When Can You Trust a Known Bad Actor Again?
-
The question came up offline of "but doesn't the government hire known bad actors all of the time?" And yes, of course they do. However this is wildly different for two key reasons.
First, the government itself is famously incompetent and insecure and has no idea how to do things in a logical or secure way. That the government's known bad practices result in bad things doesn't make things okay.
Second, this isn't what the government does. We were discussing hiring a thief as a guard. The government hires thieves to discuss being thieves. Very different things. Even the government doesn't use someone being a thief as a reason to then give the thieves access to the very things that they were trying to steal. "A" job, maybe, in some extreme cases, but the very job of protecting the things that they tried to steal, definitely not.
-
Not everything is excusable; even with time and potentially gutting the beast. There's certain things that are just a death sentence in my book. I'm fully aware of what Lenovo has done, and I'm all done recommending them. Others may not feel the same about severity.
I'm not totally aware about Barracuda with intentional malicious action, there is some stuff with their VPN side of things that I've been iffy about regarding security (thinking of Java and their weird method for authentication to a browser redirect from the local client). All I've really heard is about negligence. Care to share?
-
For absolute bald face intentional nefarious acts, the answer is never.
-
Yup, never. Another example of "never": Yahoo.
-
Didn't Dell do a 'superfish' as well?
-
@ccwtech said in When Can You Trust a Known Bad Actor Again?:
Didn't Dell do a 'superfish' as well?
Dell did a Superfish as well. Dell did NOT pull a Lenovo and put it into the irreplaceable drivers. Looking at Lenovo's attack as being an issue of "deploying Superfish" hides the real issue of having put malware into drivers that came back even in a clean install. Dell had standard bloatware that no one following even a modicum of good practices would never have even seen. So totally different. Bad, but bad in a trivial only hurts people who hurt themselves, way. Whereas Lenovo had no means of working without you being compromised and was the first vendor to ever put malware into clean drivers.
So if you see Dell's as bad in any way, Lenovo's is literally a thousand times worse. People affected by Bell's Superfish would be similar to people getting ransomware because they didn't match. Could the vendor have done something better, sure. Was there any reason for Dell to worry about having bad bloatware that everyone is supposed to remove upon receipt of the box anyway? Not really.
So was it bad, yes. But it wasn't anything like Lenovo in reality, that was click bait headlines.
What Dell did was this: "Dell is shipping computers that come preinstalled with a digital certificate that makes it easy for attackers to cryptographically impersonate Google, Bank of America, and any other HTTPS-protected website." Which is very bad, but not even slightly on par with Superfish itself, which was nothing compared to Lenovo building Superfish into the network drivers and getting those drivers to be the only ones out there. So yes, Dell did something bad, but it didn't do a Superfish.
-
@scottalanmiller said in When Can You Trust a Known Bad Actor Again?:
@ccwtech said in When Can You Trust a Known Bad Actor Again?:
Didn't Dell do a 'superfish' as well?
Dell did a Superfish as well. Dell did NOT pull a Lenovo and put it into the irreplaceable drivers. Looking at Lenovo's attack as being an issue of "deploying Superfish" hides the real issue of having put malware into drivers that came back even in a clean install. Dell had standard bloatware that no one following even a modicum of good practices would never have even seen. So totally different. Bad, but bad in a trivial only hurts people who hurt themselves, way. Whereas Lenovo had no means of working without you being compromised and was the first vendor to ever put malware into clean drivers.
So if you see Dell's as bad in any way, Lenovo's is literally a thousand times worse. People affected by Bell's Superfish would be similar to people getting ransomware because they didn't match. Could the vendor have done something better, sure. Was there any reason for Dell to worry about having bad bloatware that everyone is supposed to remove upon receipt of the box anyway? Not really.
So was it bad, yes. But it wasn't anything like Lenovo in reality, that was click bait headlines.
What Dell did was this: "Dell is shipping computers that come preinstalled with a digital certificate that makes it easy for attackers to cryptographically impersonate Google, Bank of America, and any other HTTPS-protected website." Which is very bad, but not even slightly on par with Superfish itself, which was nothing compared to Lenovo building Superfish into the network drivers and getting those drivers to be the only ones out there. So yes, Dell did something bad, but it didn't do a Superfish.
But bad is still bad. So don't buy Dell either.
In other words, one person only beats women but one murders, both are still bad right?
-
@ccwtech said in When Can You Trust a Known Bad Actor Again?:
@scottalanmiller said in When Can You Trust a Known Bad Actor Again?:
@ccwtech said in When Can You Trust a Known Bad Actor Again?:
Didn't Dell do a 'superfish' as well?
Dell did a Superfish as well. Dell did NOT pull a Lenovo and put it into the irreplaceable drivers. Looking at Lenovo's attack as being an issue of "deploying Superfish" hides the real issue of having put malware into drivers that came back even in a clean install. Dell had standard bloatware that no one following even a modicum of good practices would never have even seen. So totally different. Bad, but bad in a trivial only hurts people who hurt themselves, way. Whereas Lenovo had no means of working without you being compromised and was the first vendor to ever put malware into clean drivers.
So if you see Dell's as bad in any way, Lenovo's is literally a thousand times worse. People affected by Bell's Superfish would be similar to people getting ransomware because they didn't match. Could the vendor have done something better, sure. Was there any reason for Dell to worry about having bad bloatware that everyone is supposed to remove upon receipt of the box anyway? Not really.
So was it bad, yes. But it wasn't anything like Lenovo in reality, that was click bait headlines.
What Dell did was this: "Dell is shipping computers that come preinstalled with a digital certificate that makes it easy for attackers to cryptographically impersonate Google, Bank of America, and any other HTTPS-protected website." Which is very bad, but not even slightly on par with Superfish itself, which was nothing compared to Lenovo building Superfish into the network drivers and getting those drivers to be the only ones out there. So yes, Dell did something bad, but it didn't do a Superfish.
But bad is still bad. So don't buy Dell either.
No, bad is not just bad. These aren't comparable, at all. One is actively malicious malware against all customers. One is passively poor security against only customers that actively choose to be insecure already.
Unrelated, incomparable. One is bad, pure and simple. The other is not bad to anyone who didn't choose for it to be bad, making it not actually bad.
You are using a broad brush to paint unrelated things. Being actively evil isn't the same as not be perfect.
-
@ccwtech said in When Can You Trust a Known Bad Actor Again?:
In other words, one person only beats women but one murders, both are still bad right?
If this was comparable, yes. But we are talking about a VOLUNTARY bad thing in one case, the victim was a participant. We are talking about INVOLUNTARY in the other.
In your example, it is both involuntary, so not related to the Lenovo vs. Dell comparison.
-
@scottalanmiller said in When Can You Trust a Known Bad Actor Again?:
@ccwtech said in When Can You Trust a Known Bad Actor Again?:
@scottalanmiller said in When Can You Trust a Known Bad Actor Again?:
@ccwtech said in When Can You Trust a Known Bad Actor Again?:
Didn't Dell do a 'superfish' as well?
Dell did a Superfish as well. Dell did NOT pull a Lenovo and put it into the irreplaceable drivers. Looking at Lenovo's attack as being an issue of "deploying Superfish" hides the real issue of having put malware into drivers that came back even in a clean install. Dell had standard bloatware that no one following even a modicum of good practices would never have even seen. So totally different. Bad, but bad in a trivial only hurts people who hurt themselves, way. Whereas Lenovo had no means of working without you being compromised and was the first vendor to ever put malware into clean drivers.
So if you see Dell's as bad in any way, Lenovo's is literally a thousand times worse. People affected by Bell's Superfish would be similar to people getting ransomware because they didn't match. Could the vendor have done something better, sure. Was there any reason for Dell to worry about having bad bloatware that everyone is supposed to remove upon receipt of the box anyway? Not really.
So was it bad, yes. But it wasn't anything like Lenovo in reality, that was click bait headlines.
What Dell did was this: "Dell is shipping computers that come preinstalled with a digital certificate that makes it easy for attackers to cryptographically impersonate Google, Bank of America, and any other HTTPS-protected website." Which is very bad, but not even slightly on par with Superfish itself, which was nothing compared to Lenovo building Superfish into the network drivers and getting those drivers to be the only ones out there. So yes, Dell did something bad, but it didn't do a Superfish.
But bad is still bad. So don't buy Dell either.
No, bad is not just bad. These aren't comparable, at all. One is actively malicious malware against all customers. One is passively poor security against only customers that actively choose to be insecure already.
Unrelated, incomparable. One is bad, pure and simple. The other is not bad to anyone who didn't choose for it to be bad, making it not actually bad.
You are using a broad brush to paint unrelated things. Being actively evil isn't the same as not be perfect.
I like my broad brush.
-
Should you avoid Dell because of it? That's a grey area. But you can't not use Dell based on the same logic that you can't use Lenovo. If you feel Dell can't ever be trusted because they did something that should not affect anyone, then you need (and potentially can) make a decent logical case for that. But you can't make that case based around the logic from the Lenovo case.
I have no concern with the Dell case and see it as "not bad", that's not the same as "good". It hurt no one that didn't actively do something I would consider wrong. Dell didn't install malware, they installed a certificate. It's not good, but a proper clean install makes it not exist. So is a bad action against no one still a bad action? The multiplier is zero. So a bad action that doesn't happen is still bad, in a zero degree manner.
Vendors do dumb things, vendors make mistakes. Making a mistake, that wasn't hidden, does not make someone a bad actor. Being actively, unremorsefully, and actively malicious does make a bad actor.
-
Also, Dell apologized and immediately fixed the issue, and didn't do it again. Lenovo never admitted it was a mistake, and did it again immediately afterward but in a more insidious way showing that they were sad they got caught, not that they did it. Dell's action was pretty obviously a mistake - it was sloppy, no effort was made to hide it, they fixed it as soon as they found out. Lenovo's was not a mistake - it was elegant, loads of effort was made to hide it (and to force it back on machines after it was removed), and instead of fixing it when found they worked to make it even harder to remove.
