3 ms·

It's great that they're putting so much care and attention something that's usually overlooked - motherboards/laptops are released and often shortly abandoned b

It's great that they're putting so much care and attention something that's usually overlooked - motherboards/laptops are released and often shortly abandoned by manufacturers if they're not flagship models, leading to security holes, missing features, or poor performance. Is there any way to tell, prior to purchase, if a system is going to have good support? I have a Dell Latitude from 2012 (Ivy Bridge CPU) and it's still getting BIOS updates, which is great. Seems like similar-year Thinkpads have been abandoned for 4 or 5 years now. (edit: this is incorrect, thanks ac29. Bad comparison. The complaint still stands; many devices are released that see two or less updates, but they tend to be consumer-facing, not business-oriented, like Dell's Latitude line or Lenovo's Thinkpad line.)

ac29 8y ago
> Seems like similar-year Thinkpads have been abandoned for 4 or 5 years now. Hmm? The X230 and T430 (Ivy Bridge era Thinkpads) both had BIOS updates in the past 6 months [0][1]. Lenovo is far from perfect as a vendor, but they are good about firmware updates for Thinkpads. [0] https://support.lenovo.com/us/en/downloads/ds029187 https://support.lenovo.com/us/en/downloads/ds029187 [1] https://support.lenovo.com/us/en/downloads/ds029252 https://support.lenovo.com/us/en/downloads/ds029252
- elagost 8y ago
  Interesting. Since I last checked, my X220 hadn't received any updates in more than a year, and I run coreboot now, so I've stopped checking. Looking now, it seems they released one in January. Seems like my impressions were wrong.
- joewee 8y ago
  What is amazing is that despite updates, Lenovo still hasn’t fixed the gaping security flaw affecting almost all Thinkpads. https://github.com/Cr4sh/ThinkPwn https://github.com/Cr4sh/ThinkPwn You can’t trust thinkpads for security.
  - mehrdadn 8y ago
    You sure? I don't see the T470+ series on the vulnerability list: https://support.lenovo.com/us/en/solutions/len-8324 https://support.lenovo.com/us/en/solutions/len-8324
    - joewee 8y ago
      That list hasn’t been updated since 2016, but they continue to ship vulnerable firmware. Including in all bios updates since 2016. You would have to dump an image of your bios firmware using chipsec to confirm for yourself. https://github.com/chipsec/chipsec https://github.com/chipsec/chipsec
      - bubblethink 8y ago
        They did patch the reported vulnerabilities in updates. What chipsec reports as warnings are not necessarily exploitable. i.e., They didn't patch them to the extent of getting all green ticks in chipsec, but it does not automatically imply exploitable.
        joewee 8y ago
        Ok. Thanks. I haven’t actually tried to run the PoC against it.

ac29 8y ago

> Seems like similar-year Thinkpads have been abandoned for 4 or 5 years now. Hmm? The X230 and T430 (Ivy Bridge era Thinkpads) both had BIOS updates in the past 6 months [0][1]. Lenovo is far from perfect as a vendor, but they are good about firmware updates for Thinkpads. [0] https://support.lenovo.com/us/en/downloads/ds029187 https://support.lenovo.com/us/en/downloads/ds029187 [1] https://support.lenovo.com/us/en/downloads/ds029252 https://support.lenovo.com/us/en/downloads/ds029252

elagost 8y ago
Interesting. Since I last checked, my X220 hadn't received any updates in more than a year, and I run coreboot now, so I've stopped checking. Looking now, it seems they released one in January. Seems like my impressions were wrong.
joewee 8y ago
What is amazing is that despite updates, Lenovo still hasn’t fixed the gaping security flaw affecting almost all Thinkpads. https://github.com/Cr4sh/ThinkPwn https://github.com/Cr4sh/ThinkPwn You can’t trust thinkpads for security.
- mehrdadn 8y ago
  You sure? I don't see the T470+ series on the vulnerability list: https://support.lenovo.com/us/en/solutions/len-8324 https://support.lenovo.com/us/en/solutions/len-8324
  - joewee 8y ago
    That list hasn’t been updated since 2016, but they continue to ship vulnerable firmware. Including in all bios updates since 2016. You would have to dump an image of your bios firmware using chipsec to confirm for yourself. https://github.com/chipsec/chipsec https://github.com/chipsec/chipsec
    - bubblethink 8y ago
      They did patch the reported vulnerabilities in updates. What chipsec reports as warnings are not necessarily exploitable. i.e., They didn't patch them to the extent of getting all green ticks in chipsec, but it does not automatically imply exploitable.
      - joewee 8y ago
        Ok. Thanks. I haven’t actually tried to run the PoC against it.