Lenovo Statement on Superfish • Hacker News Board

Re: Lenovo Statement on Superfish

#11

Post by resonantcore » Thu, Feb 19, 2015, 4:29 PM UTC

They disabled it server-side? What about the CA certificate in all these Lenovo users' trust stores that blackhats can now use to MITM with wild abandon?

Re: Lenovo Statement on Superfish

#12

Post by pjmlp » Thu, Feb 19, 2015, 4:29 PM UTC

jacquesm wrote: post #8

Lenovo is going to lose more through how they handle this than through the fact that they did it in the first place.

Sadly no. Businesses will still buy Thinkpads like candies.

Re: Lenovo Statement on Superfish

#13

Post by pkinsky » Thu, Feb 19, 2015, 4:30 PM UTC

I was considering getting a Lenovo X1 Carbon to run linux on. I'd be installing a clean image, so no Superfish, but I still don't want to give money to Lenovo right now.

What alternative linux laptops are there? (aside from macs)

Re: Lenovo Statement on Superfish

#14

Post by jacquesm » Thu, Feb 19, 2015, 4:33 PM UTC

pjmlp wrote: post #12

jacquesm wrote: post #8

Lenovo is going to lose more through how they handle this than through the fact that they did it in the first place.

Sadly no. Businesses will still buy Thinkpads like candies.

I'm structurally distrustful of the hardware that I buy so I rip out the drives without ever even booting them and then install Linux on a drive bought through another source. I can still see some potential issues there (drive firmware compromised, bios tricks, chipsets with junk and management devices) but that's a basic precaution against getting something you didn't actually buy.

Re: Lenovo Statement on Superfish

#15

Post by jkot » Thu, Feb 19, 2015, 4:34 PM UTC

pkinsky wrote: post #13

I was considering getting a Lenovo X1 Carbon to run linux on. I'd be installing a clean image, so no Superfish, but I still don't want to give money to Lenovo right now. What alternative linux laptops are there? (aside from macs)

Dell sells laptops with Ubuntu, its $100 cheaper. Most awesome is probably XPS 13" 2015, but it does not have official support yet.

Re: Lenovo Statement on Superfish

#16

Post by electic » Thu, Feb 19, 2015, 4:34 PM UTC

> "We will not preload this software in the future."

I know it is lucrative to preload but I really wish this practice would just die. In the long run, they are just hurting their business.

Re: Lenovo Statement on Superfish

#17

Post by de_dave » Thu, Feb 19, 2015, 4:34 PM UTC

pkinsky wrote: post #13

I was considering getting a Lenovo X1 Carbon to run linux on. I'd be installing a clean image, so no Superfish, but I still don't want to give money to Lenovo right now. What alternative linux laptops are there? (aside from macs)

The Dell XPS 13 is superb, been running Linux on it since day one. Fantastic, solid little machine.

Re: Lenovo Statement on Superfish

#18

Post by admax88q » Thu, Feb 19, 2015, 4:35 PM UTC

pkinsky wrote: post #13

I was considering getting a Lenovo X1 Carbon to run linux on. I'd be installing a clean image, so no Superfish, but I still don't want to give money to Lenovo right now. What alternative linux laptops are there? (aside from macs)

The Dell XPS is actually not bad if you're looking for an ultrabook type machine, also the HP EliteBook.

Re: Lenovo Statement on Superfish

#19

Post by ingler » Thu, Feb 19, 2015, 4:36 PM UTC

Lenovo is just copying their betters at the NSA: Infect the machines of others and when caught, deny it. Sadly, this business model will probably work for them.

Re: Lenovo Statement on Superfish

#20

Post by mmastrac » Thu, Feb 19, 2015, 4:36 PM UTC

Unfortunately the best response to this is extracting the private key for the cert it installs in the root and publishing it: http://blog.erratasec.com/2015/02/extracting-superfish-certi...