Live data from Hacker News

Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

wired.com

51–60 of 225 posts

Re: Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

#51

That's one example of management being utterly technologically incompetent, which unfortunately is the case in a lot of Chinese companies.

Thankfully American companies _never_ have technologically incompetent managers...

Re: Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

#52
post #30

Earlier quoted context omitted.

Well because they were making darn good hardware. I had my T60 for many many years. Carbon X1 seems nice. Now I ended up buying a cheap ASUS Chromebook for traveling, replaced drive with a large one and installed Ubuntu. But still haven't decided if I want to replace my main machine. Was eyeing Carbon X1 models for a while, but now will have to rethink. Besides, like some people here, I always wipe everyone out and r…

The T60 was one of the very first laptops Lenovo released after it purchased the IBM PC division. I wonder if it had already been in development under IBM before the purchase.

I am pretty sure it was. Mine still has the old style IBM Thinkpad logo on the case. Documentation and driver downloads pointed to ibm.com site for a long while even after the acquisition.

Re: Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

#53
post #33
post #12

I was under the impression that Lenovo supplies a lot of computers to government and enterprise contracts around the world. Was Superfish only installed on consumer oriented devices, like the ones typically found at Best Buy? I realize most large enterprise would re-image their computers before deployment. I'm shocked that Lenovo would release such a statement. The damage to its credibility is significant.

Yes, it was only installed on their consumer oriented machines. Their T model Thinkpad don't have it installed. Now the question is of course what else are they installing and what other yet undiscovered issues we'll find. It sounds like FUD but so far based on their response, they seem either incompetent (stupid) or malicious. And I don't exactly like either...

I never quite got this distinction between consumer and non consumer machines, when you can buy high end ThinkPads (but not the blocky T models) at a retailer, and are just as nice as big old blocky good old ThinkPads.

I'm really interested if a high end (but "consumer") ThinkPad like http://www.microsoftstore.com/store/msusa/en_US/pdp/Lenovo-T... that you can buy at a retail store (in this case, a special MSFT Store version that has plain Windows supposedly on it) was infected.

Re: Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

#54
post #26

Kudos to MS, srsly. lol the amount of positive press that MS has been garnering recently on HN is impressive.

Don't think it is purely happenstance. There is absolutely and unequivocally either brigading Microsoft fans, or paid shills, hitting HN hard. There was a garbage post on the front page yesterday and I left a completely benign post that didn't go with the pro-Microsoft/anti-Google narrative -- saw -11 within less than 60 seconds.

Re: Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

#55

The more they deny this is a problem, the more it damages their reputation. They should just admit the problem, thank the security experts, and develop an easy fix.

They did admit the problem and linked page describing how to remove SuperFish. > We're sorry. We messed up. We're owning it. And we're making sure it never happens again. Fully uninstall Superfish: http://lnv.gy/182BW8g https://twitter.com/lenovoUS/status/568578319681257472

Then there's a disconnect between the PR people who handle that Twitter account, and the PR people who are quoted in this story.

Re: Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

#56

The more they deny this is a problem, the more it damages their reputation. They should just admit the problem, thank the security experts, and develop an easy fix.

They did admit the problem and linked page describing how to remove SuperFish. > We're sorry. We messed up. We're owning it. And we're making sure it never happens again. Fully uninstall Superfish: http://lnv.gy/182BW8g https://twitter.com/lenovoUS/status/568578319681257472

Only after various rounds of denials followed by backlash against them. Even their "removal" instruction initially failed to fully remove the root certificate. Every single step they made PR-wise was too slow and just reactionary to the backlash. Somebody up there should be fired and replaced.

Re: Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

#57
post #13

Microsoft is currently doing Lenovo's work for them: https://twitter.com/FiloSottile/status/568800260111388672 The latest version of Windows Defender is actively removing the Superfish software and the cert. The text of the definition is here: http://pastebin.com/raw.php?i=us7iXvkn

15 years ago this would have led to rioting on slashdot and Usenet. How dare Microsoft remove someone else's software? I'm generally in favor of MS doing this specific thing, but there is potential for abuse here.

For all we know, Lenovo and Microsoft have been in communication and Lenovo asked or was ok with Microsoft doing this via Defender. Also, Defender specifically flags this issue as a "CompromisedCert", indicating that the impetus for removing it was not necessarily the app itself but because the private key for the cert was found and leaked everywhere.

Re: Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

#58
post #40
post #28

Earlier quoted context omitted.

Why buy a computer from a company that has ties to the US government, an authoritarian government that supports dictators in Africa, the Middle-East, South America, and East Asia, including torture, drug smuggling, misogyny, and has itself engaged in abduction, detention without trial, and in relation to this case, illegal interception of communications?

1.) Which US computer company has ties to US government? Literally owned by the government? 2.) How is US government authoritarian? Have you actually lived in a country that has no elected representative?

> 1.) Which US computer company has ties to US government? Literally owned by the government?

But Lenovo isn't owned by the Chinese government, either.

> 2.) How is US government authoritarian? Have you actually lived in a country that has no elected representative?

The existence of more dictatorial countries doesn't mean the US isn't authoritarian—it is a spectrum rather than a dichotomy.

Re: Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

#59

I warned all my friends and colleagues who use Lenovos, and their answers were all the same. "Who'd be crazy enough to use the default install? First thing I did was (a fresh reinstall of Windows|install Linux)." (Edit: Obviously this is not representative of the general population, and I didn't mean to suggest it was. I was just noting that my efforts to warn people about the untrustworthiness of Lenovo were thwarte…

I use a default install and I'm a techie. I just remove the bloatware first.

Sometimes this is the only way to get CPU scaling to work properly, as the drivers for the laptop's particular quirky ACPI implementation may not be available sepatately. It's no fun having a clean system that either runs at 1999 speeds or burns a hole in your desk. Linux can be a bit better on some systems, but worse on others.

Re: Lenovo's Response to Its Dangerous Adware Is Astonishingly Clueless

#60
post #8

Great... I'm the last person in the startup world still using a PC, and it happens to be a Lenovo.

And you're still running the OS that it came with? Even if you want to keep Windows, always reinstall fresh. It's far easier than trying to hunt down every piece of malware they put on it

This is repeatedly recommended, but I think it's overlooking that not all manufacturer customization is entirely evil. You then to hunt down all the drivers for bits of the motherboard. Are you sure your power consumption settings are optimal after you've done this?
Post reply on HN