Lenovo Statement on Superfish

Re:Lenovo Statement on Superfish by jeletonskelly on Thursday February 19, 2015 @12:25PM (#9075326)

I love my Lenovo X1 Carbon. It's a really nice machine. I do run linux so I know I'm not the average user, but they haven't lost my business despite this being an epic screw-up. I think they make good machines and I'll continue to buy from them in the future, but I'll be reformatting immediately just like I've always done with any PC I've ever bought from Dell, Gateway, Lenovo, etc, so I don't have to deal with the bloat they put on their machine images.

[ Parent | on HN ]

Re:Lenovo Statement on Superfish by toolz on Thursday February 19, 2015 @01:06PM (#9075666)

If they are willing to compromise you on a software level, what makes you think they aren't prepared to do so on the hardware level (presuming they already aren't).

[ Parent | on HN ]

Re:Lenovo Statement on Superfish by notsony on Thursday February 19, 2015 @01:38PM (#9075920)

At some point you're going to have to trust the vendor and the supply chain... unless you're prepared to build your own computer by soldering home-made components onto a bread-board! ;-)

[ Parent | on HN ]

Re:Lenovo Statement on Superfish by joshuapants on Thursday February 19, 2015 @01:54PM (#9076029)

It makes more sense to trust someone who hasn't already been caught abusing your trust.

[ Parent | on HN ]

Re:Lenovo Statement on Superfish by blfr on Thursday February 19, 2015 @03:00PM (#9076570)

You can make the opposite argument: since they screwed up, they will be more careful in the future. This kind of heuristic reasoning is pretty weak.

[ Parent | on HN ]

Re:Lenovo Statement on Superfish by EpicEng on Thursday February 19, 2015 @04:11PM (#9077074)

"Screwing up" implies negligence, but not malicious intent. I think it's likely a bit of both.

They did "screw up", i.e., the financial side of the business thought it was ok to hurt the user experience in order to make more money, and the engineering side was too incompetent to realize the security risk. Why would this level of demonstrated incompetence lead you to believe that they will be better in the future?

[ Parent | on HN ]

Re:Lenovo Statement on Superfish by joshuapants on Thursday February 19, 2015 @04:49PM (#9077334)

The fact that they've gone from minor user-unfriendly features to major violations of trust doesn't speak well to their learning ability or consumer care, however.

[ Parent | on HN ]

Re:Lenovo Statement on Superfish by sjolsen on Thursday February 19, 2015 @07:19PM (#9078133)

In a company as big as Lenovo, I'd be kind of surprised if the person or persons who decide what bloatware to load onto the consumer image make any sort of hardware decisions.

There's also that this particular kind of compromise is basically inapplicable to hardware. What are they going to do, put a 3G radio in your laptop that broadcasts your "data" via the cell network to Belarus?

[ Parent | on HN ]

Re:Lenovo Statement on Superfish by waps on Thursday February 19, 2015 @09:48PM (#9078625)

This provides some details :

http://thehackernews.com/2015/02/hard-drive-firmware-hacking...

So no, they'll get a rootkit process running on your machine and (for instance) upload everything on your hard drive through your web browser.

Another thing they've done is to upload hacked drivers to cause other hardware connected to the infected machine to physically destroy itself.

[ Parent | on HN ]

Re:Lenovo Statement on Superfish by sjolsen on Friday February 20, 2015 @01:50PM (#9082098)

There's a big difference between Lenovo selling bloatware rights to an adware company and the NSA (or whoever) bugging some hard drives.

Is that spyware Windows-specific?

[ Parent | on HN ]

Re:Lenovo Statement on Superfish by zevyoura on Thursday February 19, 2015 @01:06PM (#9075669)

There's a huge difference between bloat and malicious advertising software that creates real security holes that are invisible to the average user.

[ Parent | on HN ]

Re:Lenovo Statement on Superfish by razster on Thursday February 19, 2015 @01:30PM (#9075837)

What about the hardware level, which you cannot easily cleanup without knowing the full details of. If they're willing to try another route.

[ Parent | on HN ]