3 ms·

Shouldn't Lenovo be issuing a recall and pulling all the inventory in their distribution channel? In other words, Best Buy shouldn't be selling these things!

by guelo 12y ago

TheSoftwareGuy 12y ago
You are absolutely right, but frankly, they never should have sold them to begin with.
nandhp 12y ago
I believe Lenovo's official statement previously said "We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns." However, it now has a link to LEN-2015-010, a high-severity security vulnerability. http://news.lenovo.com/article_display.cfm?article_id=1929 http://news.lenovo.com/article_display.cfm?article_id=1929 https://news.ycombinator.com/item?id=9074676 https://news.ycombinator.com/item?id=9074676 http://support.lenovo.com/us/en/product_security/superfish http://support.lenovo.com/us/en/product_security/superfish
- orblivion 12y ago
  They didn't even close all their parentheses.
remarkEon 12y ago
Yes to both.
nness 12y ago
It's not in Lenovo's interest to voluntarily recall anything, unless they wanted to save face, but I would imagine consumer expectations on Lenovo are different than, say, a car manufacturer. But unlike a car manufacturer, I doubt any governments will compel them either... since this kind of thing is exactly what a government would want.
arthurfm 12y ago
According to the Wall Street Journal [1], Lenovo are going to release a program that completely removes Superfish from their PCs. > WSJ: What are you doing now to ensure the security of people who bought Lenovo laptops with the Superfish app? > Hortensius: As soon as the programmer is finished, we will provide a tool that removes all traces of the app from people’s laptops; this goes further than simply uninstalling the app. Once the app-wiping software is finished tonight or tomorrow, we’ll issue a press release with information on how to get it. [1] http://blogs.wsj.com/digits/2015/02/19/lenovo-cto-were-working-to-wipe-superfish-app-off-of-pcs/ http://blogs.wsj.com/digits/2015/02/19/lenovo-cto-were-worki...
- cnvogel 12y ago
  Also from this Article: ❝WSJ: Isn’t the best prevention tool to simply stop pre-loading any software on Lenovo computers? Hortensius: In general, we get pretty good feedback from users on what software we pre-install on computers.❞ Probably it would be a good idea, if this is really what the company things is true, that upon first boot a menu is opened asking for the particular programs to install? Thanks for buying a Lenovo product. To get the most out of your new high-performance mobile workstation, the following software products can be installed free of charge by ticking the check-box and clicking 'Next'. [x] Superfish Ad-Injector, making your web-browsing experience miserable and yourself vulnerable to Man-in-the-Middle-Attacks when doing facebook and online banking. [x] Limited trial of Super-High-Security-Internet- Security-Anti-Vius which will constantly nag you about paying for the full product (...)
jfindley 12y ago
Pulling unsold inventory would be in some ways far harder to do for the consumer computing industry than many other industries more commonly known for recalls (auto, pharma, etc) - these laptops won't just be sold at the large outlets that have properly managed supplier relationships with Lenovo, they'll also be sold at innumerable tiny independent stores, that probably got their stock from a reseller - or even a reseller of a reseller. Thus tracking down all the stock and issuing recall notices would be hard. But recalling already-sold inventory? Even disregarding the difficulty and inconvenience, this would be a terrible idea. In order for them to be able to remove this, they'd need to be able to log in to your computer, and change the security settings, as well as modify the recovery partition. I doubt I need to explain why giving your login credentials to Lenovo is a terrible idea! In reality then they've done the only reasonable thing they could do - post a statement with clear removal instructions. They didn't have a lot of choice admittedly, so I'm not particularly lauding them for this - once you've made enough of a mistake to appear in mainstream media (the story was on the BBC website, and there was a fairly large article in my newspaper this morning), you can't really get away with doing nothing if you'd like to continue selling laptops.
- dagw 12y ago
  In order for them to be able to remove this, they'd need to be able to log in to your computer, They could offer to re-image the hard drive with a non-infected image.

Shouldn't Lenovo be issuing a recall and pulling all the inventory in their distribution channel? In other words, Best Buy shouldn't be selling these things!

by guelo 12y ago

Shouldn't Lenovo be issuing a recall and pulling all the inventory in their distribution channel? In other words, Best Buy shouldn't be selling these things!

TheSoftwareGuy 12y ago

You are absolutely right, but frankly, they never should have sold them to begin with.

nandhp 12y ago

I believe Lenovo's official statement previously said "We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns." However, it now has a link to LEN-2015-010, a high-severity security vulnerability. http://news.lenovo.com/article_display.cfm?article_id=1929 http://news.lenovo.com/article_display.cfm?article_id=1929 https://news.ycombinator.com/item?id=9074676 https://news.ycombinator.com/item?id=9074676 http://support.lenovo.com/us/en/product_security/superfish http://support.lenovo.com/us/en/product_security/superfish

orblivion 12y ago
They didn't even close all their parentheses.

remarkEon 12y ago

Yes to both.

nness 12y ago

It's not in Lenovo's interest to voluntarily recall anything, unless they wanted to save face, but I would imagine consumer expectations on Lenovo are different than, say, a car manufacturer. But unlike a car manufacturer, I doubt any governments will compel them either... since this kind of thing is exactly what a government would want.

arthurfm 12y ago

According to the Wall Street Journal [1], Lenovo are going to release a program that completely removes Superfish from their PCs. > WSJ: What are you doing now to ensure the security of people who bought Lenovo laptops with the Superfish app? > Hortensius: As soon as the programmer is finished, we will provide a tool that removes all traces of the app from people’s laptops; this goes further than simply uninstalling the app. Once the app-wiping software is finished tonight or tomorrow, we’ll issue a press release with information on how to get it. [1] http://blogs.wsj.com/digits/2015/02/19/lenovo-cto-were-working-to-wipe-superfish-app-off-of-pcs/ http://blogs.wsj.com/digits/2015/02/19/lenovo-cto-were-worki...

cnvogel 12y ago
Also from this Article: ❝WSJ: Isn’t the best prevention tool to simply stop pre-loading any software on Lenovo computers? Hortensius: In general, we get pretty good feedback from users on what software we pre-install on computers.❞ Probably it would be a good idea, if this is really what the company things is true, that upon first boot a menu is opened asking for the particular programs to install? Thanks for buying a Lenovo product. To get the most out of your new high-performance mobile workstation, the following software products can be installed free of charge by ticking the check-box and clicking 'Next'. [x] Superfish Ad-Injector, making your web-browsing experience miserable and yourself vulnerable to Man-in-the-Middle-Attacks when doing facebook and online banking. [x] Limited trial of Super-High-Security-Internet- Security-Anti-Vius which will constantly nag you about paying for the full product (...)

jfindley 12y ago

Pulling unsold inventory would be in some ways far harder to do for the consumer computing industry than many other industries more commonly known for recalls (auto, pharma, etc) - these laptops won't just be sold at the large outlets that have properly managed supplier relationships with Lenovo, they'll also be sold at innumerable tiny independent stores, that probably got their stock from a reseller - or even a reseller of a reseller. Thus tracking down all the stock and issuing recall notices would be hard. But recalling already-sold inventory? Even disregarding the difficulty and inconvenience, this would be a terrible idea. In order for them to be able to remove this, they'd need to be able to log in to your computer, and change the security settings, as well as modify the recovery partition. I doubt I need to explain why giving your login credentials to Lenovo is a terrible idea! In reality then they've done the only reasonable thing they could do - post a statement with clear removal instructions. They didn't have a lot of choice admittedly, so I'm not particularly lauding them for this - once you've made enough of a mistake to appear in mainstream media (the story was on the BBC website, and there was a fairly large article in my newspaper this morning), you can't really get away with doing nothing if you'd like to continue selling laptops.

dagw 12y ago
In order for them to be able to remove this, they'd need to be able to log in to your computer, They could offer to re-image the hard drive with a non-infected image.