Hacker News Reader

Comment by jeletonskelly | Hacker News Reader

I love my Lenovo X1 Carbon. It's a really nice machine. I do run linux so I know I'm not the average user, but they haven't lost my business despite this being an epic screw-up. I think they make good machines and I'll continue to buy from them in the future, but I'll be reformatting immediately just like I've always done with any PC I've ever bought from Dell, Gateway, Lenovo, etc, so I don't have to deal with the bloat they put on their machine images.

View on HN

If they are willing to compromise you on a software level, what makes you think they aren't prepared to do so on the hardware level (presuming they already aren't).

At some point you're going to have to trust the vendor and the supply chain... unless you're prepared to build your own computer by soldering home-made components onto a bread-board! ;-)

It makes more sense to trust someone who hasn't already been caught abusing your trust.

You can make the opposite argument: since they screwed up, they will be more careful in the future. This kind of heuristic reasoning is pretty weak.

"Screwing up" implies negligence, but not malicious intent. I think it's likely a bit of both.

They did "screw up", i.e., the financial side of the business thought it was ok to hurt the user experience in order to make more money, and the engineering side was too incompetent to realize the security risk. Why would this level of demonstrated incompetence lead you to believe that they will be better in the future?

The fact that they've gone from minor user-unfriendly features to major violations of trust doesn't speak well to their learning ability or consumer care, however.

In a company as big as Lenovo, I'd be kind of surprised if the person or persons who decide what bloatware to load onto the consumer image make any sort of hardware decisions.

There's also that this particular kind of compromise is basically inapplicable to hardware. What are they going to do, put a 3G radio in your laptop that broadcasts your "data" via the cell network to Belarus?

This provides some details :

http://thehackernews.com/2015/02/hard-drive-firmware-hacking...

So no, they'll get a rootkit process running on your machine and (for instance) upload everything on your hard drive through your web browser.

Another thing they've done is to upload hacked drivers to cause other hardware connected to the infected machine to physically destroy itself.

There's a big difference between Lenovo selling bloatware rights to an adware company and the NSA (or whoever) bugging some hard drives.

Is that spyware Windows-specific?

There's a huge difference between bloat and malicious advertising software that creates real security holes that are invisible to the average user.

What about the hardware level, which you cannot easily cleanup without knowing the full details of. If they're willing to try another route.

Reply on news.ycombinator.com