My guess is that Adafruit tried flux.ai, noticed a server misconfiguration, contacted flux about it, and then received a cease and desist to prevent them disclosing the vulnerability publicly.
(AFAICT they haven't published anything yet? If they have it's been taken down).
There's a definite bit of Streisand effect here because I for one am very much looking forward to finding out what the deal is.
Note that this is not related to Black Forest Labs Flux, the image synthesis models builders, and is instead related to a PCB AI authoring product called Flux.ai.
"solution" is an interesting choice. I haven't talked to anyone who tried it and actually got anything useful. It completely failed when I tried using it.
Flux just got funding from Bain and others, and it feels like Adafruit was preparing a post about it. Maybe they contacted Flux to confirm some info and they freaked out?
I can't find in archive.org if they had a previous post about it.
Also, seems like there a good bunch of complains in Reddit about Flux and its billing...
Adafruit probably did a review of AI PCB tools. I've used Flux.ai before; it was a pretty bad experience. After about 50-100$ in tokens a couple of times, I couldn't get more than a couple of simple components on the schematic. And not in sensible positions.
The product just grinds tokens for little return, in my opinion. I had far better luck wiring together KiCad MCP, SKIDL. There are some AI-driven autorouters out there now. Placement is probably the big issue that needs to be solved now. I could only get about 80% of what I wanted together with my hacky workflow.
As an electrical engineer who has tried to use it multiple times, I think Flux is an absolutely awful product. No surprise at all that they want to sweep details about their “intellectual property, commercial traction and user base” under the rug.
>The letter further asserts claims under the Computer Fraud and Abuse Act. Adafruit accessed only information that Flux’s own systems made publicly available through a server misconfiguration
Never heard of Flux.ai before. It seems to be a 3D circuit designer with 'AI'.
Not sure what the issue between them and Adafruit is.
However, people over on Reddit¹ claim that Flux.ai is a little bit scummy. They push users into a beginner trial ($5/month) and then silently charge for usage per token - up to $100 per month.
Oh, they also claim that they have "the world's largest community-driven public library of Adafruit products, including footprints, symbols, datasheets, and simulation models"². I wonder whether they designed these themselves or whether they use existing ones. Could not easily find licenses info.
> Oh, they also claim that they have "the world's largest community-driven public library of Adafruit products, including footprints, symbols, datasheets, and simulation models"². I wonder whether they designed these themselves or whether they use existing ones. Could not easily find licenses info.
Their PCB designs are mostly CC Attribution-ShareAlike typically.
What's funny is that most Adafruit products aren't exactly secret. Most of them have open source schematics and PCB layouts. Even when they aren't, they pretty much just a reference design from a data sheet. The kind of people that have the competence to be using board design software could replicate their designs pretty easily.
When you discover an exploit, only communicate with source (and pray they respond) or get sued. Seems like the position is customers and stakeholders shouldn't be allowed access to this information.
Can we see the content of the demand letter? It should have been linked to your post. It's difficult for us to evaluate the merits of their allegations otherwise.
Why do we tolerate this bullying and misconduct from companies that harms us and progress overall? Is there really no solution in this day and age for harmful behavior and aggression and hostility like what it looks like Flux is doing here? I can't believe we don't have an answer, I think it's just that the bad guys are drowning us in noise and making it hard for us to identify the solutions where we band together a la David v Goliath against them.
> Adafruit accessed only information that Flux’s own systems made publicly available through a server misconfiguration
Does anyone have some more context about what happened here? An uncharitable analogy might be that I misconfigured my front door by not locking it, which doesn't give someone the right to walk in and look around - but I have no idea what Adafruit is specifically being accused of doing.
It often does when your front door is otherwise a business storefront. Without knowing the specifics of what was accessed, analogies really aren't helpful. And there seems to be zero context here, so this strikes me as the most plausible scenario: https://news.ycombinator.com/item?id=48368635
(I agree that Adafruit's statement itself is worded pretty terribly!)
what about if I knock on the door (send an http request), and someone comes to it and hands me a bunch of documents (sends an http response with data).
It certainly doesn't look like they've publicly released anything. My guess is they found a problem and have been following reasonable responsible disclosure guidelines. However, the 90 days (or whatever time limit was given) is likely expiring and to head off publication, flux.ai is getting lawyers involved.
This is all 100% speculation, just based on checking the archive sites and search sites historical data and finding nothing.
Whenever something like this comes up, I always think back to the excellent paper, "The Structure and Legal Interpretation of Computer Programs." I don't have a specific answer, but I like to review this paper whenever a question like this is posed.
I wanted to love flux.ai because i love codex... and if i could automate the creation of some PCB projects with as much success as I am with codex it would have been quiet fun in the shop... so i gave them a $100~ bucks and i got like nothing in return so I decided i'd wait and see... sounds like it has not improved.
68 comments
[ 1.8 ms ] story [ 65.9 ms ] thread(AFAICT they haven't published anything yet? If they have it's been taken down).
There's a definite bit of Streisand effect here because I for one am very much looking forward to finding out what the deal is.
Thank you, lawyers. If you ever find yourself out of work use this as your reference to pivot to advertisement
https://hpc-tutorials.llnl.gov/flux/
"solution" is an interesting choice. I haven't talked to anyone who tried it and actually got anything useful. It completely failed when I tried using it.
I can't find in archive.org if they had a previous post about it.
Also, seems like there a good bunch of complains in Reddit about Flux and its billing...
https://old.reddit.com/r/PCB/comments/1t476x4/warning_fluxai...
The product just grinds tokens for little return, in my opinion. I had far better luck wiring together KiCad MCP, SKIDL. There are some AI-driven autorouters out there now. Placement is probably the big issue that needs to be solved now. I could only get about 80% of what I wanted together with my hacky workflow.
A confession
Not sure what the issue between them and Adafruit is. However, people over on Reddit¹ claim that Flux.ai is a little bit scummy. They push users into a beginner trial ($5/month) and then silently charge for usage per token - up to $100 per month.
Oh, they also claim that they have "the world's largest community-driven public library of Adafruit products, including footprints, symbols, datasheets, and simulation models"². I wonder whether they designed these themselves or whether they use existing ones. Could not easily find licenses info.
¹) https://www.reddit.com/r/PCB/comments/18o5zfo/thoughts_on_fl...
²) https://www.flux.ai/sitemap/manufacturers/adafruit
Their PCB designs are mostly CC Attribution-ShareAlike typically.
What's funny is that most Adafruit products aren't exactly secret. Most of them have open source schematics and PCB layouts. Even when they aren't, they pretty much just a reference design from a data sheet. The kind of people that have the competence to be using board design software could replicate their designs pretty easily.
When you discover an exploit, only communicate with source (and pray they respond) or get sued. Seems like the position is customers and stakeholders shouldn't be allowed access to this information.
limor and i are very much looking forward to telling our story.
Seems especially useful when paired with an agentic coding tool!
1. Make a slop machine that's a wrapper around another slop machine like claude, openai, google or whatever.
2. Hire a lawyer to send threatening emails to anyone that might call you out.
3. Get a few investors that are completely clueless to throw a ton of cash at you for having ai in your product.
4. Profit.
Honestly, get a hold of Louis Rossmann, this shit needs to stop.
Does anyone have some more context about what happened here? An uncharitable analogy might be that I misconfigured my front door by not locking it, which doesn't give someone the right to walk in and look around - but I have no idea what Adafruit is specifically being accused of doing.
(I agree that Adafruit's statement itself is worded pretty terribly!)
This is all 100% speculation, just based on checking the archive sites and search sites historical data and finding nothing.
https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4445484