I'd argue that so far, that's exactly the point, their response makes it worse.

"We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns" is a laughable statement to have issued.

I can understand the legal reasons for not admitting to the security issues. But outright saying that they can't find anything to suggest they exist indicates a company I wouldn't want to do business with.

To expand on that, in this case I know enough about the subject matter to understand that it's ridiculous to suggest there aren't security concerns. But I can't guarantee this will be the case for other problems. So going forward I'd probably avoid being a customer of a company who I have positive proof is prepared to issue blatantly incorrect statements about security issues.

I also had to laugh when Jobs started talking about "antenna gate". Instead of saying "We made a mistake here" he started saying "other phones have similar problems", etc. So his response wasn't good, but people still buy Apple and Apply is currently the largest company by market cap...

An antenna doesn't pose a security hole. Bullshit about antennas in other phones is Apple's traditional humbleness deficit, bullshit about compromised SSL connections is a criminal lie.

> "We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns" is a laughable statement to have issued.

Why o why does "investigated this technology" even imply that somebody (technical) looked at it?

Lead: Hey vendor, is your product secure?

Vendor: Sure it is. It helps people find products they want.

Lead: Aye! That's cool. Deal!

Vendor: Aye! Let's hand it off to the mere mortals to implement the plan...

Customer (formerly known as lead): Nice doing business with you. I like we have a relationship based on trust and honesty.

This is not a mistake. This is an outright attack on the user, and it is straight-up disingenuous to claim it otherwise.

Anybody can MitM any HTTPS connection coming from these laptops. Anybody! The private key is public knowledge! This is so transcendentally bad and so impossible to implement without understanding the consequences that somebody should go to jail for this.

It is not a "mistake."

If I'm reading you correctly, you're making the argument that Lenovo, the company that was just discovered to have been intentionally shipping a massive security vulnerability on their laptops, is still thought of by you as listening to their users better than Apple, the company that would never in their wildest dreams even remotely consider the idea of putting something like Superfish on their computers, simply because Lenovo changed their minds and stopped shipping the security vulnerability?

"Oh, no, my husband's a good man. He even promised to stop beating me!"

Clearly Lenovo are stupid for bundling third-party ad-injection software, but who knows what Apple are doing behind closed doors? e.g. CarrierIQ in the baseband... etc.

Who knows what <insert person or company of choice> is doing behind closed doors? What am I doing behind closed doors? What are you doing behind closed doors?

While there is a chance someone may be doing something bad behind closed doors, that cannot be used as a reason for why they are worse than someone whose door we have opened and found doing something bad.

Just to be clear, this is Apple, the company famous for putting user experience ahead of everything else (and often criticized by developers for putting user experience ahead of developer experience). Apple, the company that routinely tops customer satisfaction surveys. Apple, the company that has gone on the record time and time again about how user-focused they are.

There are plenty of valid things to criticize Apple for, but accusing them of sneaking malware onto their devices is not one of them.

This Lenovo press release is evidence neither for nor against Apple's malfeasance. But I think we can all agree that if Apple does bundle malware, that malware's user experience will be thoughtful, smooth, and superbly curated. /s

As part of "fixing their mistake" Lenovo just outright lied about the security implications. So what does that tell you about them?

Their response is basically that this wasn't even a problem, but they'll still stop because people are making a big deal out of it for no reason and it's good to keep people happy, even when they're idiots.

This seems like a pretty good reason to drop them. When you catch somebody misbehaving, and their response is "fine, I'll stop, but it wasn't a problem" then you can't trust them at all.

> When you catch somebody misbehaving, and their response is "fine, I'll stop, but it wasn't a problem" then you can't trust them at all.

Indeed. This kind of response is one of the most disrespectful things you can do to another person. "Hey, what are so upset about? Chill, it wasn't a big deal anyway!"

I'm kind of impressed that their PR guys are so incompetent. Their statement is so nakedly condescending, they might as well have straight-up said, "You guys are full of shit, but we'll stop just so you'll shut up about it."

If I was a lawyer, the basic requirement I'd have for a statement like this is to make it so it can't be construed as an admission of guilt, because that may later be used in court to extract damages.

You probably should blame legal, not PR.

I'm certain that the legal requirements can be met without outright lying (or admitting to unbelievably gross incompetence).

In fact, they seem to agree. I loaded the page just now, and "We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns." is no longer present in their statement.

Their statement is still unbelievably condescending and awful (and none of that has any legal bearing that I can see) but they at least removed the part where they outright denied any security problem.

>What I see is a company willing to listen and admit their mistakes.

Apply this to a human who did something similar.

"I'm sorry I purposefully allowed my previous employer's systems to be infected by a virus in return for payment. I'm willing to admit it was a mistake and I've taken steps to correct it."

Would you honestly hire someone like that to be a sysadmin?

A buffer overflow is a honest security mistake. This was a security sabotage.

That is not a mistake. That is a deliberate, well planned action done by management.

If they had asked someone with a clue before, that wouldn't have happened.

Stop calling stealing and lying "mistakes" you astroturfer

Punish bad behaviour. It will scare other other technology companies from doing this sort of thing again. If you switch to another company, you're rewarding the new company for not putting this spyware on their machines.

Bringing back the physical click buttons is a step in the right direction, but their recent drivers have ruined the middle mouse button for me. Can't use it both to scroll and middle click; you can either get scrolling or uninstall the driver and get middle click. There is a buggy piece of software called TPMiddle that lives on my X220 right now, but I'm jumping ship for my next laptop purchase.

> Why stop buying Thinkpads?

Panasonic makes much higher quality hardware than Lenovo (and Apple for that matter). Panasonic also doesn't preload bloatware onto Windows.

http://www.panasonic.com/business/toughbook/semi-rugged-lapt...

No trackpoint.

They have acknowledged that the issue exists, but not what it actually is.