4 ms·

It annoys me that this is being so directly compared to Superfish. Yes the technical aspect is similar but the intent is very different. Intent matters.

by nnutter 11y ago

jacquesm 11y ago
I haven't seen anything that really showed the intent of Dell, just a bunch of woolly corp-speak about improved customer service.
- s_henry_paulson 11y ago
  The intent is in the certificate. Superfish could create and sign any certificate, meaning it could impersonate websites. This certificate cannot sign other certificates, meaning it can't be used in the same way as superfish. Thus the logical intent seems to be bloatware, backdoors, etc.. not snooping on HTTPS connections. This is the distinction the person you are replying to is trying to make, because although similar to superfish, it is not quite the same.
  - tedunangst 11y ago
    If the dell cert can't be used to impersonate websites, what's with all the test websites people set up to demonstrate it?
    - nnutter 11y ago
      I think the problem is the private key is accessible AND machines were already setup to trust it (because of the cert). So what s_henry_paulson said is technically correct but it's conceptually wrong.
KirinDave 11y ago
Intent isn't magic. Jeopardizing the integrity of every secure connection for a customer is outrageous. Comparisons to Superfish are entirely appropriate. There is no product, service, business or political cause that justifies destroying the security and integrity of the internet. This places people affected by this in an incredibly risky situation. And then rather that recall the laptops, Dell is issuing removal instructions and asking customers (many of who may be receiving the laptops second hand via personal or corporate means) to fix the problem for them. If our law were even remotely up to date, this would result in at least a crippling fine for the company that did it.
jakejake 11y ago
The end result is the same but super fish was clearly and intentionally malicious (or at the very least unethical). Dell's blunder is more negligence. I'm glad that smart people are keeping an eye on these companies.
deleted 11y ago
[deleted]

It annoys me that this is being so directly compared to Superfish. Yes the technical aspect is similar but the intent is very different. Intent matters.

by nnutter 11y ago

It annoys me that this is being so directly compared to Superfish. Yes the technical aspect is similar but the intent is very different. Intent matters.

jacquesm 11y ago

I haven't seen anything that really showed the intent of Dell, just a bunch of woolly corp-speak about improved customer service.

s_henry_paulson 11y ago
The intent is in the certificate. Superfish could create and sign any certificate, meaning it could impersonate websites. This certificate cannot sign other certificates, meaning it can't be used in the same way as superfish. Thus the logical intent seems to be bloatware, backdoors, etc.. not snooping on HTTPS connections. This is the distinction the person you are replying to is trying to make, because although similar to superfish, it is not quite the same.
- tedunangst 11y ago
  If the dell cert can't be used to impersonate websites, what's with all the test websites people set up to demonstrate it?
  - nnutter 11y ago
    I think the problem is the private key is accessible AND machines were already setup to trust it (because of the cert). So what s_henry_paulson said is technically correct but it's conceptually wrong.

KirinDave 11y ago

Intent isn't magic. Jeopardizing the integrity of every secure connection for a customer is outrageous. Comparisons to Superfish are entirely appropriate. There is no product, service, business or political cause that justifies destroying the security and integrity of the internet. This places people affected by this in an incredibly risky situation. And then rather that recall the laptops, Dell is issuing removal instructions and asking customers (many of who may be receiving the laptops second hand via personal or corporate means) to fix the problem for them. If our law were even remotely up to date, this would result in at least a crippling fine for the company that did it.

jakejake 11y ago

The end result is the same but super fish was clearly and intentionally malicious (or at the very least unethical). Dell's blunder is more negligence. I'm glad that smart people are keeping an eye on these companies.

deleted 11y ago

[deleted]