Your DS18B20 temperature sensor is likely a fake, counterfeit, clone (opens in new tab)

The original FT232R chips have a clocking bug that makes bitbang mode unusable for many applications, with no workaround (their errata sheet suggests a bullshit workaround of setting the clock speed to max, that is unusable in practice because USB can't keep up). It's supposedly fixed in a revision that I've never seen, and I believe they never manufactured it.

The clones... work perfectly fine: https://twitter.com/marcan42/status/695292366639378433

In fact, I reverse engineered FTDI's bricker, and it works by exploiting the fact that their own chips violate their own interface design by requiring EEPROM words to be written back to back - even word writes alone are staged and ignored without an odd word write. The clones honor the writes independently, like FTDI's other chips. Their bricker code only writes even EEPROM words and preimage attacks their own checksum algorithm (since the real checksum is at an odd word they can't touch) to make it work, so it has no effect on the real chips (which get sent the same commands). It's hilarious.

Don't buy FTDI. They're just bad.

However, the FTDI debacle didn't punish those people, they're not the consumers. It punished end users who have no idea what an FTDI chip is or does or that one exists in the products they buy.

In your airliner microcontroller example, you have much more informed consumers. They could reasonably be expected to know what processor is in their hardware, and to want to validate it. That's not the same.

It would be more like a good packaging manufacturer finding that their packaging was being counterfeited and their proprietary plastic blend was somehow being leaked up the supply chain. If they changed their recipe to something toxic, but using good plastic internally, and when people started dying said "they should have bought potato chips packaged in genuine FoodSafeStuff bags". People don't know what their packaging is made from or who it's made by. They have no way to verify it prior to purchase, and even after purchase, it would take an expert to identify. And there's no customer loyalty based on the plastic bag, after the food manufacturer switches away from the counterfeit they won't be significantly harmed. But everyone who innocently bought those bags and got poisoned suffered real harm.

There's a difference between not taking steps to ensure counterfeit devices function, and purposefully causing hardware to fail on a remote system. For example, I'm pretty sure purposefully causing the problem is illegal, if the user didn't request it, as it seems the same as hacking to me.

> Imagine counterfeit processor make it into the supply chain. Should the avionics OS do its best to work with every possible fake or should it brick it on power-up before that potentially dangerous aircraft gets off the ground?

Refusing to function is acceptable. Bricking the hardware is not.

They destroyed devices that worked perfectly well, but maybe (or maybe not) had a fake FTDI branding on a chip inside the device.

Even the manufacturer may have been a victim of commingled inventory. For this reason I stopped buying anything with FTDI in it, because I didn't want to take the chance it would be bricked because the smalltime seller on Tindie.com bought from a bad supplier.

I would hate to think what you would have Apple do to Hackintosh hardware.

An emergency comes up, and the instant the emergency system comes up, it turns out to have been bricked. People die. Is this a good outcome?

If I were a manufacturer, I'd want to know about this ASAP. Would I want devices to stop working? Especially the examples you gave where people's lives are on the line? Absolutely not. I'd want them to work as well as possible until a replacement can go out.

Pro-consumer would be a pop-up letting the user know they received a counterfeit devices. I can then contact whoever sold me the device, and ask for a replacement. During cross-shipping, I can keep working. Anti-consumer is having my business trip and fall on its face when all the pen tablets which allow people to work from home are bricked during a pandemic.

Of course the counterfeit manufacturers are the bad guys. But FTDI is a company I'd never do business with either. If I'm an FTDI partner, and I got the wrong product, we were both cheated. I'm no more at fault than FTDI.

Should FTDI smack me and my customers upside the head for it? Well, that means we're not really partners.

a) > company should be responsible for ensuring that counterfeit devices work correctly

or

b) > bricking [the counterfeit] device as soon as possible

The answer is almost always c) let it be, if it works fine, if not, not your problem.

Adding any kind of bricking code anywhere, unnecessarily introduces the possibility that it will be unintentionally (or maliciously) activated. Personally I don't have that kind of confidence in software or the people that write it (and I am one of those people)

A counterfeiter commiting crimes against FTDI does not excuse FTDI committing crimes against a third party (i.e. the consumer). The world being safer without the counterfeit products also does not excuse the FTDI destroying things that aren't theirs. The justice system being ineffective at addressing counterfeiters is also no excuse for FTDI to take matters into their own hands. Vigilante justice is usually illegal.

Programmers make mistakes. A bug in your counterfeit detection code may end up destroying legit products. In addition, you can not be sure destroying a product will be safe - if the chip is in a medical device, you might be killing someone. The entire idea of destroying a product without explicitly being told to do so is fraught with peril.

You deal in false binaries. The third, imo correct, option is for FTDI to design software that works correctly with their own product, and spend no effort on the counterfeits - neither to get them to work correctly, nor to brick them on purpose.

A fourth option, if you want to spend some effort on something other than destruction of property, is to take option three, and also alert the user that they are using a counterfeit chip with unpredictable behaviour, and in your airplane example, advise the user they should probably not take off. If you want to be pro-consumer, this is a better way to go about it than smashing their stuff.

From the consumer's perspective, they had a working device, and a firmware update bricked it on purpose. It is possibly out of warranty, in which case they end up footing the bill (or experiencing frustration) for replacement and downtime. It takes Olympic levels of mental gymnastics to view that as 'pro-consumer', imo.

The primary counter argument to mine requires an inversion of responsibilities and ascribes criminality to the victim.

Devices got bricked because counterfeiters committed a crime in the first place.

Along the same lines, there are supply chain questions that are impossible to answer:

How many of these device manufacturers knowingly used fake chips because they cost less?

How many distributors knowingly shipped fake components because, again, they cost less and delivered higher margins?

How many device manufacturers were true innocent victims who did not know fake devices had been substituted for the real thing?

How many failures of import controls led to consumers receiving devices with fake chips?

I have had the experience of having major US electronics parts distributors knowingly substitute defective --yet genuine-- parts instead of the top grade parts we ordered. The effect was what the hardware sector generally refers to as "infant mortality", where your hardware fails early or becomes unreliable due to substandard components.

It took months for these effects to come out into the open and for the major US distributor to own up to this against the threat on our part of legal action. Not only did they replace all components with legitimate top grade parts, they also paid the costs involved in replacing the affected systems for our customers.

My guess is that the context lacking most, if not all, who disagree with my position perspective that comes from having "skin in the game" in the domain we are discussing.

The knee-jerk reaction is to think bricking these devices is bad for consumers, as if that would have been the end of the story. No, in a properly functioning economy and legal system this would and should lead to tracing through levels of responsibility as far as possible, with consumers being made whole with properly engineered and manufactured devices.

The end result of forcing FTDI to not protect their product from counterfeiters is that not one consumer today can be assured the devices they purchase has quality reliable parts that will function according to specifications. A chip can, quite literally, go up in flames (I had this happen to me with a cheap Chinese device) because we did not support FTDI in disallowing fake chips from the market.

Sure, there would have been short term pain and a bunch of companies and suppliers fixing their pipelines and designs. Yet, we would have emerged with an above-average guarantee of quality and performance and counterfeiters thinking real hard before doing what they do.

Instead the feedback we gave counterfeiters is "you win".

And the result we obtained for consumers is "you lose, forever".

This incident extends well past FTDI. Because the mob won and forced FTDI to accept fakes it now means nobody is going to take similar steps towards protecting their products. Which, in turn, means counterfeiters know they won and know they can get away with it. Consumers, once more, lose, big and in unknown ways.

We are swimming in a sea of fake products. The only way to stop this is if fake products become losing propositions for producers, suppliers, manufacturers and consumers.

I mentioned I had a chip go up in flames. A while back I bought a little humanoid robot directly from a vendor in China. One of these things with 15 to 20 servos and, typically, a mobile phone class processor powering it and the touch screen on the chest. I bought several of them as part of a business venture.

A couple of days after receiving them one of my kids was working with it on the table in the garage. As the robot walked, it failed to take a step and fell. It just planked onto the table, a 90 degree rotation from the toes, nothing too dramatic.

In an instant flames were shooting out of the chest. Flames, not smoke. Since we were in the garage it was an easy matter to open the door and toss the thing onto the driveway.

Upon inspection we found a crater at the center of the ARM processor on the main board. It failed and took a bunch of other parts with it.

I contacted the company and very specifically asked about the source of this processor. We were actually considering importing and modifying this robot in quantity for educational purposes. In other words, we had established an engineering relationship with this company, this wasn't a case of just another consumer buying their product.

They pretty much told me they bought the cheapest ARM processor clone they could source in China.

This was and was not a revelation to me. Having done business with China for some time, as well as having a number of friends and business acquaintances doing business in China, nothing surprises me any more.

The degree of supervision and cross checking you have to engage in when doing business with China is impossible for someone outside of manufacturing to grasp. It takes a lot of work to ensure safe products are landed in Europe and the US. When you deal with European or US companies this requirement almost disappears because you can generally trust they will deliver what they agreed to supply at the required level of quality.

Taking the case of this real product, this robot, as an example, it would have been far better if --through whatever mechanism-- the thing had been bricked by the processor manufacturer before it got into the hands of any consumer.

I cringe to think that this company likely sold tens of thousands of these units into homes and schools that could, due to fake chip issues and low component quality, go up in flames any time. We got lucky in that the robot ignited while we were there and under circumstances that were easy to control. This could have happened in the middle of the night and the story would have been potentially horrific.

Be careful to think that allowing consumers to be fed fake products of unknown quality and traceability equates to having a pro-consumer stance.

Due to this FTDI event it is likely consumers today have no clue what quality and safety has gone into the products they are using. This is not a good outcome. The right path would have been to take the pain of fixing the real problem and make consumers whole through both corporate responsibility and the legal system.

In other words, FTDI is a victim and consumers are now even larger victims because the fake chip content of their devices is likely to go well beyond a little USB chip. No way to know how far and wide this has gone. A clear case of good intentions actually causing more damage to consumers.

OK, I'm done. I don't expect to change anyone's mind. Just stating a perspective I think many don't have because they don't have practical experience at scale in the world of hardware manufacturing and support. If it makes even one person think this through, research and perhaps understand, I am satisfied.

Be tolerant of contrasting perspectives...you might just be wrong and not know it...or, even worse, one day you will be correct and the mob will dismiss you just as you have to others when you think you are right.

Tolerance is important. Don't punish, dismiss and ignore those who you do not agree with because one day that person could be you.

Now I wouldn't mind this nearly as much if I could get the shipping rate upfront but it seems 80%+ of sites won't give you a real rate until you have almost completed check out which takes a lot of time. The funny thing is if they have a phone number you sometimes can get them to ship it more reasonably if their system has the flexibility to do that.

This is where ebay is a godsend as a lot of sellers will have the odd part around and work at having cheap shipping. But it is caveat emptor.

I've never had any trouble getting individual parts from RS either.

Disclaimer: I only ordered full boards from them so shipping seemed reasonable. No idea about ordering one small capacitor.

You often just need to fill that form entry, and not have any sort of official company. Things like Self, or your name again will work just fine. I have a fake company name that one day I'll need to actually register, but in the mean time is used whenever someone is willing to take my money, but not provide service without a company name.

The envelope is of course another matter.

A recent change allows the USPS to increase rates for epacket. It looks like the new rates will go up slowly, so shipping from China will still be cheaper for packages under 3 ounces for a few years.

[1] https://www.ecomcrew.com/why-china-post-and-usps-are-killing...

So sellers pay for shipping, which is cheap, then gets subsidy, then there’s delay between Buy Now and actual transfers and financing to compensate it, those supposedly all add up and turn profits.

Digi-Key on the other hand probably has employee pension plans and that would be as far they go in terms of global financial investment techniques, so...

So far I've seen a ton of fake audio op-amps.

For discrete parts like transistors things are much simpler. Just build a simple test rig and test a few parameters. If they fall within the specs they're probably good enough. Of course it's not worth it to do this for jellybeans like 2N3904, but when some parts get obsoleted without a replacement (or they're too pricey) there isn't much else a lone hobbyist can do.

I'm Canadian, and last I checked, the shipping costs to get parts from places like digikey was just ridiculous.

Then you pot the sensor with something thermally conductive and waterproof - waterproof potting compound is cheap (e.g. "RS PRO White Epoxy Potting Compound"). Finally heatshrink the outside.

You will never beat China prices, but this is one of those parts that's relatively easy to make yourself and shouldn't cost a fortune. The most expensive stuff is the epoxy, but it will last for a while.

Purely on performance, does it matter? If it doesn't matter if you're off by a degree or two, then the cheap versions will be OK. If you need the guarantee of a genuine sensor, or a different cable length, or whatever, it'll cost about $20 for five.

At least that was my experience 8 or so years ago when I made the mistake of purchasing a lot of 100 MAX7219 off eBay for $100 shipped from China...$1/ea was such a tempting deal to a younger, more naive self when these chips were selling for upwards of $7/ea from ECIA-authorized distributors at the time.

Never fell for that trap again.

You'd pay a pretty penny for things and support local/national businesses. Now, you're funneling fuel into the dragon's mouth. For what? A hobby project? Just spend the $7 shipping and get it from Digikey.

Also check out RS Components Australia. They often offer free shipping with no minimums. https://au.rs-online.com/web/p/temperature-sensors-humidity-...

RS is also a good place to buy decent mechanical bits and pieces (bearings, drill bits, etc) if you don't want to play the lottery on Amazon. They even do their own 3D printing filament which I've had some good results with.

If you need small quantities (like one-of), you should look at sample requests. This is still alive and well - almost all the big manufacturers still honour them. I've gotten some $40 RTD digitising chips from Analog, micro-coax cables from Samtec and lots of random bits over the years. You may need a non-generic email address, but that's easy to sort.

For example you can sample the DS18B20 straight from Maxim: https://www.maximintegrated.com/en/products/sensors/DS18B20....

Yes? Because it usually does? If you test a bunch of fakes and they tend to be either basically accurate xor really inaccurate, and your project isn't super critical, why not? It's like unit testing; if you trust your tests, then any function which passes is probably fine to use. I wouldn't do it for something mission-critical, but for fun hobby stuff I probably would.

Long 1-wire networks are notoriously unreliable [1]. Something that works fine today can stop working tomorrow. That doesn't mean that they shouldn't be used anywhere. They have their niche.

If I want my heating system monitor to report temperatures once per hour and it takes me 5 tries and 10 seconds to read a sensor, I call it good enough. If monitor doesn't succeed after 20 retries, it sends an alert to replace the sensor (so far that only happened due to damaged wiring, not the sensor itself).

It is possible (and quite fun) to build reliable systems using somewhat reliable components :)

[1] https://www.maximintegrated.com/en/design/technical-document...

And sure enough that happens about 1/3 of the time regardless of equipment or facility.

So "just doesn't feel right" is something that absolutely happens in the real world. Not taking that into account is sloppy engineering

Probably he is right though, but to me it reads like the conclusion is the premise. (Might be due to the writeup though)

Edit: here is my bone: it says: how do I know? If the ROM does not follow the pattern 28-xx-xx-xx-xx-00-00-xx then the DS18B20 sensor is a clone [5]. And here I would have expected [5] to be the datasheet or something, but not 'own research'. The idea of citations is also to make your claims more verifiable.

Now, if we look at the Datasheet: https://datasheets.maximintegrated.com/en/ds/DS18B20.pdf it actually says:"The least significant 8 bits of the ROM code contain the DS18B20’s 1-Wire family code: 28h. The next 48 bits contain a unique serial number. The most significant 8 bits contain a cyclic redundancy check (CRC) byte that is calculated from the first 56 bits of the ROM code. A detailed explanation of the CRC bits is provided in the CRC Generation section." So the 28 is required. The '00-00' part is ust the higher bits of the unique serial number.

I wouldnt be surprised if different factories get different higher bits.