4 ms·
Why is Superfish getting all of the heat, while Komodia gets comparatively very little? A product that injects ads in your web traffic is crapware, but the sca
by murbard2 12y ago
Why is Superfish getting all of the heat, while Komodia gets comparatively very little?
A product that injects ads in your web traffic is crapware, but the scandal here isn't that superfish was crapware, the scandal is the security hole it introduced, which compromised Lenovo users. Yes, we all hate crapware, but there's a big difference between bothering people with sneaky, unwanted, ads, and opening the doors for malicious parties to intercept their online banking credentials.
However, a SSL intercepting software does not need to expose such a security flaw. It was only Komodia's moronic implementation which did so. If instead of using a fixed private CA key, they had generated one on the fly when the software is run for the first time, users wouldn't have been exposed.
Regarding the VCs, I would give them the benefit of the doubt as well. What where they pitched? SuperFish was about shopping using image recognition. For all I know, they raised money on a pitch about offering a search service, and then ended up pivoting. I don't know for sure if that's the case, but it's possible, and the VCs should get a chance to tell their side of the story before being dragged in the mud.
- ffumarola 12y agoIt's not just that Komodia used the same root cert. It goes a bit deeper than that: https://blog.filippo.io/komodia-superfish-ssl-validation-is-broken/ https://blog.filippo.io/komodia-superfish-ssl-validation-is-...
- murbard2 12y agoI was wondering if they even did the validation properly on the Internet facing side. Turns out they don't, wow.
- patcheudor 12y agoAlso covered on HN first: https://news.ycombinator.com/item?id=9078536 https://news.ycombinator.com/item?id=9078536
- elcct 12y agoInjecting ads into traffic is basically stealing advertising space from websites. They should sue the living shit out of Lenovo.
- glesica 12y agoThat seems like a bad precedent, I don't want my ad-blocker getting sued into oblivion because then I'd have to see ads online... :)