CubeIDE forcing you to login to ST [...] - Follow up

[CBerg]

The original Thread "CubeIDE forcing you to login to ST ...", opened by @JDoe.2 in August 2023 with 37 Kudos for JDoe

got shut down (flagged as read-only) today with a last statement by @Amel NASRI which is marked as "Solution".

 

Congratulations ST, now I am really upset. Now I know you read the community postings, you just prefer to ignore them if they are annoying. Flagging a thread as read only and posting an "alibi" technical solution where the thread clearly shows that thread was not about technical issues in common, but your customers do not want to be forced to log in to use your product is an affront against all those people who spoke out against those new policies.

 

Please take this posting as my formal protest against your action.

Edit: shortened Title to reflect the note from Amel

 

 

[Andrew Neil]

Indeed, this need to log in is a key reason I haven't even tried to upgrade from 1.13.0.

[unsigned_char_array]

It's one thing to force users to log in to download the tools. It's another thing to force users to log in to use those tools. At least give users the option to use alternative download mirrors (github?) in case they don't want to log in or if ST servers are down.

[Amel NASRI]

Hi @CBerg,

First of all I admit that I precipitated to make the previous thread only. I made it for a reason: the thread is diverging : discuss about:

• the issue identified previous week and taken as urgency on our side to fix it  (details here)
• the login feature not working or don't know how to do it (the procedure is explained here)

The main topic of the previous discussion and current one remains valid: why ST added the login obligation.

I'm not the right person to explain the rationale but I can ensure that at ST, we are aware about the situation and thinking about your concerns. We will come back to you if we have farther to share.

Now that I closed previous thread (my mistake) and you created this new one with same title, I suggest to continue here (the history will be always available) and I invite you to revisit the title to be aligned with the Ground Rules of our Community.

I understand your protest & I am sorry for my hasty action.

-Amel

[CBerg]

Hi @Amel NASRI 

Thank you for your answer. I had chosen this title, because it was a copy & paste of the title of the original thread. But I have changed that now, according to your note that the title should be aligned with the community rules.

I for my part can surely live with your proposal to continue the discussion in this thread. Switching back to the old thread would IMHO just add more confusion.

 

About the topic. Thank you for listening. I can just point out what I already mentioned before. A Supplier / Manufacturer / Solution Provider that adds mandatory logins to their products sets of several alarms at my side. I am developing software for almost 40 years now. I have seen a lot and each time a manufacturer started to put their users on a leash, the end-result was that they forced their customers to use crappy products for a way to high price because they managed it to get in a position where they could - at least for a while - dictate the conditions to the customers.

 

I am not willing to accept this. A supplier who puts itself into the position to change conditions after I have made the fundamental decision to build a product based on their products is an unacceptable strategical business risk. As I already have experienced how this "small changes" work out in the end, so I am on high alert when such things happen!

 

I am here, I use ST Products, because the Software Toolchain was free (I started with Atolic True Studio), and because of the good performance and the broad availability of the hardware. I left my old supplier National Instruments, because they made their Product a “SaaS” Product and doubled their prices after messing up the quality because they thought I had no choice. I had a choice, it was no pleasant one, but finally I built the hardware-functionality I previously bought form NI by myself, based on STM32 Microcontrollers. If I see now the first signs of a “squeeze” I am getting nervous …

 

If the mandatory login is just for statistic reasons, there are several other – non intrusive – options to get the data you need. If you are considering on monetizing on the IDE, my suggestion would be: make it free of charge under any circumstances for students, universities and DIY users, because this group generates your future customers and discuss with professional users like me about my expectations and a fair pricing. But under all circumstances avoid the path to “Software as a Service”. Everyone hates this license model, except the stake-/stock-holders. But they don’t work with your products, they just pull money out of it.

 

[unsigned_char_array]

I agree with you, except the last paragraph. I think the tools should also remain free for companies. Companies invest time and money into learning to work with the ST framework/ecosystem and switching to a paid licensing type would be unethical. It might even be illegal. Think of the challenge of a company doing hardware and software redesign of all their products with STM32 MCUs. The company I work for switched to STM32 MCUs, partly because TouchGFX is free while QT has problematic licensing. We contribute to the forum to give back to the community. If it becomes paid or severely restricted that will stop.

I'm realistic and understand that Companies like ST want some level of control and want data. I'm not expecting or demanding that to be removed. I would be happy with being able to opt out and also having the options for supplying download mirrors. If someone tries to compile a project in 10 years it should still work.

[JDoe.2]

I've just noticed what happened to my thread. I'm also very upset and, true to my Frenchman nature, I'm about to complain. This is Yellow Vest time. If you get the feeling that I'm being less polite than in the previous thread, it's because I'm starting to realize that a customer being polite is mistaken for weakness. As if this were some sort of PID regulation loop, I'm now compensating the other way.

I tried getting in touch with the ST personel involved (a Lina DABASINSKAITE apparently renamed the old thread) but it appears you can't send private messages, so we'll be doing this in public. I don't mind.

First thing first, I do not appreciate the renaming of the old thread. I was careful not to write "BS" precisely to avoid censorship but hey, when Corporate wants to sweep negative comments under the rug, they'll just make up any arbitrary excuse; and one that relies on subjective criteria is very easy to weaponize. The 1984'ed title now reads like a positive instead of a complaint: starts with "solved", ends with "complete", how effing convenient for you. Amel Nasri or whoever made the change could have asked me to rephrase, instead they chose to neuter. I'm not tolerating this.

I also don't accept the weak excuse for closing the thread. It isn't solved because ST is still forcing us to login. And I'm going to paste what I wrote in my original post because it is still the fact of the matter. I'll make it bold so maybe you can read it better this time:

FYI, some of us work in companies where our computers are not, must not and cannot be, connected to the internet. It's already tough enough installing some of your HAL libraries (the patches) while being offline, we do not need the additional hassle of a login system that does nothing useful anyway.

And now for a very recent, very negative experience caused by this login ***:

Two weeks ago, I participated in the Eurobot robotics championship. One of the teams I'm helping uses STM32 and needed me to urgently build and flash their firmware on new hardware. We were hundreds of kilometers from home, I had a borrowed laptop, it had CubeIDE but no login saved, and of course the necessary HAL for my target weren't already installed. I do not know my ST login by heart because frankly ST, it'll be a cold day in Hell before I waste a single neuron on that sort of ***. End-result: the new hardware couldn't be used, the team had to go into its following matches handicapped. You made half a dozen college students sad, and that after weeks of preparation and a road trip halfway across France, for something most of them will only get to do once in their lives. Believe me, they WILL remember that long after they graduate and get jobs in the industry. And those are the kinds of ultra-motivated kids that will go far and will have buying decision on your products for decades to come. And they all have social networks in their DNA, for better or worse.

ST did have a booth at the championship but I was way too busy or I would have gone and complained in person. I regret not doing so, now that I see how you've handled my original complaint on this forum.

As for me, I don't just train future engineers, I'm a veteran of several industries. Right now I'm working for a very well-known automotive supplier of EV ECU's, chargers and inverters, and for the past two months I've been looking at different suppliers of MCU's for our next product, which will be in millions of cars in the future. ST Stellar is under consideration, however from day one I have raised a red flag because of the requirement for logins on ST tools. As I've put it before, in bold, and to repeat myself, we (and our customers) install development tools from servers managed by our own IT departments. Things like logins are disabled and cannot work in those environments, resulting in crippled user experience. If you don't understand why that is, perhaps because you're only here to "manage the community", please bring in someone from ST's IT department so they can confirm for your executives how the real world works.

To reiterate:

No one wants to be monitored. Most people value their privacy; companies even more so.

No one wants telemetry, especially hidden telemetry.

No one wants any of that enabled by default. It should always be opt-in only.

And if it doesn't tangibly benefit the customer, you shouldn't even be doing it in the first place.

And I swear to the almighty Cthulhu, if you ever decide to go full Microsoft and install an "AI assistant" that learns how we code "to help us" (and maybe secretly monetize our skills), all you'll be helping us do is switch to a different manufacturer. I'll just argue that's industrial espionage.

I was an Intel customer before I switched to Atmel. And then I switched to Cypress. And then I switched to NXP. And then I switched to ST. You should not feel certain you're the last on that list and cannot be replaced. Risc V is looking sexier by the minute, at this point. Or I could just decide to go FPGA, make my own Cortex-M1 or LEON3 designs same as I used to for the European Space Agency, and never have to deal with this again.

I've always selected MCU's based on convenience: are they easy to design boards for? Are they easy to code for? Is the manufacturer respectful? Those are the criteria your customers go by. None of us is buying ST because we love the ST logo and show it off "on social". You're not Apple, you're not selling iPhones. You're FACOM and you're selling screwdrivers. The day FACOM requires a login for people to change the bits on their ratchet wrench is the day people stop buying FACOM.

Denying reality doesn't change it, 38 people "kudoed" the original comment, but maybe you don't realize what that means in practice: I'm the only one where I work who uses an ST account and posts on the forum, and it's like that in most places because we're not paid to waste time on forums. When we really need it it's just one guy creating a login and posting. My feelings on this matter are shared by many engineers where I work. 38 kudos doesn't mean 38 people, chances are it's a lot more than that.

Oh and before I leave: we still don't know what exactly you're claiming we gain from logging into your tools, compared to when we didn't have to. I'm still not seeing it, only hassle, waste of time and frustration.

[CBerg]

I like a good rant :) ... take my Kudo.

 

[JDoe.2]

You're welcome :beaming_face_with_smiling_eyes:

All joking aside, I'm past my limit with corporate BS. I'm at the point where I've switched to Linux because Windows has gotten so bad I need to rebuild their installers from scratch to castrate Windows Update and all their spyware, bloatware, adware, not to mention disembowel Cortana. And now they announced an AI "copilot" that will record everything on your screen at all times. CIA wet dream. What will it take for corporations to take a hint?

You know, I used to answer customer surveys. And on trade shows I used to give honest feedback to suppliers. I don't bother anymore. They want to spy on me instead of trusting my word, then why should I waste time? Idiotic, disrespectful practices killed my goodwill in that regard. Now I don't answer surveys AND I do my best to eliminate telemetry. They get less data than they used to.

Anyway, that's enough bile for one day. Time to settle down and see what ST has to say. Oh, by the way, I just checked: the old thread got the most kudos on the forum by a huge margin. Let's hope ST understands what this means in terms of customer sentiments and acts on it.

[Pavel A.]

What can be better than a good rant? )) Only a good fact checking.

Sorry I haven't time for thorough test right now, so did just a quick one. Like some other people on this forum I was scared by the rumors and stayed with older CubeIDE version sufficient to my work.

So here's quick informal results:

* Downloading v.1.15.1 for Windows (with logon, of course) - no issues.

* Unzip the downloaded file and install on Win11, side by side with v.1.12: no issues.

No logon requirement during install.

On the last page of the setup wizard there's a notice that telemetry can be disabled in the options (don't remember exact wording). Immediately I went there and unchecked "Help ST improve its products". No issues.

Also, in the Firmware updater option page I've checked Connection mode: OFFLINE MODE.

 * Started the new version. It opened as usual, no logon requirements again.

* Imported some existing CubeIDE projects and existing repository with installed Cube Packages for my projects: no issues, and no login prompts.

* Opened the .ioc in "Device configuration" view - again no issues and no login requirements.

* Build the imported projects - ditto, it all works (except of warnings due to the new toolchain).

Conclusion: You can install CubeIDE 1.15 in isolated environment and use it with pre-loaded files, without a single logon prompt.

 

[LCE]

> Conclusion: You can install CubeIDE 1.15 in isolated environment and use it with pre-loaded files, without a single logon prompt.

 

Maybe @Pavel A. 's post above on "how to install with isolation" should be made a sticky in this forum.

For now I'm staying with 1.10 anyway - never change a running system or so...

[Pavel A.]

@unsigned_char_array 

> And now ST with the requirement for logging in for downloads and pack updates without a means to opt out or use alternative mirrors (we archive all downloaded tools and packs for this reason).

Could you explain please how  ST can limit your ability to make backups of the software in any way that you prefer?

@CBerg 

>  @Pavel A. picks out the one point that he could prove and ignores the whole rest and the most important context.

Correct, I've picked only one scenario that is vital (and mostly sufficient)  for my workflow.  This was exactly my intent. Others can consider ability to create new projects and update online as most important for them.

Now, is whistleblowing an important part of our culture or necessary evil... this is way off-topic here IMHO.

 

[unsigned_char_array]

"Could you explain please how ST can limit your ability to make backups of the software in any way that you prefer?"

I did not claim that at all. Backups work fine like I wrote in the same sentence you quoted of me. My main problem is that you need to log in to download packs. So after you've installed all STM32CubeMX you need to download packs and those require login. It's an unnecessary hurdle. And as we saw recently it actually led to problems due to ST having problems with their servers or users with strict firewalls. There are also privacy concerns since ST knows which users use which packs, what their IP address is and where they work. You gave an example of already installed packs in your earlier post, but that scenario is not a problem. If ST provided users to use download mirrors to download packs (such as a git repo) that would make everything so much easier.
I do not plan to leave STM32 microcontrollers any time soon, but I think it's heading in the wrong direction. It seems a bit of an overreaction, but I simply don't want it to get further then this. More and more products and services have mandatory logins and accounts, require phone number verification or require you to install apps. This is a problematic trend as these things make us more depended on our smartphones, on big tech and also leads to potential privacy concerns.

[CBerg]

Long time no update! Has ST finally removed that sh***y mandatory login? Or do they still insist in annoying their users?

[STOne-32]

Dear @CBerg , @Techn  @JDoe.2  @unsigned_char_array  @Pavel A.,

 

I wanted to share these actions that we are implementing to Try to make our STM32 Developers  experience more appropriate and simple while Downloading then Installing and using STM32CubeIDE here :

https://www.st.com/en/development-tools/stm32cubeide.html

 

Action 1: implemented already  -  we limit the download options to only last 4 versions. In case of older versions requested - to contact us via Online Support .

>> This will reduce the Web page hangs in some browsers and configuration and we launch it for a testing purpose till end of the Year with full monitoring of the downloads.

 

Action 2 :  After installation and while using the STM32CubeIDE we limit the Login and user authentification to “Only” downloading operations  as follow starting for Today release V1.17.0.

 

I know this is not yet an optimal solution for long term that needs more engineering effort but some incremental changes to make the less frustrated customers and developers . Your voice Matters  I wanted to thank all of you as we are listening and taking your feedback in actions .

Happy Thanksgiving to you and your family

 

Ciao

STOne-32 

[CBerg]

even if it's not the optimal solution: you heard us and you did not give a f*** on your users like many other big tech corps do. There is hope ;) Thanks and take my kudo.

 

[JDoe.2]

So. I tried giving ST a piece of my mind on the thread about that issue. To no one's surprise, my reply doesn't appear on the forum. Gee I wonder why.

Meanwhile, I fired-up an old virtual machine I use for experiments. It's a Win10 and has CubeIDE 1.12 on it. Before booting it, I disabled its network connectivity.

I launched Cube IDE, went to create a new project, and the first thing that happened was this dialog box:

I said no, of course, and then picked an MCU and wouldn't you know:

So yeah, ST put a kill switch in their tools. If your work depends on it, I suggest backing up your installers and setting everything up in a VM. For your information, VMWare is free and works perfectly well with tools like CubeIDE. Moreover it supports USB passthrough for your STLINK and other needs.

I think we need to start taking matters into our own hands. We should start an effort to collect all past installers for all ST tools, including Cube libraries, and put them somewhere safe where we can all access them and back them up. I started doing so as far back as CubeIDE 1.12 and will gladly contribute.

As for my VM... I'm half tempted to clone it, give the clone internet access, and see if CubeIDE gets lobotomized. But I have better things to do with my time and ST has yet again wasted too much of it. If it happens, I'll let you know. It's just safe to assume no install of CubeIDE is safe.

EDIT: I was so pissed-off I did clone my VM and give it internet access. Started CubeIDE 1.12, started a new project, and now the Cube option is grayed out. There was no message or anything about updating or downloading something. Even as far as 1.12, CubeIDE phoned home every single time you used it.

I will have words with my contacts at ST about this. I am now beyond fuming and I will give people bad days over it. The enshitification of this world has to stop.

[CBerg]

>>Started CubeIDE 1.12, started a new project, and now the Cube option is grayed out. There was no message or anything about updating or downloading something. Even as far as 1.12, CubeIDE phoned home every single time you used it.<<

This is a very bad development. And it makes me very nervous. 

If ST has really implemented kill switches, what is the purpose of those? I hope this is just a misconfiguration of some updater config files or something ...

If ST would be so kind and make a statmement about this matter, and if this behaviour is by intent, please explain the intentions of their decisions and their implications! 

 

[STOne-32]

Dear @CBerg , @JDoe.2 

Thank you very much for bringing to our attention this outstanding recent issue impacting old versions already installed. Our Technical teams just  found the root-cause of this weird behavior and are working for a fix. 

It seems a change on a product database naming on one production server, thus responsible of this behavior.  We will be back to you with more details, once fixed. 
https://community.st.com/t5/stm32cubeide-mcus/stm32cubeide-stm32cube-project-creation-issue/td-p/823125

Thanks again.

STOne-32