Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless • Hacker News Board

Re: Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

#41

Post by mattmanser » Fri, Feb 20, 2015, 4:38 PM UTC

rcthompson wrote: post #10

I warned all my friends and colleagues who use Lenovos, and their answers were all the same. "Who'd be crazy enough to use the default install? First thing I did was (a fresh reinstall of Windows|install Linux)." (Edit: Obviously this is not representative of the general population, and I didn't mean to suggest it was. I was just noting that my efforts to warn people about the untrustworthiness of Lenovo were thwarte…

On that note, Microsoft seem to have taken down the windows digital downloads, OEM CD keys don't work. How would you do a fresh install now?

Re: Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

#42

Post by [deleted] » Fri, Feb 20, 2015, 4:40 PM UTC

eli wrote: post #39

SideburnsOfDoom wrote: post #19

While we're at it, Lenovo's statement that we might enjoy the adware: "The relationship with Superfish is not financially significant; our goal was to enhance the experience for users" is self-evidently bullshit.

The key word is significant . They're not claiming they didn't preload this software for money, they're just saying it wasn't for very much money. Such a small amount of money that they have no problem ending the relationship now that it's causing them problems. My wild guess would be they got in the ballpark of $0.25 an install.

[deleted]

Re: Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

#43

Post by SideburnsOfDoom » Fri, Feb 20, 2015, 4:40 PM UTC

eli wrote: post #39

SideburnsOfDoom wrote: post #19

While we're at it, Lenovo's statement that we might enjoy the adware: "The relationship with Superfish is not financially significant; our goal was to enhance the experience for users" is self-evidently bullshit.

The key word is significant . They're not claiming they didn't preload this software for money, they're just saying it wasn't for very much money. Such a small amount of money that they have no problem ending the relationship now that it's causing them problems. My wild guess would be they got in the ballpark of $0.25 an install.

For me the key word is "enhance". Why would Lenovo go to the trouble of bundling this, knowing full well that it doesn't actually enhance anything for end users?

Hint: It starts with $ and ends with $.

Re: Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

#44

Post by [deleted] » Fri, Feb 20, 2015, 4:40 PM UTC

eli wrote: post #39

SideburnsOfDoom wrote: post #19

While we're at it, Lenovo's statement that we might enjoy the adware: "The relationship with Superfish is not financially significant; our goal was to enhance the experience for users" is self-evidently bullshit.

The key word is significant . They're not claiming they didn't preload this software for money, they're just saying it wasn't for very much money. Such a small amount of money that they have no problem ending the relationship now that it's causing them problems. My wild guess would be they got in the ballpark of $0.25 an install.

[deleted]

Re: Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

#45

Post by devy » Fri, Feb 20, 2015, 4:45 PM UTC

I found this whole Lenovo Adware-gate very hypocritical. Why everyone blames the messenger Lenovo but not the source Superfish? Why? Is it because Lenovo is a Chinese company whereas Superfish is a Iserali-American company based in Silicon Valley?

Before this adware-gate, EVERY PC manufacturer bundles adware, HP, Dell, Acer, Lenovo, Asus to name a few top players(Apple perhaps is the only exception as I don't count them as a PC manufacturer). Did anyone bother to look if there were tons of similar security risks with those?

Re: Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

#46

Post by rdtsc » Fri, Feb 20, 2015, 4:47 PM UTC

leereeves wrote: post #3

The more they deny this is a problem, the more it damages their reputation. They should just admit the problem, thank the security experts, and develop an easy fix.

Their PR style is a bit outdated. Denying and minimizing worked before very well -- major news sources would publish the official denials only and it would kind of stop there.

And most of all it helped if there would be litigation. The thought goes if CTO goes on record admitting guilt that is a slam dunk case for anyone suing them.

Therefore the typical corporate non-apology apology "I am very sorry you feel this way" kind of bullshit.

The problem of course is information sources are a lot more diversified, with Twitter and other media bubbling up tech news to the top faster.

The other problem they are facing is a lot of technical people were their proponents and would advocate and drive purchasing decision (in turn putting their own reputation on the line). This is where it is going to hurt them.

Something to the effect of "We are very sorry, this was a mistake, here is how to remove the software, we'll send you free software or Lenovo.com discounts. We'll cut off our relationship with this company. Etc, etc.." I think would have been much better for them in the long run.

Re: Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

#47

Post by Tortuga001 » Fri, Feb 20, 2015, 4:47 PM UTC

rdtsc wrote: post #30

fown9 wrote: post #16

"Beijing-based computer maker Lenovo has reportedly been blacklisted for years by spy agencies worldwide, as concerns about government-sanctioned Chinese hacking persist. According to the Australian Financial Review, Australia, the UK, Canada, New Zealand, and the US have all rejected Lenovo machines for their top-secret networks since the mid-2000s, though the computers can be used for lower-security tasks that don'…

Well because they were making darn good hardware. I had my T60 for many many years. Carbon X1 seems nice. Now I ended up buying a cheap ASUS Chromebook for traveling, replaced drive with a large one and installed Ubuntu. But still haven't decided if I want to replace my main machine. Was eyeing Carbon X1 models for a while, but now will have to rethink. Besides, like some people here, I always wipe everyone out and r…

The T60 was one of the very first laptops Lenovo released after it purchased the IBM PC division. I wonder if it had already been in development under IBM before the purchase.

Re: Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

#48

Post by JohnTHaller » Fri, Feb 20, 2015, 4:49 PM UTC

devy wrote: post #45

I found this whole Lenovo Adware-gate very hypocritical. Why everyone blames the messenger Lenovo but not the source Superfish? Why? Is it because Lenovo is a Chinese company whereas Superfish is a Iserali-American company based in Silicon Valley? Before this adware-gate, EVERY PC manufacturer bundles adware, HP, Dell, Acer, Lenovo, Asus to name a few top players(Apple perhaps is the only exception as I don't count t…

Because there are all sorts of insecure malware/adware out there. They're all various levels of evil and a known quantity of badness.

Lenovo is a company that you paid your money to to buy a laptop. It shouldn't come pre-infected with something that compromises your security and privacy.

Re: Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

#49

Post by rdtsc » Fri, Feb 20, 2015, 4:51 PM UTC

devy wrote: post #45

I found this whole Lenovo Adware-gate very hypocritical. Why everyone blames the messenger Lenovo but not the source Superfish? Why? Is it because Lenovo is a Chinese company whereas Superfish is a Iserali-American company based in Silicon Valley? Before this adware-gate, EVERY PC manufacturer bundles adware, HP, Dell, Acer, Lenovo, Asus to name a few top players(Apple perhaps is the only exception as I don't count t…

Lenovo had a chance to redeem itself by apologizing, removing the software and quickly distancing itself from the company.

They screwed up by denying there was problem in the first place. Which means they were defending both their decision to install Superfish as well as, by proxy, Superfish itself.

Thus they are seen to be either incompetent (can't trust them) or malicious (also can't trust them).

Also consumers never bought Superfish. They paid for a relatively expensive piece of hardware from Lenovo and got screwed. They are right to blame Lenovo for it.

Re: Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

#50

Post by engendered » Fri, Feb 20, 2015, 4:51 PM UTC

devy wrote: post #45

I found this whole Lenovo Adware-gate very hypocritical. Why everyone blames the messenger Lenovo but not the source Superfish? Why? Is it because Lenovo is a Chinese company whereas Superfish is a Iserali-American company based in Silicon Valley? Before this adware-gate, EVERY PC manufacturer bundles adware, HP, Dell, Acer, Lenovo, Asus to name a few top players(Apple perhaps is the only exception as I don't count t…

Why everyone blames the messenger Lenovo but not the source Superfish?

Because Lenova is the one who took your hundreds to thousand+ dollars and in return compromised your experience (for what has to be pennies). And in this case it caused a serious security compromise?

"EVERY PC manufacturer bundles adware"

Crapware/bloatware and adware are very different things. Dell installs some bloatware crap that I can uninstall (and even that is, truly, unacceptable. Again, they can't make more than a dollar or two on that junk, yet they compromise the user experience), but they don't MITM my secure communications, or compromise my security.

This has nothing to do with Lenova being a Chinese company. Further, no one expects anything out of Superfish (some slimy adware company), but they do expect standards from Lenova.