On one of the rare days that Whisker and I aren't working on videos, software, hardware, woodworking, etc, I hang out in our IRC and catch up on the latest tech news. Yesterday it just so happened to be the debacle with FTDI's USB chip drivers that we coined #FTDIGate. (Because anything + Gate = MASSIVE CONTROVERSY).
FTDI is a company best known for their USB to serial chips which can be found on numerous cables, boards, dev kits, etc. As a result of this functionality's near ubiquitous use, there are many different chip options made by other companies such as Microchip, Cypress, Prolific, etc. However, there are many counterfeit chips who claim to be FTDI chips and therefore use their drivers.
So what do these drivers do? So when a USB device is plugged in, it has a specific VID/PID combination - with VID = Vendor ID and PID = Product ID. The PC uses this combination to find drivers (if any) that are to be used for the device. For this to work, the VID/PID combo must be unique in the sense that each USB device with the same VID/PID will use the same driver. Or in other words, if you need a specific driver, you will need a unique VID/PID for that product. (cite: http://www.voti.nl/docs/usb-pid.html)
There are two ways to get a VID number - become a usb.org member or buy a VID number - both costly options. Each VID number then gives you 65536 PID numbers. And PID numbers are given out by those who own VID numbers. So you can request them from FTDI or Microchip or whoever the VID owner is. Now because it is so costly, (annual fees for usb.org membership, set-up costs, etc), counterfeit chips often piggyback by setting their own product's VID/PID to that of a currently working set-up, in this case, FTDI's.
So over the past month, issues with various "FTDI" chips have surfaced, and have been found to be linked to the latest FTDI driver: http://hackaday.com/2014/10/22/watch-that-windows-update-ftdi-drivers-are-killing-fake-chips/
This update from FTDI can be found on the typical Windows update and what it does is essentially write a bunch of information to its FTDI chips and in doing so, "rewrites" the PID number of the counterfeit chips to 0000 - which as far as I am aware, is not associated with any particular product. What this ends up doing is making it so that that chip is out of commission until either the counterfeit chip can be reprogrammed, and given its old PID with a previous driver version.
There are two camps of opinion with a vast majority somewhere in between. I'll try to include some of the arguments made by both sides:
1) FTDI was absolutely right. They updated their own drivers for their own chips. They have no obligation to support counterfeit chips and are in fact protecting their intellectual property. If anyone's to blame, it's the manufacturers of the product who used the counterfeit chips instead of buying from reputable sources as well as the counterfeit chip makers.
If something is not working, people should send the item back to the manufacturer - or have them recall the product and fix it.
Engineers of large industrial items put more than one safeguard such that if by some fluke, a counterfeit chip enters into the system and is rendered useless by this, it's likely that the machine won't suddenly go haywire and kill all of its operators.
Medical related items are severely anal about where they get their parts from and track each part even down to the manufacturing lot.
Root out the wrong do-er in the chain of production who's providing the counterfeit chips and get rid of them - not FTDI!
Going after cloning vendors in China is not going to get you anywhere.
Truth of the matter is if a lay end user has something which stops working after the windows update, they'll go back to whoever sold them the item, who will then report that a massive batch of products are now messed up. This will allow the company selling the items to look back into their supply chain to see where the wrong party is and FIX the chips.
The chip's situation is completely reversible and is something that can be fixed. The chip wasn't suddenly given 1000v of juice to give up the smoke. The chip is NOT destroyed or bricked. Nor are the electronics past the chip. Fix the chip, you have your electronics back.
Counterfeiting is illegal. Buy the chips from reputable sources, and then bring it to their attention when something is wrong!
By using FTDI drivers, and not writing your own, you are accepting all responsibility with using those drivers. It's not FTDI's fault if it borks your chip which cannot be used with its drivers.
If you buy a clone board, expect counterfeit parts. Can't have your cheap cake and eat it too.
Companies should be in control of their supply chain anyway - it's good practice, and it allows you to not be caught with your pants down. Inconvenience now = popcorn for when counterfeiters are being brought down.
Take responsibility for not having the right parts on your boards manufacturers!
Counterfeiters should write their own drivers. Get their own VID/PIDs - because clearly they're making enough money to be so ubiquitous that board houses can't control the quality of the parts.
Ignorance of "lay people" is not a reason that counterfeiting chips should be allowed to continue populating boards and be allowed to keep working off of the PID of a legitimate chip.
2) FTDI was wrong to do this and it will backfire. They are hurting the end user instead of directly going after counterfeit chip manufacturers by suing them. And they could have used a gentler method of disabling - rather than reprogramming the chip - they could have had a pop-up, or merely not allow the chip to work with the driver.
With this update, items may just stop working and cause major damage - especially in industrial or medical settings.
There are many places where counterfeit FTDI chips could come into the system - board house, parts supplier.
End users may purchase a product in good faith from a reputable company, but the product itself may have been manufactured with a counterfeit product unbeknownst to the manufacturer due to supplier error. Don't punish the end users!
Asking the company to recall their products and fix the parts could lead to bankruptcy for the company and would not be feasible for most companies.
Property's now been bricked and destroyed. The chip's destroyed, and that's illegal.
People are just going to say, well, there could be fake FTDI chips that'll mess up my product, so we're not going to even bother with FTDI. This move backfired on them.
I'd rather have had them just disable the chip rather than maliciously re-programming it. It's the active reprogramming to render useless that is not okay.
Was this driver actually necessary or was it just to be malware against counterfeit chips?
There are so many counterfeits out there running in important hardware that it shouldn't have been disabled in that manner.
Auto-updaters are automatically pushing this potentially product-breaking update without consumers actually knowing that there is a chance their items will be effectively useless.
How do we know their detection mechanism for the driver won't also mess up their own chips?
What a polarized subject. I don't know the repercussions of FTDI having done this in the courts, but I do know that not all press is good press. And if you have additional arguments for or against, I'm all up for it.
So far general consensus is that FTDI has the right to defend their IP but not reprogram other companies' chips, even if they're counterfeit.
