Digikey programming service idiocy - Page 1
Forum section: electronics / general

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: January 13, 2017, 05:52:27 pm
content: So I had a vague memory of seeing that Digikey offered a device programming service, but could find no trace of it on their website exceptthis 2012 videoSubsequently discovered that the product page on the US site indicates availability of programming on a product page, but not on the UK site.Transpires that the reason is that they believe that as they are "customising" the part, they need a custom export control classifiction for it ( and presumably again every time you change the code).Are US export regs really that retarded or are they misinterpreting them ?

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: January 13, 2017, 06:01:18 pm
content: And a quick skim of the Export control site suggests that only US companies can apply...

author: donotdespisethesnake
author_rank: Super Contributor
timestamp: January 13, 2017, 09:31:10 pm
content: Quote from: mikeselectricstuff on January 13, 2017, 05:52:27 pmYes, blame the US govt, not Digikey. If a company doesn't follow the rules, they get fined and subject to very close scrutiny for a year or so, which is a major hassle (seen it happen to a company I worked for).

author: CJay
author_rank: Super Contributor
timestamp: January 13, 2017, 09:38:49 pm
content: Pretty sure Farnell also offered that service at one time, would it be worth contacting them I wonder?

author: imidis
author_rank: Frequent Contributor
timestamp: January 13, 2017, 10:15:22 pm
content: I would believe it, I downloaded some TI stuff and they require some sort of silly agreement for the software. It's all nutty.

author: Monkeh
author_rank: Super Contributor
timestamp: January 13, 2017, 10:16:36 pm
content: Quote from: imidis on January 13, 2017, 10:15:22 pmIf I were exporting software from the US for the purpose of developing weapons of mass destruction I'd be certain to tick 'yes' to that question.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: January 13, 2017, 10:32:11 pm
content: It sort of implies that any company exporting any software from the US needs an ECCN...Or is there a generic ECCN for "non-controlled" software, in which case all DK would need is a declaration that the programmed code calls into that category, in the same way as they ask the export questions at checkout.

author: jpanhalt
author_rank: Super Contributor
timestamp: January 13, 2017, 10:34:13 pm
content: Being in the American Midwest, I am puzzled why you have not approached distributors in the EU for the same service?

author: ajb
author_rank: Super Contributor
timestamp: January 13, 2017, 10:39:28 pm
content: Quote from: mikeselectricstuff on January 13, 2017, 05:52:27 pm"retarded" is debatable. But they are extensive and difficult for the uninitiated to navigate for sure.QuoteNo, I think they are following the letter of the law in order to cover their own asses.The ECCN is simply an identifier for the particular box the BIS puts the exported item in for the purposes of export controls. If the ECCN is all that you need to supply to Digikey, then it's "simply" a matter of wading through hundreds of pages of categorization descriptions to figure out which ones apply to your software. The good news is, you should be able to skim the index and narrow it down to ~20-50 pages that require close reading. It will be *very* close reading, though, because it's a lot of "items that have A property except those covered by category B unless they also have property C or are D, E, F, or G and not property H", where A-H are very specific technical properties of the sort of device in question. It's a slog, but doable. It is possible for an item to fall under multiple ECCNs, in which case generally the most restrictive one is used for determining applicable controls--which vary depending on the destination country.Quote from: mikeselectricstuff on January 13, 2017, 10:32:11 pmANYTHING exported from the US requires an ECCN. For standard components, Digikey presumably already have ECCNs on file for everything, so it's normally transparent for you. Also, the UK is presumably one of the most permissive controls as far as US->UK exports, so you're less likely to hit a snag.QuoteIIRC, if the item does not fall under a specific ECCN, it's considered EAR99.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: January 13, 2017, 11:34:33 pm
content: Quote from: jpanhalt on January 13, 2017, 10:34:13 pmWhenever I've enquired in the past it's been crazy expensive ( like more than the cost of the chip) - was enquiring with DK as their video shows big auto-loading machines which means they may be able to do it cheaper.I was initlally looking at using PIC10F322 which Microchip will program, tape and mark for 4p, but noticed that Attiny5 is half the cost, but Microchip don't yet offer programming on it.I wonder if there is an ECCN for "General purpose bootloader", which is all it needs to contain.

author: chicken
author_rank: Frequent Contributor
timestamp: January 14, 2017, 02:08:19 am
content: Classification is not that granular. For software the decision tree is something like:- does it contain cryptography? If no, EAR99- if yes, classify according to type, strength, purpose of crypto and whether users can change itA programmed IC also includes the capabilities of the chip, so you have to consider that as well to determine classification. Atmel classifies the ATTINY5 as EAR99, so if your bootloader doesn't use encryption, EAR99 for the programmed chip is probably appropriate.

author: DimitriP
author_rank: Super Contributor
timestamp: January 14, 2017, 03:12:54 am
content: That's only half the fun. The other half is the "custom programming fee" or whatever they call it this week.

author: kaz911
author_rank: Super Contributor
timestamp: January 14, 2017, 08:47:20 am
content: Hi Mike,have you tried MicroChip directly?http://www.microchipdirect.com/- then click on PROGRAMMING header on top - there is even an online quote system based on chip. The PIC32's i looked at - programming charge was 16 USD cent in 500 quantity - plus the cost of the chip at $1.5-$2. They have other fee's but I have no idea if they are applicablemandatory or ...

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: January 14, 2017, 11:21:25 am
content: Quote from: kaz911 on January 14, 2017, 08:47:20 amLike I said, they don't yet support the former Atmel parts, and they are saying it could be months before they do.This job could use a 10F322, but Attiny 5 is half the cost, but only if I can get it programmed at a comparable price. Part cost is an issue as there will be many hundreds on one board.

author: imidis
author_rank: Frequent Contributor
timestamp: January 14, 2017, 11:31:23 am
content: Quote from: Monkeh on January 13, 2017, 10:16:36 pmWhat, they expect you to tell the truth on those things?

author: newbrain
author_rank: Super Contributor
timestamp: January 14, 2017, 03:12:18 pm
content: Quote from: imidis on January 14, 2017, 11:31:23 amNo, but then they have one more charge to throw at you: making WMDandrunning afoul of the custom regulation...remember Al Capone.I work in a large international corporation, and checking US rules for SW import/export take a good deal of time when we release SW or change the used open source part of our products.We also need to state the amount of code that has been produced in the USA, as this affects the rules for the included crypto (IIRC).

author: Howardlong
author_rank: Super Contributor
timestamp: January 14, 2017, 03:46:19 pm
content: Which is at least part of the reason why Microchip, a US company, offshores their convenient chip programming services to Thailand. Thus the blunt legislation designed to prevent such nefarious activities happening doesn't work, and ends up instead simply exporting jobs.

author: HwAoRrDk
author_rank: Super Contributor
timestamp: January 14, 2017, 04:42:34 pm
content: US export regulations for software are such a pain.Reminds me of the time I was dealing with getting an iPhone app published to the iTunes store for a previous employer. Because Apple are deemed to be the ones publishing the software, it is deemed to be being exported out of the USA even if you're only listing the app in your own country.And of course there's the crypto nonsense. As far as I could determine, because our app contained code to perform SHA1 hashing, according to the rules we should have answered 'yes' to the 'does this app contain crypto?' question; but, all advice I could find on the subject said, for our case, to just answer 'no' to make things simpler and avoid a headache.

author: ajb
author_rank: Super Contributor
timestamp: January 14, 2017, 05:24:59 pm
content: Quote from: imidis on January 14, 2017, 11:31:23 amIt's more that they expect the company doing the exporting to be accurate and honest, because the regulations put the onus on the exporter to ensure that the items are not exported in violation of export controls. Which makes sense, because there's not much the US government can do to keep people in other countries from trying to import whatever they want, but they can sure as hell levy massive fines and criminal penalties against US companies that export a controlled item improperly. Obviously in this case the software is originating from outside the US, so it's a pointless step, but one that Digikey is still obligated to carry out. Of course it also defeats the purpose to have the importer provide the ECCN, but presumably their lawyers have decided that's good enough to cover their asses at least, and it's not like they have any other option for classifying the firmware (short of disassembling and reverse engineering the binary you send them...).

author: BrianHG
author_rank: Super Contributor
timestamp: January 14, 2017, 07:17:31 pm
content: Quote from: HwAoRrDk on January 14, 2017, 04:42:34 pmOMG, are you saying if I, here in Canada, make an iTunes playlist manager to be made available on the iTunes store, my product may be removed if I use any type of protection scheme on my library files, which are changed and updated every other day. I meany I would have to fill out a new form every single day of the year. How on earth can I survive on a product which has daily updates?

author: tszaboo
author_rank: Super Contributor
timestamp: January 14, 2017, 08:32:47 pm
content: Quote from: mikeselectricstuff on January 13, 2017, 05:52:27 pmOnce I got a mail from them, that they are very sorry, but they cannot ship me a certain ST part, because export regulation. ST is a company, which has the R&D and manufacturing in Italy and France. So the americans are really that ignorant, that they cannot sendbacka part to the european union, because the part can be used to, IDK, make the death star.

author: HwAoRrDk
author_rank: Super Contributor
timestamp: January 14, 2017, 09:02:12 pm
content: Quote from: BrianHG on January 14, 2017, 07:17:31 pmI don't think it applies to data files provided with an iOS app (or later downloaded by some kind of update mechanism) that happen to be encrypted, only to the code within the app itself that does any encryption/decryption. But don't take my word for it, as this was a few years ago and I never dug too deep into all the small print.More info here:https://itunespartner.apple.com/en/apps/faq/Managing Your Apps_Trade ComplianceSeems they've relaxed the rules a bit recently. Now you get an exception if you're simply using OS-provided APIs to do crypto or are only doing HTTPS, and in those cases only need to fill out some kind of annual self-classification report, rather than needing explicit export approval from the US government.

author: james_s
author_rank: Super Contributor
timestamp: January 22, 2017, 08:41:50 pm
content: Quote from: NANDBlog on January 14, 2017, 08:32:47 pmThis is what happens when you get legislators who do not understand technology writing laws that attempt to legislate technology. Most of us here in the US roll our eyes about it too. Politicians tend to live in their own little bubble.

author: David Hess
author_rank: Super Contributor
timestamp: January 22, 2017, 10:14:52 pm
content: Quote from: HwAoRrDk on January 14, 2017, 09:02:12 pmThey would prefer the use of the OS provided encryption APIs which are more effectively compromised by the US government.Quote from: james_s on January 22, 2017, 08:41:50 pmSomeone understands it. After the Clipper chip fiasco for controlling domestic encryption, the NSA and other US government agencies stepped up efforts to "discourage" the use of strong cryptography domestically and by foreign entities. One aspect of this is using export controls which are difficult to impossible to challenge in court.

author: Howardlong
author_rank: Super Contributor
timestamp: January 23, 2017, 09:59:09 am
content: Quote from: HwAoRrDk on January 14, 2017, 09:02:12 pmI wonder if this is one reason (among others) why IoT devices have a reputation for bad security?

author: David Hess
author_rank: Super Contributor
timestamp: January 23, 2017, 02:23:57 pm
content: Quote from: Howardlong on January 23, 2017, 09:59:09 amI does not help but I doubt this is the major reason. There is just no profit to be had developing good IoT security.

author: Bakunin
author_rank: Contributor
timestamp: January 27, 2017, 04:21:16 am
content: Quote from: Monkeh on January 13, 2017, 10:16:36 pmOfftopic, but I recall once having to fill in an entry questionnaire when traveling to the US and they asked, among other things, whether I've ever been a member of the National Socialist Party of Germany or participated in the Holocaust. I found the implication that the Germans are such a law-abiding people they'd be inherently compelled to answer truthfully rather humourous. Why yes, I *did* commit unspeakable atrocities but lying on a questionnaire is a step too far even for me! I must draw zee lein somewhere! The ironic bit is that the OSS (forerunner to the CIA) resettled Nazis in the US and Canada in droves. IIRC, they also asked whether I was traveling to the US with the intention of committing polygamy. I wasn't before they asked, I thought to myself, not so sure now..