Comment by kevin42 | Hacker News Reader

Comment by kevin42 | Hacker News Reader

Parent Full thread

I'd highly recommend you revisit your protection of customer's IP. Considering that you require source files (not just the industry standard gerbers), your legal terms are very unfavorable to customers. This makes me uncomfortable because it makes my IP much easier to leak. As written, I cannot justify the risks given your agreement.

Nothing in the legal terms explicitly prevents your employees from using my designs for other purposes. If you leak my IP and I find out 13 months later, your terms prevent me from seeking damages because you only cover 12 months from manufacturing.

I like that you have an NDA that I can opt in to, but you should be offering the NDA by default when I upload the files. I should not have to go looking for it in your documentation.

Edit: I realize that there is also limited protection and a lot of risk using a Chinese manufacturer. But requiring source files makes it much, much, easier to look at my design, recognize what it's for, and reproduce it, or at least copy the innovative parts of my design.

You can upload Gerbers/ODB++ if you like. We also sign custom NDA's. We count many of the worlds largest corporations as customers so this is pretty standard.

Would you address other concerns voiced above? They are pretty serious points or allegations. Also, a PCB sourcing should not require a custom NDA when the selling point is convenience, legal protection, and speed vis-a-vis overseas sourcing.

Then there's either a usability issue or a bug. I uploaded gerbers but it wouldn't let me continue unless I uploaded schematics and board files.

And why should I have to sign an NDA? You aren't giving me any confidential data, I am giving it to you.

>> We also sign custom NDA's

> And why should I have to sign an NDA?

I think you misunderstood?

What did I misunderstand? Their documentation (https://docs.circuithub.com/importing-a-project/files-requir...) says:

---

For additional legal protection of your intellectual property please sign our NDA.

---

To make it worse, you can't even read what their NDA says without signing up with your email address on a third party site.

Yes. If you're that risk adverse that giving your email address in 2026 to a site is too much of a burden, you're going to be a problem customer and they don't want your business. They're in business to make money and it's a business transaction and if you can't cross that low threshold, you're more trouble than you're worth as a customer.

Isn't capitalism neat‽

Funny how you frame this like it's a problem for the customer. The business needs customers to survive, the customer does not need the business to survive. The customer is in the business of giving money to people who aren't going to abuse their data. If you can't cross that low threshold, you're more trouble than you're worth as a business, and you're not getting paid. Isn't capitalism neat?

I don't think you are a target customer. All the contract fab, manufacturing etc run on NDAs.

I'm confused, aren't they already shipping millions of boards to customers, and scaling up rapidly beyond that?

Sounds like their actual customers don't agree with you at all...

Correct.

Customer and supplier is a two-way street. Each needs the other. Ideally, both want multiple of the others to add competition, but in the end, you need both. Good customers want to ensure their suppliers survive so that they can use them again. Likewise, good suppliers want to ensure their customers survive so they get used again.

Many, many people, including a lot of industry, thinks that this is a zero-sum game and so they need to win. They end up hurting themselves in the long run.

GP didn't say they didn't want to enter their email because it's a risk. My reading was that it was another hoop they had to jump through to do their diligence, reflecting on what the company thinks of their customers the same way the NDA requirement itself, and the IP clauses do. I'm not sure how the connection to money or capitalism comes in here.

This is odd because as supplier if any NDAs were involved surely they should be the ones signing your NDA?

I agree that it raises a red flag when you see something like "For additional legal protection of your intellectual property" for a service which terms should be absolute confidentiality out fo the box.

I second the use of NDA/privacy gaurantee as default. It shouldn't be opt-in with friction. Of course if I want to use a custom/overriding NDA then i'm happy to contact you to review.

Here's what the documentation says:

---

In order to receive a quote on CircuitHub, you will need to upload the original design files from your EDA tool, or an export that carries the same data. This allows us to provide instant quotes and automate the manufacturing process to lower lead times and cost. Currently, our platform works with Altium, KiCad and Fusion 360 files, and with ODB++ and IPC-2581 exports from any design tool, including Cadence Allegro and OrCAD.

We do not accept Gerber files on their own because they do not contain all of the design and assembly data required by our automated process. We do use your Gerber files when you upload them together with an ODB++ or IPC-2581 export, or with Fusion 360's EAGLE exports, which describe the parts.

---

Other vendors don't require this. They just need the gerbers, BOM, and CPL files. That's way different than source files or ODB++/IPC-2581 exports, which is basically the same thing as source.

IPC-2581 is the future.

Good riddance to the compatibly hellhole of 30 different flavors of Gerber/Gerberx/NCdrill

EDIT: haven't even mentioned everyone's different goofball CSV BOMs

There is a singular gerber standard, the deviation is generally just caused by CAM tools.

The Gerber standard just doesn't describe a PCB, just the shape of the layers. I would've sworn there was old dead Gerber, GerberX(the one you want), and then some newer ones that are unreliably implemented across programs.

You almost always need an NC drill.

You have to add a separate GerbJob to describe what the board is made of.

other vendors even support native librepcb files and have it fully included in their automated build process. i understand that librepcb is not big enough (strangely) and thus not supported. however not accepting gerber? seems like a strange choice

It’s several steps up from Chinese manufacturers already however where they will almost certainly use your design for something else if it suits them and you have no protections.

I agree up to a point. It's like the difference in giving someone binary or source code. Yes, someone can reverse engineer gerbers into a schematic, but that's a lot different than handing over the schematic, which includes more information about the design than the gerbers do. It's much easier to look at a schematic and say "oh, that's a circuit I want to use" than it is to look at gerber files and think that.

I have some level of confidence that JLC is going to protect my IP. They are big and if someone's IP leaked it could be devastating to their business. Their legal agreements are a lot more detailed and favorable than what's currently on circuithub.

Pretty much any new product gets a Chinese copy within a year. How are you so confident JLC is not the source of atleast some of these. Also there is no other alternative so they have that security.

That's fair. But gerber files are just a step up from reverse engineering a physical PCB. For a fairly simple, 2 layer PCB, the actual hardware will be easier to reverse engineer than gerbers alone.

So even if nobody ever sees my schematic or gerber files, they could still clone a lot of products if they just have someone spend some time with a multimeter on a device they buy.

Yeah, or at this point just get an LLM to verify it and explain the circuit.

Chinese engineering labor is dirt cheap. They don't need your design files to make a clone.

And contrary to popular white-washed belief, there is very little to anything special in most copied designs.

Reply on news.ycombinator.com