Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Superfish Funder List

qntra.net

Post reply on HN
Print view View original

51–60 of 90 posts

Re: The Superfish Funder List

#51

Post by clwg »

hoodoof wrote: post #32

Draper Fisher Jurvetson = SuperFish? Classy. Ultimately its worth remembering this is Windows..... Microsoft has to be responsible for the crapware installed when people buy a Windows computer. The reasonable conclusion is that if you buy Windows you risk stuff like this because Windows resellers install crapware on top of clean Windows builds.

I used to work in security for one of the big OEM hardware vendors, Microsoft has been working with all vendors for years trying to secure the Window's ecosystem by extending out their SDLC and providing free security services and training to OEM partners.

We use to ship them our consumer laptops for testing, and the result was always the same "get rid of the crapware". MS is probably more upset about this than anyone, because ultimately this isn't about Windows at all, but people don't differentiate between Windows and the garbage that OEM's throw on their boxes, so they get blamed as well.

Re: The Superfish Funder List

#52

Post by [deleted] »

comboy wrote: post #49

Apart from discouraging future VCs, legit question - do you think those listed ones had any idea about how does it exactly works? I mean, you need to be careful what you support, so I think that list is great anyway, just wondering how it usually looks like.

[deleted]

Re: The Superfish Funder List

#53

Post by rayiner »

madaxe_again wrote: post #16
Tepix wrote: post #14

Earlier quoted context omitted.

Shouldn't it work both ways then? If you're not culpable for offenses, why are you proud of achievments that you have nothing to do with?

Jingoism.

Hardly.

Countries inculcate values, educate people on the public dime, support R&D, etc. People should be proud when those policies bear fruit. E.g. Sergei Brin's family emigrated to the U.S. when he was six, because of Soviet discrimination against Jews. E.g. they were graded harder on university entrance exams, or given tougher exams altogether. He went to public high school and college, and went to graduate school at Stanford on a National Science Foundation fellowship. And Stanford, as an institution, heavily benefits from public spending on research.

So why shouldn't Americans take a little credit for Brin's success?

Re: The Superfish Funder List

#54

Post by jgalt212 »

keslag wrote: post #40
Fede_V wrote: post #36

One of the most effective ways we can shut down companies that make this kind of crapware is public shaming. Publicly naming companies and executives associated with this horrendous breach of privacy and security should hopefully serve as a deterrent for VCs who are considering making a quick buck by funding companies that are fucking over non-tech literate consumers.

Publicly shaming Comcast doesn't seem to be working, at all. I think it's good in theory, but doesn't work so well in practice.

I'm not so sure about that. Within a few weeks of the Time Warner/Comcast merger announcement (which has still yet to occur), I closed my Time Warner account and opened up one with the Verizon.

I don't have a ton of love for Verizon, but certainly the lesser of two evils.

Re: The Superfish Funder List

#55

Post by snarfy »

keslag wrote: post #40
Fede_V wrote: post #36

One of the most effective ways we can shut down companies that make this kind of crapware is public shaming. Publicly naming companies and executives associated with this horrendous breach of privacy and security should hopefully serve as a deterrent for VCs who are considering making a quick buck by funding companies that are fucking over non-tech literate consumers.

Publicly shaming Comcast doesn't seem to be working, at all. I think it's good in theory, but doesn't work so well in practice.

It's misdirected. There needs to be legal consequences. There is nothing about maximizing profits that says be a moral citizen when doing so. The only way any corporation will be reigned in is through the legal system.

We should be publicly shaming the politicians that let this (comcast) happen or worse, are a part of the scam.

Re: The Superfish Funder List

#56

Post by flatline »

finnn wrote: post #2

>CoinBase, an similar anti-privacy company Really? How is looking at public blockchain data at all similar to installing malware?

The very notion of a service like coinbase is problematic, and coinbase's implementation is especially poor for privacy. First, they are taking an inherently trustless system and demanding a very high level of trust for AML/KYC requirements, which is unavoidable when dealing with fiat conversions. Why not just trade directly in bitcoin (of course few people want to do this which is why coinbase exists)? Specifically however, coinbase by default keeps your private keys under their control, which is where the bigger violation is IMO. They push everyone to go through their service and not use bitcoin directly, so they can track and control everything. The blockchain may or may not even be involved in some of their schemes (they offer a fiat-fiat service that supposedly involves bitcoin!). This is inevitable, as they are a company out for profit not an idealistic bunch of ancap hackers, but they are not just looking at public blockchain data. Even their name is a conflation, coinbase is a technical term for the block reward transaction.

Re: The Superfish Funder List

#57

Post by murbard2 »

Why is Superfish getting all of the heat, while Komodia gets comparatively very little?

A product that injects ads in your web traffic is crapware, but the scandal here isn't that superfish was crapware, the scandal is the security hole it introduced, which compromised Lenovo users. Yes, we all hate crapware, but there's a big difference between bothering people with sneaky, unwanted, ads, and opening the doors for malicious parties to intercept their online banking credentials.

However, a SSL intercepting software does not need to expose such a security flaw. It was only Komodia's moronic implementation which did so. If instead of using a fixed private CA key, they had generated one on the fly when the software is run for the first time, users wouldn't have been exposed.

Regarding the VCs, I would give them the benefit of the doubt as well. What where they pitched? SuperFish was about shopping using image recognition. For all I know, they raised money on a pitch about offering a search service, and then ended up pivoting. I don't know for sure if that's the case, but it's possible, and the VCs should get a chance to tell their side of the story before being dragged in the mud.

Re: The Superfish Funder List

#58

Post by ffumarola »

murbard2 wrote: post #57

Why is Superfish getting all of the heat, while Komodia gets comparatively very little? A product that injects ads in your web traffic is crapware, but the scandal here isn't that superfish was crapware, the scandal is the security hole it introduced, which compromised Lenovo users. Yes, we all hate crapware, but there's a big difference between bothering people with sneaky, unwanted, ads, and opening the doors for m…

It's not just that Komodia used the same root cert. It goes a bit deeper than that: https://blog.filippo.io/komodia-superfish-ssl-validation-is-...

Re: The Superfish Funder List

#59

Post by elcct »

murbard2 wrote: post #57

Why is Superfish getting all of the heat, while Komodia gets comparatively very little? A product that injects ads in your web traffic is crapware, but the scandal here isn't that superfish was crapware, the scandal is the security hole it introduced, which compromised Lenovo users. Yes, we all hate crapware, but there's a big difference between bothering people with sneaky, unwanted, ads, and opening the doors for m…

Injecting ads into traffic is basically stealing advertising space from websites. They should sue the living shit out of Lenovo.

Re: The Superfish Funder List

#60

Post by teddyh »

fooqux wrote: post #48
keslag wrote: post #40

Earlier quoted context omitted.

Publicly shaming Comcast doesn't seem to be working, at all. I think it's good in theory, but doesn't work so well in practice.

You and the parent are both right. The problem with Comcast is that many people (I being one of them) have no choice in the matter. It doesn't matter how much I despise my ISP, for they are literally the only game in town. My vocation dictates I have high-speed internet, thus I'm forced to work with Comcast. Shaming Lenovo or its partners can make a difference because people do have a choice here. There are many lapt…

> My vocation dictates I have high-speed internet, thus I'm forced to work with Comcast.

Or move. Sorry to sound like a Comcast apologist, but it annoys me when people claim that they’re being “forced” to do something when they aren’t explaining why the obvious alternatives are unacceptable. I mean, maybe you can’t move because of your job. Or maybe you can’t afford to move. Or you have to live where you do because of your health. Or you can’t leave the state for legal reasons.

(This post is not in any way intended to condone or support the actions of Comcast or that of any other ISP.)

Post reply on HN