Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs

blogs.wsj.com

Post reply on HN
Print view View original

41–50 of 54 posts

Re: Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs

#41

Post by xerphn »

packetized wrote: post #4

"We’re not trying to get into an argument with the security guys. They’re dealing with theoretical concerns." - Peter Hortensius I'd say that someone having cracked out the password for the private key is a bit more than a 'theoretical' concern. This might be the most tone-deaf handling of a potential PR disaster so far this year.

This says a good deal about your company's priorities.

You say you do due diligence to make sure the software you include is secure... yet you miss on such blatant vulnerabilities.

"Not doing enough" only scrapes the surface.

Re: Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs

#42

Post by wvenable »

SwellJoe wrote: post #34
wvenable wrote: post #33

Earlier quoted context omitted.

> Every single one of them denies any wrongdoing. Of course. You make out like that's a significant detail. "Large company denies liability" is not a headline. Do you honestly think Dell, HP, or even Apple would say anything differently in a similar situation? Based on the quantity and quality of the software pre-installed on every laptop I've ever owned, I'm not quite as convinced as you are that this is exclusively…

Sony shipped spyware, too. As has Samsung on their TVs. But, that doesn't mean it's OK, or that anyone should trust Lenovo because "they've been burned". Lenovo isn't the wronged party, their customers are. I'm saying I would need to see a "mea culpa" from Lenovo before I would even begin to think about trusting them.

I never intended to imply that anyone should implicitly trust Lenovo now because this happened; such a point is so ridiculous I'm surprised you believe I was making it. I also never made that point that Lenovo is somehow the wronged party -- which is again is ridiculous.

Instead, given the general attitude of most PC manufacturers with regard to what is pre-installed, I don't think boycotting Lenovo would necessarily save you from this sort of issue in the future. You're just as likely to be burned by almost any one of them. This product wasn't even made specifically for Lenovo.

Perhaps this attention will make Lenovo more careful in the future. It equally might not. It might make other manufactures more careful. Or it might make no difference at all.

Re: Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs

#43

Post by dredmorbius »

Lenovo, Peter Hortensius, Yang Yuanqing: I'm writing this on a T520i laptop. It's one of a half dozen or more IBM or Lenovo Thinkpad products I've owned personally or used through work over the past 15 years.

And yes, while I'm running my own installation of Debian GNU/Linux, I preserved the Windows installation for (very) occasional use. Only under a VM, and not in two or more years that I recall. With this news I'm strongly inclined to wipe it

But pulling crap like this is a tremendous erosion of trust. In your products. In any Microsoft Windows installation (not that I trust these in any event). It's a tremendous hit to your own brand equity, as well as Microsoft's.

The sad truth is that there are few alternatives out there, and that there are plenty of other security risks. But you can solidly bet that as a consumer and IT director I'll explore the hell out of other alternatives before making my own or corporate purchases and/or recommendations.

Re: Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs

#44

Post by bztzt »

AceJohnny2 wrote: post #23
jjoonathan wrote: post #18

Earlier quoted context omitted.

The price of "don't ascribe to malice" is that it's trivial to exploit. The most incompetent PR department in the world can have a strict adherent on a leash and barking to their tune inside of 5 minutes. Courts of law have a good reason to hold high standards of evidence. For everyone else it's just an excuse for laziness. Not that I'm any better, I just don't insist on rationalizing it :-)

I'm now old and cynical enough to understand/believe that the world is run with laziness as the prime heuristic (with secondary heurisitc being "don't die/maintain current level of comfort"). I agree that it's trivial to exploit, but I choose to believe that, in the general case, people/entities are lazier than they are evil. That said, laziness can be in the form of "not taking into account the externalities", which…

thoughtlessness and callousness are far more common sources of evil than either incompetence or malice strictly defined. "People who don't care if I live or I die".

Re: Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs

#45

Post by dredmorbius »

pekk wrote: post #37
AceJohnny2 wrote: post #7

Earlier quoted context omitted.

This is cluebat level of ignorance. I want to apply the "don't ascribe to malice what can adequately be explained by ignorance" maxim, but I'm having trouble with the "adequately" here. Either they managed to live under a rock and completely ignore everything related to the Snowden revelations, or they're willfully dismissing it. Such a pity, I was looking forward to getting an X1...

My concern when making a purchase is whether the purchase will be good for me. I would definitely wipe whatever laptop I purchased, so this story is interesting and embarrassing for Lenovo but has no effect on my own purchases which are driven by what will function well for my preferences (like good Linux support and not requiring me to use a trackpad) Given the general sliminess in computer, phone and software compa…

If Lenovo are willing to compromise user software for some perceived corporate benefit, what's to say that they're not going to compromise hardware, firmware, bootloaders, recovery tools, etc.?

I ask that from a Lenovo Thinkpad T520i, one of a half-dozen or more I've owned or used over 15+ years, and absolutely my preferred mobile hardware over that period.

Re: Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs

#46

Post by AceJohnny2 »

bztzt wrote: post #44
AceJohnny2 wrote: post #23

Earlier quoted context omitted.

I'm now old and cynical enough to understand/believe that the world is run with laziness as the prime heuristic (with secondary heurisitc being "don't die/maintain current level of comfort"). I agree that it's trivial to exploit, but I choose to believe that, in the general case, people/entities are lazier than they are evil. That said, laziness can be in the form of "not taking into account the externalities", which…

thoughtlessness and callousness are far more common sources of evil than either incompetence or malice strictly defined. "People who don't care if I live or I die".

I realize now I've been mixing up "incompetence" "ignorance" and "laziness". I used "ignorance" in the maxim in my first comment where it's actually "incompetence", and then discussed "laziness" in my followup comment. Sorry.

FWIW, I agree with you: I put thoughtlessness and callousness fall under the laziness umbrella.

Re: Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs

#47

Post by jjoonathan »

AceJohnny2 wrote: post #23
jjoonathan wrote: post #18

Earlier quoted context omitted.

The price of "don't ascribe to malice" is that it's trivial to exploit. The most incompetent PR department in the world can have a strict adherent on a leash and barking to their tune inside of 5 minutes. Courts of law have a good reason to hold high standards of evidence. For everyone else it's just an excuse for laziness. Not that I'm any better, I just don't insist on rationalizing it :-)

I'm now old and cynical enough to understand/believe that the world is run with laziness as the prime heuristic (with secondary heurisitc being "don't die/maintain current level of comfort"). I agree that it's trivial to exploit, but I choose to believe that, in the general case, people/entities are lazier than they are evil. That said, laziness can be in the form of "not taking into account the externalities", which…

I tend to suspect you're right about this being a case of malicious laziness. Once the engineers started protesting, middle management decided it was easier to feign ignorance of the problem and push on than to come up with a more legitimate value-add. Laziness-driven, but (I suspect) also entirely malicious in the sense that if you had given anyone in the room a choice between receiving a laptop with their crapware and a laptop without, they would have chosen the latter without the slightest bit of hesitation.

Then again, I may be underestimating management's ability to drink their own kool-aid.

Re: Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs

#48

Post by [deleted] »

freehunter wrote: post #14
vinhboy wrote: post #6

> Hortensius: In general, we get pretty good feedback from users on what software we pre-install on computers. LOL. Yes sir! The internet is filled with people happy about bloatware... I seriously wonder how much money they make off these bloatware providers to risk pissing off customers and devalue their brand. It can't be that much can it?

The weird part is, I've bought three Lenovos of my own and never had a problem with their preinstalled software. Some of it, like the ThiknVantage suite, can even be useful. Maybe it's because I buy from the Thinkpad line? Do they install less crap on Thinkpads than on IdeaPads or other laptops?

[deleted]

Re: Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs

#49

Post by korg250 »

wvenable wrote: post #17

I'm aware that Microsoft is legally limited from restricting what vendors can pre-load into Windows but they really should provide a technical solution. For example an operating system option to revert to absolute stock. This would necessarily be different from reinstalling from recovery (which also reinstalls the crapware).

Agreed.

But they are trying that through the signature store.

Re: Lenovo CTO: We’re Working to Wipe Superfish App Off of PCs

#50

Post by fpgeek »

packetized wrote: post #4

"We’re not trying to get into an argument with the security guys. They’re dealing with theoretical concerns." - Peter Hortensius I'd say that someone having cracked out the password for the private key is a bit more than a 'theoretical' concern. This might be the most tone-deaf handling of a potential PR disaster so far this year.

This just occurred to me: Lenovo is a Chinese company and this broke right at the start of the Chinese Lunar New Year (a Christmas-sized or arguably bigger holiday in Chinese culture). Obviously I can't prove this is having an impact, but it wouldn't shock me to find out that this contributed to the amazing PR tone-deafness and incompetence of their response so far. Of course, that wouldn't excuse any of the terrible decisions made earlier, but it would be an interesting wrinkle from the perspective of assessing their crisis-management.
Post reply on HN