I've been using GPG heavily for as long as it has existed, but I have never published my keys to the keyserver pool, and probably never will. I suspect I'm far from the only one. I think that his metric may not indicate what he thinks it does.

As near as I can tell, av-totals is just measuring how effective things are in terms of antivirus. They don't appear to be analyzing the AV software itself for security problems such as the bogus cert. That's not a fault with them -- that's expecting them to be doing something they aren't claiming to do.

There's your problem. People rating apps generally haven't performed security audits.

Because knowing and caring are two different things.

Because Lenovo has demonstrated such an extreme amount of bad judgement with this Superfish thing that it demonstrates that the company cannot be trusted at all. Thinkpads may not have Superfish installed -- but they might have other things that are awful, or Lenovo might start putting awful things into their business products as well. In other words, if Lenovo can think that putting Superfish onto cheap consumer computers is just fine, they are capable of pretty much anything else as well.

If I were to use Apple products, I'd have to either use OSX, which I loathe, or replace the OS, which means that there is no point, since I can replace the OS on x86 machines too.

As bad as all that shovelware is -- and it is bad -- This Superfish thing is far worse. It is active spyware that opens your machine up to be easily hacked by anybody.

It doesn't matter. That they were willing to do this on low-cost consumer machines indicates a lack of judgement that reflects on all aspects of their company.

Lenovo is Chinese. How do executives in the Chinese executive class fail?

I might agree with you if their initial response hadn't been lying (they claimed that they thoroughly tested and there was no security risk) and designed to avoid taking real responsibility (we did this for you!)

It can be, in the right context. Amazon showing me ads for other Amazon products I might like is acceptable -- I'm already shopping, after all. My computer injecting ads into random web sites is not acceptable, nor is it useful. It's malware. Showing ads in any context where I'm not actually shopping is never actually useful to me, but would be tolerable if there were no tracking going on.

I honestly don't see any benefit to what Superfish does whatsoever. So, as I said, they might not be lying -- in which case they're delusional.

Yes, but that has nothing to do with why computers don't come with a DVD of Windows anymore. I'd always raged at the OEMs for that, but apparently I should have been raging at Microsoft.

Also, the "signature edition" stuff is just insulting. I'm not about to buy an OS twice just to get what I should have had in the first place.

Well, they'll miss it then! Their reputation is now that they are a sleazebag company willing to compromise their customers security so they can make a few bucks injecting unwanted advertising, then lying about the security risk when they got caught.

That's a company I will never do business with again.

Yes, that response was insufficient on a number of points. But what struck me about their statement was this:

Why in the world do companies keep insisting that datamining and delivering ads "enhances the experience for users"? They can't possibly believe that. If they do, then they're hopelessly delusional. If they don't, then they're scumbag liars. Either way, it does nothing but make them look terrible.

I was going to say something like this. Linux has been as easy (or easier, with some distros) to install as Windows for years now.

That was because of Microsoft? I hate, hate, hate that practice, but I assumed that it was just because the computer manufacturers wanted to save a dime.