Adafruit Data Breach - Page 1
Forum section: electronics / general

author: EEVblog
author_rank: Unknown
timestamp: March 06, 2022, 05:27:08 am
content: Data breach at Adafruit, and they didn't inform anyone.https://blog.adafruit.com/2022/03/04/a-github-repository-was-public-viewable/Quote

author: EEVblog
author_rank: Unknown
timestamp: March 07, 2022, 06:11:45 am
content: FYI, Adafruit are blocking people on Twitter for mentioning this

author: Ed.Kloonk
author_rank: Super Contributor
timestamp: March 07, 2022, 06:30:53 am
content: Quote from: EEVblog on March 07, 2022, 06:11:45 amClassic shit show. I resisted commenting, but here we are.

author: hans
author_rank: Super Contributor
timestamp: March 07, 2022, 08:02:43 am
content: QuoteIt's always fun to pack up a contradiction with many words, hoping no one will notice.I'm actually more surprised a company wouldn't write the 2nd sentence the other way around. The last thing someone read will stick better.

author: madires
author_rank: Super Contributor
timestamp: March 07, 2022, 09:32:56 am
content: Quote from: EEVblog on March 07, 2022, 06:11:45 am... becauseQuoteWhat a bunch of hypocrites!

author: Ian.M
author_rank: Super Contributor
timestamp: March 07, 2022, 10:39:54 am
content: As GitHub doesn't log downloads or repository clone operations, Adafruit have no way of knowing if the data has been grabbed by 'black hats' and if the data is used for identity theft, it is extremely unlikely Adafruit would be aware.Their notice would be a lot more reassuring if it stated "All affected users have been notified", but it would seem that either they FUBARed the takedown and failed to capture the data set, or their lawyers advised an 'Ostridge' maneuver.

author: jpanhalt
author_rank: Super Contributor
timestamp: March 07, 2022, 11:02:20 am
content: The word "inadvertent" is sometimes used as it sounds better than mistake to some people. (Maybe they confuse it with unavoidable?) It was and maybe still is common for physicians to use it in hopes of avoiding a lawsuit. I found its copious use in that disclosure surprising.A corporate attorney where I once worked pointed out that in American law, "inadvertent" admits carelessness or inattentiveness, and thus can be better equated to "negligence." There are whole treatises written about such words.As others, I did find the "apology," if there was one, insincere.

author: magic
author_rank: Super Contributor
timestamp: March 07, 2022, 12:31:39 pm
content: Their first lie was associating themselves with the mythology of Ada Lovelace (whom I presume the name refers to), which consists in approximately 50% of hype made up by Boomer feminists from the United Satan of America. Don't stick your credit card in crazy seems to apply

author: eugene
author_rank: Frequent Contributor
timestamp: March 07, 2022, 02:07:39 pm
content: Remember when everyone's name, address, and phone number was leaked every year by the phone company?

author: madires
author_rank: Super Contributor
timestamp: March 07, 2022, 03:07:01 pm
content: Over here you can tick a box for more than 30 years to be not listed in any phone book. But the point is that the US have laws about notifiying victims of data breaches (https://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx).

author: eugene
author_rank: Frequent Contributor
timestamp: March 07, 2022, 04:54:19 pm
content: There's no question that Adafruit made more than one poor decision. The first and most serious one being that they used real customer data for training purposes.Me personally, I'm not too worried about the fact that one more bad guy has my phone number and email address. As for the strictly legal issues, meh. There's more to life that's not legislated than is.

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 07, 2022, 07:24:33 pm
content: Quote from: eugene on March 07, 2022, 04:54:19 pmUh yeah definitely. And the second is storing that on github.

author: floobydust
author_rank: Super Contributor
timestamp: March 07, 2022, 08:33:55 pm
content: Silence about a data breach- from a company that touts support for trans rights LGBTQ, BLM - movements that are necessarily outspoken, is just gross.Why they consulted with "our privacy lawyers and legal experts" but said nothing to customersI find Adafruit two-faced, if you suggest/complain/point out design mistakes, website issues, company policies that suck etc. it's usually met with silence or a defensive stance that they can do no wrong. Oh yeah, and just discontinue that dud product that makes us butthurt instead of fixing it with a Rev. 2It's like they use the Waterfall model to run the place, can't handle any feedback/criticism, even when constructive or 100% warranted.In electronics you are always getting it wrong.The best EE's admit their mistakes, eat some humble pie and it's no big deal, learn and move on.The worst EE's have their ego all in it and blame other things for the problems, they can't own it and spend their energy on containment.Blocking people on Twitter because we can't take any of our earned butthurt? Silence is a reason authoritarian regimes grow and get out of control, I can't believe the hypocrisy of neo-liberals.

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 07, 2022, 08:53:18 pm
content: While I knew there was some "politics" behind Adafruit, I've never really cared. What they have done was all in all not bad at all for hobbyists. But I admit their screw-up here probably comes from poor management, and their attitude regarding communication about it is pretty bad.

author: eti
author_rank: Super Contributor
timestamp: March 07, 2022, 09:23:37 pm
content: I don't shop at hipster "Maker" outlets, always get that cringe feeling which puts me right off, and I want no part of. And the sexual orientation BS is repellant, and puts me off even more. No sale, no way.

author: free_electron
author_rank: Super Contributor
timestamp: March 07, 2022, 09:24:08 pm
content: Why is data like that stored on GitHub to begin with ?

author: oPossum
author_rank: Super Contributor
timestamp: March 07, 2022, 10:09:15 pm
content: https://twitter.com/adafruit/status/1500834741041442817

author: eti
author_rank: Super Contributor
timestamp: March 07, 2022, 10:24:21 pm
content: Quote from: oPossum on March 07, 2022, 10:09:15 pmThat is worded in an incredibly childish tone -"We will try to earn your trust again"- is this company run by 11 year olds? It sounds like an "apology" made under duress, from a naughty child to his headmaster when his parents are called into the office.

author: thm_w
author_rank: Super Contributor
timestamp: March 07, 2022, 11:06:28 pm
content: Seems like a reasonable response to me.The blocking part I don't understand, but also seems to have been resolved:Quote

author: Sal Ammoniac
author_rank: Super Contributor
timestamp: March 07, 2022, 11:51:53 pm
content: Newly created repositories on Github are public by default. IMO new repositories should be private by default and the creator should have to tick the Public box to make them public, rather than the other way around. This sounds safer to me and is less likely to inadvertently divulge material that should never have been made public.

author: Sal Ammoniac
author_rank: Super Contributor
timestamp: March 07, 2022, 11:56:09 pm
content: Quote from: magic on March 07, 2022, 12:31:39 pmIf I had a name like Limor Fried I'd probably make up a silly name too.

author: thm_w
author_rank: Super Contributor
timestamp: March 08, 2022, 12:07:42 am
content: Quote from: Sal Ammoniac on March 07, 2022, 11:51:53 pmGitlab does this, unlimited private repos.I think Github used to charge for private repos, thats why they defaulted to everything being public.

author: Gregg
author_rank: Super Contributor
timestamp: March 08, 2022, 01:18:08 am
content: A classic case of "fruit" spoiling rather than maturing.

author: james_s
author_rank: Super Contributor
timestamp: March 08, 2022, 01:56:50 am
content: Quote from: eugene on March 07, 2022, 02:07:39 pmEven today it's nearly that available. The last time I met a girl I was thinking of going on a date with I googled the phone number she gave me just to see if it was legit or came up with anything sketchy. I was kind of shocked when one of the first links was a page that had her full name, address, when she bought her house and how much she paid for it, the names of family members, the name of the company she works for, the name of her ex, and various other stuff. Searching for myself pretty easily finds similar information except for my phone number. It's really kind of creepy how much information is out there now and how hard it is to prevent it from getting spread around.

author: xrunner
author_rank: Super Contributor
timestamp: March 08, 2022, 02:05:55 am
content: Quote from: james_s on March 08, 2022, 01:56:50 amI've still got free credit and identity theft monitoring resulting from a US government employee data breach, gosh it's been 15 years ago. I'll probably have it for ten more years last time I talked to them. Since then I've been in breaches from a credit reporting service and a big phone company breach not too long ago. Who knows how many others that are unknown.I figure by now any thief that wants to go after me can get my records at will. I just hope that because of the sheer numbers of records out there I'll slip by.

author: amyk
author_rank: Super Contributor
timestamp: March 08, 2022, 02:35:06 am
content: Quote from: eti on March 07, 2022, 09:23:37 pmWhen I first looked at AF, the first thing that put me off was the price. They're just sourcing from China like everyone else.

author: floobydust
author_rank: Super Contributor
timestamp: March 08, 2022, 02:53:20 am
content: No mention of the breach on theirforumsorblogor website.I'm glad Adafruit is clearing the air about this sorta on Twitter, what happened (breach) sounds like no biggie - but the way it was handled, not so great.I find their products are simply fun, and at least some creative energy and quality is in them compared to stuff straight out of Originality Central.

author: thm_w
author_rank: Super Contributor
timestamp: March 08, 2022, 10:34:44 pm
content: Quote from: amyk on March 08, 2022, 02:35:06 amuh...Quotehttps://www.adafruit.com/about

author: Sal Ammoniac
author_rank: Super Contributor
timestamp: March 08, 2022, 10:46:59 pm
content: Quote from: thm_w on March 08, 2022, 10:34:44 pmThey do provide one valuable service: they create breakout boards for ICs that are often small and hard to use on a breadboard and package the whole thing up along with documentation describing how to use them. This latter part is especially helpful when the original documentation from the vendor is written in horrible Chinglish. But, for the most part, their stuff is generally very expensive and I tend to order the raw parts directly from Digi-Key or Mouser instead. I agree with the hipster description!

author: EEVblog
author_rank: Unknown
timestamp: March 08, 2022, 11:12:08 pm
content: Quote from: thm_w on March 07, 2022, 11:06:28 pmSomeone blocked is actually disputing that though.I was blocked by Phil on his personal account, but that wasn't about this, now unblocked.He sent me proof that the Adafruit account no longer blocks anyone.

author: james_s
author_rank: Super Contributor
timestamp: March 09, 2022, 04:55:24 am
content: Quote from: Sal Ammoniac on March 08, 2022, 10:46:59 pmI've bought from them a couple of times when they had something I couldn't easily get somewhere else. I've also built a few of their designs myself using the provided gerbers. The real value they provide is as you mention here, the documentation and also source. I was trying to support them for that effort although I got really turned off when they got completely silly trying to ban words like master and slave in regards to SPI. That's just beyond stupid and I won't support the euphemism treadmill.

author: floobydust
author_rank: Super Contributor
timestamp: March 09, 2022, 06:26:12 am
content: They also have issue with using the terms male or female to describe connectors.

author: magic
author_rank: Super Contributor
timestamp: March 09, 2022, 06:51:07 am
content: What are they using instead, then?(Or maybe nothing at all - just look at the pictures, customer)

author: thm_w
author_rank: Super Contributor
timestamp: March 09, 2022, 10:11:48 pm
content: Quote from: magic on March 09, 2022, 06:51:07 amAdafruit are still using the terms "Male/Female" and "MOSI/MISO".Just on their site they choose to define MOSI as "Main output, secondary input". There is no "banning" of the word that I am aware of.As usual, people want to get their opinion across and won't let facts get in the way of it.

author: apelly
author_rank: Unknown
timestamp: March 09, 2022, 10:34:49 pm
content: Do we know the scale of this? Was it their whole database?

author: EEVblog
author_rank: Unknown
timestamp: March 09, 2022, 10:41:12 pm
content: Quote from: floobydust on March 08, 2022, 02:53:20 amIt is on their blog:https://blog.adafruit.com/2022/03/04/a-github-repository-was-public-viewable/

author: EEVblog
author_rank: Unknown
timestamp: March 09, 2022, 10:57:01 pm
content: Quote from: thm_w on March 09, 2022, 10:11:48 pmThey were quite vocal about it at the time, and have made changes:https://blog.adafruit.com/2021/06/01/adafruit-switching-default-branch-of-circuitpython-repositories-from-master-to-main/https://blog.adafruit.com/2021/06/24/controller-and-peripheral/and they have bloged about it oftenhttps://blog.adafruit.com/2020/06/22/replacing-master-slave-terms-in-music-technology-musicmonday/https://blog.adafruit.com/2021/06/12/micropython-updating-to-controller-peripheral/https://blog.adafruit.com/2021/05/04/python-cpython-the-python-programming-language-repository-migration-to-main-on-github/Just search "adafruit blog inclusive" or similar.IIRC they made a pledge somewhere to remove it all from the website and documentation, but it's still everywhere.And it's embedded into their CircuitPython code of conduct:https://docs.circuitpython.org/en/6.3.x/docs/design_guide.htmlQuote

author: thm_w
author_rank: Super Contributor
timestamp: March 09, 2022, 11:29:35 pm
content: OK fair enough, seems very extensive.If they start banning the use of it on their forums, comments, or twitter, then thats going to far.

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 10, 2022, 12:23:04 am
content: I don't like this "inclusive" politics stuff either (and I do think this is actually promoting division and segregation in the end rather than inclusion and peace, but this is another story), but at least they acknowledge this is politics they want to promote, and they state it clearly. Now everyone's free to get on board with that or not, or to ignore it or not. It's not hidden.

author: floobydust
author_rank: Super Contributor
timestamp: March 10, 2022, 01:47:01 am
content: As I remember it was a hassle looking for connectors. The usual search keywords were not working at that time, I'm assuming they also were affected.I just looked now and Adafruit is using plug/socket, or male/female in descriptions, and mixes up those up (hint: it's the pins not the housing) but at least you can search and find some parts (search results).

author: Monkeh
author_rank: Super Contributor
timestamp: March 10, 2022, 01:55:01 am
content: Is this a plug or a socket? Answers on a postcard.Can people just stop getting offended by nothing already?

author: apelly
author_rank: Unknown
timestamp: March 10, 2022, 03:05:25 am
content: Quote from: Monkeh on March 10, 2022, 01:55:01 amNice! A plug-in socket.

author: EEVblog
author_rank: Unknown
timestamp: March 10, 2022, 03:32:02 am
content: Quote from: Monkeh on March 10, 2022, 01:55:01 amNo, they can't. Unfortunately it's how modern society has programmed people to function. If you aren't offended by something then you are a victim of something, didn't you know?

author: apelly
author_rank: Unknown
timestamp: March 10, 2022, 03:52:50 am
content: Quote from: EEVblog on March 10, 2022, 03:32:02 amI imagine the entitleds in Ukraine have an updated perspective on such issues now. Maybe they can explain to their youthful counterparts who are lucky enough to be elsewhere. Oh, wait. Their new perspective. Hmmm...

author: Bud
author_rank: Super Contributor
timestamp: March 10, 2022, 04:34:11 am
content: Quote from: apelly on March 10, 2022, 03:05:25 amAmphenol was prepared decades ago !

author: johnboxall
author_rank: Unknown
timestamp: March 10, 2022, 05:13:40 am
content: Quote from: thm_w on March 08, 2022, 10:34:44 pmThey still get a lot of stuff from China, can't blame them at all.E.g.:https://imgur.com/a/7bgsAPB

author: james_s
author_rank: Super Contributor
timestamp: March 10, 2022, 08:26:05 am
content: Quote from: thm_w on March 09, 2022, 10:11:48 pmWell if you want to argue semantics..."Main output, secondary input" is not what MOSI means, it's just made up bullshit to be politically correct. Everyone knows it's Master out, Slave in, so were the words "master" and "slave" banned or were they just changed? What is the difference?

author: bitwelder
author_rank: Super Contributor
timestamp: March 10, 2022, 09:11:51 am
content: Quote from: Bud on March 10, 2022, 04:34:11 amWell, there are also the infamous RP-SMA connectors (or any other RP- abomination)

author: Ian.M
author_rank: Super Contributor
timestamp: March 10, 2022, 09:41:26 am
content: Lets *NOT* repeat the 71 page 2020 great 'woke' master Slave debate:https://www.eevblog.com/forum/chat/master-and-slave-tech-terms-face-scrutiny-amid-anti-racism-efforts/

author: magic
author_rank: Super Contributor
timestamp: March 10, 2022, 09:46:32 am
content: There is one thing the SJWs actually get right: if they don't want to bring attention to something, they speak about it in code words and don't post links to it(Meanwhile, somebody is bumping the old thread in 3... 2... 1...)I also appreciate that I can be passive-aggressive to them simply by using standard industry language, I like it

author: Ian.M
author_rank: Super Contributor
timestamp: March 10, 2022, 09:58:48 am
content: Well, if people are going to stir the sh1t, best send them to the manure heap!The whole movement stinks ofnewspeak, which would be mighty convenient for the American political and economic oligarchy, who seem determined to reduce their workforce to little better than indentured servitude.

author: newbrain
author_rank: Super Contributor
timestamp: March 10, 2022, 10:08:32 am
content: Quote from: james_s on March 08, 2022, 01:56:50 amIn Sweden, there are free services likehttps://hitta.se, just type a name and you'll get address, age and birthday, apartment/house size, who they live with and sometimes phone number - no data on minors, I think.Rather creepy, but legal AFAIK.

author: magic
author_rank: Super Contributor
timestamp: March 10, 2022, 12:53:40 pm
content: At least somebody is thinking of the childrenHow is it not a violation of all that newfangled GDPR stuff?

author: thm_w
author_rank: Super Contributor
timestamp: March 10, 2022, 10:09:13 pm
content: Quote from: james_s on March 10, 2022, 08:26:05 amQuoteThey aren't banning it anywhere on their forums or comments, that I am aware of. You could say banned internal use though.Its their own private business, if they decide to call a banana a vegetable, they are entirely entitled to do so, regardless of how wrong or stupid it is. Hell they could require their employees to all dress up as elves during work.

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 10, 2022, 11:52:16 pm
content: Quote from: magic on March 10, 2022, 12:53:40 pmGPDR is mainly a smoke screen.I don't think it prevents web sites from holding personal data whatsoever. It mainly forces sites to allow people to have access to their own data if there is any, and to get it deleted if they so ask. But as long as nobody asks anything, I think they can do almost whatever they please. Of course, please correct me if I'm wrong about GPDR.

author: james_s
author_rank: Super Contributor
timestamp: March 11, 2022, 04:53:51 am
content: Quote from: thm_w on March 10, 2022, 10:09:13 pmSure, and they have absolutely every right to do that if they want, just like I have the right to roll my eyes, think it's stupid and consider shopping elsewhere. Not saying I would never buy from them over that, but it sure doesn't do anything to encourage me to support them.