Slashdot Mirror
McAfee To Pay For PC Repairs After Patch Fiasco
Barence writes "McAfee has offered to pay for the PC repairs of consumers affected by last week's faulty antivirus update. The problematic patch falsely identified the SVCHOST.EXE Windows file as a virus, causing PCs running Windows XP SP3 to crash or enter endless reboot cycles. In a blog post addressed to 'Home or Home Office Consumers,' the company offered to reimburse PC repair expenses, though there was a notable caveat. 'If you have already incurred costs to repair your PC as a result of this issue, we're committed to reimbursing reasonable expenses,' the company said. 'Reasonable expenses' has yet to be formally defined."
I'm pretty sure that reimburshing my IT department's lost money and time is pretty reasonable considering I spent two days walking to every computer on the campus.
Reimburse them ... or ... maybe what they should do is give the "victims" extended subscriptions instead ... that's probably exactly what they want ;-)
A 2 year extension? What, so they can have 730 more days to do it again?
I don't see how this even begins to approach the amount they are in for.. they are going about it the wrong way. In signing up to pay home/ home office users, they are automatically assuming guilt for themselves (as if anyone wasn't sure that they were guilty in the first place?)
First off, they are starting with home / home office users. This population will incur the highest cost per computer to fix - i.e. instead of paying 1 IT guy 30/hr to fix a bunch of computers in one place, this is one-at-a-time visits to Geek Squad (ugh) or whatever which will run 50+ per computer..
This is just opening the door for future corporate lawsuits - i.e. "Clearly they have said that they were the cause of this issue and are willing to refund some of their users to the tune of X for just ONE computer. My company lost 1000 computers, I want 1000x dollars, plus lost productivity."
Currently they are extending subscriptions by two years. Enough to prevent any successful bid by IT personnel to get higherups to approve a switch. Now whether they will cover the actual cost of lost productivity, not just of IT staff but by the company as a whole.
Didn't Google mark all websites as malware-infested about a year ago? All it takes is some engineer to mistype a single keystroke (a "*" in Google's case) and down the whole system comes.
What quality control system?
The epic fail was the initial bug. This response however is exactly what McAfee should be doing. Offering fairly spontaneously to reimburse people for their expenses incurred is good customer service and good damage control. It is also the ethical thing to do. When something is both the most ethical and most business-savvy course of action, that's a good thing. And that they are willing to do so when it essentially admits to the fact that they screwed up big time shows that they are willing to admit to their mistakes, something many people are not. When evaluating both corporations and people, look at how they respond to the serious failures and crises. McAfee has a good response.
Why would you willingly use McAfee in any way after this? Why not just go with AVG or Avast or MSE?
All it takes is some engineer to mistype a single keystroke (a "*" in Google's case) and down the whole system comes.
A single engineer to mistype a single keystroke + A director of quality that proposed/allowed a quality control methodology that didn't include a single check between the engineers coding and the public receiving a new version.
Laying blame on those who don't have a large scale responsibility is, very often*, wrong.
*: Yes, a dev could've set a logic bomb when suspecting he'd be fired. And even then most of the blame was on the one who lost control on the future firing info.
And people wonder why I rarely use virus software. The damage caused by the AVS is often worse than the actual virii or spybots. Seeing a "Windows XP can't boot" message is pretty damn annoying. I ended-up having to install KDE Ubuntu Linux instead, and never did recover my lost files (just videos fortunately).
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
I was thinking this would be a boon for me. I do in home and business support in my off hours, good spending money. However, due to my issues with McAfee, none of my regular clients use McAfee AV products.
So, if I had recommended McAfee to my clients, I would be a rich person now. Damn, doing the right things doesn't make as much money!
What could possibly go wrong?
Using the made-up "virii" as a plural for viruses makes you look like a retard.
AV industry is just one big fuck up.
Instead of building a true behaviour based, sandbox'y style AV solutions, they peddle their ugly products and never exchange their virus signatures leading to a situation when no AV can detect all existing viruses, and no AV is even remotely future-proof in defeating unknown malware types.
And let this McAffee debacle become the next little step in embracing of open source OS'es by the corporate world.
What, if any, level of incompetence would (legally) be "indistinguishable from malice"...
Obviously, by installing an AV product, you indicate a desire for it to perform certain operations on your system, and an acceptance of the fact that it will probably tank your I/O performance and so forth. And, in general, courts have generally accepted the notion that vendors are nominally, at best, liable for buggy software.
In this case, albeit unintentionally, McAfee ended up committing several hundred thousand hack attacks. Disabling thousands of computers, including plenty that would fall under the CFA's definition of "protected computers".
Thought experiment: If some punk kid had accidentally disabled some hundreds of thousands of computers(along the lines of that old accidental self-replicator worm, or something), what parts of the book would they be throwing at him right now? Are McAfee's actions just a desperate attempt to keep some of their burned customers, or do they fear something more serious here?
Maybe it will cost them a fortune. Or maybe they'll make everyone trying to file a claim jump through unreasonable hoops and end up paying almost nothing.
Extending a license for 2 years costs them NOTHING if the customer would have left.
And that's just for home users. There's still no word on other users (like school districts).
"Ladies and gentlemen, coming to to you all the way from Seattle, Washington, the one, the only - Patch Fiasco!"
or perhaps...
(Twelve bad guys lie dead or mortally wounded on the street, surrounded by astonished and bewildered townsfolk. One speaks up.)
- Who are you?
(the man lights a cigarette, drags it in and exhales, then adjust the brim of his hat.)
- My name... is Patch Fiasco. (turns around and starts walking away. music: mournful slide guitar)
Prisencolinensinainciusol. Ol Rait!
At this point, an offer to pay "reasonable" expenses is about as generous as Ford apologizing for selling a car airbag that deploys as soon as you sit in the seat. Plus, it's covered in broken glass and rusty nails. Also, lemon juice.
It's nice that they're taking responsibility and all, but a bodyguard who beats up his own client isn't really the sort of person that you give second chances to.
If you were blocking sigs, you wouldn't have to read this.
Virusesii, obviously.
Be wary of any facts that confirm your opinion.
Come on guys, I hate McAfee as much as you do but "reasonable expenses" makes perfect sense and it's not something you can easily quantify everywhere... but we all know how ridiculous some potential charges are or how some stupid customers are. I can see some stupid, stupid people thinking they need to go out and buy a new 500 dollar computer to fix this problem.
I have sigs turned off.
Under the influence of Post-Cyberpunk Gonzo Journalism
True, then again, accepting this payback probably excludes them from any other settlement. So a user has an option - get a refund for getting their computer fixed, or getting a coupon for a free 6 months of McAfee, but having to pay to fix their computer. The really dumb ones get a coupon and a broken computer.
Also, McAfee will probably hide behind the EULA for the class action, since the EULA probably also said they don't have to pay if they screw up your system anyhow.
Ignoring, of course, that this is only reimbursing the private-use of the program. As of now, the corporations who were affected quite severely financially (for following suggested security measures) are still out in the cold.
Write your representatives! Repeal the 2nd Law of Thermodynamics!
AVG burned us with proxies. Did you forget?
This post contains benzene, nitrosamines, formaldehyde and hydrogen cyanide.
or, it's just a case of statistics being a bitch. given the number of updates that have to be pushed through the system, it's only a matter of time before the process lets a faulty one through. that it was so egregious is, well, unfortunate.
But svchost.exe *is* a virus; there just isn't a way to remove it. Almost as big a security breach as iexplore.exe.
If you own one Prius and then actually want to buy a second, you have more severe problems than what to call the two cars.
Only if you flunked Latin. "Virii" is not the plural of "virus" however you slice it--in fact, it's even more complicated than it looks as "virus" is in fact *not* a second-declension noun in spite of the "-us" ending. Stick with "viruses" and you won't look like a moron trying to look sophisticated.
His point is that instead of using a Latin form that is nonexistent, and wouldn't look like that even if it DID exist, you can use a perfectly good English (as in English, the language you're actually speaking) form that works, is correct, and doesn't make you look like a moron.
How about software prima donnas that think they are too good to make mistakes and say QA just gets in their way? I would say this is far more likely due to a software guy skirting the checks rather than there be no checks in place for an established company like McAfee
If a developer has the ability to skirt QA checks at all in any way QA is fundamentally broken. Who sets up a dev shop like that? Dev hands code to QA; QA hands code to production.
In any case, the most basic sort of automatic regression testing should have caught this (since it breaks the test machine on install). At any professional shop this would have been bounced on check-in, and never even made it as far as QA. And, again, software prima donna mindset doesn't matter - you check in, the BVT fails, the change is rolled back (or the "line is stopped").
Socialism: a lie told by totalitarians and believed by fools.
It should not be possible for the coder to skirt QA. He should not have the security access to push the change out to production.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.