Live data from Hacker News

Lenovo Statement on Superfish

news.lenovo.com

31–40 of 312 posts

Re: Lenovo Statement on Superfish

#32
post #4

> We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns. I try to be measured around here, as hard as I can. I can't formulate a polite way to respond to this claim. Lenovo, you are full of shit, and maliciously so. There is no excuse, nor forgiveness, for what you've done here.

Can you ever imagine Apple pulling a stunt like this? No, because it’s astonishingly user hostile: Lenovo should be hanging their head in shame, not making out like it’s no big deal.

Re: Lenovo Statement on Superfish

#33

Unfortunately the best response to this is extracting the private key for the cert it installs in the root and publishing it: http://blog.erratasec.com/2015/02/extracting-superfish-certi...

OK, thanks for this. I wasn't sure if the signing of stuff was being done locally by the proxy or remotely. i.e. whether the private key was on the machines. So yes, complete security clusterfuck.

Re: Lenovo Statement on Superfish

#34
post #27

> The relationship with Superfish is not financially significant; our goal was to enhance the experience for users. I would prefer for this to be a lie than for it to turn out for this statement to be true. Surely nobody at Lenovo honestly belived that ad injection improved user experience?

Well, a lot of people use their computer to purchase things. How do people know what to purchase? Ads! Therefore more ads = more knowledge about what to purchase and results in a better user experience QED /s.

Re: Lenovo Statement on Superfish

#35
post #13

I was considering getting a Lenovo X1 Carbon to run linux on. I'd be installing a clean image, so no Superfish, but I still don't want to give money to Lenovo right now. What alternative linux laptops are there? (aside from macs)

Why does lenovo thinkpad have to be the only line of laptops that has a trackpoint by default? How hard can it be to include it for other brands? This is a very important feature for some people and it limits their choice to thinkpads and (AFAIK) some HP laptops.

Re: Lenovo Statement on Superfish

#36
post #27

> The relationship with Superfish is not financially significant; our goal was to enhance the experience for users. I would prefer for this to be a lie than for it to turn out for this statement to be true. Surely nobody at Lenovo honestly belived that ad injection improved user experience?

This would SEEM obvious because as techies we hate ads. But you can't extrapolate this to the general population.

There was one time when I visited my mother. We started her instant messaging program, and we were presented with special offers. I recognized it as such within half a second, so I almost automatically checked the 'Do not show this again' checkbox.

My mother alarmed me: "No, do not make it go away! I want to see the offers, they're useful!"

I was mindblown.

Another example: I have snail mail advertisements. But my girlfriend, who's living with me now, asked me to sign up for advertisements such as supermarket special offers. Another mindblown.

Re: Lenovo Statement on Superfish

#37
post #13

I was considering getting a Lenovo X1 Carbon to run linux on. I'd be installing a clean image, so no Superfish, but I still don't want to give money to Lenovo right now. What alternative linux laptops are there? (aside from macs)

There's System76, which are basically pre-loaded Clevo laptops (which are sold under many different names). I have the Galago Ultrapro and am quite happy with it. Good battery life, fast, user-serviceable and a calibrated IPS screen. On release the keyboard was a little off, but the new one is pretty good.

How's battery life? That was always my concern, it seemed to be quite pathetic in comparison to modern 6-12hr competitors.

Re: Lenovo Statement on Superfish

#38
post #13

I was considering getting a Lenovo X1 Carbon to run linux on. I'd be installing a clean image, so no Superfish, but I still don't want to give money to Lenovo right now. What alternative linux laptops are there? (aside from macs)

I am running the dell xps 15, works beautifully. Though the refreshed xps 13 is likely worth a look as well.

Re: Lenovo Statement on Superfish

#39
post #3
post #2

"We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns." Seriously?!

Anybody can MITM secure connections these computers make, right?

And present any HTTPS cert of their choosing to any compromised visitors e.g https://b4nk0famer1ca.com/

Re: Lenovo Statement on Superfish

#40
post #27

> The relationship with Superfish is not financially significant; our goal was to enhance the experience for users. I would prefer for this to be a lie than for it to turn out for this statement to be true. Surely nobody at Lenovo honestly belived that ad injection improved user experience?

...for users¹

¹ ...of our targeted advertising platform

Post reply on HN