LMG Sponsor Complaints

[AnonymousThorn]

4/2013: Keeper threatened to sue Fox-IT for finding that the vault password was being logged and the logs were sent to their server. (https://blog.fox-it.com/2013/04/05/security-advisory-unencrypted-storage-of-confidential-information-in-keeper-password-data-vault-v5-3-for-ios/)

 

12/2017: Keeper sued Dan Goodin and Ars Technica. (https://www.techdirt.com/2018/03/09/keeper-security-reminds-everyone-why-you-shouldnt-use-it-doubles-down-suing-journalist/)

 

5/2018: Keeper's servers can request the encryption key during login. It didn't get patched until the security researcher went public. It was patch 2 days later. (https://seclists.org/fulldisclosure/2018/May/41)

 

5/2018: I learned Keeper has a GitHub account and immediately found an out of scope vuln but didn't want to get sued. So I've told no one publicly. Well besides stating that they have the worst downgrade attack out of all the password managers I've looked at. Well LastPass's is almost as bad but it is also silent. So it's both better and worse. LastPass "fixed" theirs when I told them about it but it was unfixed when I checked a few years later.

 

----

 

Other password managers (if you're looking for a different password manager as a sponsor):

TL;DR: Dashlane or maybe 1Password if they implement basic features (P.S. 1Password is a Canadian company).

 

Dashlane: Current best but I don't use it because it doesn't meet my level of security. Also they used a really bad open source random number generator that Keeper also used. It was RC4 with a key of 32 bytes from a good CSPRNG followed by 224 bytes of time based data. I believe both companies have removed that library.

 

1Password: Has the best tech and would meet my level of security, but the browser plug-in doesn't implement edit. So it dumps you into the web client and hands over your encryption key. Also to administrate your account you have to use the web client. Again exposing your encryption key.

 

Proton Pass: They paid a DDoS ransom and then said it was a sophisticated attack because the attacker ran tracert to find their data center and ISP then DDoSed them too. "We all have PhDs in physics so we know encryption..." got hit by several XSS bugs. Also GPG yuck.

 

Bitwarden: Has a limited downgrade attack.

 

LastPass: Has a silent downgrade attack and doesn't implement change password or change iterations except as a web page (iframe, webview, or opens in a browser depending on platform). You can also cause an email to go out that someone tried to logged in from another country with your password. Which will cause most users to change their password. I reported this to LastPass in January last year still not fixed. Among other things. Oh this one's funny they had a padding oracle where they sent the decrypted byte that failed to the server as an error code. Just clown shoes. But I doubt you'll go with them after the latest breach.

[GeorgeWilkins]

Not sure if this counts as a complaint but just something odd and to be aware of if you are purchasing this sponsored product.

I went to buy the UPDF program that was a sponsor of the WAN show this week. It automatically put the price in GBP probably since I live in the UK. All over their website it showed the price in dollars as 49.99 USD but when I got to the checkout it changed it to £49.99 which is about 62.92 USD so $12 more. Nothing to unusual there as this is a common thing companies do like Apple do this for example. 

But what got me was the fact that you can change the currency at checkout. So I just clicked on the drop down box, set it to USD and then payed only £34.73 for it. Bit confusing but if you are going to buy UPDF, click on the drop down and see if you can save some money by changing the currency like I did saving about £15.

[jonwil]

Not sure if this is the right thread but I would like to suggest you not promote any investment products at all (not just crypto and NFTs like you already say you wont promote). Even if they are legitimate (and some that I have seen sponsor other YouTube channels are not) its not good for LTT to be pushing investment products.

 

A good example of this is Masterworks who I have seen all over YouTube but which (depending on the source you read) at best will probably take you years to make you any money or at worst is an outright scam.

 

Please also stay away from promoting companies that knowingly profit off copyright infringement (Chinese marketplace Temu for example refuses to take down copyright infringing products). Its OK to buy weird crap from China for a video but you should not take sponsor dollars or work with any of these marketplaces that rip-off the hard work of other companies.

 

[Garrettnilan]

I don’t know if they’d re a sponsor but I purchased the guli kit controller with your guys recommendation and I can’t get anybody to discuss how I can resolve my issues for over a month. 

 

 

 

 

 

[Aluminumhaste]

Just wanted to talk about the today's sponsor, Solid Works.

 

At my work I had a conversation with a customer who was being shaken down by Solid Works's (Dassault Systèmes) Legal dept, claiming they were using too many computers without the valid licenses.

They provided MAC addresses of the NIC's and the IP addresses of the offending connections. Neither of these showed up in the customers logs.

The customer was provided the connection information for the last year and a half to prove they're never had that IP address.

 

The response they got was basically "doesn't matter, we've already determined that you owe this 100,000$, and need to tell us how you're going to pay in the next 10 days, or we're going to litigate".

 

I was pointed to a thread on Reddit (

 

I sent this over to our customer, they pushed back like the others did in that Reddit thread, and Solid Works backed off and haven't contacted them since.

 

 

[AbsentlyPercolate]

18 hours ago, jonwil said:

Not sure if this is the right thread but I would like to suggest you not promote any investment products at all (not just crypto and NFTs like you already say you wont promote). Even if they are legitimate (and some that I have seen sponsor other YouTube channels are not) its not good for LTT to be pushing investment products.

 

A good example of this is Masterworks who I have seen all over YouTube but which (depending on the source you read) at best will probably take you years to make you any money or at worst is an outright scam.

 

Please also stay away from promoting companies that knowingly profit off copyright infringement (Chinese marketplace Temu for example refuses to take down copyright infringing products). Its OK to buy weird crap from China for a video but you should not take sponsor dollars or work with any of these marketplaces that rip-off the hard work of other companies.

 

If you look at the other post under "Sponsor Discussion", 

They mention they do not do investment, crypto, etc.

[jonwil]

It specifically mentions crypto and NFTs, doesn't say anything about investment more generally.

 

[RTX 3090]

9 hours ago, Garrettnilan said:

I don’t know if they’d re a sponsor but I purchased the guli kit controller with your guys recommendation and I can’t get anybody to discuss how I can resolve my issues for over a month. 

 

Easiest way it to just file a return with Amazon. If you use their chat, they don't really care about who's right or wrong and just send you a return label. Even though the window is 28 days they will let you return things past the deadline

[QwertyChouskie]

11 hours ago, Garrettnilan said:

I don’t know if they’d re a sponsor but I purchased the guli kit controller with your guys recommendation and I can’t get anybody to discuss how I can resolve my issues for over a month. 

 

 

 

 

 

Go through the proper Amazon return/exchange process, otherwise your communications probably won't even reach the right people.

[Lannis]

Regarding the promotion of TEMU on the LTT channel: How did you guys pass them for sponsor quality? The products there can be summarized as low cost E-waste. They're notorious for promoting and endorsing scams (mainly their referral program), using predatory advertising (free Nintendo Switches, et cetera), and are complacent to human rights violations, and are facilitating the use of forced labor camps.

TEMU is affiliated with the production and distribution of goods from Chinese camps located in the Xinjiang region. These products have links to forced labor primarily of the Uyghur muslim minority group situated there. This is in violation of the Uyghur Forced Labor Prevention Act (UFLPA) (US ban of items produced in the region due to the links with forced labor). www.bbc.com/news/business-65990529: Temu: Risk popular website sells forced labour goods - BBC News , Temu Sells Products in US Linked to Forced Labor in China’s Uyghur Region - Bloomberg

"American consumers should know that there is an extremely high risk that Temu's supply chains are contaminated with forced labor," the House Select Committee on the Chinese Community Party said in its report. (Report hyperlink)" (excerpt from BBC article linked above)

"But the company—the U.S. offshoot of Chinese e-commerce giant Pinduoduo—is also starting to develop a reputation for undelivered packages, mysterious charges, incorrect orders, and unresponsive customer service. Temu has already been subject to more than 30 complaints to the Better Business Bureau, and has a BBB customer rating of less than 1.5 stars. "
-The Truth About Temu: Complaints and Concerns | Time

Below are some other concerns with the sponsor, found below. The text below was copied over from the LTT subreddit. 

 

https://www.uscc.gov/research/shein-temu-and-chinese-e-commerce-data-risks-sourcing-violations-and-trade-loopholes

https://www.latimes.com/business/story/2023-05-02/what-is-temu-ecommerce-app-china-ban

https://www.usatoday.com/story/tech/columnist/komando/2023/04/20/delete-temu-app-cybersecurity-expert-advice/11667796002/

https://www.compassitc.com/blog/temu-app-poses-potential-data-risk-for-consumers?hs_amp=true

https://7news.com.au/news/cyber-security/warning-over-dodgy-detail-in-popular-online-shopping-site-temu-c-11748431.amp

Basically there are four (probably more) major concerns:

1. The company that created TEMU previously got caught installing malware on user's devices to steal private information.

2. Users have reported fraudulent charges and bank withdrawals after using or purchasing from the app.

3. Privacy concerns given the excessive permissions required to use the app and its parent company's ties with the Chinese government.

4. Broadly with any app like this: Consumer protections, human rights violations, trade violation.

 

 

[mMontana]

I cannot emphasize enough the value of your report.

However...

I still don't trust USA-based US much more than Chinese-based software houses.

[Kilrah]

21 minutes ago, Lannis said:

Regarding the promotion of TEMU on the LTT channel: How did you guys pass them for sponsor quality?

The video is sponsored by Seasonic, not Temu. They're "making fun" of Temu as the subject.

[charlespick]

Does Ubiquiti/Unifi at LTX and LTT using their APs at their office count as a "sponsorship"? I bought 2 APs from them a couple months ago and I haven't been able to get them to work. I've been in a support thread with them since week one where they've blamed everything from my M1 Macbook, to my upstream switch to my POE injector. Every time they ask me to test something new, like just change one setting in the unifi console, I share my results the same day or the next day and then they take 2 weeks to reply again. Now I am past the return window for the devices. According to the report in the unifi console, the channels I am using have no other interference on them. I'm using a 5ghz connection, line of sight between the AP and my macbook for testing, about 6 feet away, high transmit power, the widest channel available. I'm getting iperf3 results between 60 and 480Mbitps with these APs that are speced at 1200. Finally, I got so frustrated with this last week that I had my friend from work bring in a cisco AP yesterday. With the default settings, the same ethernet cable and poe injector, and no changes to the switches vlans, we got full gigabit performance on my MacBook. I just want to get the performance that I was advertised when I bought the AP and I've been working with their support for months now and they haven't been able to get it to work. I feel like getting what I paid for isn't too much to ask. 

[Lannis]

4 hours ago, Kilrah said:

The video is sponsored by Seasonic, not Temu. They're "making fun" of Temu as the subject.

I see. I misunderstood then. Regardless, any exposure of a brand such as Temu is very questionable. 

[Kilrah]

They aren't painting it in a particularly good light, sure you can say "any publicity is good publicity" but at some point - sites like wish, temu, aliexpress exist and people will use them, it kinda makes sense to "document" what people can expect from them which they've done several times. 

[Johnsnowaus]

Hey Team, 

 

First time writing on this forum but i've been a subscriber ever since the Linus team was working out of a bedroom in his house. I wanted to express a few things about the Temu video and how much in it contradicts your environmental and ethics values.

Temu has now popped up across most of my favourite tech reviewers with some already calling them out to have ties to forced labour industries in China. The fact that there is an Investigation already underway with the US Congress prior to the release of this video, why would you then go promot it on your channel? 

ontop of this, it comes down to e-waste! You openly criticise many large companies for having plastics in the unboxing but then go publish a site where you know the products are garbage and most of it will be thrown out into the bin. Even if you have an in-house system that the products are passed down to people or given away the company itself is being promoted through your channel for consumers to buy complete garbage that will break or be thrown away quickly. 

 

pretty disappointing when you Linus Tech Tips want to be the authority in good products and honest reviews and calling companies out....

 

 

References:

 

https://apnews.com/article/temu-shein-forced-labor-china-de7b5398c76fda58404abc6ec5684972

https://www.uscc.gov/research/shein-temu-and-chinese-e-commerce-data-risks-sourcing-violations-and-trade-loopholes

https://selectcommitteeontheccp.house.gov/media/press-releases/select-committee-releases-interim-findings-shein-temu-forced-labor 

[Skipple]

37 minutes ago, Johnsnowaus said:

why would you then go promot it on your channel?

Someone going to need to show me where the promotion was during this video, because apparently I watched a different video from everyone else.

[Johnsnowaus]

1 minute ago, Skipple said:

Someone going to need to show me where the promotion was during this video, because apparently I watched a different video from everyone else.

Its being promoted by being the whole PREMIS of the video then having a link to the website Temu in the description below. Just because someone doesn't expressly say they are promoting something but bases an entire video of its products and where its from, doesn't mean its not promoted? 

[IkeaGnome]

15 minutes ago, Johnsnowaus said:

Its being promoted by being the whole PREMIS of the video then having a link to the website Temu in the description below. Just because someone doesn't expressly say they are promoting something but bases an entire video of its products and where its from, doesn't mean its not promoted? 

So this video promotes buying tanks?

Spoiler

 

I understand your point, but it's a bit of a stretch. 

[Skipple]

21 minutes ago, Johnsnowaus said:

Its being promoted by being the whole PREMIS of the video then having a link to the website Temu in the description below. Just because someone doesn't expressly say they are promoting something but bases an entire video of its products and where its from, doesn't mean its not promoted? 

Just so we are clear: is the mere mention of a company, even in neutral language, considered promotion in your book? Because from the video all I saw was:

1. Company exists
2. We purchased silly things from this company
3. Here is what we received
4. It's junky

Does today's video promote the Apple Newton? 

[Johnsnowaus]

On 9/5/2023 at 3:46 AM, IkeaGnome said:

So this video promotes buying tanks?

  Reveal hidden contents

 

I understand your point, but it's a bit of a stretch. 

I mean, having a link in the description (pinned comment) isn't much of being a stretch its straight promoting. Happy to be wrong but I don't personally see that as a stretch

 

On 9/5/2023 at 3:48 AM, Skipple said:

Just so we are clear: the is the mere mention of a company, even in neutral language, considered promotion in your book? Because from the video all I saw was:

1. Company exists
2. We purchased silly things from this company
3. Here is what we received
4. It's junky

I mean, having a link in the description (pinned comment) isn't much of being a stretch its straight promoting. Happy to be wrong but I don't personally see that as a stretch. Plus it's got to do with values as well, Linus hammers pretty hard on not going over the top with over consumerism and buying junk then does a whole video on a website that promotes just that. 

[Skipple]

4 minutes ago, Johnsnowaus said:

I mean, having a link in the description (pinned comment) isn't much of being a stretch its straight promoting.

I still disagree. Someone will inevitably ask the question: What model headphones was that? They are simply providing information, if you were so inclined to look for it. 

 

4 minutes ago, Johnsnowaus said:

Plus it's got to do with values as well, Linus hammers pretty hard on not going over the top with over consumerism and buying junk then does a whole video on just that. 

Where was Linus encouraging the purchase of these products? 

[Johnsnowaus]

7 minutes ago, Skipple said:

I still disagree. Someone will inevitably ask the question: What model headphones was that? They are imply providing information, if you were so inclined to look for it. 

 

Where was Linus encouraging the purchase of these products? 

by having a full video on it and links in the description to the website that is under investigation for forced labour? Surely this is a few red flags to have come up before releasing a video. I just don't think that a company like this should be shown to the masses as a place to buy goods from. Its about the e-waste too, like wish.com its being pushed into viewers eyes for them to be disappointed in the cheap product they buy and then is thrown out. 

[Skipple]

13 hours ago, Johnsnowaus said:

by having a full video on it and links in the description to the website that is under investigation for forced labour? Surely this is a few red flags to have come up before releasing a video. I just don't think that a company like this should be shown to the masses as a place to buy goods from. Its about the e-waste too, like wish.com its being pushed into viewers eyes for them to be disappointed in the cheap product they buy and then is thrown out. 

If your issue with the site is forced labor, I have bad news about every single website that sells products produced in China. If that's the standard we are trying to hit, then Linus probably shouldn't show himself purchasing things on Amazon, Alibaba, Walmart, Rakuten, etc. anymore either, nor should he take a sponsorship from them. (if you are that concerned you should voice yourself on the relevant topic) It's harder to find manufacturers that can guarantee ethical labor than not. (seriously, try and find some) Linus has actually talked on this topic previously with sourcing T-Shirts for LTTStore.

 

Secondly, every time there is one of these videos featuring Wish.com, Temu, etc from LTT or Austin or Dawid, the outcome is always "yeah these products are junk and you shouldn't buy them". I'm not sure how anyone could possibly walk away from these videos with a positive view of the site, especially not to go out and purchase from them expecting a quality product, only to be disappointed.

 

Regardless, this may be something we will have to agree to disagree on. Videos like these scratch my itch at minimum for answering the question: "What the hell is Temu, what's going on over there, and why am I getting so many ads for them?" I enjoy the videos and now I can safely disregard any advertisement I get for the site in the future. 

[Johnsnowaus]

2 minutes ago, Skipple said:

If you issue with the site is forced labor, I have bad news about every single website that sells products produced in China. It's harder to find manufacturers that can guarantee ethical labor than not. (seriously, try and find some) If that's the standard we are trying to hit, then Linus probably shouldn't show himself purchasing things on Amazon, Alibaba, Walmart, Rakuten, etc. anymore either, nor should he take a sponsorship from them. (if you are that concerned you should voice yourself on the relevant topic)

 

Secondly, every time there is one of these Wish.com, Temu, etc. the outcome is always "yeah these products are junk you shouldn't buy them". I'm not sure how anyone could possibly walk away from these videos with a positive few of the site, especially not to go out and purchase from them expecting a quality product, only to be disappointed.

 

Regardless, this may be something we will have to agree to disagree on. Videos like these scratch my itch at minimum for answering the question: "What the hell is Temu, what's going on over there, and why am I getting so many ads for them?" I enjoy them. 

Thats a fair enough answer, I guess on a personal level I have big issues with these types of companies and disagree when I don't see harsh enough actions from people like LTT who like to criticise other companies for not using plastics and ethically sourced materials and tend to give much harsher reactions to other people but skim by it on things like this. But happy to agree to disagree with you here for at the end of the day is a personal ethical disagreement I have with these types of videos.