Hacker News new | past | comments | ask | show | jobs | submit login

It's interesting to consider from a legal perspective exactly why this isn't something a company is allowed to do. (Assuming the company did in fact intentionally damage people's chips, reversibly or not -- sounds like we don't know for sure yet?)

- Intentionally sabotaging someone's stuff, legally, is more or less the same as intentionally taking it. Keying a car and driving it away might have different names but are on the same scale.

- There ain't no self help. If you think someone else's stuff should actually be your stuff, your path is through a court.

- We don't fix things with injunctive relief that can be fixed with money. When Apple proves that Samsung violated a patent or vice versa, we don't collect and burn all the infringing phones, we just make someone cut a check. Because we are not idiots.

- The "someone" who cuts the check is Samsung or Apple, not their customers. As far as I know no one's managed to go after end users, even in extreme cases like a $10 designer handbag where the buyer obviously knows it's not real. (And it's at best unclear whether going after the buyers would make any sense, even in those extreme cases -- if someone pays knockoff prices for a knockoff product, it's the seller and not the buyer who has ill-gotten gains. There might be some additional reputation damage and lost profits that the buyer is complicit in, but it makes a lot more sense to me -- and apparently everyone else -- to make the seller pay for those as well.)

- When you do go after the seller of trademarked goods and want to seize those goods, we actually have a procedure for that -- Section 34 of the Lanham Act.[1] Which includes a whole bunch of protections like swearing out an affidavit, getting permission from a judge, informing the attorney general, posting a bond to cover damages, conducting the seizure through government agents, and keeping the seized items in the custody of the court. It's very much unlike showing up at someone's house and breaking their stuff.

(I am a lawyer; I am not a trademark lawyer; I just googled some stuff based on vague memories from law school to write this.)

[1] http://www.bitlaw.com/source/15usc/1116.html




* we don't collect and burn all the infringing phones, we just make someone cut a check. *

Destruction of trademark-infringing goods and copied media is quite common, though.

In the UK, deliberately sabotaging hardware with drivers could be counted as a violation of the Computer Misuse Act, but there are hardly ever any prosecutions under that law.


Destruction after due process and by the proper authorities, yes. After all, it's a reverse engineered product. How does the software know that it's got FTDI stamped on it? Everything else is just implementation details.


These guys are apparently Glaswegian, so Scottish law. Computer Misuse Act territory, perhaps, in my (lay) opinion?

They aren't the first to do malicious copy-protection. It did not go well for the previous contenders. At all.


They may be from scottland, but I bet anyplace they distribute their driver can claim jurisdiction. After all, the crime (or tort or whatever it is) is not writing the offending driver, but distributing it to an unsuspecting public.


One could argue that using the official driver with counterfeit chips is outside intended purpose of the official driver, at which point the user is proceeding at his or her own risk.


I think the counterargument (elsewhere in this thread) is pretty persuasive -- that this defense won't help much if you intentionally set out to damage counterfeit chips.

Think about it this way. Suppose the driver works like this:

``` if(counterfeit()){ // do something harmful to the identified device } ```

If you have a counterfeit chip, and you run the driver, and the driver breaks your chip, then you are in fact using the "official driver" for its "intended purpose." Its intended purpose is to break your chip, and it works just fine. It just lied to you about its intended purpose in order to persuade you to install it.

Of course if the code does something that is safe and useful to do on the legit chip, and just happens to break the counterfeit chip, that's very different. I don't claim to know which thing is happening in this case.


In this case the driver is executing two writes which a legitimate chip would ignore, but which the counterfeit responds to and actions. Those writes just happen to be the position in the counterfeit's EPROM where the USB PID is stored, and just before where the checksum is stored.


"just happen"

In what universe can them doing a preimage attack on the checksum "just happen"?


I think you'll find I'm not in any way suggesting that it was a coincidence. It's a classic Electronic Counter Measure, exploiting the behavioural differences between the 'real' and 'fake' hardware - EXACTLY the same kind of thing you'd see being executed against pirate pay-TV smartcards, for example.


I think if somebody steals your bike, they ride it away at their own risk, but...

* That doesn't mean you can shoot them as they ride away.

* It also doesn't mean you can booby trap your bike.


But if I shoot myself while driving in nails with the butt of a handgun, no one would blame the gun manufacturer.


you can if they release a patch that makes hitting the butt of the gun a firing mechanism without telling you... Also, can we agree that a gun metaphor is rather ridiculous?


Regarding going after buyers, if potential buyers know that buying a counterfeit item puts them at legal risk, I think the market for said counterfeit items will shrink substantially. I think that could be a potentially convincing argument in the case of items where the buyer clearly knows (or should know) that the item they are buying is counterfeit. Is it really all that different from receiving stolen property, which IS illegal?

I think in the FTDI case, though, it would be really hard to argue that the end users should (or even could) know that the chip they have is counterfeit.


What would FTDI be able to go after them for? The end-user isn't copying anything so they can't run afoul of much with regards to copyright law, they know they're getting a counterfeit so they're not being fooled by trademark infringement and probably only care about the functionality of their ICs anyways, and the internals are completely different so the patent risk is minimal.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: