text: The head of Superfish responded to security concerns by saying the vulnerability was "inadvertently" introduced by Komodia, which built the application. In response to the criticism, Lenovo detailed that it would cease further distribution and use of the Superfish software, and offered affected customers free six-month subscriptions to the McAfee LiveSafe software. Lenovo issued a promise to reduce the amount of "Software bloat" it bundles with its Windows 10 devices, promising to only include Lenovo software, security software, drivers, and "certain applications customarily expected by users". Salon tech writer David Auerbach compared the Superfish incident to the Sony DRM rootkit scandal, and argued that "installing Superfish is one of the most irresponsible mistakes an established tech company has ever made."
  Lenovo Service Engine
  From October 2014 through June 2015, the UEFI firmware on certain Lenovo models had contained software known as "Lenovo Service Engine", which Lenovo says automatically sent non-identifiable system information to Lenovo the first time Windows is connected to the internet, and on laptops, automatically installs the Lenovo OneKey Optimizer program (software considered to be Software bloat) as well. This process occurs even on clean installations of Windows. It was found that this program had been automatically installed using a new feature in Windows 8, Windows Platform Binary Table, which allows executable files to be stored within UEFI firmware for execution on startup, and is meant to "allow critical software to persist even when the operating system has changed or been reinstalled in a "clean" configuration"; specifically, anti-theft security software. The software was discontinued after it was found that aspects of the software had security vulnerabilities, and did not comply with revised guidelines for appropriate usage of WPBT. On 31 July 2015, Lenovo released instructions and UEFI firmware updates meant to remove Lenovo Service Engine.