5 ms·
I don't understand how anyone can support Lenovo after the spyware incident.
by nojito 6y ago
I don't understand how anyone can support Lenovo after the spyware incident.
- OJFord 6y agoPerhaps ignorance - link?
- oliveshell 6y ago“Alert (TA15-051A)- Lenovo Superfish Adware Vulnerable to HTTPS Spoofing”: https://www.us-cert.gov/ncas/alerts/TA15-051A https://www.us-cert.gov/ncas/alerts/TA15-051A
- TheSpiceIsLife 6y agoIf I recall correctly, this is the (one of) HN threads from the time: https://news.ycombinator.com/item?id=9072424 https://news.ycombinator.com/item?id=9072424
- deleted 6y ago[deleted]
- TheSpiceIsLife 6y agoIs there any reason to believe the current line of Lenovo laptops shouldn’t be trusted? I mean, an more or less than any other brand or manufacturer?
- nojito 6y agoWhy would you ever trust a company that did that in the first place?
- nix23 6y agoWhy would you ever trust Hardware and or proprietary Soft/Firmware.
- TheSpiceIsLife 6y agoI mean, if we're never trusting anyone who ever did anything wrong, we might as well give up now. I'm presuming either the people who transgressed in that scenario have learned, or they're no longer in a position to make those decisions, or there's more oversight etc etc etc, and / or that the community is more vigilant.
- joveian 6y agoOften because there is little practical choice. For example, Dell seems to have done the same type of thing after the Superfish incident: https://www.eff.org/deeplinks/2015/11/superfish-20-now-dell-breaking-https https://www.eff.org/deeplinks/2015/11/superfish-20-now-dell-... Personally, I try to avoid Dell because they set up their laptops such that the display doesn't work if the backup battery is dead, a move that seems entirely designed to make customers think that something more serious is wrong. Relatedly, they make the battery hard to reach (or at least made in two previous models I've seen). The trick is finding companies that are minimally decent.
- codeisawesome 6y agoOh gosh yuck, I didn't know about this. At least, the cert seems to be installed at OS level (https://duo.com/assets/pdf/Dude,_You_Got_Dell_d.pdf https://duo.com/assets/pdf/Dude,_You_Got_Dell_d.pdf) instead of BIOS (like on Lenovo) - but now I'm as wary of Dell as I am of Lenovo =/
- someperson 6y agoWell Lenovo is based in China, so suffers from the exact same security issues as Huawei, HikVision, Zoom and other arms of the government of China's intelligence services who's goal is to siphon off all commercially valuable information and pass it on to private companies like Huawei . And as mentioned, Lenovo have already been caught bundling spyware. There's no need to install overt spyware once caught the first time: It's easy to hide a backdoor in bundleware or a driver (whether proprietary or open source) to say, allow a well crafted network packet to pwn your machine while maintaining plausible deniability that it wasn't inserted on purpose. Like it or not you need to trust your vendors. I take my chances with a US owned company, because even with a free press and whistleblowers like Edward Snowden, the US has not been caught doing mass scale theft of commercial information to give to private companies with the goal of saving them R&D costs to be internationally competitive.
- geogra4 6y agoZoom is an American company.
- dungdang 6y agoand apple is an irish company, and the cruiselines are barbados companies. it's crazy there's someone who doesn't know zoom is developed in and by chinese in china, yet here we are..
- pedrocx486 6y agohttps://technode.com/2020/05/15/zoom-suspends-chinese-individuals-users-from-hosting-meetings-due-to-regulatory-demand/ https://technode.com/2020/05/15/zoom-suspends-chinese-indivi... >US based
- throwaway5543 6y agoZoom is a US owned company.
- TheSpiceIsLife 6y agoI’ll agree that is a valid concern, if your threat-model includes sensitive / secret data and state-level actor.
- throwaway5543 6y agoSame reason I now trust Dell even though the did the same. Besides, the Thinkpad line was never affected.