Hacker News Reader

Comment by jerf | Hacker News Reader

We do not want to set a precedent whereby a company responds to customer feedback, and then gets hit by a huge lawsuit anyhow. That just incentivizes companies to dig their heels in, because it means there's no change in outcome between speedily responding and trying to stay the course, at which point staying the course is the only sensible choice.

There's a time and a place for mercy, and giving positive feedback to the company for rapidly reversing course. They ate their crow; save the nuclear escalation for a company that refuses to.

View on HN

Bluntly? Fuck 'em. The only reason they "responded" apparently is because Microsoft tapped them on the shoulder, by way of yanking their updates until it gets fixed, and then only because someone publicly connected the dots as to what was going on.

There is an untold amount of bricked gear out there. Those people are entitled to replacements and compensation for their time spent dealing with this malfeasance.

No, this isn't "responding to customer feedback". The code they published was pretty much illegal - imagine your garage destroying your car because it's the wrong brand! Their reasoning should be (and probably was) "by fixing this fuck-up ASAP, we'll only get a class-action lawsuit by 10K customers, instead of by 100K".

I'm totally happy setting a precedent where malware (let's call it what it is) distributed by a company causes financial damage to that company.

I'm guessing they've already done plenty of self-inflicted financial damage that they're going to have to explain to their investors.

They have already damaged my equipment. I don't give two shits about hurting a corporation's feelings. They've already hurt my physical items. Once they've gone down that path, it's now an actionable tort. I can't believe their legal team approved of this.

They need to be made an example of.

What specific piece of equipment was affected? (not doubting - just curious, as I've not come across specific examples of people being affected by this driver)

This guy in /r/sysadmin claims 35 devices nuked:

http://www.reddit.com/r/sysadmin/comments/2k6wjk/fyi_ftdi_de...

So, in other words, they didn't damage your equipment.

35 devices put together by students doing EE projects... well, that's annoying, but they are at least direct consumers/users of the counterfeit components - presumably they have the option/ability to replace the chip with a genuine one once they source one. I've yet to hear of any end user finding that a commercially purchased peripheral has been bricked by this driver because its manufacturer used counterfeit parts, though. Would be fascinated to hear about such an example.

Maybe they should reach out to affected parties and help them replace their destroyed equipment.

They really should. Class actions are an inferior mechanism for both parties anyhow. The lawyers sitting in the middle will make it so it's radically more expensive for the company, and the odds of the supposed "winners" of the class action suit will probably get uselessly small vouchers for service rather than actual replacement.

Class actions are less about compensation and more about forming big enough sticks to beat misbehaving corporations about the head with.

And lawyers getting big, fat paydays.

"Class actions are less about compensation and more about forming big enough sticks to beat misbehaving corporations about the head with. "

Class actions were never about this until recently . The original purpose was to make it easier to manage the case (vs 50 separate cases) for the justice system. It was about "the efficient administration of justice". Nothing more, nothing less.

When they were created (out of thin air) in the US, this was the goal. AFAIK, nobody thought about, or wanted, what has happened now. It's not even a good vehicle to accomplish "beating misbehaving corporations" , because when used for that purpose, it mostly makes money for lawyers, encourages nuisance suits, etc.

No equipment was destroyed by the old driver: the old driver set a word in the firmware of counterfeit devices to zero. All that needs to happen to reverse what some comment-writers are calling "bricking" is to set the word back to its original value. The new version of the driver could probably do that.

Bricking is exactly what you describe - the device is not usable after the driver sabotages it. Bricking is a common description of a device made non-functional by interrupting a firmware upgrade process. It's not destroyed, and can be restored to functionality by special tools. But as far as the user is concerned, the device is broke.

I'm not an expert on USB protocol, so I'm not sure how your suggestion would work. The driver bricks it in the sense that the Product ID of the device is wiped (zero'd). As a result, the OS doesn't know what to do with it or what drivers to connect it with.

Is there some signature to the USB device that would allow the OS to know what to do with the affected gizmos? Or do you have to explicitly tell the system "no, really, the device on this USB port is specifically this"? If it's not automatically deployed like the initial driver but rather actually requires the user to screw with firmware-style updates, then it's effectively ruined for many beginners with these chips. (Thankfully, there's been a lot of fuss over this, so newbies will likely be able to troubleshoot this problem after a few hours of groping in the dark for why their device has gone silent.)

It's an eight step process.

http://www.reddit.com/r/arduino/comments/2k0i7x/watch_that_w...

Dang. If a person's not familiar with the ins and outs of USB protocol, I'm going to bet they're not going to be able to think up or through that procedure. At best it'd just be some incantation to recite in the hopes the gizmo comes back to life. And if you're using the FTDI chip specifically because it abstracts away serial to USB communication stuff, well, hopefully the device is cheap enough to just replace.

Still, perhaps it could be automated somehow via a responding Windows Update? That's the thing that gets me - it was autmatically propagated, it oughtta be automatically fixed.

Nice find though.

"Bricking" doesn't mean a device is completely demolished, just that it's basically been rendered into a useless lump, especially via corrupt firmware. Even a 'hard' bricked device can sometimes be recovered via JTAG.

The we can do what the US Coast Guard does about oil/fuel spills into water. You're guaranteed a fine when it's reported. However, the fine is lower if you report it yourself. Gives a clear incentive for the ship operator to report their spill rather than someone else who happens to find it.

Given their initial reactions on Twitter, I don't feel bad if they get taken to court over this. As others have mentioned, they only agreed to rapidly reverse course after Microsoft put them in time out.

"Act first and apologize later" is a bad idea when your actions affect large numbers of uninvolved parties.

Reply on news.ycombinator.com