Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs • Hacker News Board

Re: Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs

#31

Post by HackinOut » Thu, Feb 19, 2015, 11:33 PM UTC

skymt wrote: post #19

Hortensius says Lenovo failed in due diligence. How, exactly? The two reasons people are upset about Superfish are that it breaks web security and injects ads into pages. Hortensius doesn't believe the former, and the latter is the entire purpose of the software. The only failure he could mean, taking him at his word, is in not anticipating the backlash, because as he describes it Superfish works as intended.

Double standards are also seen in their "Removal Instructions" post on their forum. When uninstalling SuperFish, it seems suddenly important to remove the root certificate...

"It is very important to delete the certificate even though the application itself has been removed."

http://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Removal-...

Didn't seem that important earlier today: https://web.archive.org/web/20150219151726/http://forums.len...

"files in user directory will stay intact for the privacy reason. Registry entry and root certificate will remain as well. "

Re: Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs

#32

Post by ZanyProgrammer » Thu, Feb 19, 2015, 11:42 PM UTC

takluyver wrote: post #27

packetized wrote: post #4

"We’re not trying to get into an argument with the security guys. They’re dealing with theoretical concerns." - Peter Hortensius I'd say that someone having cracked out the password for the private key is a bit more than a 'theoretical' concern. This might be the most tone-deaf handling of a potential PR disaster so far this year.

> This might be the most tone-deaf handling of a potential PR disaster so far this year. I think you're assuming that the broader public shares the indignation of HN about this. On mainstream news sites, it's down under the 'technology' heading. It sounds like Lenovo is scrambling a fix that will remove the certificate. If that's out in the next day or two and they have a way to get most affected users to apply it, p…

Less technically inclined people will still buy Lenovo's lower range products, and I'm sure businesses will do the enterprise thing and continue to buy Lenovo, since they tend to be the definition of ossified. But what about power users? I think Lenovo (and ThinkPads in general) have a reputation as the power user computer for Windows and Linux users. Not the biggest hit to be sure, and nothing to get the attention of CNN, but surely Lenovo will lose a certain segment of power users.

Re: Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs

#33

Post by wvenable » Thu, Feb 19, 2015, 11:45 PM UTC

SwellJoe wrote: post #21

wvenable wrote: post #15

Earlier quoted context omitted.

Nearly every laptop is preloaded with crapware. Lenovo might have (briefly even) picked one of worst examples of it but I'm sure there are (or will be) examples of this from other manufacturers that has yet to be discovered. It might now be the case going forward that Lenovo will be a better choice. They've been burned.

There's crapware, and then there's spyware/adware. The shovelware that most vendors ship on their boxes is offensive, yes. It's annoying. It steals a little of my life each time I buy a new machine, because I have to take time to re-image the system or clean off the crap (my current HP Envy was particularly egregious in this waste of my time, in that the restore image didn't work, so I had to wait ten days to get a r…

> Every single one of them denies any wrongdoing.

Of course. You make out like that's a significant detail. "Large company denies liability" is not a headline. Do you honestly think Dell, HP, or even Apple would say anything differently in a similar situation?

Based on the quantity and quality of the software pre-installed on every laptop I've ever owned, I'm not quite as convinced as you are that this is exclusively an issue that could only ever happen to Lenovo customers.

Re: Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs

#34

Post by SwellJoe » Fri, Feb 20, 2015, 12:07 AM UTC

wvenable wrote: post #33

SwellJoe wrote: post #21

Earlier quoted context omitted.

There's crapware, and then there's spyware/adware. The shovelware that most vendors ship on their boxes is offensive, yes. It's annoying. It steals a little of my life each time I buy a new machine, because I have to take time to re-image the system or clean off the crap (my current HP Envy was particularly egregious in this waste of my time, in that the restore image didn't work, so I had to wait ten days to get a r…

> Every single one of them denies any wrongdoing. Of course. You make out like that's a significant detail. "Large company denies liability" is not a headline. Do you honestly think Dell, HP, or even Apple would say anything differently in a similar situation? Based on the quantity and quality of the software pre-installed on every laptop I've ever owned, I'm not quite as convinced as you are that this is exclusively…

Sony shipped spyware, too. As has Samsung on their TVs. But, that doesn't mean it's OK, or that anyone should trust Lenovo because "they've been burned". Lenovo isn't the wronged party, their customers are.

I'm saying I would need to see a "mea culpa" from Lenovo before I would even begin to think about trusting them.

Re: Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs

#35

Post by bluecalm » Fri, Feb 20, 2015, 12:09 AM UTC

As usual bundling stuff together is anti-consumer practice. If we have laws against bundling then it would be better world because a lot of useless at best/malicious at worst stuff wouldn't be able to get money (like crapware no-one sane would order separately).

Here is something to start with: "if you offer a product A bundled with product B you have to offer A alone for the price not more than A bundled with B"

while weak and not really addressing many issues with bundling it at least gets rid of the most blatant problem of malicious add-ons.

Then something like A for not more than price(A) + 1/2price(B) and now we are getting rid of a lot more useless stuff.

Re: Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs

#36

Post by lorddoig » Fri, Feb 20, 2015, 12:14 AM UTC

I can understand the motive, however flawed it may seem in hindsight. They were seeing dollar signs, happy shareholders, job security - so they took a chance that massively backfired.

Am I the only one who thinks they deserve a little credit for getting their CTO to publicly deal with the issue on the same day all this came to a head, including saying that a guy was literally sat coding out a removal tool right now and due for release tonight? That's a damn respectable feedback loop for a megacorp if you ask me, and we'd have a lot less to whine about here on HN if all mistakes were rectified so expeditiously.

Re: Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs

#37

Post by pekk » Fri, Feb 20, 2015, 12:16 AM UTC

AceJohnny2 wrote: post #7

packetized wrote: post #4

"We’re not trying to get into an argument with the security guys. They’re dealing with theoretical concerns." - Peter Hortensius I'd say that someone having cracked out the password for the private key is a bit more than a 'theoretical' concern. This might be the most tone-deaf handling of a potential PR disaster so far this year.

This is cluebat level of ignorance. I want to apply the "don't ascribe to malice what can adequately be explained by ignorance" maxim, but I'm having trouble with the "adequately" here. Either they managed to live under a rock and completely ignore everything related to the Snowden revelations, or they're willfully dismissing it. Such a pity, I was looking forward to getting an X1...

My concern when making a purchase is whether the purchase will be good for me. I would definitely wipe whatever laptop I purchased, so this story is interesting and embarrassing for Lenovo but has no effect on my own purchases which are driven by what will function well for my preferences (like good Linux support and not requiring me to use a trackpad)

Given the general sliminess in computer, phone and software companies, there is no "pure" option except to buy some ancient computer and never use it on the internet, like RMS. This isn't acceptable to me. I will buy what serves my own needs, and you can do whatever you want.

Re: Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs

#38

Post by spiralpolitik » Fri, Feb 20, 2015, 12:19 AM UTC

einrealist wrote: post #25

Lenovo should just offer the unbiased, truthful and transparent choice between a clean image (with device drivers) and their usual crapware image. They can then easily gather metrics on what image is selected when customers order products. Just give customers a choice!

Sadly there is no money in the clean image option for Lenovo. Margins on Non-Apple PC hardware are now so razor thin its only through the pay to play software "value-add" can companies turn enough money to justify the whole expense.

Re: Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs

#39

Post by AceJohnny2 » Fri, Feb 20, 2015, 12:40 AM UTC

pekk wrote: post #37

AceJohnny2 wrote: post #7

Earlier quoted context omitted.

This is cluebat level of ignorance. I want to apply the "don't ascribe to malice what can adequately be explained by ignorance" maxim, but I'm having trouble with the "adequately" here. Either they managed to live under a rock and completely ignore everything related to the Snowden revelations, or they're willfully dismissing it. Such a pity, I was looking forward to getting an X1...

My concern when making a purchase is whether the purchase will be good for me. I would definitely wipe whatever laptop I purchased, so this story is interesting and embarrassing for Lenovo but has no effect on my own purchases which are driven by what will function well for my preferences (like good Linux support and not requiring me to use a trackpad) Given the general sliminess in computer, phone and software compa…

Isn't Apple the least slimy in this regard?

I've been eyeing Macbooks forever, but as far as I know Linux support has never been great, despite the prevalence of their hardware. System76 sells some good Linux-oriented laptops. Some of Dell's laptops are Ubuntu-certified. I had a good HP Elitebook via work about 6 years ago, but everything I've tried of theirs over the past couple years has been throw-out-the-window bad.

Re: Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs

#40

Post by takluyver » Fri, Feb 20, 2015, 12:42 AM UTC

ZanyProgrammer wrote: post #32

takluyver wrote: post #27

Earlier quoted context omitted.

> This might be the most tone-deaf handling of a potential PR disaster so far this year. I think you're assuming that the broader public shares the indignation of HN about this. On mainstream news sites, it's down under the 'technology' heading. It sounds like Lenovo is scrambling a fix that will remove the certificate. If that's out in the next day or two and they have a way to get most affected users to apply it, p…

Less technically inclined people will still buy Lenovo's lower range products, and I'm sure businesses will do the enterprise thing and continue to buy Lenovo, since they tend to be the definition of ossified. But what about power users? I think Lenovo (and ThinkPads in general) have a reputation as the power user computer for Windows and Linux users. Not the biggest hit to be sure, and nothing to get the attention o…

They're losing favour among a - probably fairly small - segment of users. But they're probably calculating that they'd lose much more customer confidence by admitting that it's a big problem, especially before they've got a fix out.

In a couple of days, they might be much more contrite about this. But today, the PR department's number one job is to keep it from becoming a big story in mainstream media.