Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lenovo Statement on Superfish

news.lenovo.com

Post reply on HN
Print view View original

191–200 of 312 posts

Re: Lenovo Statement on Superfish

#191

Post by danielki »

xioxox wrote: post #184

I have a Lenovo laptop and had the superfish root cert installed. I also have a "Nuance" trusted root certificate installed. It's a SHA1RSA certificate issued by Nuance, expiring in January 2040 (serial 9e ef 9d f5 9a...), thumbprint (51 2d 19 4d 28 64...). It says it's usable for everything. Does anyone know about this one?

Nuance makes Dragon Naturally Speaking, which also comes preinstalled on some Lenovo laptops (including mine, but it was one of the first things I uninstalled). I'd imagine it has something to do with being able to voice control applications/websites/whatever-Dragon-does. If you don't use Dragon, you can probably safely delete it.

Re: Lenovo Statement on Superfish

#192

Post by notsony »

lilyball wrote: post #131
notsony wrote: post #118

Earlier quoted context omitted.

Why stop buying Thinkpads? Lenovo have acknowledged the issue and are now trying to resolve it. Everybody makes mistakes but how they fix those problems tells you a lot about the culture of the company. Lenovo also made a terrible mistake in removing the physical click buttons, but is now reintroducing them across their entire laptop range for 2015. What I see is a company willing to listen and admit their mistakes.…

If I'm reading you correctly, you're making the argument that Lenovo, the company that was just discovered to have been intentionally shipping a massive security vulnerability on their laptops, is still thought of by you as listening to their users better than Apple, the company that would never in their wildest dreams even remotely consider the idea of putting something like Superfish on their computers, simply beca…

Clearly Lenovo are stupid for bundling third-party ad-injection software, but who knows what Apple are doing behind closed doors? e.g. CarrierIQ in the baseband... etc.

Re: Lenovo Statement on Superfish

#193

Post by jdjb »

wvenable wrote: post #56
pcora wrote: post #2

"We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns." Seriously?!

I expected that quote, but this one is even more off the rocker: "The relationship with Superfish is not financially significant; our goal was to enhance the experience for users." Right.

"We thought that performing an SSL MitM on our users to serve targeted ads would improve their experience. What a shocker when we found out we were wrong!"

Re: Lenovo Statement on Superfish

#194

Post by TeMPOraL »

ptaipale wrote: post #117
lifeformed wrote: post #26

"Superfish was included [...] to help customers potentially discover interesting products while shopping". Wow how thoughtful and helpful of them. I don't understand the point of bloatware. Are the manufacturers making a ton of money off of them or something? How much could bloatware writers possibly be offering to make it worth uglifying your brand?

Yes, "ton of money" meaning a few grand. I think manufacturers are selling their reputation for too cheap. There of course is a point that each manufacturer would like to provide some added value through software that would set them apart from other vendors - because hardware competition is so fierce - but unfortunately their priorities for selecting the vendors they use are really bad. Much of the crap is just horri…

Yup. You know how real value-add looks like? Permanent +50GB of DropBox I got when I bought my Galaxy S4. While I wasn't aware of it until I bought the phone and was just pleasantly surprised, it's a kind of thing that really could influence my choice of phone if I was on the edge of a choice.

Re: Lenovo Statement on Superfish

#195

Post by rmc »

notsony wrote: post #118
chinathrow wrote: post #65

Earlier quoted context omitted.

Indeed. I have been buying IBM and then Lenovo Thinkpads for ages. I hate the thought that my next machine will be another brand. Lenovo: One customer lost. More to be lost.

Why stop buying Thinkpads? Lenovo have acknowledged the issue and are now trying to resolve it. Everybody makes mistakes but how they fix those problems tells you a lot about the culture of the company. Lenovo also made a terrible mistake in removing the physical click buttons, but is now reintroducing them across their entire laptop range for 2015. What I see is a company willing to listen and admit their mistakes.…

Punish bad behaviour. It will scare other other technology companies from doing this sort of thing again. If you switch to another company, you're rewarding the new company for not putting this spyware on their machines.

Re: Lenovo Statement on Superfish

#196

Post by unprepare »

utxaa wrote: post #144
Alupis wrote: post #129

Earlier quoted context omitted.

If you re-installed your OS and didn't use the factory image (which always includes other bloatware), then you were not affected. Or if you installed another OS (Linux, BSD, etc) then you were not affected. I love my thinkpad... but I've always paved over the factory image the moment I got my new laptop. This is egregious beyond a doubt, but it does not affect me so I'm not worried about buying more of their laptops.

but what if you're a windows user? is the backup image on the drive adware free?

No, a windows user would have to buy a second copy of windows from microsoft and use that to install on the machine.

Using Lenovo's recovery images will reinstall the same bloat that it originally came with

Re: Lenovo Statement on Superfish

#197

Post by theintern »

Alupis wrote: post #129
chinathrow wrote: post #65

Earlier quoted context omitted.

Indeed. I have been buying IBM and then Lenovo Thinkpads for ages. I hate the thought that my next machine will be another brand. Lenovo: One customer lost. More to be lost.

If you re-installed your OS and didn't use the factory image (which always includes other bloatware), then you were not affected. Or if you installed another OS (Linux, BSD, etc) then you were not affected. I love my thinkpad... but I've always paved over the factory image the moment I got my new laptop. This is egregious beyond a doubt, but it does not affect me so I'm not worried about buying more of their laptops.

I love mine too, but this makes me pause. If they were willing to do something like this in software, what's to say they wouldn't do something that you couldn't just flash away? Like an 'enhanced user experience' BIOS. or hardware component? You can't just reformat those.

The, it didn't effect me because I reformatted is kind of a "First they came for the communists..." argument.

Re: Lenovo Statement on Superfish

#198

Post by tomp »

sejje wrote: post #169
tomp wrote: post #110

Earlier quoted context omitted.

In contrast, I've been refusing to opt-in to my banks online statements for a long time now, simply because I want to have important stuff (e.g. my money) printed black-on-white. Email can be easily faked.

Would it not be easy to print a fake? I don't really understand why "can be easily faked" is how you're justifying this.

That's right... I will need to check if there are any hard-to-fake signs on my bank statements (e.g. company stamps/special kind of paper/watermarks).

Re: Lenovo Statement on Superfish

#199

Post by zamalek »

chinathrow wrote: post #65
eropple wrote: post #4

> We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns. I try to be measured around here, as hard as I can. I can't formulate a polite way to respond to this claim. Lenovo, you are full of shit, and maliciously so. There is no excuse, nor forgiveness, for what you've done here.

Indeed. I have been buying IBM and then Lenovo Thinkpads for ages. I hate the thought that my next machine will be another brand. Lenovo: One customer lost. More to be lost.

> Lenovo: One customer lost. More to be lost.

Never purchased a Lenovo but I was bent on using one for my next machine. No longer. Their lies about it "not being a risk" have put the affected customers at immense risk.

Re: Lenovo Statement on Superfish

#200

Post by tempestn »

eropple wrote: post #4

> We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns. I try to be measured around here, as hard as I can. I can't formulate a polite way to respond to this claim. Lenovo, you are full of shit, and maliciously so. There is no excuse, nor forgiveness, for what you've done here.

Speaking of Lenovo being full of shit, there's also this gem:

> The relationship with Superfish is not financially significant; our goal was to enhance the experience for users.

Right. You loaded adware onto users' computers, not for financial gain, but to enhance the experience for them.

Post reply on HN