(1) Superfish isn't a Chinese company -- it was founded in Tel Aviv and moved to Palo Alto; (2) Superfish wasn't installed on ThinkPads; (3) it wasn't on Lenovo laptops for long: they uninstalled it and apologised.

You sure they weren't referring to Lenovo Service Engine or Lenovo Accelerator? Sure, they may not have installed these things on all of their laptops, but they've been caught quite a few times recently and it seems like a bad trend. The UEFI stuff that installs on a vanilla Windows install is super sketchy.

How likely is it that someone would describe Lenovo Service Engine or Lenovo Accelerator as Chinese spyware?

How would you describe it? Lenovo is a Chinese multinational company and Lenovo Service Engine phoned home with personal information. How do you describe spyware?

I get that companies may not have bad motives. It's difficult to survey users real-life use cases. But companies have abused users with pre-installed software that's slow, poorly written, creates new vectors for exploit, shares "anonymous" information that often isn't a) secured properly or b) still personally identifiable.

The fact that they did it in the first place is enough for most people. An apology hardly covers the potential for damage. All in the name of some bundled shitware to make them a few extra bucks. Totally inexcusable, and I don't see why people jump in to defend them at all.

You also don't see why someone should jump in to correct a wrong statement?

Either way, the potential for damage wasn't that obvious: it could have happened to any company. (Employees often make commercial decisions without understanding the technical ramifications.)

Also, Superfish said it wasn't its fault: it blamed Komodo's tool. This amounts to a similar type of buck-passing.

I've bought a couple of Lenovo machines since Superfish, mainly because they were fantastic value for money. I also know that if I wasn't happy with the installation, I could download Windows 10 from Microsoft and do a clean installation.

>I also know that if I wasn't happy with the installation, I could download Windows 10 from Microsoft and do a clean installation.

You’d think so. It turns out not though.

https://www.techdirt.com/articles/20150812/11395231925/lenov...

Great point!

Luckily I didn't buy any of the models that included that feature (and none of them were ThinkPads) or I would have had to run Lenovo's LSE Windows Disabler Tool from https://pcsupport.lenovo.com/gb/en/downloads/ds104370

Yeah, I wish I could like them, since Lenovo/Thinkpad has been putting out some pretty appealing hardware recently, but that kind of irresponsible behavior demands a response from people who understand the severity.

I refuse to buy or recommend Lenovo for my family members for at least another three years yet, no matter how much they seem to have reformed. If they haven't had a repeat incident in that time I'll be glad to start considering them again.

You could boycott Lenovo-branded machines while not boycotting ThinkPads. As far as I know, ThinkPads have been beyond reproach. It's a valuable brand for Lenovo, and it acquired the whole IBM division, not just the name.

I managed to be a ThinkPad fanboy for decades while despising IBM ;-)

If you install a decent OS replacing the one it comes with, there won't be any malware (at leat not the kind we knew about)

Just linked this in another comment, but I’ll post it here too: https://www.techdirt.com/articles/20150812/11395231925/lenov...

Short version, manufacturers can use a feature called WPBT to load executables into your “clean” Windows installation from firmware. It’s intended for providing drivers.

Reinstalling the OS may be good enough for most people, but you also have to be aware of firmware.

For that, the metal shredder is probably the best solution.

how does NSA spyware taste?

Not great, but better

Needs more salt.

It might, but do you have proof that it has it?

Those were not Thinkpad Yoga.

Linux runs great on Thinkpads

for some other reason, the Thinkpad line was never affected.