Slashdot Mirror
FTDI Driver Breaks Hardware Again (eevblog.com)
janoc writes: It seems that the infamous FTDI driver that got famous by intentionally bricking counterfeit chips [NOTE: that driver was later removed] has got a new update that injects garbage data ('NON GENUINE DEVICE FOUND!') into the serial data. This was apparently going on for a while, but only now is the driver being pushed as an automatic update through Windows Update, thus many more people stand to be affected by this.
Let's hope that nobody dies in an industrial accident when a tech connects their cheap USB-to-serial cable to a piece of machinery and the controller misinterprets the garbage data.
Let's hope that nobody dies in an industrial accident when a tech connects their cheap USB-to-serial cable to a piece of machinery and the controller misinterprets the garbage data.
...
I think I'll keep my Windows computers with updates disabled, as all the updates have been detrimental to the user, lately.
Checking the eevblog thread, though it seems it affects Windows 10, which I also elected not to touch.
"The agriculture ministry is not in charge of Gundam" - Japanese ministry official.
Thanks to the reality of supply chains, companies intending to buy the real deal can accidentally buy the knockoffs. Anyone willing to do this(or their previous actions, like bricking devices) is someone I intend to never purchase from, real deal or not.
There are now plenty of competitors to FTDI. Don't buy FTDI- even if you think you're buying the real deal, reality can intervene.
What is Microsoft's responsibility here?
They are pushing out drivers that bricks hardware through their Windows Update service?
How the hell did this pass their WHQL?
Not necessarily true. Low-level technology like this is frequently the source of "cascading failure" that can endanger people or property.
For instance, we have many USB-to-Serial devices installed in chains that capture weight readings from industrial scales. If this suddenly and inobtrusively starts causing that measurement data to be misaligned in the output, those weight readings could be transmitted to shippers who may or may not re-weigh the product based on our volume. In the worst case scenario, something like this could be done as the last check-weight for loading an aircraft -- a weight-critical application where getting it wrong can cause a tail-strike on takeoff.
Screwing with low-level data INTENTIONALLY is never a good thing. End users have no way of ever knowing that it's happening. Pushing it by Windows Update, where no devs are involved to catch the error, is a recipe for potential disaster somewhere.
This IS Pure Crap... on the part of FTDI.
Notice: Your mouse has been moved. Windows will now restart so this change can take effect.
Here's the safe driver, in the form of source code so you could check it yourself if you want to.
http://lxr.free-electrons.com/...
This driver does require a non-crap operating system, of course. Linux, FreeBSD, OpenBSD, etc probably OSX will work too.
Why would a vendor of a basic USB-Serial port converter bother writing a driver?
Because the FTDI chip actually works. It's one of the very few USB to Serial chips that has proper timing and signals to make it work with marginal, antiquated hardware. A lot of people trying to use old automotive scan interfaces and the like which interface with serial have serious problems when using other chips.
I have literally never had a USB device outside of HID or mass storage which didn't need its own special snowflake driver, even though USB has driver profiles for several types of device.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Why can't FTDI realise that this kind of behaviour is only going to hurt innocent end users, rather than the people responsible for peddling counterfeit devices? I've bought hundreds of these devices in the past from reputable suppliers, and in precisely zero cases can I determine whether the chipset is genuine or not before purchase. If I can't tell what I'm buying, then why am I being punished when I've bought in good faith? Why can't FTDI instead use existing mechanisms and laws to find the people responsible?
Of course Linux drivers for these devices work every time, counterfeit or not. Perhaps a different approach might be for someone to take the Linux code and create a decent open-source Windows driver to replace the buggy (i.e. injecting unwanted serial data) FTDI code?
Son of a.... I spent, literally, 4 hours yesterday trying to troubleshoot a 3d Printer (Tinyboy 3D), with it not working. MProg from FTDI said the chip was fine (right vendor and product ID), but it just wouldn't work. I tried every driver I could find. Finally, I uninstalled the driver, disabled wifi, plugged it in, waited for Windows 7 to install the version it knew (2.4 something), used Mprog 3.5 to reprogram the chip as legit (as per: https://www.youtube.com/watch?...), unplugged, replugged (at which point windows reinstalled it again, with 2.4), and suddenly it started working! I can confirm this "Non Genuine" serial data, since I opened up the Arduino IDE and saw that on the serial console. You know, I sympathize with FTDI. They're having their tech ripped off. But, it's inappropriate to punish end users who don't have any say. Sure, we could not buy stuff that uses counterfeit chips, but many sellers aren't even going to know. FTDI should be pursuing the counterfeiters in China, and using what legal system China has to stop it. Either that, or create a version of the chip that has such a low price point, they put the cloners out of business by providing legit-working-alternatives for a price point. So annoying that I've lost time because FTDI does this crap, and apparently Microsoft is okay with it (I don't see how this should have passed WHQL).
Wait, you're actually surprised that Microsoft is okay with screwing users over something they already paid for?
I'm a big consumer of the Arduino clones (and FYI - Arduinos are FREE to clone for everyone, it's a part of the concept).
The chip has now been replaced with the CH340 - which even though it lacks some of the FTDI features, is a bang up chip that gets the job done - even at really high Serial speeds, I've yet to see one of them fail on me (I use Linux, where CH340 runs right out of the box, windows needs a driver).
I've not even heard of the FTDI before all of this came up.
What this world is coming to - is for you and me to decide.
Those damned florists and their delivery vans!
Have gnu, will travel.
FTDI is malware.
Use Linux.
use MCP2221.
aaaaaaa
'Compatible' chips that report FTDI's USB Vendor ID (VID) and Product ID (PID). That way, they don't have to actually write their own driver and get it approved by MS.
So, when Windows interrogates the device, it appears to be FTDI, so Windows loads the FTDI driver.
That driver makes an undocumented call that only genuine FTDI chips will respond to correctly, so the driver can tell whether a knockoff part is attached.
Other legit serial chip makers use their own PID/VID, so it's not an issue with TI, Silabs, etc., only with 'Best Lucky Interface Ltd' parts.
Mission: To provide products that consume time and energy as entertainingly as permitted by the laws of thermodynamics.
One problem these counterfeit chips pose is that all the sudden companies like FTDI end up with a lot of support costs for people who bought shoddy products with the fake chips, which often don't work nearly as well as the real thing. This is a way for FTDI to crack down on the counterfeit chips. While it sucks for the consumers that end up with the fake chips, it will also help put a stop to the counterfeit chips since any product that uses them will not work.
At my company we make a number of development boards using the quad FTDI chips for the serial interface. We use them because in addition to RS232 they also can talk I2C and JTAG, among other things. I can reliably run the FTDI chips at 10Mbps. I've used other USB to serial devices in the past but I've had lots of problems with them. Some cables I bought, for example, will just suddenly stop working and I have to periodically reset the baud rates.
Why should FTDI have to bear the burden and support costs of counterfeit chips? If somebody else slaps the FTDI manufacturer ID and product ID onto their USB device then they deserve whatever happens. Why should FTDI have to spend resources supporting fake chips? By doing what they are doing, it will drive the fake chips out of the system and prevent future ones.
I work for a chip manufacturer and while there's a very low risk that someone will make fake chips like ours (very complex network processors), we have had to add features to our chips so that our end customers can prevent counterfeit equipment which just copies their software. We have some large customers who have been battling Chinese made counterfeit equipment.
This post is encrypted twice with ROT-13. Documenting or attempting to crack this encryption is illegal.