Just because Lenovo didn't build the software, doesn't mean they are not guilty of overlooking a serious security vulnerability by including software which provides no benefit to its customers. It's an insult to customers.
The bugs you find in openSSL and Bash are not insults, they are mistakes made by people who don't get money out of their work (and who don't go out of their way to sell / track information). Security is hard to build correctly, easy to break.
The fundamental problem is that software like this greatly increases your attack surface, and thus should only be used with careful consideration if the benefits are worthwhile. Instead, Lenovo put its users at risk without informing them or providing them with any benefit.
https://jimshaver.net/2015/02/11/decrypting-tls-browser-traf...
Before that I used Burpsuite, but that uses its own self signed cert too.
Privoxy doesn't do SSL or did I miss something?
They did put their customers up to harm, for no other reason then trying to squeeze another buck out of them. They provide no additional benefit to the customer.
OpenSSL and Bash are free services providing benefit to their users.
Komodia is to blame for making the software they make and the way they do it.
Open-source is irrelevant to this matter, but if anything the tech community is to blame for telling the world that the lock in the browser and https means the connection is secure.
(S)he picked incompetent:
> Lenovo did not vet the software properly before bundling it and heads should roll, but I do not think they are deliberately evil or malicious.
Lenovo did not vet the software properly before bundling it and heads should roll, but I do not think they are deliberately evil or malicious.
If Lenovo are to be condemned, then the entire open-source community must also condemn itself for allowing OpenSSL and Bash to have remained vulnerable for so long. Just like Lenovo, our eyes were wide shut, and it took a shock to open them.