporting the practice, most others wondering wtf FTDI was thinking) to electronics enthusiasts/integrators, security experts, and even legal eagles who aren't sure whether FTDI did something clearly illegal any more than whether they did something that was clearly legal, and a secondary discussion on what to replace FTDI parts with. All rather more negative bits of PR for FTDI, even if further out into the future I think this will have been seen as a good move.

Re:Alternatives? Same problem..

[TheGratefulNet]

problem with that is: so many come from china and the sellers are like cockroaches when the light comes on; they scatter, change names, go out of business and resurface.

there is next to zero ways to punish china based sellers and 99% of them are engaged in selling fakes (of anything, not just chips).

suppose the chip is soldered onto a system that can't easily be fixed? is ftdi going to do the rework? zero point zero percent chance of that happening. so, them sending you another 'chip' is pretty useless, in practice.

shaming the sellers usually wont' work unless its a perma business like sparkfun or adafruit. amazon and ebay sellers are like cockroaches, as I've said. you can't kill them all.

all you could realistically do is give a tool to end users to DETECT fake chips. then, next time you buy one, you run the test and you have a few days or weeks to return to the vendor (while they are still around and in business). then again, ebay would have to ammend its policy to NOT require you to ship the goods back to a china seller, or at least send you a prepaid shipping label.

in reality, I see none of this happening.

best I can do is stop windows update from now on (MS lost all my trust on this, forever, at this point), install 2.10 on my win boxes, lock them down and carry on with my life.

oh, and all ftdi designs I had in progress are now being modified to use another chip instead of ftdi. I may have to buy ftdi's on arduino nanos (I like them...) but I won't DESIGN with the chip in my own embedded boards anymore.

Re:Alternatives? Same problem..

[TheSunborn]

Sorry, you are wrong here. The chips with pid0 works fine with Linux, so there is no reason, the vendor could not make a working Windows driver.
 

Re:Alternatives? Same problem..

[toejam13]

I don't know much about FTDI's chip ... but it sounds like they designed something that was relatively easy to clone, and now they're stuck trying to sell something that many manufacturers don't see as differentiated enough from the copy-cats to try too hard to buy the original part? Trying to actively destroy the competition is NOT the solution. Perhaps more R&D to offer a superior update to the original chip would be?

The manufacture of inexpensive clones is nothing new in the chip industry. After the SN7400 TTL series was released in the 1960s, a flurry of clones were released. Same goes for the MC6800 IC series in the 1970s. Some were licensed second source suppliers, some were unlicensed compatibles, some were outright counterfeits.

Intellectual property law in many countries tends to prohibit counterfeits. Those knockoff Asian light bars you described could have been seized by customs if they tried to pass off as KC brand products. Likewise, it is unlawful in most countries to create a chip and sell it as an FTDI brand chip without their express permission. That isn't an issue of R&D issue, that's I.P. theft.

The issue of unlicensed clones is a little more murky. In some cases, the original product may have one or more patents that protect its design, function or interface. If those knockoff Asian light bars tried to used a patented housing design or voltage module without licensing, you have another I.P. theft issue. The owner of the patent could get judicial permission to have customs block or seize those products.

In the case of the affected FTDI compatible clones (and counterfeits), the issue comes down to their use of FTDI's vendor and device code in the USB stack. FTDI developed software drivers for customers of FTDI products. The unlicensed clone manufacturers have designed their chips to utilize FTDI drivers so that they didn't have to incur the expense of writing and maintaining their own drivers. So really, it is the unlicensed clone manufacturers who need to bump up their R&D research so that they don't facilitate I.P. theft and/or terms of use violations for their customers. If Microsoft wrote the device drivers or if unlicensed clone manufacturers wrote their own device drivers, we wouldn't have this mess.

The big question is if FTDI has a lawful monopoly on the USB vendor code it has been assigned. If it has, then it may have a right to physically stop squatters from using it (read: resetting the USB vendor ID code). Of course, being an international issue, it is going to vary by country. They may have broken the law in some places. They may only have the right to disable the driver. They may only have the right to degrade the driver. Or they may only have the right to display warning messages.

So I don't think it is just a cost, quality or R&D issue here. It really is about third parties designing their products to utilize work on FTDI's part without paying for it.

Re:Alternatives? Same problem..

[idontgno]

You keep repeating this egregious lie with such enthusiasm I have to assume you're being paid to do it.

At least we know that FTDI has some representation in this discussion, although they're not doing a very good job hiding their interest.

Re:Alternatives? Same problem..

[sjames]

The fakes do claim to be genuine FTDI chips.

Re:Alternatives? Same problem..

[petermgreen]

As a manufacturer of devices I can see a few defenses you can employ

1: avoid chips that hide their internal details from you. The FTDI clones are totally different internally from the genuine devices but because that is all hidden from it's difficult to tell the difference without decapping them. Something like a microcontroller is much harder to clone without the customer noticing.
2: avoid manufacturing in a country where faking things and substituting parts from non-approved sources are culturally accepted.
3: if you are big enough to justify it put in place a program of destructive testing of samples of incoming material. Especially if supply problems push you into buying from non-approved sources.
4: don't buy from non-approved sources just to save a few bucks.

Of course all these defenses will cost you money which is why many device builders don't do them.

Re:Alternatives? Same problem..

[Vapula]

Their use of FTDI VID/PID is a way of saying "use the same driver than this device" and definitively not representing as an FTDI chip.

On the other way, many of these clones have printings that mimic the one of a genuine FTDI chip (same logo/reference number/...) and THAT is counterfeiting.

But they are free to make a clone, with a different printing, a different reference ("XXCloner CFT232R" for example) exposing the same VID/PID... they won't be authorized to use the USB certified logo (neither would the finished product). But if they are not pretending to be a FT232R from FTDI, it's definitively not counterfeilting.

VID/PID spoofing can't even be said as a way to breach copyright at the driver level as there are free drivers (Linux for example) that use the same VID/PID pair.

You may compare that VID/PID problem with Ethernet addresses... the first 3 bytes make a number assigned to a specific manufacturer. But lmots of hardware allow to change the ethernet address using another vendor number. It's very often seen in routers and Wifi-routers where it allows to show on the WAN port the Ethernet address of some LAN computer.

Re:Alternatives? Same problem..

[Vapula]

You should say to the buyer of a 1000$+ 3D Printer that if it's expensive tool stops to work, it's because a 2$ clone of a 3$ chip disabled by a driver update...

Do you open your printer and check the marking on all chips to see if any of them is a counterfeit ?

Don't forget that we are not speaking about a finished product (the 3D printer *IS* genuine) but a very small part inside of it... among many other similar small parts...

And no company is safe when it's about counterfeited components... Do you remind the Capacitor debacle with ASUS motherboards ?

I'm not even sure that refusing to work with a clone would be a valid solution...

Re:Alternatives? Same problem..

[Talderas]

If they're re-using FTDI's manufacturer ID, then they're counterfeit.

No, at most it is a trademark violation.

Counterfeit goods are trademark violations.

Re:Alternatives? Same problem..

[sl149q]

Even if you want to dispute whether FTDI has ownership of their Vendor ID.

If you want to create your own driver and get it into Windows Update that requires that you also pass the USB Logo tests and that will require that you follow the rules from USB.org with respect to their allocation of Vendor ID's.

The only reason to use somebody else's vendor id without their permission is to allow you to illegally access their drivers (discounting the small possibility that you are developing a product for exclusive use with linux.)

Re:Alternatives? Same problem..

[sl149q]

Huh?

Counterfeit goods are routinely seized and destroyed. Google counterfeit products seized.

You can be charged with fraud, possession of property obtained by crime, possession for the purpose of trafficking in stolen goods. Etc.

Re:Alternatives? Same problem..

[knorthern knight]

> Sorry, you are wrong here. The chips with pid0 works fine with Linux, so
> there is no reason, the vendor could not make a working Windows driver.

Sorry, *YOU* are wrong here. The current Windows kernel will not mount a device with pid0, period, end of story. If the kernel won't mount a USB device, no driver will run it. You would need specialized bit-banging software to fix it.

The Linux kernel acted similarly, but there is now a patch out for the kernel to allow fixing FTDI devices.

Re:Alternatives? Same problem..

[Mr Z]

And that helps this how? The counterfeits aren't mask copies, but rather microcontrollers programmed to emulate FTDI chips. This isn't a "ghost shift" problem like many counterfeit consumer goods.

Re:Alternatives? Same problem..

[nctritech]

How many people really care about "counterfeit chips" if they generally function as expected when FTDI isn't running a routine called BrickClonedDevices to intentionally damage them? FTDI cares, sure. I have no reason to care at all.

Re:Alternatives? Same problem..

[stoatwblr]

It's counterfeited because it's more expensive than the other pin-compatible devices out there.

FTDI is making quite a profit margin on their devices.

They were effectively faced with a choice of reducing their margin a little on a device which has repaid its R&D costs many times over (which will stop the counterfeiting of their logo) or protecting it by defending against trademark forgery.

The choice they took to protect it amounts to criminal overreach which affects the wrong parties.

"screwed the pooch" doesn't even come close to describing this mess. It may well result in FTDI having to exit the USB-serial market entirely.

Re:Alternatives? Same problem..

[stoatwblr]

"there is next to zero ways to punish china based sellers and 99% of them are engaged in selling fakes (of anything, not just chips)."

Incorrect and incorrect.

Chinese copyright, trademark and patent law exists and is enforced. If companies are too bone-arsed lazy to register their trademarks/patents in china then they can't defend them there.

Chinese authorities regularly shut down and arrest counterfeiters - where the IP is registered in china.

Before the americans in this thread pile in, I'll remind you that until the start of the 20th century, european copyrights, patents and trademarks had zero validity in the USA unless explicitly registered there - something which Thomas Edison took advantage of to steal not only the inventions of the Lumiere Bothers (the movie projector), but also their creative works (Their movies) - something which the Lumieres found out the hard way when they tried to move to the USA and were found guilty of copyright infringement for displaying works they had made, but which Edison had registered copyrights on.

Amongst other things the result of this was the global book distribution cartels, which exist to this day, where parts of the world are carved up and a book authored and printed in the USA can be seized as copyright violation if sold in Australia without going through the "correct" distribution channels - which in some cases increase the cover price by a factor of 20 compared to direct imports.

Even now, a EU-registered patent has no validity in the USA unless explicitly registered there too (and vice-versa).

Copyrights/trademarks are a good idea for protecting intellectual property, but not such a good idea when attempts are made to use them as a license to print money, especially in this new era of widely available and rapidly circulating knowledge.

Re:Counterfeiters not competitors

[Anonymous Coward]

Does FTDI provide a utility to un-disable the disabled chips? If the answer is no then the chips are for all intents and purposes bricked.

It's not a grey area at all; FTDI intentionally did this. That is a crime. There is no exception in the law for cases of counterfeit merchandise. If their driver update happened to unintentionally cause counterfeits to be bricked, it would not be an issue. But this was intentional and they admitted as such.

99% of people with the counterfeit FTDI products don't know they're counterfeit. They are victims too - victims of unscrupulous vendors.

It's moments like this ...

[briancox2]

... that make me so happy to run Linux Mint and CyanogenMod exclusively as my OS's ...

Re:It's moments like this ...

[macraig]

That's pretty thin logic ya got there, buddy. You'd best be praying those environments never gain measurable market share, because that is the only thing keeping you from being dragged squarely into the same drama.

Re:It's moments like this ...

[zdzichu]

Don't worry, similar driver modification was proposed for inclusion – https://lkml.org/lkml/2014/10/... . But Linux maintainers didn't took it. Instead, original driver was adjusted to work with FTDIs ”bricked” by Windows driver: http://marc.info/?l=linux-usb&...

Linux is not fun anymore.

Re:It's moments like this ...

[nctritech]

Parent needs to be modded +5!

Sorry They're Changing

[Dredd13]

If I was a hardware manufacturer, this would make me MORE likely to use FTDI chips. It means I have greater confidence that what I'm getting is "real", because I know that they are actively trying to make counterfeiting their product more difficult.

Re:Sorry They're Changing

[Truekaiser]

Sorry but then your company then goes under after a large percentage of your customer base returns your products after they stop working.
You can spec the designs ALL you want to use authentic chips, but when your company's accounting department sees they can save a few cents to a buck per device by using the less than authentic chip. You're pretty much sunk.
Even if the accounting department agrees with you, and you get the company you work for to have boots on the ground in your manufacturing plants to make sure you use authentic parts. Even then you can't tell the chip is authentic until you destructively open it up and look at the silicon.

To put it bluntly as long as they exist the entire apparatus of the corporate machine is geared to use them because they provide the exact same function as the authentic chips at a lower price.

Re:Sorry They're Changing

[qbast]

Yeah, right. You also risk getting warranty calls from 10 000 of your customers and bad reputation for years, because it turns out that your FTDI chips were either not as genuine as you thought or their drivers got a bit overzealous and bricked genuine FTDI chips too.

Re:Sorry They're Changing

[Dredd13]

*My* company doesn't go under in that model, because my company in that model is more careful about where I buy my chips from, getting them directly from FTDI for example, to ensure the provenance of the hardware I'm selling, rather than trying to find lots of them on alibaba.

When you explain to accounting that we lose ALL the money if they use the fake chips, versus a small amount of money by using the real, most accountants get it.

And - yes - there are companies who will randomly sample chips from lots of 1000, 10,000, whatever, and open them up to verify that "the five units we sampled in this lot at random" were legitimate. It's part of their COGS calculations.

Re:Sorry They're Changing

[flopsquad]

At first I knee-jerk disagreed, because of my personal feelings about their crazy "it's ok to break other peoples' stuff" mentality. But looking at it from a HW mfr perspective, you're absolutely right.

I know that my supplier is tough on counterfeits, check. They're already top in quality, check. And also, I will never incur support costs in dealing with angry end-users complaining about bricked chips. My competitors might, if they're cheapos, and that's a competitive advantage. The aggregate cost to cleanup their mess could even outweigh the few cents they saved going with a counterfeit.

Re:Sorry They're Changing

[Dredd13]

As I said in the other reply: buy direct. They sell direct. No need for a middle man.

And if they brick the chips I purchased from them, I have a legitimate cause of action against them for the damages they caused by it.

No problem either way.

Re:Sorry They're Changing

[nedlohs]

And how can you be sure that counterfeit chips don't make it into the supply chain somewhere down the line without you knowing about it?

Having your devices get bricked (from the user's perspective) on mass because FTDI decided to try this again in the future seems like a rather large risk to take

Re:Sorry They're Changing

[AmiMoJo]

Also, now you know that FTDI will admit when it has made a mistake and reverse course. The other guys might just silently make their driver BSOD with fake chips and blame it on bad hardware *cough* Prolific *cough*

Re:Sorry They're Changing

[itzly]

So you buy your chips from FTDI, send them to China to have them assembled, and then some factory worker swaps them for fakes, while selling the originals.

Re:Sorry They're Changing

[bws111]

If your company is so poorly run that you don't have certification processes and suppliers you can trust then you deserve to go under. If you have to destroy a few chips every now and then to make sure you are getting what you paid for, then you do that. If you have to have wording in your contracts with your suppliers that they are responsible for using genuine parts, then you do that, and you hold them to it.

Every industry has counterfeiters. Responsible manufacturers know how to deal with it.

Re:Sorry They're Changing

[DarkOx]

I think a great deal of this comes from two sources:

Company A creates a design, builds proto types etc. Hires Compnay B ( like a Foxcon to manufacture ) lets company be mange all the parts inventory etc. Essentially they just send orders.

Company B makes the product with genuine parts as speced for some period of time. Company A feels good stuff is being made correctly etc. Gradually company B starts to do more and more runs with the knock off parts growing their margin because they continue to charge A the same for completed units.

Maybe Company B runs likes to A's spec during the day, delivers all of A's orders to spec. At night the knock off the whole damn finished product using fake parts and other cuts and push complete counterfeits out to other channels, knowing A won't get to inspect them for quality.

Re:Sorry They're Changing

[Dredd13]

Buy direct. They sell direct. Most chipmakers do.

Re:Sorry They're Changing

[Dredd13]

If you don't understand why you'd care about ensuring that you're using quality components rather than cheaply made knock-off fakes, remind me never to put you in charge of my supply chain.

Re:Sorry They're Changing

[bickerdyke]

Why would you decide to use UST-to-Serial chips that need vendor specific drivers in the first place? That's a basic usb profile that should be handled with generic drivers.

Largely reduces such unpleaseant surprises.

Re:Sorry They're Changing

[Dredd13]

If that's happening, I sue the bejeezus out of the factory worker. Or I decide "the risk isn't worth it", and control my own manufacturing.

There are solutions to all these problems. They may cost more up-front, but that's -- again -- the market normalizing itself as it weeds out the cancer of fraud.

Re:Sorry They're Changing

[Dredd13]

If Company A isn't demanding test-samples from every shift-run, they're doing their QC wrong. That's just CODB.

Re:Sorry They're Changing

[petermgreen]

This driver does not appear to make counterfeiting significantly more difficult, AIUI the counterfeit USB-Serial chips are microcontroller based and what the driver does is to rewrite one of it's IDs in a way that fails on the genuine chips but succeeds on the counterfiets. It will be trivial for the counterfieters to update their firmware to act like a genunine chip in this case.

What this driver did is make devices containing counterfeit chips mysteriously fail in the field long after deployment with no indication of why. Having a load of your devices suddenly and mysteriously fail in the field is not going to be good for your reputation.

Sure if you have any sense you try to keep counterfiet parts out of your supply chain but for the little guys that can be easier said than done. You are totally reliant on your distributors not to supply counterfeit parts and your manufacturing partners not to make unauthorised substitutions.

Re:Sorry They're Changing

[Qzukk]

Well obviously you can, you just need to install this driver.

Re:Sorry They're Changing

[Registered Coward v2]

If I was a hardware manufacturer, this would make me MORE likely to use FTDI chips. It means I have greater confidence that what I'm getting is "real", because I know that they are actively trying to make counterfeiting their product more difficult.

True, and legitimate hardware manufacturers are probably already doing that. However, problems arise when either a component supplier decides to use cheaper chips to make a little extra profit or counterfeit chips find unknowingly their way into a legitimate supply chain and so some percent of your product now is problematic.

Re:Sorry They're Changing

[Dredd13]

And - as discussed elsewhere in this thread - reputable manufacturers have means of holding their suppliers accountable, both in terms of QCing products they source, and in terms of indemnification for defective merchandise.

Re:Sorry They're Changing

[nedlohs]

Because you have complete control of course.

The shipment of real chips couldn't get swapped out for cheaper ones at the factory in China to be resold or anything like that.

If the DoD can't manage to keep counterfeit chips out of fighter jets it seems like a cheap usb gadget manufacturer might find it tricky.

Re:Sorry They're Changing

[itzly]

Good luck trying to sue somebody in China. But, yes, the market is normalizing itself by avoiding FTDI chips.

Re:Sorry They're Changing

[itzly]

Even with destroying a few chips, there's no way for a customer to detect the chips are clones.

Re:Sorry They're Changing

[Dredd13]

Then you control your own manufacturing. Lots of companies do that very thing. Or they have very strict contracts with their manufacturers to lay the financial burden at their feet if there is parts-swapping happening.

Reputable manufacturers solve this problem every day. It's the cheap-ass folks trying to go on volume versus quality that have the problems.

Re:Sorry They're Changing

[Dredd13]

Actually, yes. China's government is very protective of ensuring that buyers are getting what they pay for, because the gov't doesn't want to upset the goose that's laying a Fort Knox worth of golden eggs in their country. The Chinese government knows exactly which side its bread is buttered on.

Chinese manufacturer management personnel who've done this sort of thing in the past with food products have been fucking executed, so don't for a minute think that there's no teeth to such an indemnification.

Re:Sorry They're Changing

[Khyber]

" getting them directly from FTDI for example, to ensure the provenance of the hardware I'm selling, rather than trying to find lots of them on alibaba."

I got some real bad news for you. If the company making the authentic product is in China - IT'S ON ALIBABA. Trying to source direct will only get you laughed at.

Now, this won't work since FTDI isn't a Chinese company.

Yes, I do tons of global sourcing. Alibaba is about to steamroll the internet.

Re:Sorry They're Changing

[Khyber]

" buy direct. They sell direct"

Plenty of companies refuse to sell direct. For example, you will not buy anything directly from Cree unless you become their distributor. They'll send you engineering samples if you've got a legit request, but that's as far as it goes. You're stuck with Mouser or Digikey or similar.

Re:Sorry They're Changing

[Khyber]

"Buy direct. They sell direct. Most chipmakers do."

That does absolutely nothing with concerns to shipment swap/redirections, which I guarantee you the chip makers aren't running their own freight logistics.

Your 'guarantee' is not even close to iron-clad.

Re:Sorry They're Changing

[Khyber]

FTDI would have probably NEVER admitted fault until Microsoft got in touch with them.

Re:Sorry They're Changing

[Dredd13]

You do realize FTDI sells direct, right?

us.sales@ftdichip.com

Re:Sorry They're Changing

[Dredd13]

So buy through their designated supply channel and QC what you receive to ensure its provenance. Ask the manufacturer for appropriate QC steps to ensure that you are receiving "genuine product" that they manufactured. Make sure there is suitable indemnification in your contract with the supplier so you have recourse if they slip in bad product.

Again - these are all problems that reputable manufacturers have solved decades ago. It's the fly by nighters who have the most difficulty.

Re:Sorry They're Changing

[Dredd13]

It doesn't absolve you of a need to QC what you're receiving. It just decreases the likelihood of getting bad product.

Re:Sorry They're Changing

[Khyber]

Do you even have reading comprehension skills?

It's very apparent you do not, otherwise "Now, this won't work since FTDI isn't a Chinese company." in my comment would've stood out like a fucking sore thumb before you typed your inane comment.

Re:Sorry They're Changing

[Khyber]

"So buy through their designated supply channel and QC what you receive to ensure its provenance."

You fail at logistics too, it seems. When you get down to it, the only way to guarantee authenticity is to rip the thing apart yourself (costing money) and analyzing it against a known-real sample from the company. Then to top it off, I'm DESTROYING potentially usable product to ensure that I've got real stuff. Now I'm losing more money.

There is NOTHING that stops shipment swaps. Even the best logistics places have this happen all the time.

Re:Sorry They're Changing

[Dredd13]

No, you fail at QC.

What you're describing is what most reputable manufacturers do - they do destructive tests on random samples of each (lot,shift,day,week,whatever), few from the beginning, few from the middle, few from the end. As noted elsewhere, I've personally seen trays and trays of 486SX/DX chips ripped apart by IBM for testing prior to those lots' "acceptance" for use in IBM branded hardware.

So after they receive the hardware (ie, after the shipment swap risk) they test what they received. If the product leaves their possession and comes back (ie, attached to a board), they test samples of THOSE (also, again, destructively).

That QC is baked into the COGS for the product in question.

Re:Sorry They're Changing

[king neckbeard]

This isn't about quality, it's about whether or not the parts are genuinely from a specific manufacturer. Being a 'knock-off' doesn't inherently mean it's low quality, although I will admit that it can be the case. However, it can also be the case that the knock-offs are actually higher quality than the genuine material, especially if a business is effectively resting on its laurels. As others have pointed out, there are several places in the supply chain where somebody could be making a switch, and potentially screwing over the customers of anybody who doesn't treat a USB-to-serial chip like it's being used to protect nuclear secrets.

Re:Sorry They're Changing

[Dredd13]

well, as noted elsewhere in this thread:

- The knockoffs *are* shit quality in this case, flaky as hell, causing FTDI to field calls for issues with hardware that isn't even theirs
- knockoff quality is "indeterminate" and -- worse -- without recourse (there is no way to trace back who did shoddy work and get them to make good on the problems they caused)

Re:Sorry They're Changing

[Registered Coward v2]

And - as discussed elsewhere in this thread - reputable manufacturers have means of holding their suppliers accountable, both in terms of QCing products they source, and in terms of indemnification for defective merchandise.

Agreed, but all of that doesn't prevent it from happening. Your argument seems to be that a component manufacturer who bricks counterfeit parts is more desirable; I would question the decision making process of a company that did such a thing and be worried about the stupid decision's potential impact on my company.

Re:Sorry They're Changing

[amicusNYCL]

when your company's accounting department sees they can save a few cents to a buck per device by using the less than authentic chip

... and they actually suggest this as a business model, then you fire your company's accounting department and recruit some people that have the same morals as you.

Re:Sorry They're Changing

[sjames]

Not me. I would avoid a chip where the counterfeits are known to be hard to spot but where the end user may find their device (that I made) sabotaged later with the customer expecting me to refund their money (and I get a bad reputation in the process).

OTOH, if FTDI distributed a fool proof counterfeit detector free to manufacturers INSTEAD, that would increase my confidence when selecting their chip.

Re:Sorry They're Changing

[sjames]

In Chinese court? Good luck with that, assuming you can prove who did it in the first place.

Re:Sorry They're Changing

[petermgreen]

AIUI the "clones" are totally different chips inside that present the same interface. So you can tell the difference by disolving the package and inspecting the die.

Re:Sorry They're Changing

[Vapula]

Except that this driver which disables the clones is only there for less than one month... before you had no way of detecting if the chip was a fake or not... Maybe even FTDI didn't know until recently when they found out that "write-check" weakness...

So, you may have been in business for years, sold hundred of thousand devices with the clone with no way to detect it... until this recent driver update...

Re:Sorry They're Changing

[stooo]

>>If you don't understand why you'd care about ensuring that you're using quality components rather than cheaply made knock-off fakes

Today, using a ftdi chip in a new design means :
- using a too common device, typical target for compatibles and fakes
- using a device which costs too much (hence the easy and obvious target for fakes)
- using a part which presents a serious risk of customer return you have to take the cost because of a malicious action from FTDI. You use original chips, but you will be bitten due to good fakes being non discernable

I won't use FTDI in my upcoming products. There are better alternatives who cost half, are of equivalent value, and don't try to screw you to keep asking for a premium price.

Re:Sorry They're Changing

[sl149q]

No, because FTDI is now providing me with drivers that will detect if I get a batch of product manufactured with counterfeit chips.

So I can immediately return the product to where I had it manufactured and have them review their supply chain issues.

Any boards that work I can happily sell because I know that the FTDI chip and driver will provide a reliable solution.

Re:Sorry They're Changing

[goose-incarnated]

Then you control your own manufacturing. Lots of companies do that very thing.

Let's say you do that. You control your own manufacturing, but you don't manufacture everything, do you? You don't put up a multibillion dollar chip fab plant to turn out 150000 $0.99 parts, do you? You buy those things from somewhere reputable, like FTDI itself. You own the logistics (yes, you went out and bought a cargo ship, crewed it and run it just to give you your parts), you own the manufacturing (spending billions of dollars putting up a plant capable of doing this).

Nevermind all that, you go with the $0.99 FTDI part, well, because ... and everything seems to work. One year later when you have 150000 $10000 dollar devices in the field FTDI releases a new driver which instantly and permanently bricks half the devices in the field. Your customers instantly pull out the warranty agreement and because you have no devices that definitely won't be bricked you have to give them money instead. Well done, you're now broke and bankrupt!

How did your "genuine" devices get bricked anyway? Well, some lowly paid peon on your cargo ship, or your transport trucks, or in your warehouse, or on your factory floor got paid a small amount of money to switch them out. The erratic nature of the switching over time meant that your strategy of random sampling five out of every 10000 chips was not good enough (perhaps you should have used a stratified random approach?).

The point is that even when you theoretically control everything, if there is money to be made to swap out the chips with fakes someone under your theoretical control will swap it out for the money. At this point it is almost way too risky to trust anything to an FTDI driver - maybe use a different driver (seriously, as a poster above pointed out it's a fairly trivial thing to write a driver for this particular example), but if you're going to use a different driver then why not simply use a different chip?

It is almost stupid, in light of what happened, to actually trust a company willing to damage your property to protect itself from a crime which has already happened. An analogy would be if a grocery store wronged you, and then you decided to take revenge by hunting down everyone else who shopped there and killing their loved ones, or burning their house down - they are an innocent third party!

In no situation is it acceptable to take punitive measures against innocent third parties when someone wrongs you, and in this situation it is even more repulsive than usual as the innocent third party won't even know what FTDI is, or why they should care - they bought a fucking printer, or car diagnostic unit, or snazzy Hi-Fi unit, or whatever. This company should be forced to make reparations for the replacement of any bricked device. It might make them go out of business, but it would definitely set a good precedent. I'm tired of companies getting away with actual crime while individual citizens get their lives destroyed in civil suits brought by companies, with no actual crime getting proved.

Can the counterfeit chip be detected?

[jones_supa]

Is there a way to detect a counterfeit chip without bricking it? If that's the case, they could have just added a System Log message "FTDI device attached to system is not genuine! Driver will not start." Then the driver would return an error and Control Panel would show a yellow exclamation mark for the device.

Re:Can the counterfeit chip be detected?

[SirDrinksAlot]

From the sounds of it, that's pretty much what they're going to do.

I'm totally fine with TFDI disallowing counterfeit devices, even tho the consumer will get boned in the end they will have to go back to the manufacturer that tried to save a few bucks by buying what is unquestionably a counterfeit chip at counterfeit price. There's no pleading ignorance when the official suppliers charge a certain amount and these back ally dealers are a fraction of the price. Any authorized fab is going to have a fixed license fee that's going to keep the price relatively high compared to the unlicensed fabs. Crucifying FTDI because they're disallowing the devices is unfair with out putting most of the blame on the companies sourcing the questionable chips.

Re:Can the counterfeit chip be detected?

[Andy Dodd]

From looking at how their stuff works, no. The driver tries to change the PID on all devices, but genuine hardware doesn't actually write out the EEPROM until further action is taken, while clones immediately write out the EEPROM.

Although it isn't really a "brick" - it sets the PID to 0. Which is invalid, but happens often enough these days that you can still force the hardware to be used. Someone wrote a Linux patch that would register the correct driver for FTDI's VID and a PID of 0.

Another option FTDI could have done is: Change the PID to one reserved for clones, then spit out warnings when that PID is seen.

Re:Can the counterfeit chip be detected?

[caseih]

Obviously there is a way, since their malware driver was detecting it and *then* changing the pid to 0x0000. In fact you can see source code for this that someone posted to the Linux Kernel Mailing list a few days ago. Hopefully the new driver will do exactly as you suggest, though I think a big warning message box saying that the device is not genuine, but continue to function might be enough for end users to let companies know their devices are using the fake chips.

Re:Can the counterfeit chip be detected?

[Truekaiser]

To the end user it is bricked. Thats all that matters.

Re:Can the counterfeit chip be detected?

[0123456]

Yeah, because refusing to work with a compatbile chip that's been operating critical hardware in my business for years is so much better.

Re:Can the counterfeit chip be detected?

[Munchr]

No, the source and comments posted show that the pid change is issued to ALL devices, real and fake. It just happens that the real device ignores the command, and the fakes obey it.

Re:Counterfeiters not competitors

[Dredd13]

When you send your fake Rolex (that you think is real) into Rolex for service, they don't send it back to you, they confiscate it as a counterfeit and it's destroyed. I went through this myself with a fake Mophie battery pack. They sent me back a photograph of the giant piles of counterfeit batteries that they confiscate because they came in for warranty work, and they weren't real.

This is functionally no different from that.

Not a chance

[Anonymous Coward]

My involvement with hardware is currently only as a hobbyist, but there's a hardware project I might get on soon at work. FTDI has shown that it is willing to punish both direct and indirect customers for a wrong committed by a third party, and has not even remotely recanted that view. Management apparently thinks that they merely went too far when the world is shouting at them that going in that direction at all is unacceptable.

The obvious alternatives for USB-to-serial are:

1) Prolific 220x
2) Build a soft UART with a suitable microcontroller (PIC, AVR, Cortex-M0, whatever); this is apparently how the fakes work anyhow. Conform to USB CDC and most operating systems should have a built-in driver.

Re:Not a chance

[arglebargle_xiv]

The obvious alternatives for USB-to-serial are:
1) Prolific 220x

Prolific are never an alternative, unless the question is something like "Would you rather have gonorrhea or ...?". In order of preference, it's something like FTDI, FTDI clones, banging rocks together to get ones and zeroes, Prolific, Prolific clones.

Re:Not a chance

[stoatwblr]

See other postings about Prolific.

There are a dozen USB-serial devices out there, quite a few are pin-compatible and most of them are cheaper than FTDI's F232R

Yes we're going to keep using FTDI chips

[gweeks]

We don't use any of the serial only chips, but on the higher end with JTAG and SPI the FTDI parts work great and aren't too expensive. If any "clone" chips get into our supply chain we would be very pissed at whoever did it. We specify actual FDTI parts for a reason. The "clones" have very hit or miss quality. We don't use them under windows either.

Re:Yes we're going to keep using FTDI chips

[__aajfby9338]

If FTDI provided a standalone counterfeit detection tool that manufacturers could use at final test or just as a spot check, then that could be helpful for conscientious designers/manufacturers like you or me who might find fake chips in our supply chain and then be really angry about that. We want to discover the problem before our finished goods end up in our customer's hands! It wouldn't address the problem of manufacturers who knowingly use fake parts or who just don't care, but it would be a step in the right direction. Deliberately and silently borking the fake chip after it's already in the end user's hands potentially causes a support burden for legitimate manufacturers of products using FTDI chips, without giving those manufacturers the information they need to constructively address the problem.

Re:Yes we're going to keep using FTDI chips

[j-beda]

We don't use any of the serial only chips, but on the higher end with JTAG and SPI the FTDI parts work great and aren't too expensive. If any "clone" chips get into our supply chain we would be very pissed at whoever did it. We specify actual FDTI parts for a reason. The "clones" have very hit or miss quality. We don't use them under windows either.

I suspect however that if FDTI fakes did make it into your supply chain, you would much prefer any FDTI software updates to toss up a "we won't work with this device" message rather than making the device not work with any software. I don't know that I would continue to use a supplier with this type of business practice if there were any viable alternatives.

Re:Yes we're going to keep using FTDI chips

[Z00L00K]

That doesn't always work.

The problem is that the fake chips are sometimes injected into batches of real chips, and it costs money to test the validity of every chip on the production line. If the standard driver borks the fake chips on the production line then they will fail tests and go into the junk bin. If the junk bin overflows with borked devices due to fake chips then it will definitely go back the food chain.

Re:Yes we're going to keep using FTDI chips

[gweeks]

By "pissed" I mean we would charge them with the costs of removing all of the hardware from the field and doing the board reworks. You don't get these kinds of guarantees at the hobby level, but you do at the higher end. We've never had to do it for "clones" but we have for parts that didn't meet spec in other ways. I might be a little bit ticked at FTDI, but none of our stuff ever touches windows anyway.

Re:Yes we're going to keep using FTDI chips

[VGPowerlord]

It isn't clear that they have a good way of detecting clones other than trying to rewrite the USB IDs (or other EEPROM data) as the clones immediately overwrite it while real devices don't.

Re:Yes we're going to keep using FTDI chips

[zarthrag]

THIS.

Supply chains and procurement is already wild enough. Checking every part is not part of the deal. (Though, using authorized distributors is the first/best step. Stay away from Shenzhen if you can.) I've never been a huge FTDI fan, but this debacle has all but ensured that I never use their parts in a design. Accidentally acquiring clones could result in a support nightmare that really didn't have to happen.

Besides, this move doesn't punish the clone makers at all. Just end-users. They could have put up a pop-up window or notice. But bricking... that would have me calling up the lawyers. If they feel it's okay to destroy product (especially if those clone chips weren't purchased knowingly). That's more than ill-will:

That's liability.

Re:Yes we're going to keep using FTDI chips

[zarthrag]

This is from the viewpoint of an OEM manufacturer, btw.

Re:Yes we're going to keep using FTDI chips

[stoatwblr]

" it costs money to test the validity of every chip on the production line"

It costs money to install a chip tester on the line for every device before it's planted on the board and adds nothing to the line time, as it's in the chip chute or tape-path. The actual monetary cost is small beer if correctly implemented.

It saves money if that means you reduce your return rate by 1-2% and it might save you from a bad batch of manufacturer chips too.

Not that it will help if you're buying your components from a mall in downtown Shenzen.

Re:Yes we're going to keep using FTDI chips

[stoatwblr]

"By "pissed" I mean we would charge them with the costs of removing all of the hardware from the field and doing the board reworks. You don't get these kinds of guarantees at the hobby level, but you do at the higher end. We've never had to do it for "clones" but we have for parts that didn't meet spec in other ways. "

How much did that cost (including intangible losses) vs the cost of installing chiptesters on the tape dispenser of the pick and place machines?

Re:Yes we're going to keep using FTDI chips

[equivocal]

So the next product out of china will be a counterfeit counterfeit detection tool. Then FTDI will have to invent a counterfeit counterfeit detection tool tool. So the next product out of china will be a...

Probably Not

[Rob Riggs]

As a "maker" who sells small runs of boards that I have manufactured in China by an assembly house, I trust that they will build the board to spec. But I do not have the wherewithal to manage and secure my supply chain from start to finish. If I specify a part, I trust that the assembly house uses genuine parts. If they do not, I don't know what sort of recourse I have if, two years, later, all of my parts start being bricked. But I certainly see it from FTDI's perspective (and Prolific, another serial chip manufacturer with the same problem). It's a really tough problem. I don't know what the right answer is. Maybe create a standard for USB serial interfaces that everyone can use? I think that already exists (the CDC).

Re:Probably Not

[Rob Riggs]

Pardon the stray comma.

Re:Probably Not

[OzPeter]

As a "maker" who sells small runs of boards . . I trust that they will build the board to spec . . I don't know what the right answer is

If you are getting boards built but not checking that they are to spec, then I'd suggest that you are not doing any quality control. Doing that would be the very first step in the process. And you don't have to test every board, just a random sample.

And FTDI has now done the heavy lifting for you by writing software that will test if their chips are genuine.

Re:Probably Not

[ogdenk]

Maybe create a standard for USB serial interfaces that everyone can use? I think that already exists (the CDC).

Bingo. NIH syndrome will always bite you in the ass. Not using an open standard because you want people to think you're more unique and cool is just a recipe for needlessly blowing money, reinventing the wheel and causing people great pain such as this.

Personally, I think if they had sold the chips as "FTDI compatible" and have a link on the site or install CD to FTDI's driver download page instead of trying to brand them as FTDI chips this would be a non-issue. FTDI would simply have to compete.

Re:Probably Not

[wonkey_monkey]

Now that's a way to get more Slashdot readers reading your posts.

Re:Probably Not

[Qzukk]

tl;dr: two years, later.

Re:Probably Not

[Rob Riggs]

Two years ago I had no clue that counterfeit chips existed. All I would have known is that there is a chip marked FTDI on the board and the serial drivers worked. What more QC is expected from a board supplier who may be producing a few hundred boards for a niche market and making a few thousand dollars per run?

Re:Probably Not

[wonkey_monkey]

Dude, spoiler alert. Not cool!

Recommended Edit

[TwoEyedJack]

Edit: Last night, FTDI, a Scottish manufacturer of USB-to-serial ICs, posted a response to the ongoing debacle over its allegedly intentional bricking of competitors' chips. Replace "competitors' chips" with "chips made by illegal scum sucking counterfeiters who bear no costs of driver development or warranty that unscrupulous manufacturers use to make a few more points of margin at the expense of FTDI and customers".

Re:Counterfeiters not competitors

[QuasiSteve]

When Rolex sneaks into your house because somewhere in your apartment lease you agreed that trusted maintenance people could do so to make sure that everything is on the up and up, finds your Rolex to be a fake, and takes a winding gear out... would you consider that to also be functionally no different?

Because that's more akin to what has happened.

Windows users allow Windows (by default) to let WHQL drivers to be updated silently. FTDI made use of this mechanism to update their driver. Their driver, when called upon to communicate with the device, then sends it some data which either does nothing (genuine) or reversibly disables it (if counterfeit).

Computer Missues Act 1990

[wfmcwalter]

Section 3 "unauthorised modification of computer material" being the relevant element. There isn't, I think, an existing case which exactly mirrors this, but it is similar to the matter of "time locks" in software (where a program disabled itself after a given time). For a long time after the passage of the act, lawyers theorised that such locks might be illegal in some circumstances; the prosecution of Alfred Whittaker in Scunthorpe Magistrates Court in 1993 showed that it could be. But crucially in Whittaker, the locks were unknown to the customer (the company on whose computer the software was installed) - I don't think anyone thinks that time-limited trialware ("this software will stop working in 28 days unless activated") is illegal.

So whether FDTI are in trouble will depend on what expectation someone might have when installing the new driver (where the court assumes they actually read the licence screed). If the expectation was solely that it would improve their system or do nothing, they weren't giving consent, and FDTI may be found to have breached section 3. If the licence unambiguously said "this update will detect and disable fake or work-alike products without further interaction", they're probably fine. Likely the wording is much less clear, which is what keeps lawyers in jobs.

If all the bricked chips are counterfeits (that is, they have fake FDTI markings and have been passed of as real FDTI products), the Fiscal is probably going to say that a prosecution isn't in the public interest. The authorities, often working with trademark owners, have routinely seized counterfeit goods from unknowing individuals, with no compensation; they may argue this is an analogous case (sweeping analogies is what keeps judges in jobs). But if someone has been making FDTI workalike clones that aren't pretending (to consumers) that they're the FDTI product, their customers would have a better chance of twisting the Fiscal's arm.

Stupid is as stupid does

[eclectro]

Any BOM that passes through my hands will get FTDI crossed off. I'm sorry they have a counterfeit problem. They need to improve anti counterfeiting measures instead of inflicting collateral damage. Their abrupt decision is smelly no matter how you look at it.

Re:Stupid is as stupid does

[Z00L00K]

That's only working into the hands of the counterfeit chip producers.

The problem isn't the real FTDI chips, it is those that leeches on property (PID/VID) purchased by FTDI with substandard equipment/chips.

If this causes a backlash of a lot of devices ending up in warranty claims due to non-functionality or DOA (Dead on arrival) then it will definitely hurt the counterfeiters.

Re:Stupid is as stupid does

[Grog6]

Agreed; I won't use them from here out; what will they do next week?

Especially when their business tanks suddenly.

It's in the license!

[Pedrito]

The FTDI driver license states "The license only allows use of the Software with, and the Software will only work with Genuine FTDI Components. Use of the Software as a driver for a component that is not a Genuine FTDI Component may irretrievably damage that component. It is your responsibility to make sure that all chips you use the Software as a driver for are Genuine FTDI Components." Surely they neglected to share this with their lawyer. You can't punish users because the manufacturers are breaking the law. How is my mother going to know if she has a genuine FTDI chip or not? That's just asinine.

Re:It's in the license!

[ledow]

By the same token, if some bloke down the pub gives me a Windows key, shouldn't Microsoft allow it to activate?

It doesn't work like that.

Unfortunately, there's a difference between having a driver that won't drive a counterfeit chip, and one that actively "breaks" counterfeit chips.

In the same way that Microsoft are quite entitled to refuse to activate illegal copies of Windows, but they aren't entitled to take it upon themselves to format your hard drives when they find them.

Re:It's in the license!

[Registered Coward v2]

Microsoft are quite entitled to refuse to activate illegal copies of Windows, but they aren't entitled to take it upon themselves to format your hard drives when they find them.

Certainly. They only do that with legitimate window's licenses...

Re:It's in the license!

[Orgasmatron]

If you park in a ramp, the back of the ticket says that the ramp's owners/management disclaim responsibility for damage to the cars.

That means that you shouldn't complain to them if the guy that parks next to you dings your car with his door. It doesn't mean that the employees expect that they have permission to walk down a row of cars smashing out headlights with a hammer.

Re:It's in the license!

[stoatwblr]

"The FTDI driver license states"

It didn't state anything at all when the new driver went in via windows update.

Re:Counterfeiters not competitors

[fuzzyfuzzyfungus]

That isn't actually so clear:

According to the die shots, the clone chips' implementation is more or less entirely different from the FTDI implementation. Intended to be pin-compatible, and exhibit the same behavior; but totally different silicon, not a cut and paste job.

The clones that are then labelled and sold as 'FTDI' are, certainly, in all kinds of violation of trademark law; but what of any that are just blob-topped or generically packaged and not represented as being actual FTDI? Not something FTDI likes, or is obliged to provide driver support for; but neither was the Compaq 'IBM PC compatible' BIOS.

Even if the (typically very harsh, though widely unenforced) laws regarding trademark infringing goods do actually allow FTDI to brick them in the field, they haven't actually established that a given chip is a counterfeit, rather than a mere clone, before bricking it. Unless they wish to claim that "0x0403" is entitled for trademark protection, the driver is hardly in a position to distinguish between the two.

Re:Counterfeiters not competitors

[QuasiSteve]

I'm quite certain that most people wouldn't even know that they invited anybody into their house - as it is, they're technically already in the house (FTDI's drivers come with Windows). The invitation would be with the update - but as the occupant, I'm even unaware of this invitation. In this analogy, I trust my landlord, and my landlord trusts the maintenance people. The maintenance people broke that trust, no matter how well-intentioned their actions.

As far as the winding gear bit - FTDI merely cause a re-write of the USB PID to 0000. Nothing that can't be restored, just as a winding gear can be put back into place. It's not so much destruction as it is disabling.

"the tree of evil bears bitter fruit"

[HotNeedleOfInquiry]

Anyone old enough to remember that Microsoft message?

Re:Counterfeiters not competitors

[Dredd13]

Unless they wish to claim that "0x0403" is entitled for trademark protection, the driver is hardly in a position to distinguish between the two.

They could make an argument that "0x0403" is a reference to the "FTDI" identifier, which is trademarked, and so they are claiming (to hardware and anyone who talks to it directly) that they *are* made by the vendor 0x0403/FTDI. At which point, it's a textbook trademark dilution matter.

From another OEM fighting couterfeit copies

[twdorris]

We had a similar situation come up with one of our older products. People copied our initial hardware designs some 12 years ago, built (crappy) knock offs and sold them as their own along with copies of our chips to go along with it. The black market was clearly going to run us out of business and I despised the idea of having to basically compete with ourselves just to keep handing new features over to leeches. It was infuriating to the point that I had seriously considered just shutting the business down and moving on to other things.

Instead, we spent a LOT of time redesigning our stuff to prevent anyone from (reasonably) being able to do that again. We basically wasted an entire year just dealing with counterfeit issue rather than improving our core product.

Luckily it paid off and we were able to shut that whole black market segment down. But at one point we had to consider the same option FTDI did. We gave thought to effectively bricking devices that we were able to identify as counterfeit or, worse, someone would send us one of these counterfeit packages asking us for support or service on the item. We had to basically return to them a chip and adapter we knew, without a doubt, was a bogus copy of our stuff.

It was hard, but we knew full well we could not possibly damage or keep something they had purchased through what they considered legitimate channels. FTDI should have realized this as well. They royally screwed up on this one.

It's a little strange, though, because if you buy something somewhere and it ends up being a stolen item, you're obligated to give it back to the original owner. I mean the police trail leads to your doorstep, you're out the item you bought whether you knew it was stolen or not. I guess the same concept doesn't applied to IP somehow. I'm not even sure how it would. I guess IP isn't really "property" after all.

Re:From another OEM fighting couterfeit copies

[stoatwblr]

"It's a little strange, though, because if you buy something somewhere and it ends up being a stolen item, you're obligated to give it back to the original owner."

If you buy a fake Picasso, you get to keep it even once identified as fake.

Picasso's estate don't have the right to come along and take it off you or splash it with paint.

They DO have the right to go after the forger.

Re:From another OEM fighting couterfeit copies

[YA_Python_dev]

IP is a marketing term, there's no concept of IP in the law. There are trademarks, copyright and patents. Ideas cannot be owned by anyone.

Re:Counterfeiters not competitors

[Dredd13]

The T&C are there. If you've decided to automatically accept updates without reading the T&C you're agreeing to, well, that's your own bad legal judgement.

And -- in this case -- the T&C specifically say that they "may" break counterfeit hardware.

Could have been a show-stopper

[kheldan]

I work somewhere (a large chip manufacturer) where we use USB serial adapter cables all over our testing lab to interface things like thermal controllers. Since these are COTS items we have no control over what chip is in them. If this update had bricked our entire lab, it would have been a disaster and a total show-stopper for our testing schedule until we located (and understood!) the problem and fixed it. Personally I think it was a childish way for them to handle this situation and I'm glad they saw reason and yanked it back before it created a total disaster.

Re:Counterfeiters not competitors

[spire3661]

That is theft, outright, and you could easily sue for it. They dont get to keep property that is not theirs. Anyone with money to burn would ass ream them in court for that.

An alternative

[pjrc]

Today Atmel, Microchip and others make inexpensive microcontrollers with native USB peripherals. The Atmel "8u2" chip, for example, is less expensive than even most of the FTDI clones, and certainly a LOT less than a genuine FTDI chip.

For years, I've published a very simple and easy-to-use USB code for those chips.

http://www.pjrc.com/teensy/usb...

I also publish a signed INF installer that works with ALL USB Serial based on this standard protocol (called Communications Device Class, Abstract Control Model, or CDC-ACM). All 3 operating systems have the necessary driver built in. Mac OS-X and Linux load it automatically. Windows needs the user to add a INF.

http://www.pjrc.com/teensy/ser...

Sadly, the CDC-ACM driver in Windows (called USBSER.SYS) is buggy. About a year ago, I sent Microsoft this reproducible bug report.

https://www.youtube.com/watch?...

In a follow up email a few months ago, they were supposedly testing a fix. I'm hopeful that Windows 10 may be the first version of Windows to ever ship with a good quality USB Serial driver (as Linux has done for many years, and Apple as done since releasing Lion a few years ago).

Re:An alternative

[hwstar]

Spot on.

The root of the issue is the FTDI chip is to damn expensive. It performs a relatively trivial function and is not cost effective. It's only claim to fame is it works on a large number of platforms without installing any device drivers. This is why the Chinese want to make counterfeit chips. The genuine part costs too much.

Re:An alternative

[fnj]

You rule for sure, Paul. The Teensy line is just amazing.

Re:An alternative

[thegarbz]

I saw that a while ago. Thanks for your efforts. I ended up using the LUFA library and bootloader to implement Serial CDC on my ATMEGA32U4, but thanks all the same.

Even more thanks for that 128x64 LCD driver. You have saved me a world of headaches coding for my hobby projects. Wish there were more people like you :-)

How to detect a bricked chip

[n2hightech]

Seems like FTDI has admitted they were bricking counterfeit parts on purpose. How would someone go about determining if their device quit working because it was bricked by FTDIs bricking driver? Is there a lawyer out there who would want to do a class action against FTDI for damaging peoples equipment? Also I do not see why FTDI would take this approach I would think they would stand to make a lot of money and gain some good will if instead they had their driver pop up a message to the user that his device had a counterfeit FTDI chip in it and offer the owner the option to join a class action suite against the equipment manufacturer by entering certain info (name address equipment make model and manufacturer ) and in return they would allow their driver to work with the counterfeit chip and share in a settlement over the counterfeit parts or they could purchase a right to use their driver for a fee equal to the chip cost ($2-$10 depending on chip) or they could choose to do neither in which case the driver would no longer work with the counterfeit chip. This strategy would help them eliminate counterfeiters or at least pay them for the right to use their software.

Re:Counterfeiters not competitors

[QuasiSteve]

So we shouldn't just blame the users for buying products with counterfeit chips - which they may very well not even have known about - but we should also blame them for not digging up the automatic driver update mechanism that they may very well not even have known about?

Is there anything else we could blame on the user - the party most immediately affected - in this situation?

Re:Counterfeiters not competitors

[Zalbik]

Also, FTDI destroyed *everything* that was fake, not just the winding gear. So for the analogy to be accurate, they'd have to destroy the entire watch (which is actually what they do today).

Although I disagree with what FTDI did, this is a terrible analogy.

FTDI did not "break" anything. They modified counterfeit products so that they would no longer function with FTDI's drivers. The device itself was still fully functional, and could even (fairly easily) be modified back into a non-counterfeit state.

The "watch" equivalent would be as if a Rolex service person was invited into your house (you initiate driver updates) to service your Rolex watch and your Rolex clock. You watch and clock are the latest "smart" devices and time-sync with each other via Wi-Fi.

The service guy notices that your Rolex clock is actually a "Rollexx" knock-off, so he wraps the antenna in tin-foil so the two can no longer communicate.

You are free to take the tinfoil off after the service guy leaves. (ok, it's a little bit harder to reprogram a PID, but given there were "fixes" up yesterday within hours of the story breaking, it's a reasonable analogy).

Re:Counterfeiters not competitors

[Dredd13]

No, I think that about covers it.

pardon / execution

[McFly777]

The comma might recieve a pardon, but the first period and capital B on "But" will be tried, found guilty, and executed immediately.

LKML response

[Anonymous Coward]

FTDI tried to also get the "brick-patch" to Linux, but Greg Kroah-Hartman blocked it with this response:

Funny patch, you should have saved it for April 1, otherwise people might have actually taken this seriously :)

Patches as performance art, now I've seen everything...

greg k-h

Re:LKML response

[Megane]

Here is the original message. It has the comment "/* Attempt to set Vendor ID to 0 */". So yeah, they are intentionally fucking with a chip when it fails to validate. And in addition to fucking over buyers of equipment where the manufacturer may have unknowingly been given counterfeit parts, they've also told the cloners exactly what to change for their next run of chips.

Wow, just WTF. It's one thing for them to claim some loss, no matter how slight, from people leeching off of their Windows driver. But considering that the clones do not copy FTDI silicon (have ANY of them been found to do so?), and they have absolutely no claim to ownership of the Linux kernel driver, this is just greed at its worst. Also, not all clones have counterfeit labeling on the chip and can thus be considered fair competition. I wouldn't be surprised if some are even in package types that FTDI doesn't sell. Their driver may see their 16-bit VID number on the chip (you can't trademark a number, that's why Intel renamed the 586 as "Pentium"), but it can't see whether FTDI is etched on the chip or not.

Or maybe someone can point me to something that says you can patent a register layout and chip pinout. (essentially the hardware equivalent of software APIs) Except again, there is no way that the driver can even know that the chip uses the same pinout.

Now maybe if they had the chip return the text "FTDI" (aka actual trademark-able text) and checked for that along with some other kind of "real chip" test... but that still won't justify fucking with the chip. Just refuse to run is all you need.

Re:LKML response

[EndlessNameless]

The vendor ID is assigned by the PCI SIIG pursuant to their own registration rules. The vendor ID underlies a variety of PnP functionality, dating back to the original PCI interface. USB, PCIe, and a few other standards jumped on the bandwagon.

The clones who used FTDI's identifier are violating the standard.

I think FTDI is perfectly justified in stripping their identifier from third-party hardware.

The other manufacturers didn't want to develop, validate, and support their own drivers. This means FTDI incurs greater costs in bringing its product to market, but it also means FTDI has control of the software interface to their equipment (in a Windows environment). They have only themselves to blame, and they get no sympathy from me.

Re:LKML response

[noidentity]

Wow, those comments from the FTDI engineer who submitted the patch are damning. "This is definitely not targeting end users" except that it does exactly that. No way I will ever buy a possibly-genuine FTDI product in the future, with that kind of company culture.

Re:LKML response

[Megane]

I thought I posted this yesterday, but maybe I forgot to hit submit: the original message was apparently intended as a joke, but was based on the actual disassembled code.

An end-user's advice to hardware developers

[userw014]

As a potential end-user (i.e.: I bought an Arduino to explore a hobby, and own a device with an embedded Ardino), I would point out that FTDI's statement isn't an apology but an excuse for their behavior:

As you are probably aware, the semiconductor industry is increasingly blighted by the issue of counterfeit chips and all semiconductor vendors are taking measures to protect their IP and the investment they make in developing innovative new technology. FTDI will continue to follow an active approach to deterring the counterfeiting of our devices, in order to ensure that our customers receive genuine FTDI product. Though our intentions were honourable, we acknowledge that our recent driver update has caused concern amongst our genuine customer base. I assure you, we value our customers highly and do not in any way wish to cause distress to them.

As such, if you specify FTDI products but your supply chain can't guarantee or hasn't guaranteed genuine FTDI products, or has specified or equivalent products, you're still vulnerable to their drivers suddenly causing your products to fail. You're customers won't love you for that! You still have every reason to evade FTDI at this point as they're still threatening an existing product base.

As an end-user, the issue of counterfeit chips doesn't rise to the level of probably aware.

This perspective is not terribly fair to FTDI's product line being subverted by counterfeits, or the general problem of counterfeit devices. All I can suggest is some form of planned obsolescence implemented by FTDI's drivers (which is just a fig-leaf of protection from irritated end-users.)

No, it's not bricked.

[Chirs]

"Bricked" means that it is no longer useful, ever, under any circumstances. It's dead, and not recoverable.

In this case the end user is temporarily inconvenienced until they load up some software to restore the PID, or use software that can make use of the device even with a PID of 0.

Re:No, it's not bricked.

[tshawkins]

I dont think the windows usb.sys will allow conndctions to devices with pid=0, thats why you can only fix them on a mac or linux box.

Re:No, it's not bricked.

[stoatwblr]

> "Bricked" means that it is no longer useful, ever, under any circumstances. It's dead, and not recoverable.

OK, "soft bricked"

The legality of this is still unquestionable. if the enduser has to expend energy undoing the damage then what's happened is a crime in many countries, EULA or no EULA (None is presented when you do a Windows update so a judge will not only toss out any attempt to point to that as a defence, but likely find any such attempt to be in contempt of court)

I would not like to be a FTDI exec at the moment.

FTDI doesn't "own" the PID:VID

[Chirs]

As I understand it, FTDI doesn't actually have legal ownership of the PID:VID combo. usb.org handles the PID:VID registry, but if a chip manufacturer hasn't registered with them there is no legal reason preventing them from using any PID:VID numbers that they feel like.

Re:FTDI doesn't "own" the PID:VID

[sl149q]

Nope. USB.org assigns (sells) Vendor ID's.

Assignment of Product ID's is 100% under the control of the vendor who owns the Vendor ID.

My prediction Short term effect on FTDI

[jockm]

Yesterday a number of my clients called me to say they wanted me to design out the FTDI FT232R from current designs and replace it with an alternative (I settled on the Microchip MCP2200). Today, after this news, I called each of them to explain FTDI's change in policy and see if they still wanted to make this change. All of them said yes.

The feedback was essentially this: FTDI's actions left a bad taste in their mouth and they didn't appreciate this action being taken without any real attempt to notify resellers and manufacturers; and now that they know the alternate chip I proposed was about half the price as FTDI's offering they are happy to change. Now none of these people are high volume manufacturers, so it will unclear if FTDI will even notice.

The reason I have found for most clients wanting FTDI is confidence in the brand more than anything else. This move will affect it a little, but people's memories are short, and FTDI responded quickly enough that they won't suffer too much damage. My prediction is that FTDI will take a dip in sales for a quarter , and then things will return to more or less normal; but companies like Microchip will likely see an uptick, because manufacturers more aware of the alternatives.

Re:My prediction Short term effect on FTDI

[gweihir]

And in turn more people will get experience on using the alternatives. That the competitor is half the price also tells us something about FTDI, namely that they do not care much about their customers. Well, we knew that already from the bricking.

But my guess is that there will be quite a few others doing this. The risk of accidentally using counterfeit parts and then having a huge catastrophe is just to big. Part of the risk is caused by FTDI charging too much. My guess is greed took over in that company.

And if I see this right, the MCP2200 does not even need special drivers, MS already supplies working ones. A downside seem to be that the MCP2200 needs a crystal or ceramic resonator. If I remember correctly, the FT232R comes with an internal oscillator. On the other hand, even with that it seems a lot cheaper.

Re:My prediction Short term effect on FTDI

[hjf]

just FYI: I've had MCP2200 stop working for whatever reason. One day, boom, bye bye MCP. No idea why.
Also you have to manually install drivers for them, which may or may not be something important to you.

Re:Avoid them like the pest

[Z00L00K]

But you aren't a FTDI user, you are a user of a counterfeit device that happens to lure the OS to load a FTDI driver.

If anything - shun Chinese fake products.

Re:Not sure what is going on here... but...

[Anonymous Coward]

The government is the only reason why that IP is "your IP". It's an artificial monopoly granted by your government that does not exist in natural law. They're your sole recourse. Damaging other people's property, knowingly and/or intentionally, is not on the list of legal avenues for recourse, and will probably get you in to legal trouble, as you're about to see with FTDI. You don't have a right to enforce copyright law yourself. The government is your sole remedy. You'll feel bad when you're fined and jailed.

Re:Counterfeiters not competitors

[JesseMcDonald]

It is a textbook trademark case, but you're referring to the wrong part of the textbook. Consider the case of the game consoles which wouldn't operate without a bit-for-bit copy of the manufacturer's logo in the ROM, a trick intended to shut out unlicensed game developers. The court ruled that third-party developers could include the logo image without a license despite the fact that it was both copyrighted and trademarked, because the manufacturer had chosen to make it necessary for compatibility.

Re:Not sure what is going on here... but...

[McFly777]

The problem is that FTDI wasn't screwing up "whomever is profiting from ripping [them] off." The device user likely purchased the device expecting a genuine chip. Refusing to work with the fake would have achieved the same effect, but would have left the user with the ability to (possibly) obtain a different driver (legal 3rd party, FOSS, etc).

Since you proposed a wild west analogy, it would be like finding out that a cattle rustler "borrowed" one of your free-range bulls to impregnate* his cows, the offpring of which were sold to local farmers. So, in retribution, you ride in and shoot all the calves which have similar patterned spots on their fur, thereby punishing the farmers who innocently purchased the calves at auction. Meanwhile, you have done nothing to the rustler who actually committed the crime.

Do this a few times and you are likely to be the one who is going to be lynched.

* The rustler returned the bull to the range. Only the bull's "software" was being copied. In case anyone wants to complain about the analogy, think about stud fees for prize bulls.

 

Re:Counterfeiters not competitors

[Dredd13]

But in this case, the manufacturer didn't choose that 0x0403. The USB working group did.

HW guys writing software & type 1 errors

[Thud457]

How do we know the @)#$*)@^& driver isn't buggy?
Hardware drivers routinely are shitty.

Prove component authenticity?

[wisewellies]

Counterfeit components are much more of an issue than you might imagine. Counterfeit and reclaimed components are very common in the component supply chain, and there's almost no way for a manufacturer to determine whether they've bought a dud or the genuine article. Most electronics companies contract out circuit board manufacture and component procurement - unless you're making a huge number of boards, it simply isn't economical to run this kind of operation in-house. At the end of the day it comes down to trust and supplier vetting - but you can only really vet the first link in what can be a very long supply chain. All it takes is for one supplier in the chain to be slightly dishonest, and you end up with a counterfeit device on your board.

Now - there are companies who will specify forged parts - but equally there are companies who specify the genuine article, and don't get it. How would they ever know? FTDI's approach is (was?) to stop the end-user's device from functioning. This device could have been supplied by a legitimate supplier (and not a dodgy eBay import) - yet this company was (until now) completely unaware until faulty units start piling up on their doorstep. Let's also remember that not all electronics companies are the size of Cisco - and a product recall to replace what they believed to be a genuine part could prove so expensive as to put someone out of business.

Realistically, it's an almost impossible problem to solve - semiconductor manufacturers deal in massive quantities through distributors - and the smaller the quantity that you require, the more distributors are involved in the sale. Some may advocate buying direct - but realistically, no semiconductor manufacturer is equipped to do this at present. Manufacturers need to find ways to prove that their components are authentic, rather than telling end users that they have bought a fake.

Have a look at this blog - a small supplier of a very nice series of logic analysers who were hit with exactly this kind of problem. They procured components in good faith, yet had to carry the costs of their supplier's dishonesty. Not what a small business needs when they're just getting going.

asking for people in similar situations

[Thud457]

Instead, we spent a LOT of time redesigning our stuff to prevent anyone from (reasonably) being able to do that again.

Any pointers you care to share? Or would that be proprietary IP?

Re:Counterfeiters not competitors

[fuzzyfuzzyfungus]

They could make the argument; but I'm not sure that they could win it.

It is widely accepted that you can use a protected mark, so long as you don't do so deceptively, to provide information about your product(the usual formulation is "Store brand product, compare to Product(tm) active ingredients). Not a trademark violation, even if the trademark holder might not like it; just telling the customer what your product is intended to be compatible with.

In computing applications, since the data are usually being sent to an (often inflexible and buggy) program rather than to a human, and since identifying information is often necessary for operation, even more blatant use is often accepted. Most browsers still claim to be "Mozilla/5.0" followed by a bunch of other stuff, often equally trademarked and equally false, because that particular string was the only way to get the correct output from assorted crufty HTTP servers. In more adversarial cases, like Lexmark's battle with Static Control Components over toner lockout chips, SCC ended up being allowed to duplicate an even larger chunk of Lexmark's firmware, over Lexmark's objections; because that was deemed a technically necessary part of producing an interoperable toner cartridge.

The USB VID/PID is conceptually in a similar position to the browser UA: it's not hard to find; but not really there for human readers and subject to fairly specific technical limitations if you actually want it to work. "0x0403" is a valid VID. "0x0403 (compatible; China Cloneshop)" is not. It won't even work, much less request the correct driver. USB does provide for purely descriptive, human readable, information fields ('Manufacturer String Descriptor', 'Product String Descriptor', and 'Serial Number String Descriptor') and those aren't subject to technical constraints.

I certainly wouldn't want to be on defense if I were selling a product with somebody else's trademark misused in the string descriptor fields; but the VID/PID would be much more defensible.

MAUDE, PAIR ANT OOP!

[Thud457]

Thanks for finding that for us.
MODS : mod parent up, plzokthx!

I think both sides are wrong

[mattd1812]

The reason the most manufactures use the FTDI driver is because most windows systems already have it installed. This makes it easier for consumers because they don't have to track down a driver from some unknown source. But it is well within FTDIs right to change their driver as it fits their needs. The solution would be for their to be a standard driver that manufacturers could use for usb to serial communication just as there is a standard mouse and keyboard driver for usb devices.

Re:I think both sides are wrong

[g0tai]

That right there, you nailed it.

Open standards.

Re:I think both sides are wrong

[metaforest]

AIUI the common mode CDC specification does not support some of the features that FTDI supports on their devices. FTDI supports aux GPIO.

Re:Counterfeiters not competitors

[Khyber]

"When you send your fake Rolex (that you think is real) into Rolex for service, they don't send it back to you, they confiscate it as a counterfeit and it's destroyed."

That's a lawsuit waiting to happen. If it's not your product, you send it back to me. You don't go "Oh, you bought a knockoff, we're just going to destroy it and not give you a choice in possibly getting your money back." No, you give me my fucking product back and that's the end of story unless I tell you otherwise.

Re:Not sure what is going on here... but...

[gweihir]

And in turn, when primitives like you act on it, the government has to make sure you do not do it again. There is a reason for the monopoly on violence and there is a reason to enforce it.

FTDI overstepped their authority, but...

[Just Brew It!]

They seem to be the only vendor of USB serial chips whose products seem to "just work" under the majority of use cases, on both Windows and Linux. Every time I have had a weird USB serial problem (on either OS), the solution has been to get a FTDI-based device. Problem solved.

If 3rd party vendors are illegally appropriating their IP, then they can go after those vendors in court. I also have no problem with them rigging their driver so that it does not work with "clone" products. But intentionally damaging devices they do not own steps over the line.

I do not think a boycott is the answer. Yes, they made a mistake with this driver update; but do you really want to (potentially) drive the designer of the best existing USB serial chip out of business? If we go that route, everyone loses.

I knew it would backfire on them...

[QuietLagoon]

I knew this would backfire on them.

.
You can't go destroying hardware owned by consumers, no matter what the reason.

The code has no legitimate use, does nothing on FT

[raymorris]

They explicitly wrote code that intentionally bricks the connected device. It takes advantage of a bug/ implementation detail such that it does NOTHING on a FTDI device. Because it doesn't do anything at all on a genuine FTDI device, there is no innocent reason for FTDI to put it in their driver.

If the code did something useful on an FTDI device but broke counterfeit devices, that could be accidental. That's not the case, though - the code never does anything good, it only breaks things.

That's the stupidest comment ever on /.

[Grog6]

The Chinese Govt doesn't give a rat's ass about this; they're filling their pockets too.

I have at least one counterfeit problem a year, and our supply chain is as locked down as it gets.

If a medical device fails, and someone dies because of their driver, they'll all be in prison, from the ceo to the guy that sent it to M$.

Re:Counterfeiters not competitors

[Bengie]

A fake battery pack is probably a fire hazard, having to be destroyed, and were under no obligation to send you back a replacement.

Doc, my chest hurts. Ohh, seems your heart transplant was from an unofficial donor, we'll just destroy that for you.

Re:Counterfeiters not competitors

[Dredd13]

Well, as noted, it happens with watchmakers, clothing/accessory companies as well, etc., etc.

Re:The code has no legitimate use, does nothing on

[Midnight Thunder]

Reading the article now (shame on me for not doing so), I suspect there is malice or 'good intentions' resulted in failed risk analysis and fallout prediction.

Re:Counterfeiters not competitors

[spire3661]

They can be taken from you by authorities, not businesses. Regardless of its IP status, that physical item belongs to me until a judge says otherwise.

Is counterfeiting really cheaper?

[WarJolt]

It's a shame that USB has UMS for storage and UVC for video, but there isn't a similar standard for COM ports.

With that said, it's a serial port. Come on guys!! Just make a pin compatible part and write your own driver. It would probably take about the same amount of time to reverse engineer FTDI. Can you even copyright an IC footprint?

Re:Is counterfeiting really cheaper?

[mirix]

there is a standard. CDC.

ftdi stuff oddly mostly doesn't use it. But the other common ones (PL2303, CP210x, CH340, etc) do. I've wrote programs for AVR and STM32 that support it as well, plug and play in linux. I think windows still needs an inf, which is sort of counter productive though...

Re:Questions for the supporters of FTDI...

[VGPowerlord]

What about the intel X86 compatible clones that were common in the 1980's and 1990's? Intel didn't give permission for other companies to use their instruction set.

That would be wrong.

AMD and Intel had a Microcode cross-licensing agreement from way back in the late 1970s.

Even if they hadn't, word on the street is that one of the requirements IBM had for using Intel processors in its personal computers was that there had to be a second source for them. Meaning that Intel had to license the designs to a second company. What company was that? AMD.

Re:Counterfeiters not competitors

[amicusNYCL]

No, you give me my fucking product back and that's the end of story unless I tell you otherwise.

Whoa, we got a badass here.

Explain again why Rolex is obligated to send a counterfeit product to you via mail. Is it something to do with "hard-earned money" or some shit like that which gives you some sort of magical capitalism rights because you paid for a product with money from your hot little hand? What about the rights of Rolex to enforce their trademarks? Does the fact that you paid money for an illegal product (and then had the fantastic idea to send it to them to fix) overrule their right to protect their business?

If it's not your product, you send it back to me.

But it says right there, right on the watch face - "Rolex". That's their product, right? You sure as hell thought it was when you bought it for fifty bucks, right? Or did you know it wasn't theirs, but decided to send it to them for service anyway?

Re:Counterfeiters not competitors

[fuzzyfuzzyfungus]

FTDI didn't choose that specific value(though, thinking back to Intel's amusing choice of '8086' as their PCI vendor ID, you probably can choose a VID if you push hard enough or have a cute reason); but there are still some commonalities(though arguably some differences as well):

The USB spec (and, probably more importantly, USB as implemented on basically all commercially relevant systems) supports essentially two mechanisms for telling the OS what driver your device requires:

If supported by a generic class driver; your device descriptors include a bDeviceClass field containing a defined USB device class code; but isn't 0xFF(which is valid; but means 'vendor defined'), a bDeviceSubClass field with a valid subclass code, and a bDeviceProtocol field with a valid protocol code.

If your device is supported by a specific driver(or one of the hybrid arrangements, not uncommon, where a versatile device class like USB HID will be used to do most of the low-level work; but a vendor-specific driver will implement whatever device specific behavior is offered on top of that), then you need to supply the correct VID/PID combination.

Now, let me be clear, I see absolutely no reason why FTDI should need to provide driver support for clones, so even if Windows(correctly, as an OS) responds to a USB device with an FTDI VID/PID by loading the FTDI driver, it is fully within their rights to have a driver that detects and ignores non-FTDI parts.

However, (and this is where the analogy to consoles and trademarked-but-technically-necessary really comes in), the USB spec does not offer a 'compatible with VID/PID' device description option. Either you specify the appropriate generic class, or you specify a VID/PID and a vendor-specific class. There is no other way (barring atypical configurations and kernel hacker tricks that aren't of much use in the wider world) to do it.

If you want a Game Boy or whatever to load your cartridge, you need that logo to be present at the appropriate address. If you want to specify "I need the driver that supports device X", you have to supply device X's VID/PID. There is no 'compatible with device X; but actually made by me' mechanism.

If you are buying fake FTDI gear to take advantage of FTDI's driver devs, then I have no pity. Not FTDI's problem to support you. However, there are 3rd-party FTDI-device-supporting drivers (notably on Linux and BSD, maybe somebody has ported one to Windows or OSX, maybe you plan to implement your own, whatever) that it would be perfectly legitimate for an FTDI-compatible device to request, and (so long as it doesn't involve copyright or patent infringement, or fraudulent misrepresentation) there are perfectly licit non-FTDI chips that implement FTDI-compatible behavior. The USB-IF certainly doesn't have enough power over short hex values to stop that; and I'm not convinced that we would want them to.

A large number of now standard or semistandard devices, protocols, and command sets we don't even think about today started life as dirty clones of the more popular brand: The PC BIOS, the (still spoken, in extended form, by a moderately alarming number of things) Hayes command set, the 16550 UART (originally a National Semiconductor model number; now register compatibility with those is practically a standard in itself, thanks to about a zillion clones), the NE1000/2000-compatible NICs that helped make ethernet ubiquitous and cheap...

Again, FTDI has every right to make the use of their drivers contingent on the use of their ICs (or some other licensing terms, if that amuses them). Also, non-FTDI parts being sold (with varying degrees of sophistication, from pure nonsense to nearly perfect fakes) as FTDI is a bad thing. For FTDI, for the buyer being defrauded, for the electronics supply chain generally.

However, we would not be well served to be blinded to the (generally desirable and helpful, as much as incumbents dislike them) history of 3rd-party in

Re:Counterfeiters not competitors

[JesseMcDonald]

The number may have been assigned by the USB WG, but it was the manufacturer who decided to check for it in the drivers. Either way, the use of that number is a necessary part of creating drop-in-compatible hardware.

Of course, they can't advertise their product with the USB logo if they're not following the USB specifications, including the use of assigned ID numbers, but that's a separate matter. There is no requirement for non-members to adhere to the ID numbers assigned by the USB WG so long as they don't claim to be fully compliant.

not the fault of the driver if the driver

[raymorris]

> It's not the fault of the driver if ... the driver tells the hardware to do a write, and the hardware does

How do you figure that what the driver does isn't the fault of the driver?

The driver gives instructions that tell the hardware to self destruct. The hardware faithfully follows the instructions.

It would be different if the instructions were to do something useful, but the clone instead destroyed itself. There is no innocent purpose for this sequence of instructions.

Re:not the fault of the driver if the driver

[sl149q]

It doesn't let the valuable smoke out. The device still works.

It is just not useful for USB communications until someone re-re-programs it to a vid/pid for another (non FTDI) driver.

Just because (currently) doesn't make it wrong. What was wrong was people trying to use unlicensed software illegally.

Re:Déjà vu

[makomk]

I think DirecTV got away with that in part because they still owned the cards in question and were just allowing users to make use of them. (The hack worked by modifying official DirecTV cards.)

USB VID is meant for a specific organization

[rsborg]

Actually, it is not. "Their" USB VID/PID can legally be used by anybody, it just means that the USB logo may not be used. AFAIK (and just checked on some FT232 I have), there is no USB logo on these chips.

Oh really? Not according to this FAQ:

Because a USB VID is specific to a particular organization, derivatives shouldn’t use the VID and PID of the original hardware.

Regardless of the fact that it may be legal for others to do so, it's unethical and clearly misrepresentation. It's like when Palm tried to use the USB VID of Apple so iTunes would think the Palm Pre was an iPhone - great for Pre users until that causes crashes or data corruption for users and Apple could be held liable.

Rightly so, Palm was slapped down for their "reuse" of Apple's VID.

Re:USB VID is meant for a specific organization

[dgatwood]

Regardless of the fact that it may be legal for others to do so, it's unethical and clearly misrepresentation.

Not true. Lots of small homebrew hardware uses off-the-shelf chips like the ones FTDI builds without applying for their own VID/PID combo. This causes minor headaches because software can't tell them apart from one another, but as long as the final product doesn't have a USB logo on it, it is perfectly acceptable to sell it, even if your homebrew flash programmer looks like a USB to serial adapter to any software that asks.

If you want to use the USB logo, you have to apply for your own VID/PID combo and reprogram the chip to identify itself as being your product, and ship a custom driver that talks to it (which could be a modified version of the official FTDI driver, or the open source driver, or whatever).

Re:USB VID is meant for a specific organization

[Mr Z]

As a matter of fact, I'm releasing a product soon that falls exactly into this category. I specifically chose to keep the VID/PID unmodified, as the product has a mode where it needs to look like an ordinary serial port.

Sure, I could get modified OSX, Windows and Linux drivers to teach it about a new PID so that ordinary comms software works, but it's far simpler and less risky for a small guy like me (we're talking a few hundred units total) to just go with the flow and make it work with the generic drivers everyone likely already has.

Re:USB VID is meant for a specific organization

[spongman]

palm was slapped down by the USB IF. the USB IF can't stop anyone from making USB-compatible products, or using specific VIDs. all they can do is refuse to give them the right to use their logos if they break their rules. the ftdi-cloners don't care about the UBS IF since they're not looking for their approval, so they're free to use whatever VIDs they want.

No more FTID parts in my designs !

[uski]

I am the one who gets to choose which parts go into my company next designs.

I will no longer put any FTDI parts for two reasons :

• I have no way to control the entire supply chain. Even the military got counterfeit components a few years ago - it can happen to everyone even when you buy from "legit" distributors. I don't want my products to be bricked in a few months because someone somewhere in the supply chain swapped the reels, because it's going to hurt MY business in the end even tho I wasn't responsible for the swap.
• Binary compatibility is a right which is protected by laws in many countries. FTDI should try to innovate instead of trying to protect their profits with a chip design which is many years old. I don't see the problem with a chip that works with FTDI's driver. The problem is when people write "FTDI" on chips which are not made by FTDI but there are several chips which are protocol compatible with FTDI chips and they should not be affected.

No more money for you FTDI. Try to innovate instead of trying to brick people's hardware.

uski

Not Even Mad

[EndlessNameless]

The makers of counterfeit chips are in the wrong here, not FTDI. They used FTDI's PCI vendor ID (presumably without authorization).

Everyone who had a bricked chip should go to the manufacturer and demand a replacement or a firmware flash. Maybe then those guys would use their own device identifiers and supply their own drivers.

But most people are probably just cutting corners to get something cheap. And then they blame everyone else for their problems.

Bottom line: This driver would never install on a system with a counterfeit chip if the vendor did not use FTDI's identifier. There is a standard, and it was violated by each and every knock-off chip that bricked.

Maybe FTDI deserves some heat for sticking it to their non-customers, but I have little sympathy for anyone in this snafu.

who does your computer serve?

[Thud457]

A big advantage of running Windows and requiring signed drivers!
Oh, wait, no, that's the opposite. LOL.

Re:Not sure what is going on here... but...

[Karmashock]

The chip itself was an unlicensed knock off that used the same drivers.

No mercy.

Re:Not sure what is going on here... but...

[Karmashock]

I don't have to share my IP with you or anyone. I can make it and keep it for myself. Who's is it now?

And what incentive do I have to share it with you or make it if you're just going to jack it?

You're effectively justifying behavior that undermines the whole information economy. It's fucking retarded.

Isn't there another elephant in the room though?

[Punknubbins]

Alright, regardless of your take on FTDI's actions. Isn't the real problem here trying to fix a broken market with a regulatory or software solution?

I mean why is the FTDI chip so routinely copied, or cloned? It all comes down to price and availability. We saw this with online music, and we are seeing a corollary here. In this case the end users aren't the market though, they are collateral damage in the dispute between FTDI and hardware manufacturers. FTDI has a product the market wants, but they are asking for a price that the market doesn't want to pay. So people are stepping in with drop in replacements for the parts that the market doesn't want to spend money on, or can't get access to. The best way for FTDI to fight clone makers is to lower their prices and raise their production until the market decides that taking the risk with a clone chip isn't worth it.

And this doesn't just apply to FTDI. This applies to anyone making a commodity part that is widely used by the electronics industry. Sure high quality part manufacturers will never be able to bring their cost down the exact same level as cheap knockoffs, but if they get closer they will recapture some of the market. In the case of the FTDI chip we are discussing right now, the part has been on the market long enough that they have probably made up their manufacturing and tooling costs at this point and could lower the price to meet market demand if they wanted to.

Maybe we just need to push for a "generic" chip industry similar to the US drug market, though the protected window for the original designer would have to be much shorter to factor in the shorter dev/test/to market lifecycle of electronic components. By this time would could have authorized FTDI usb to serial clones, and FTDI would be banking a fraction of a cent per unit while working on the next faster or more power efficient model.

No true Scotsman

[imatter]

inb4u... really?

Worse, same action

[thegarbz]

Prolific had some counterfeiting problems too, and while they didn't brick devices by changing them they did release a never ending stream of updates with the only improvement being that they no longer worked with counterfeits.

The real alternative is to stop working with USB bridges. With so many microcontrollers come with native USB support and excess memory to implement it. They only real problem then is you need a VIN, something you got automatically when using a bridging chip.

"FTDI drivers may be distributed in any form"

[raymorris]

FTDI's download page says:

"FTDI drivers may be distributed in any form as long as license information is not modified."

The owner of the device simply plugs it in. Windows then automatically loads the FTDI driver based on the information that _FTDI_ gave them. Microsoft and FTDI decided to load the FTDI driver for that device. So how exactly is the user "using unlicensed software illegally"?

The manufacturer of the comms chip did precisely the same thing FTDI did - manufacture a chip with a compatible USB ID. Exactly which law gives FTDI exclusive use of that number, and makes it illegal to build a compatible device?

Re:Counterfeiters not competitors

[noidentity]

The clones that are then labelled and sold as 'FTDI' are, certainly, in all kinds of violation of trademark law

The point of trademark law is for the buyer to be able to know that the product is genuine. It's for the buyer's sake, not the company's sake. That is, something branded FTDI but not really FTDI is fraud of the buyer. For FTDI to then intentionally modify the device so that it stops working is to further harm the buyer. So FTDI is just pulling a total fail here.

Re:Not sure what is going on here... but...

[noidentity]

The information economy has existed from the beginning of time. It's only recently that it's had huge violence-backed walls erected within it.

What has that got to do with PICs?

[thegarbz]

What does your hate of FTDI have to do with your love of PICs?

Here's a list of microcontroller brands which include built in USB in their lineup:

PIC
AVR 90, mega and xmega
AVR32 UC3
STM32
MSP

Actually the only standout I really could find was Parallax Propeller series. They don't seem to produce one with USB support built in.

Re:Why suspect malice?

[spongman]

would you risk a subpoena?

Re:Why suspect malice?

[spongman]

or a leak?

Not clones.

[stoatwblr]

These aren't clones.

The devices in question are internally completely different, but mimic the FTDI command set. They're workalikes, not clones, nightshift runs or factory rejects.

The "sin" comes from marking device packages as FTDI (trademark violation) and presenting a USB Vendor ID of FTDI (unlicensed use of the ID)

Analysis shows that the IP which went into creating the workalikes is at least as expensive as the FTDI devices and the die costs are about the same. What this really exposes is how much FTDI is making from their brand name for what is a generic serial device and what lengths they will go to to protect that brand name.

It's because the profit margin exists over generic, that unscrupulous vendors badge the workalines as FTDI - and the fakes are so good that they're hard to detect visually. The price differential on fake branding is almost nonexistant - 3-5% or less (sometimes no difference), which is within the margin of error on supply chains, so it's no wonder these appeared in production runs.

As others have said, FTDI has burned a shedload of goodwill in a mantter of days. If they wanted to flag attention to the fakes they could have done so in a far less destructive manner (which amounts to arbitrary seizure and destruction of property, something which requires a court order in most countries even for trademark piracy)

Thankfully, there are a bunch of pin-compatible replacements for the device from various makers The FTDI device itself was a pin-compatible replacement for first-generation usb-serial chips.

Workalike makers now know how to make their devices even better mimics of FTDI - plus how to resist VID reprogramming - and a lot of people in the design and build sphere now know that many of the pin-compatible devices are significantly cheaper, use less power and run faster.

The ironic thing out of all this is that the workalikes are significantly faster devices which draw less power and could easily stand on their own 2 feet as a properly branded item. They were sold as FTDI because of resistance to buying other brands by western designers.

End result: Own Goal by FTDI. Did they do this as a prelude to getting out of the serial chip market?

Re:It's still YOUR problem...

[kheldan]

Better throw all your computing devices away then, jerk. Oh and I'm fucking sick and tired of fucking assholes on the fucking Internet making assumptions and putting words in my mouth. WHO SAID we're buying things from 'questionable sources' and not a major outlet? WHO SAID we're buying cheap shit? WHO SAID that even a major manufacturer isn't susceptible to getting counterfeit parts, or is willing to cut corners by using an 'equivalent' part, and WHO SAID that we're responsible for any of this when a goddamned USB dongle is completely molded in plastic and you CANNOT open it up to see what parts it's made with? Oh no this is the goddamned motherfucking INTERNET, and any fucking asshole who wants to post anonymously can say any goddamned thing they want and NEVER be called out to back any of it up, and I have the GALL to actually get sick and tired of it? I'm called NAMES like this is 6th Grade or something. Fuck this shit.

Re:Not sure what is going on here... but...

[Karmashock]

Fine, we'll just go back to trade secrets.

That is what we had before patients. Companies simply kept information to themselves.

And a result of that was a much lower rate technological development because information was fragmented.

Look, if I come up with something... if I create something... why shouldn't I get rewarded for that? Why would you assume you have a right to take what I create and pay me nothing? Don't you see that I can't live or make that my job if I can't get paid? And if I can't get paid doing it, then that means I have to spend most of my time doing something else and only create in my spare time for FUN. You're going to get much less out of people if you do that then if you support them so they can produce stuff all the time. What is more, you're going to make sure that big companies and organizations spend basically no time creating anything. They'll make stuff but it won't be innovative because none of their own IP will be protected unless they keep it as a trade secret which means the secrets might be in a factory machine or something but never obvious in the final product.

The illogic of your position is just so fucking obvious... how can you not see how self destructive your position is here? You're cutting your dick off and saying "why is that a problem?".... well... I don't really mind if you want to live in a society like that. That is fine by me. I just don't want to live in your society then. I'll live in a society where IP is protected and you can live in one where it isn't. And we'll just see where that goes.

Re:Not sure what is going on here... but...

[McFly777]

So the next time you buy a car, I am justified slashing the tires because I notice that it contains a seat with similar designs to the one which I hold a patent on? (or perhaps just removing the valve from the tires, as that is "reversable.") It doesn't matter that you had nothing to do with the infringement, and no knowledge of its occurrance.

No mercy. You should have researched each part delivered with your new car, and asked the dealer to replace the infringing seat with one from a different make of vehicle which properly licenced my design.

The point is that you/FTDI are attacking the wrong person. The only logical response to such attacks is for the consumer to avoid all products which use FTDI chips, as the consumer cannot tell if they are counterfit until after they are rendered inoperable. I have no problem with you/FTDI refusing to work with the counterfit, but when your response crosses over to misplaced vigilanteism it is wrong. And despite it being cliche, two wrongs still don't make a right.

Re:Not sure what is going on here... but...

[seepho]

Do you know what the *best* part is?

The current system does nothing to prevent people from creating their own stuff and releasing it under whatever asinine license they want. So not only are people insisting that their open method of production/distribution is better than a proprietary one, but they seem to feel that we're beholden to play by their rules, simply because there's no physical limitation preventing them from copying/cloning whatever they want.

If FOS hardware/software were the amazing, best-for-humanity method for driving technology forward that all its proponents seem to think, why the hell is proprietary hardware/software so successful in the market?

Hit the little one?

[cwsumner]

What FTDI did was like someone who gets hit by a bully, and then turns around and hits the smaller boy standing on the other side of them. They punished the wrong people, and are themselves now the criminal. 8-(

How To Identify Fake FTDI chips

[TerryKing]

I have several Genuine and several fake FTDI on Arduino derivative boards.
The fakes have laser etched labels that are quite well done. BUT the “Pin 1” dot in the plastic is just a little different.
Genuine is large dot, not very shiny
Fake is slightly smaller dot and quite shiny
You can see this clearly on this photo: http://s.zeptobars.ru/ftdi-FT2...

Re:Not sure what is going on here... but...

[Karmashock]

They're witless children with little more then the first flush of a political identity. And so devoid are they of even rudimentary critical thinking skills that they get brainwashed by the first thing to try and colonize their minds.

It always goes back to the education system.

Re:Not sure what is going on here... but...

[Karmashock]

You can't patient that.

I swear... you people are so fucking stupid... it is remarkable that you can sustain this absurd arrogance at the same time you're clearly without so much as a single wit.

And my statement initially only referred to stolen tech so similar to the original that it ran on the same firmware. And my statement was that I didn't have a problem with a maker tweaking a firmware update so that it bricked knock offs.

Don't like that? Don't steal my shit.

You mad, bro? What are you going to do about?

Do this for me. Hold your breath until you turn blue. That will show me, tiger.

Seriously though... get bent.

Re:Not sure what is going on here... but...

[McFly777]

You can't patient that.

Interesting... Try US patent # 8,801,101 : Vehicle Seating System

I have a few more. Both in the field of Automotive Seating (which you just stated couldn't be patented), and in other fields. How many do you have?

Anyhow... Peace "Bro". Nobody is mad here. On the other hand, you are the one who has been ranting about people "stealing your sh--." My point is just that vigalenteism only harms innocents. Go ahead and bring suit against the actual theves. Feel free to write your drivers to only work with your hardware. But do no harm otherwise (to the end user who is innocent, and likely unaware of who manufactured the componant parts.) I attempted to express this with humor first, and later with a more concrete example by transferring it to another modern day product, but apparently both attempts have been in vain.

P.S. It is also worth noting that in a discussion, generally whomever yells first (swears, calls names, etc) has lost the argument. I thank you for your submission.

Re:Not sure what is going on here... but...

[Karmashock]

Review your citation:
http://pdfpiw.uspto.gov/.piw?D...

That is a specific system.

Furthermore, just citing a bad patient doesn't mean that it will be sustained in court.

Show me a bad patient sustained in court. And then I'll just point out flaws in the legal system. I'll point out that murderers at let go all the time by bad juries etc and yet we both agree murder should be illegal.

Your move.

Re:Not sure what is going on here... but...

[McFly777]

My move? Frankly, this has now gone far enough off topic that I am struggling to get it back on, but lets try anyhow.

Of course it is a specific system, all patents are. This just happens to be my specific system (assigned to my former employer). As to whether it is good or bad . . . time will tell. I certainly hadn't seen anything remotely like it when we developed it. What I can say is that millions of vehicles have been manufactured with it in the last seven years. (Yes, the corporate patent lawyers managed to stretch the application process out that long. Don't blame me.)

Good or bad, you are free to design around the patent, creating a system which performs a similar task through different means. (Yes, I am oversimplifying.) This is not a mistake in the patent system, it was done that way on purpose. If you can do it simpler, without losing functionality, I'll be the first to congratulate you.

None of this changes my original point regarding vigilanteism, and the potential for Streisand-like backfires.

(Hmm . . . With a better segue that might have counted for getting back on topic. As it is... Not so much. Feel free to bring it back home.)

Re:Not sure what is going on here... but...

[Karmashock]

So you are saying you agree with me and the patient system and IP rights are reasonable.

Okay... we have no disagreement.

This issue is concluded.

Or do you want to make a coherent point that uses contributing evidence or arguments that in anyway contradicts my position? Because you seemed to be disagreeing with me and then cited evidence that didn't support your position... and then made this post which seems to take something similar to my own side... which makes me wonder what the hell we're arguing about here?

I'm going to just assume you were agreeing me all along and this was just a failure in communication.... unless you want to correct that.

Re:Not sure what is going on here... but...

[McFly777]

I agree, and disagree. I have no issue with the concept of patent rights, or IP in general. There are some big issues with the implementation at the USPTO, etc., but that is another topic. I am not one of the "information wants to be free (so I am going to take it)" people.

Where we seem to disagree is what a proper (legally appropriate) response is when aggrieved. You are certainly allowed to defend your IP rights, either through the courts, or by attempting* to protect it technically. I can even empathize with your frustration when your work has been stolen. I was just saying that, as tempting as it may seem, one can't go over to the dark side and start repaying evil with evil. Bricking the end-user crosses that line; passively refusing to operate would be ok. It may not be as satisfying, but wearing the white hat means that one has a larger set of constraints than those in black. (How many more metaphors can I work in here?)

* I say "attempting" because historically the track record of such technical controls are rather poor. There is usually a technical work-around to the technical protection. One can attempt an arms-race, but there are limits to what one can do ethically. Which is back to my original point, again.

Personal insults aside, the citation was not germane to the original argument, but was in response to your questioning the ability to patent the mechanical design of a car seat, which was the parallel example that I was trying to use to make my on-topic argument. I don't have a bunch of case-law to cite, but neither do you. I am merely discussing the ethical ramifications of over-reacting.

P.S. Thanks for the spirited back and forth discussion. You can have the last post if you wish.

Re:Not sure what is going on here... but...

[Karmashock]

If a consumer buys stolen property it can be ceased by the legitimate owners at will without compensation.

The grievance is between the consumer and the thief who stole BOTH from the legitimate producer and from the consumer by selling stolen goods.

It sucks for the consumer but maybe next time they won't buy stuff from dodgy pete with the low low prices out of the back of a van in an alley.