Back

Adafruit Receives Demand Letter from Fenwick Legal Counsel on Behalf of Flux.ai

405 points7 hoursblog.adafruit.com
karmicthreat5 hours ago

Adafruit probably did a review of AI PCB tools. I've used Flux.ai before; it was a pretty bad experience. After about 50-100$ in tokens a couple of times, I couldn't get more than a couple of simple components on the schematic. And not in sensible positions.

The product just grinds tokens for little return, in my opinion. I had far better luck wiring together KiCad MCP, SKIDL. There are some AI-driven autorouters out there now. Placement is probably the big issue that needs to be solved now. I could only get about 80% of what I wanted together with my hacky workflow.

inshane3 hours ago

This is exactly my experience, wasted $60 trying to get it to make something. The founder sent an automated AI email about setting up a time to meet and go through it then ghosted me at the meeting time.

pjc505 hours ago

> There are some AI-driven autorouters out there now. Placement is probably the big issue that needs to be solved now.

Interesting that within an IC this is basically "solved", or at least properly automated with classical numeric techniques such as simulated annealing.

I would have thought there's a big opportunity in a mixed-technique approach, where you use AI to extract unstructured data from datasheets and then feed it into more deterministic tools.

I also note that it's very easy to waste more than $100 in electronics once you start actually manufacturing bad PCBs.

doubled1124 hours ago

> mixed-technique approach

I think my biggest annoyance with the way we rolled out AI is that nobody seemed to want to use it to augment already working solutions.

Just throw everything out and have an LLM do it instead.

neutronicus3 hours ago

I've been frustrated with Copilot in this regard.

I work on a large C++ codebase, with large files. Human developers jump around between files with the Visual Studio fuzzy search, set breakpoints to trace execution in the Debugger, use the IDE's refactoring tools.

Microsoft's answer to this was to just ... expose none of this to their Agent Mode!? Replace the working semantic autocomplete with fucking lies!?

Maybe it's changed, I haven't been paying that much attention after bouncing off of this. I've gotten mild acceleration from using gptel-mode in emacs, manually adding references to context, and having models do various mechanical transformations on code. And I've even had some limited success writing tools for it to do LSP lookups.

+1
xnorswap3 hours ago
+1
hamburglar3 hours ago
vablings2 hours ago

tool_call is just a fancy wrapper to a black box that executes console commands. Said commands are now the actual backbone of all agentic AI, It feels like the linux people are incredibly vindicated in the single responsibility principle

NateEag4 hours ago

I recently saw a Claude skill that used Claude, with no tools, as a spell checker.

I wanted to hurl my laptop out to the window.

julianlam23 minutes ago

This type of laziness isn't novel.

Check out left pad or the two dozen other "utility" packages that could be done in a single line of code.

mattkrause1 hour ago

Isn't this pretty much why language models were invented?

Pasting something directly into the chat interface seems weird, but if you could somehow just see where P(token | context) falls off a cliff, that's a pretty good hint that your writing has problem.

gedy3 hours ago

I swear that so many AI usecases I see are: "I did not have the skill or realize that you can write a program for this obvious logic".

I guess that works if you aren't a programmer or don't want to hire somebody, but then wtf would I pay for your service or product?

+5
kangalioo3 hours ago
ACCount3759 minutes ago

Way too much engineering effort to make something that might get leapfrogged by the next gen LLM.

It's a tantalizing thing, but far too treacherous to actually go for it, most of the time.

intrasight43 minutes ago

There are many domains where a hybrid of numeric and AI approaches would make sense. For example in those domains where there's already a rich practice of numeric tools such as with IC layout.

ahartmetz4 hours ago

Something something bitter lesson blah blah

I think the bitter lesson is severely misapplied in the current situation: If progress from "just add more resources" is very slow, and a huge amount of money is at stake, continous work on hand-engineering can give a continuous and very valuable competitive advantage.

The labs all seem to be going for AGI through bigger LLMs, and I am reasonably sure that it's not going to happen like that.

irthomasthomas2 hours ago

> The labs all seem to be going for AGI through bigger LLMs

I don't know if this is still the case. Labs like anthropic and openai are spending a huge amount of their time on custom model wrappers. Something which they used to leave to their customers.

PyWoody3 hours ago

A few days ago someone on HN commented that a teammate uses Claude to search for text in files on their own computer. Buddy... There's Command-line Tools Can Be 235x Faster Than Your Hadoop Cluster and then there's Command-line Tools Can Be ∞ Faster Than Your AI.

dylan6041 hour ago

As snark, I've been using the phrase "ask GPT about it" for things that clearly do not need an LLM to be involved. The other day, I was on a zoom call and said it, only to see the present actually doing it. I hope my unmuted laugh wasn't too distracting.

ajross3 hours ago

> nobody [wants to use AI] to augment already working solutions

Plenty of people do, but that only produces a blog post that will get you to the front page of HN. If you want VCs to drop $40M on your head, you need to pretend to reinvent the world.

Then, to further appease the rain gods, you need to sue the bloggers on the front page of HN who are challenging your world-changing narrative. Which will, heh, drop you on the front page of HN.

Our community is, literally, eating itself at this point. There was a time when we actually took "make something people want" literally. Now it's just part of the fiction.

monuszero2 hours ago

That precise mixed technique approach has worked well for me. I’ve been using JITX (python based circuit design with a powerful auto router). Free for personal use, and has been discussed a few times here in HN.

Edit: it’s almost assumed at this point but for completeness Claude / Codex were the ones driving the OO python code and datasheet research and parsing.

https://www.jitx.com/

PaulHoule2 hours ago

Until a few years ago it was generally understood that useful "creativity" involves solving problems within constraints, e.g. something a lot like SAT or SMT in spirit even if not in the details.

Then we got LLMs which will make a good parody of anything and occasionally get it right.

kevin_thibedeau2 hours ago

Within an IC you don't have large obstructions for metal layers, distances are short, and buffers can be inserted at will to manage SI.

pjc501 hour ago

It has been about 20 years since I worked on this (clock gating and clock buffering), but ..

> distances are short

I remember we had a catastrophic error for "wire longer than 2cm".

> and buffers can be inserted at will to manage SI.

Effective buffering of large nets was a massive pain. Areas where you want to buffer are inevitably areas with a very high level of placement congestion. So you push some cells out of the way to add a buffer. That ends up worsening their timing. So they need a bit more sizing/buffering. Rinse and repeat for a few hours.

( https://web.archive.org/web/20071028033035/http://www.edn.co... ; long since absorbed into Cadence)

CorrectHorseBat3 hours ago

It is far from solved in IC, synthesis tools sometimes still do really stupid things and there's still quite a lot of hand-holding required to get to a working chip.

Arodex2 hours ago

And LLM are even stupider and need even more hand-holding

The right use of AI would be to use it to create a better routing/synthesis tool, but that's not what is being worked on

embedding-shape5 hours ago

> After about 50-100$ in tokens a couple of times, I couldn't get more than a couple of simple components on the schematic.

Is this common? When I try out new AI tools, even as person who is financially independent, I load up maybe 10-20 USD worth of tokens, and if I don't get anything working from that, I literally give up and don't continue trying. If it can't do anything useful like "place a simple component on the schematic" after ~10 USD of expenditure, is it really worth continue adding more money into the platform? Seems DOA in those cases.

karmicthreat5 hours ago

I used company money on it. I was hoping I could massage it along enough to get a workable test fixture out of it. I wanted to put together a simple hardware-in-the-loop tester for a component of our product.

phs318u3 hours ago

Someone should’ve told these guys: https://news.ycombinator.com/item?id=48337328

StephenSmith5 hours ago

I tried this last week and had the same experience. It was terrible and they got $140 out of me before I realized what it was (not) capable of. Their support was nonexistent as well.

moron4hire4 hours ago

All of these Gen AI tools where you pay a subscription fee are basically Software-as-a-Casino. You spin the wheel and hope it doesn't come up 00, then chase good money after bad when it does. Add in the parasocial relationship that some people develop with the LLM and you basically have OnlyFans but instead of vaguely dissatisfying feet pics to order it's vaguely dissatisfying code to order. It's that edge of "almost there, just one more token, bro" that makes it addictive.

Lerc4 hours ago

That might be the right analogy except it is not clear that it is a house always wins situation.

If you have a .6 chance of success on any particular outcome. Long term win or loss is down to your behaviour. If you double or nothing every time loss is guaranteed. The right strategy will win over the long term.

+4
moron4hire3 hours ago
mapontosevenths5 hours ago

> I could only get about 80% of what I wanted together with my hacky workflow.

I literally did this yesterday with solid results using Codex CLI. I used xhigh thinking and gpt 5.5.

I had it use KiCad directly via cli rather than via MCP, and I did make Claude Opus review it's work after every round. I got what I think will be a working revision A in about 10 hours of tinkering spread over a few days.

nathanielks2 hours ago

Is 10 hours a short amount of time for designing a PCB?

markrages1 hour ago

Faster than some, slower than some.

PCBs come in all different levels of complexity.

phlipski1 hour ago

[dead]

ElFitz5 hours ago

> Placement is probably the big issue that needs to be solved now.

Would some sort of constraint-solving algorithm help with that? Something like (but not necessarily) Cassowary[0]? Maybe I'm misunderstanding what is meant by placement though; I don't have much domain knowledge in PCBs / electronics.

[0]: https://news.ycombinator.com/item?id=43362528

lambdaone4 hours ago

I've written my own autoplacer/autorouter. Placement is where you put the components on the board, routing is how you shape the traces to interconnect them.

It does a pretty decent job on small hobby-project boards of ~40 components (which is my use case at the moment), and I'm working part-time in the background on scaling it further.

The resulting designs pass all the KiCad electrical and geometry checks. Granted, I've spent about a year working on this problem, and it's hard, but not that hard a problem, providing you can avoid falling off the exponential cliff by decomposing it into hierarchical subproblems.

Quick-and-dirty unsupervised whole-board synthesis from schematic takes about 5 minutes, longer if you want cleaner output with nicer-looking better-routed traces.

As others here have said, placing is the real problem to solve, and that's where the magic happens. Place the components right, and routing is a relatively easy loosely-coupled constraint programming problem, place them wrongly, and you will have to get used to seeing the word UNFEASIBLE in your log output.

throwaway20373 hours ago

This project sounds very cool. Is it open source? If yes, can you share a link to the repo?

inshane5 hours ago

As an electrical engineer who has tried to use it multiple times, I think Flux is an absolutely awful product. No surprise at all that they want to sweep details about their “intellectual property, commercial traction and user base” under the rug.

cryo324 hours ago

Yeah this stuff isn't even realistic as well.

A number of years ago I was working on something professionally and there was a problem. Only about 1 in 5 boards assembled wouldn't crash the CPU. After much debugging it turned out one of the ICs had an open collector output and it wasn't loaded correctly with a pull up resistor. This caused a cascading failure, held the bus up when initialising the hardware which hit the WDT and reset the CPU over and over again.

If you aren't there designing the thing in the first place, you never read the datasheets, never drew the schematic, never placed the components and thus don't know where to look when something goes wrong. And it does go wrong. And then you're in deep shit.

I worry about people who think they can get a product out of the door with this stuff but can't.

ACCount3724 minutes ago

In the pure software domain, this is solved by letting the AI own the entire loop. The AI writes the code, runs the code, tests the code, troubleshoots the code and fixes the code.

Embedded might be resistant to it, because software-hardware interactions are notoriously hard to sim, and AI still struggles with meatspace operations.

Not that it would stop anyone!

You say "people who think they can get a product out of the door with this stuff but can't" and I immediately think: Arduino. That was also seen as a way to introduce people who understand nothing about embedded to embedded. Surely no one would ever go from an Arduino prototype to an actual production run?

Ha ha WRONG. I've seen actual production hardware ship with Arduino firmware, because no one cared enough to fully rewrite that cobbled together Arduino firmware from the first prototype. The FW team just went over it enough to whack-a-mole the most obvious issues, and shipped the result.

So, no. People are absolutely going to ship AI genned embedded hardware. I bet that by now, someone already did.

SV_BubbleTime3 hours ago

Everything you said is exactly the proper argument against vibe coding.

If you can’t or don’t entirely go over the output, the failure mode is invisible.

cryo323 hours ago

Vibe coding is certainly the main part of it. But another problem is how deep our software and hardware stacks are. There is too much information to retain to solve problems now.

tecleandor6 hours ago

Flux just got funding from Bain and others, and it feels like Adafruit was preparing a post about it. Maybe they contacted Flux to confirm some info and they freaked out?

I can't find in archive.org if they had a previous post about it.

Also, seems like there a good bunch of complains in Reddit about Flux and its billing...

https://old.reddit.com/r/PCB/comments/1t476x4/warning_fluxai...

antirez6 hours ago

Note that this is not related to Black Forest Labs Flux, the image synthesis models builders, and is instead related to a PCB AI authoring product called Flux.ai.

Trung02465 hours ago

Also not related to https://fluxkeyboard.com/

xd19363 hours ago

Nor f.lux, the warm light software that got Sherlocked by every major OS.

https://justgetflux.com/

brianjlogan32 minutes ago

Nor the continuous delivery K8s tool. https://fluxcd.io/

somewhatgoated33 minutes ago

Man that’s a blast from the past; used to be one of my fav apps.

kid642 hours ago

Nor the Flux Capacitor from Back to the Future.

+1
OrangeMusic1 hour ago
baobabKoodaa2 hours ago

There's a lesson in here about how to name your product, but I can't quite flux my finger on it

villgax5 hours ago

> Time to shine

Nor is this Flux the display warmth app

justinclift6 hours ago

Thanks, that name was indeed making me wonder what's going on with the BFL people. :)

suncemoje6 hours ago

Exactly, these vectors point in very different directions!

throwa3562626 hours ago

Had no idea about this. Now I do.

Thank you, lawyers. If you ever find yourself out of work use this as your reference to pivot to advertisement

jamesbfb6 hours ago

Streisand in full effect!

bayindirh5 hours ago

It's super effective!

ladyada27 minutes ago

hi everyone, its me 'ladyada. we're very much looking forward to telling our story, i have reached out to the founder of flux.ai (Matthias Wagner - Founder & CEO at Flux), in hopes we can resolve this together and set a good example for the community. looking forward to maybe seeing this resolved on a podcast together, or something

looneysquash25 minutes ago

I love the transparency that Adafruit is proving on this.

ptorrone5 hours ago

hi everyone, phil and limor here, any questions for now, email press@adafruit.com

limor and i are very much looking forward to telling our story.

boncester5 hours ago

It might be being suggested in that statement, but to me that reads that there's a potential opportunity there for a delayed AMA on this?

That if people were to email press@adafruit.com with a subject line (for example) of 'FLUX - AMA for later', these questions could be rounded up and the responses could then go onto a Adafruit blog page later, when and if applicable?

ptorrone5 hours ago

limor and phil here, we would 100% welcome it, looking forward to telling our story very soon - pt & limor

otterley1 hour ago

Can we see the content of the demand letter? It should have been linked to your post. It's difficult for us to evaluate the merits of their allegations otherwise.

zettabomb5 hours ago

I'm curious, but I'm not sure if you can say - has Adafruit ever published anything about Flux?

altaccount20265 hours ago

[flagged]

ptorrone4 hours ago

new "altaccount2026" only posting twice, today, about this. we are very much looking forward to sharing our story, very very soon.

if you "altaccount2026 " really want a twitter archive of my photos of my kids, puppets, links to my articles, posts, and more, it may be available on some archiver.

we are very much looking forward to sharing our story.

press@adafruit.com for inquires ...

bitexploder3 hours ago

Adafruit sure has a lot of stories they are eager to tell lately.

redsocksfan453 hours ago

[dead]

jdnrebd5 hours ago

You should read the linked article

zettabomb5 hours ago

I have, and the article does not in any way address my question. You also seem to be a brand new user, so in case you're not aware, HN guidelines say to refrain from mentioning whether or not someone has read the link.

+1
subscribed4 hours ago
altaccount20265 hours ago

[flagged]

ptorrone5 hours ago

new empty "altaccount2026" with only this post, hi.

please email press@adafruit.com , limor and i are looking forward to telling our story very soon - pt & limor

ceejayoz5 hours ago

They have a few more if you turn showdead on. All about y’all.

malfist4 hours ago

Almost makes you wonder if they're the sparkfun ceo and perpetuating that asinine feud.

RagnarD4 hours ago

Looks like Flux.ai got some publicity out of this. Maybe not the kind they wanted - after reading this thread, I'll sure never give them a dime.

somewhatgoated32 minutes ago

Yea I had no idea this product exists but it seems to be pretty horrible from the experiences shared in this thread

reactordev5 hours ago

Struck a nerve, but I wouldn’t back down. If they do take you to court, there’s this wonderful thing called discovery.

taf22 hours ago

I wanted to love flux.ai because i love codex... and if i could automate the creation of some PCB projects with as much success as I am with codex it would have been quiet fun in the shop... so i gave them a $100~ bucks and i got like nothing in return so I decided i'd wait and see... sounds like it has not improved.

0x595 hours ago

From what I can tell, the message is

When you discover an exploit, only communicate with source (and pray they respond) or get sued. Seems like the position is customers and stakeholders shouldn't be allowed access to this information.

whstl3 hours ago

Seems similar to what Microsoft is doing lately:

https://www.cpomagazine.com/cyber-security/microsoft-doubles...

sigmoid105 hours ago

That's actually very common even with respected bug bounty programs. Communicating exploits to anyone else (let alone the general public) will at the very least make you ineligible for rewards.

kasabali6 hours ago

What's the context here?

Neil446 hours ago

It seems there's suspiciously little context available, yet here I also am commenting on a 'vaguepost'. I wonder if one day AI will be able to filter out vagueposts from my browser along with ragebait and curiosity gap headlines.

somewhatgoated30 minutes ago

Idk now that there are bunch of comments on the thread it’s vastly more interesting.

abirch6 hours ago

If AI does that it’ll make us 10x readers

alexfoo5 hours ago

Indeed, however:

    10 x 0.1 = 1
pavel_lishin3 hours ago

Bold of you to assume my reading ability is that high.

throw_a_grenade5 hours ago

It's deliberately written that way, by lawyers who are making sure they (Adafruit) won't accidentaly admit to something they didn't.

Neywiny6 hours ago

Best I can tell they've taken down whatever it was, but most likely flux left some ways to get data out of their system that shouldn't have been and Adafruit leveraged that. Could have been in a good way like exposing false claims of architecture or security, or a bad way like revealing proprietary information on how the platform worked or looking at other peoples' projects (more than just seeing they could do that). If the blog doesn't come back up, I'll kinda assume they did something bad. I don't have sources but I've heard adafruit isn't the sweetest fruit in the tree...

pavel_lishin3 hours ago

> Adafruit accessed only information that Flux’s own systems made publicly available through a server misconfiguration

Does anyone have some more context about what happened here? An uncharitable analogy might be that I misconfigured my front door by not locking it, which doesn't give someone the right to walk in and look around - but I have no idea what Adafruit is specifically being accused of doing.

dghlsakjg36 minutes ago

what about if I knock on the door (send an http request), and someone comes to it and hands me a bunch of documents (sends an http response with data).

redsocksfan4532 minutes ago

[dead]

UqWBcuFx6NV4r2 hours ago

That isn’t legal in most jurisdictions either. You’re not a lawyer.

somewhatgoated28 minutes ago

What isn’t legal? Cant really square your comment with GP comment.

mindslight2 hours ago

It often does when your front door is otherwise a business storefront. Without knowing the specifics of what was accessed, analogies really aren't helpful. And there seems to be zero context here, so this strikes me as the most plausible scenario: https://news.ycombinator.com/item?id=48368635

(I agree that Adafruit's statement itself is worded pretty terribly!)

raphman5 hours ago

Never heard of Flux.ai before. It seems to be a 3D circuit designer with 'AI'.

Not sure what the issue between them and Adafruit is. However, people over on Reddit¹ claim that Flux.ai is a little bit scummy. They push users into a beginner trial ($5/month) and then silently charge for usage per token - up to $100 per month.

Oh, they also claim that they have "the world's largest community-driven public library of Adafruit products, including footprints, symbols, datasheets, and simulation models"². I wonder whether they designed these themselves or whether they use existing ones. Could not easily find licenses info.

¹) https://www.reddit.com/r/PCB/comments/18o5zfo/thoughts_on_fl...

²) https://www.flux.ai/sitemap/manufacturers/adafruit

yodon5 hours ago

> Adafruit’s reporting concerns a matter of public security interest and was conducted in the ordinary course of responsible disclosure

fn-mote1 hour ago

I was surprised they didn't publish the text of the demand letter verbatim.

Mr_Eri_Atlov4 hours ago

I previously had a passing interest in Flux, now I'm certain it's a fraud.

Falimonda5 hours ago

Had anyone tried AutoPCB (https://autopcb.app/) instead?

Seems especially useful when paired with an agentic coding tool!

pftburger4 hours ago

Yep, and it’s terrible

Not only did it burn a 100$ failing but it did so in a very untransparent way.

I bought a 20 dollar plan but they snuck a 100$ billed usage into the billing agreements next thing I know the agent as used the quote going in circles and my card is billed.

reactordev3 hours ago

We need outcome based billing...

I don't want to pay for a service that doesn't deliver.

elevation1 hour ago

> We need outcome based billing... I don't want to pay for a service that doesn't deliver.

You can already do this: hire a consultancy to build you a working deliverable for a fixed price. They will be incentivized to prompt their tools well and to avoid tools that are consistently pathological.

somewhatgoated26 minutes ago

They will also charge a lot more than you using the service if they aren’t charlatans

Edit: actually they probably will charge even more if they are charlatans

trollbridge3 hours ago

I’m so sick of this that I go to the trouble to set up prepaid cards to pay for these things now.

A handful of honest participants like DeepSeek are pay as you go instead of trying to sneakily bill you for usage.

luma6 hours ago

Flux.ai offers a PCB design solution which is a clear interest for Adafruit. Anyone have any idea what this is about?

axegon_3 hours ago

For anyone that has been missing the memo on how to become rich:

1. Make a slop machine that's a wrapper around another slop machine like claude, openai, google or whatever.

2. Hire a lawyer to send threatening emails to anyone that might call you out.

3. Get a few investors that are completely clueless to throw a ton of cash at you for having ai in your product.

4. Profit.

Honestly, get a hold of Louis Rossmann, this shit needs to stop.

wewewedxfgdf5 hours ago

Suing the industry won't win them customers/friends.

bob0015 hours ago

I suspect they don't care. Their only goal is likely to get enough good PR to sell to some big tech or AI company for an absurd valuation.

mannanj3 hours ago

Why do we tolerate this bullying and misconduct from companies that harms us and progress overall? Is there really no solution in this day and age for harmful behavior and aggression and hostility like what it looks like Flux is doing here? I can't believe we don't have an answer, I think it's just that the bad guys are drowning us in noise and making it hard for us to identify the solutions where we band together a la David v Goliath against them.

xuzhenpeng5 hours ago

[flagged]

hanzeweiasa2 hours ago

[flagged]

embirdating7 hours ago

[dead]

coalstartprob6 hours ago

[dead]

TZubiri5 hours ago

>The letter further asserts claims under the Computer Fraud and Abuse Act. Adafruit accessed only information that Flux’s own systems made publicly available through a server misconfiguration

A confession

Ekaros5 hours ago

They vibe coded their system and it showed Adafruit something? Or showed some information with trivial prodding? Sounds like your average cross-tenant leak. Maybe showing more than intended or some caching issue. Many options some not really not fault of Adafruit.

myself2483 hours ago

Or someone found server.domain/path/subdirectory/resourceX and was like "shit, I was hoping to find resourceY but I can't find a link to it, I wonder if I just click in my address bar and change the X to a Y", and voila, resourceY is right there.

To some of us, this is elementary navigation. Like going up the stairs if the elevator is out. Often it's faster than waiting for the damn elevator, too.

To others, it's cybarrrr-criiiimeeee!!!!!!11111one

kaszanka1 hour ago

People have already been imprisoned for this, one case I can think of off the top of my head is https://en.wikipedia.org/wiki/Goatse_Security#AT&T/iPad_emai....

Syzygies1 hour ago

Continental Airlines had an active frequent flyer community. A student emerged as a legendary figure (think "Hunger Games") after she noticed that Continental announcement URLs were numbered sequentially, and a not-yet-released announcement rather unfavorable to current elites was there for anyone to read. Quite the brew-ha-ha. Continental retreated.

She was nevertheless welcome at a frequent flyer event hosted by Continental in Houston, where she beat me at poker.

TZubiri3 hours ago

I don't know the details of the case, but what they worded there is a textbook unauthorized intrusion and a naïve teenager "the door was open" defense.

Mind you there can be nuances, but that quote is like saying "I took their stuff, but it was poking out of their pocket."

sq_2 hours ago

I think people have a heightened reaction to threats based on the CFAA for "the door was open" circumstances because that law is so widely known for being used in threats against folks who were trying to ethically report things and in overly-aggressive prosecutions.

Of course, we don't yet know the specifics of this particular case, but I'm willing to lean towards the people receiving legal letters threatening CFAA action until there's more information.

mindslight2 hours ago

No, it's more like "the door was open" in the context of a storefront. A public website carries an implicit invitation to visit, otherwise web browsing would be illegal.

Ekaros3 hours ago

It is bit grey area. You are evaluating something. Do some basic checks. Actually end up seeing something you should not. You stop and tell them to fix it. They then silence you.

Now it is bit questionable should you check things like this during evaluation or not. Strict legal reading probably not. With reasonable customer relations you thank them and put it on top of the priority list. Unless they clearly enumerated everything they got their hands on or tried to run more real scans.