more information here http://blog.erratasec.com/2015/02/extracting-superfish-certi...
Komodia is a company that makes an SSL hijacking product, as described on their site:
Our advanced SSL hijacker SDK is a brand new technology that allows you to
access data that was encrypted using SSL and perform on the fly SSL
decryption. The hijacker uses Komodia’s Redirector platform to allow you
easy access to the data and the ability to modify, redirect, block, and
record the data without triggering the target browser’s certification
warning. [1]
A necessary feature of such a product appears to be the inclusion of the private SSL key in any product using their hijacking tech and the installation of komodia as a valid certificate in the OS certificate store. Therefore, anyone who wants can buy a product using Komodia, extract the private SSL key, and MITM at will any computer infected with any product using Komodia software.Any website protected by SSL where that SSL authority isn't pinned by chrome (do other browsers have such tech?) is now trivially vulnerable to SSL hijacking by, eg, anyone in the same coffee shop or local network. And, of course, between that user and their destination site.
The current kerfuffle is due to the fact that Lenovo was caught pre-installing Superfish, an adware/spyware product -- for the users benefit! -- that, in turn, installed the Komodia ssl hijacking toolkit and broke SSL on any such infected computer.
The race is now on for every goddamn script kiddie in the entire world to the bank accounts of any suckers that trusted Lenovo. Go up to Seattle where windows laptops are more common, roll into a coffee shop, and I bet you can earn yourself some bank account logins.
ps -- this is a reason people buy macs. You get a vanilla OS install; that's currently only really available for Windows afaik from the Microsoft store.
In comparison, installing Ubuntu is a breeze, almost all the drivers you need are included with the install media and installed automatically, etc. Unless you have brand new, just-released hardware, it "just works", and even with brand new hardware there tend to be guides on the internet that are still easier than getting drivers installed on Windows.
Actual thing that happened: My mom said she needed to reformat an old laptop but didn't have the Windows media and wondered what to do. On a lark I suggested installing Ubuntu. A few weeks later, having not heard anything, I asked what happened to the laptop. She said she installed Ubuntu and it worked great. Never asked me a single question.
Not just the drivers, but pretty much everything I need for a new Linux system is available through apt. For windows, one must go to a dozen websites, download packages, and click next 10 times in each idiosyncratic install "wizard".
I had a similar experience with my mother, as well – I was constantly having to intervene with tech-support before I installed Ubuntu on her machine.
That's because it is. Windows: do nothing, it's already installed. Linux: you have to install.
People compare what they have to do to get Windows on a new machine, which almost always (unless it's an Apple) already has it installed, with what they have to do to get Linux on a new machine, which almost always requires it to be installed. Even the simplest installer will be more difficult than "nothing".
If computers didn't come with any preinstalled operating system, the general opinion would be different.
(That said, most of the "Linux is difficult to install" sentiment is probably either based on outdated information from the time when you had to manually configure everything, or someone who had difficulties because of unsupported or poorly supported hardware.)
I'm more thinking about setting up a new system. Whether it's Windows or Linux, I need to obtain things like an FTP program, a photo editor, a torrent manager, firefox, and so forth. It's a lot easier on Debian than Windows because you can get all of those in 5 minutes from the command line.
Though I was installing from an MSDN install DVD which isn't something everybody would have on hand.
EDIT: I had the OEM Product Key on the Sony and AW, and they both registered fine without a problem, no need for pirated versions or any taxes.
1) Windows Update can't help you install your network driver. :)
2) My experience is that only some drivers were available through Windows Update, while others were not.
http://www.microsoft.com/en-us/download/windows-usb-dvd-down...
How should the UEFI cause the piracy warning to be displayed? Much more likely: Those people got their 'other' installation medium from ~somewhere~ and the activation failed.
Booh for Lenovo's actions and a crappy recovery medium, but I highly doubt that _this_ is actually more than FUD.
For most of us hacker news reader, it's nothing out of the ordinary. It can be a little bumpy once in a while (UEFI sometimes) and it's usually faster to simply take 30 minutes to uninstall the crapware.
Personnally I start by imaging the hard drive, then I wipe ip and install whatever is required at the time usually a gnu/linux flavor or a windows 7.
For most people, it's not going to happen without help.
This does sound like a good argument for wiping the OEM windows 7 pro partition on my laptop, and install a windows 10 trial or something (I currently just run Debian GNU/Linux on it -- but it's technically dual-boot).
So I installed a pirated Windows.
The easy option is to phone microsoft support and explain the problem, you most probably will be given a new valid key. Other options for techies includes using OEM install medium or installing a free software OS.
Nowadays there's no licence key to type anymore, it's included in the hardware sold with windows 8 (which is worse).