10 ms·

GNU+Linux laptops with Libreboot preinstalled, based on coreboot

270 points by sacrosanct 4y ago

rurban 4y ago
I aplaud the offer. Just this quote is a bit hilarius: "Debian is a solid, robust OS with a strong security team"
javchz 4y ago
I love my T440p, and as a Linux machine it's great. But full disclosure, it's not perfect, a few drawbacks to be aware of: * Batteries can be hard to find, and they last 6 hours at most. * No USB-C docking capabilities (but you can use the old dock that uses the weird port under the laptop). Weirdly enough you can mod it to charge with a USB-C PD cable instead of the thinkpad one. * The iGPU is slow by today's standards. * The keyboard is okay, but was a downgrade from the T420 (aka the old IBM layout). * VS the T430, you don't have a way to connect a plugable PCI-e port. * The default screen it's horrible (but can be upgraded to a nice IPS full hd panel for not that much). If you're okay with that, despite its age it's a great machine, the CPU it's ok for most tasks, and gives you a chance to have an amazing control in your system from OS to BIOS (or well, as close as you can get without digging the full rabbit hole that are firmwares for other components). I say if you only look for bang for the buck... this it's not a machine for you, but it's more if you want a OSS community backed laptop, this it's the one for you in case you don't like the framework laptops.
- ach_hm 4y ago
  Would agree with that. Great Linux machine with that extra kilometer of freedom. With an upgraded CPU still powerful enough for 2023 and probably a few years to come. Probably one of the most powerful systems you can get with (nearly) free firmware and while not the best bang for the buck, probably the best bang for the buck for freedom that's available. I think all other systems with libre firmware are either way more expensive or less powerful … Would add to your points: * Rather heavy for a laptop (at least for my taste). * Very upgradeable, much cool! * You probably want to upgrade the touchpad to get separate trackpoint buttons. * To flash the firmware yourself you need to get access to both BIOS chips. To get to the second BIOS chip you need to nearly completely disassemble the machine. While not necessarily difficult to do, their is a good chance you have PTSD from breaking plastic clips afterwards …
- rozenmd 4y ago
  Alternatively, get a T480: https://maxrozen.com/getting-your-own-good-enough-laptop-for-under-500 https://maxrozen.com/getting-your-own-good-enough-laptop-for...
  - windexh8er 4y ago
    In the article they (you?) say T480 and explicitly not T470. I own a T470 and have been using it only with Linux since new and would still highly recommend it. Some of the upgrades they did I had ordered from Lenovo upon order (screen, battery, RAM). Mine has a i7-7600U however, which is maybe where the differential they're referring to lies. The newer i5 has double the cores/threads to 4/8 vs 2/4 in the i7 of the T470. Regardless, the T470 is still my daily driver as my personal laptop and everything works as good as the day I bought it. It's still jarring typing on my M1 MBP 16 after spending any time on the T470. Apple still has garbage for keyboards. Have they gotten better? Sure. They're still horrible though.
    - rozenmd 4y ago
      Yeah I suggest a T480 for double the cores, but honestly the T470 isn't bad either.
- urbandw311er 4y ago
  Out of interest, since you and another commenter have both observed it’s not the best bang-for-buck, could you give an example of something that is? Or, at least, comes close?
  - ach_hm 4y ago
    I can't give a specific example sadly. In my opinion it is not the best bang-for-buck because you need to luck for that specific model and the needed parts. I think you can find better deals if you are open e.g. for other Thinkpad models that are currently sold at a better price in your country but can't run Libre/Coreboot. I think T440ps are already out of the "companies are dumping them on the used market"-window so their are probably better deals with a bit younger models …
- hsbauauvhabzb 4y ago
  I think I have close to this, it’s effectively capped at 8gb of ram (I think 16gb sticks exist, but are very expensive), aside from that it’s perfect for a throw around machine. I buy them off eBay, and toss them to people (family, friends, employees), they’re brilliant all-in-one with cheap access to new power supplies, etc.
- f1refly 4y ago
  > Weirdly enough you can mod it to charge with a USB-C PD cable instead of the thinkpad one. Not weird at all, you just need a 20V decoy board, those can be bought for about a dollar a piece on ali. They obviously won't transfer data. It just so happens that the barrel charger module is in a nice separated large block of plastic that can be hollowed out to fit the usb c socket inside.
- vaxman 4y ago
  They buy this LibreBoot (blob-free CoreBoot, for the uninspired) …and then they go ahead and install Ubuntu on it?! No, no, actually they run IBM RHEL or its “free” variants! It’s all about unknown blobs (binary large objects) embedded in the dynamic processor microcode, firmware —even the chips themselves, even the FPGAs, even the sealed SoCs and processors …or is it? Maybe the LibreBoot Boys will actually load some obscure distro being maintained by some ethically challenged college-aged non-college students sharing an apartment and using a lot of mind altering substances? A few lines of obfuscated code here, a digital signature there and they have a backdoor “because they can.” Maybe they grow up, move on and another, more innocent, maintainer takes over and the backdoored project is incorporated into many more projects. SabreDAV? Arch? <DrEvil Voice> ReiserFS? So maybe the LibreBoot Boys are “smart” and run barebones Debian, but then…they start downloading containers because “everyone is doing it” Even if the container images are clean and competent (a big IF), the underlying network/firewall tech in their chosen container orchestration system is at a level of complexity many orders of magnitude above most admin competency —and some of those orchestration apps are also one-man bands, running out of a coffee shop by “some guy”, who probably is late on his rent open to a big bag of cash involving container signatures …or maybe they are just so financially distracted, the complex orchestration software that others are running critical infrastructure on is totally being ignored. How about infected blobs AND containers? Yes, many Chinese network routers/SANs now come this way. They even run forks of mainstream distros (like ImmortalWRT disguised as OpenWRT or some re-adulterated version of Ubuntu, neither of which anyone seems to be able to recreate with a matching binary signature, or even get to boot from the “open source” bits on Github). Some of these devices are then customized by American “brands” and resold to an unsuspecting Western public. ..and the commenters on here talking about wireless cards are spot on, it’s been known for 40 years —-not to mention that here in 2023, the wireless SoCs and network cards in general have reprogrammable firmware, in some cases, remotely reprogrammable firmware. Take a look at ESP32-C6…purpose built to give your devices a mind of their own. Nobody really knows what’s in the firmware. Some have assumptions based on “everyone is doing it” but that’s like eating hotdogs without thinking about how they are made —at least until one day you bite into one and find an eyeball. What to do? Start eating kosher hotdogs for a start and then use computer hardware and software that has passed similar kinds of checks. Oh, that’s right, there is almost nobody performing such checks on computers like there are on the kosher dogs (though Apple is trying). The fact is that we are already under attack like the ancient city of Troy (where a massive wooden horse was left outside the gates before being pulled inside as an accepted peace offering when out popped trojans wielding swords who let the rest of the army in). AT THIS HOUR the CCP military surrounds Taiwan using kinetic munitions during “exercises.” We have physical deterrents, they know it, and yet they keep preparing their military, probably because they can imagine “throwing the switch” and injecting (or triggering) viruses in firmware blobs, containers, “rock” chips, etc. throughout the West. As has repeatedly happened in certain US municipalities, someday our Western leaders could receive the “mother of all Chinese ransomware notes” and have to stand down and watch the world be conquered out of fear of another Great Depression triggered by Chinese computer viruses. Hopefully this saved someone a ticket to RSA (and who wants to get stabbed to death on the streets around Moscone anyway https://www.sfgate.com/bayarea/article/911-audio-released-bob-lee-stabbing-17887129.php https://www.sfgate.com/bayarea/article/911-audio-released-bo... ). Some good vendors are System 76 (pop_OS!), Apple, DELL and Cisco. Make your companies, industry regulators and local governments aware of these issues and maybe someday…
doublepg23 4y ago
I love my x200 with Coreboot. Very fun to hack around on, though I usually use my Ryzen desktop or iPad Pro M1 for anything requiring cpu power.
neilv 4y ago
If you'd like to run a Coreboot/Libreboot laptop, which hardware you use, and whether you have someone do it for you, is probably influenced by how it needs to be flashed. Best case: The particular hardware supports software flashing from the start, with some easily-accessible enable switch or Vulcan nerve pinch boot mode. Medium case: You undo a few screws, and can get easy access with a SOIC test clip, and your ad hoc RasPi programming setup can do a good read or write within a few tries. Worst case: You not only have to desolder SMT, or use a flaky SPI programmer while the flash chip is in-circuit, but you have to pretty completely disassemble and reassemble a laptop. https://www.neilvandyke.org/coreboot/ https://www.neilvandyke.org/coreboot/ All cases might be trivial for an EE technician who does this frequently, but, for software person me, the fun quickly turned to headache. Knowing that, Minifree's prices might look very good. Note: After the initial flash, subsequent flashes (such as for updates, or your own experimenting) could be done purely by software, unless and until that's disabled. This might be less secure, but it could otherwise be very practical. But, even if you have easy subsequent flashes, if one of the flashes breaks the device, you might have to go back to an initial painful flash to fix it.
lousken 4y ago
Since I am daily driving Thinkpad E540 I can say I wouldn't buy a 10 year old device at this point. I maxed out mine, using i7 4702mq, 16GB of RAM and 256GB SSD, AC wifi and fullHD display. The machine doesn't feel slow for regular day to day tasks. However, the memory is getting close to being full (my AVG is 13GBs used) and the lack of USB-C is starting to really hurt my productivity. Using a docking station or a meeting room without pulling all the cables apart is getting quite annoying. Also the trackpad is really subpar. So at this point I am looking for an upgrade to Framework 16.
- eimrine 4y ago
  E540 has a shitty case in my opinion, totally without metal. Keyboard is vulnerable to liquids and original one is also hard to find. Touchpad is a batshit.
  - lousken 4y ago
    Totally agree about the case, I replaced it once because it started cracking on various places. On the current one, the fan grill is broken yet again, but so far that's the only thing. The keyboard was not hard to find though, took me couple minutes on ebay two years ago, when I started to have issues with stuck keys.
    - eimrine 4y ago
      Replacement keyboard is really easy to find for this model but pressing keys in this one is not as smooth as in original one. Fan grill made of plastic is doomed in any laptop. Meanwhile my x220 works perfectly despite of really careless using because of metal case and keyboard which can survive a liquid and does not let it to spill on motherboard. I mean that statement about 10 y.o. laptop is not true especially if talking about good old thinkpads. But E540 does not share any good qualities except of name of that beautiful laptop family.
      - lousken 4y ago
        I don't really understand the argument here. I did point out some flaws with running old laptops, regardless of the model or manufacturer. Touchpads were not great at the time in general (neither screens for that matter), and usb-c is just missing. The specs are also getting to the point where it starts to feel slow, especially with current horribly overbloated webapps. I am not sure about what you mean by "not as smooth" keyboard. What matters to me is the accuracy and speed I perform at. And since I can hit 110wpm with great accuracy, just like on my mechanical keyboard, I don't see any real issue with it. Also for the record - I dropped my laptop twice back in the university where they had those tables tilted and it slipped. It did survive both drops, the cracks started appearing over time. I never spilled anything at or close to the laptop though. I keep my beverages on the left side of the table so I can't accidentally bump them.
neodypsis 4y ago
System76 is a good option if you want modern, performant hardware that runs Coreboot. - https://system76.com https://system76.com - https://github.com/system76/coreboot https://github.com/system76/coreboot
- nilespotter 4y ago
  As of a year ago they couldn't remove ME on them. I don't know if anything has changed since.
- manaskarekar 4y ago
  Is there a way to get these machines: - without the branding in such large font? (I understand it's an important form of advertising for small companies). - with a touchpad that has actual physical buttons? Same questions for framework laptops if anyone knows.
  - ISL 4y ago
    A sticker or a "skin" might solve the first concern?
  - benlivengood 4y ago
    My lemp10 just has stickers for the System76 logo; one letter has worn off already.
  - rekado 4y ago
    NovaCustom also sells some of the same laptops with coreboot (there are a few differences in the configurations, but it's close), and you can choose a custom logo or no branding at all. Unfortunately, there's no option for a touchpad with physical buttons.
  - fsflover 4y ago
    Purism sells laptops without a branding, but also without actual touchpad buttons.
  - larsla 4y ago
    Tuxedo gives you the option to order their laptops with either the Tuxedo logo, a custom logo, or no logo. I ordered the InfinityBook Pro 14 Gen7 without any logo and it looks really clean. I haven't checked Coreboot support before, but now found: https://www.tuxedocomputers.com/en/Infos/Help-Support/Frequently-asked-questions/Coreboot-on-TUXEDO-Computers-devices.tuxedo https://www.tuxedocomputers.com/en/Infos/Help-Support/Freque...
apengwin 4y ago
[flagged]
- WJW 4y ago
  Yes we all know this. It does not matter in the slightest to any of the users of Linux.
- lapinot 4y ago
  I don't recall systemd -- perhaps the most important userspace component of most linux distros nowadays -- to be a gnu project.
  - fsflover 4y ago
    By the number of lines of codes GNU part is still the largest AFAIK.
- nathell 4y ago
  https://www.gnu.org/gnu/incorrect-quotation.html https://www.gnu.org/gnu/incorrect-quotation.html
- VagueMag 4y ago
  Something about the greyed out text makes troll comments like this extra funny.
r3trohack3r 4y ago
I love my Libreboot laptop. But haven’t used it lately, because it’s too fragile for my environment (I work in a swimming pool). Same gripe for Raspberry Pi based laptops. I would love to see a Toughbook based version that’s water resistant.
- confounded 4y ago
  Out of interest, what kind of work do you do, on Linux, on a laptop, in a swimming pool?
  - LoganDark 4y ago
    Obviously none if their laptop is too fragile to be doing any such work :P
  - deathgripsss 4y ago
    My guess is a data center that heats a swimming pool. https://www.google.com/amp/s/www.bbc.com/news/technology-64939558.amp https://www.google.com/amp/s/www.bbc.com/news/technology-649...
  - r3trohack3r 4y ago
    When I started I was doing platform engineering for Netflix from my pool. Now I do full time consulting in the same space. I use a floating card table for my desk and a CF-31 for the laptop.
therealshiva 4y ago
guys i'm curious... about security: some say intel has a backdoor, but there is this guy Nicola who says it's not true... if it's not true, why is the driver closed source, and why is it impossible to disable ME?
- wmf 4y ago
  You can get a range of answers to that question but ultimately none of them are provable so the conspiracy theories will continue.
- anonym29 4y ago
  Intel CSME (formerly ME) and AMT ST (formerly PSP) have many properties that are / would be desireable for someone who is/was building a backdoor (DMA, TCP/IP stack that can use onboard ethernet without the host OS being aware, closed source, unremovable, etc). Keep in mind that even if there has not been a backdoor deliberately added, there absolutely have been serious exploits in ME and PSP, and even for those who are not worried about the government, these security coprocessors still pose grave risk to data privacy and security, potentially handing "ring -3" access to non-government hackers. While I personally share your belief that these are probable backdoors, it is important to remind skeptics that they pose a grave security and privacy threat even outside the context of a government backdoor conspiracy. There's a great talk on the risks posed by the capabilities of these security coprocessors by an extremely well-versed individual at Google who was (leading? involved at a high level?) working on Google's efforts to neutralize these dangerous subsystems at Embedded Linux Con in 2017: https://youtu.be/iffTJ1vPCSo https://youtu.be/iffTJ1vPCSo
  - charcircuit 4y ago
    >DMA, TCP/IP stack that can use onboard ethernet without the host OS being aware, closed source, unremovable, etc You do know a wifi card has the same capabilities, right? There are many processors in your computer that can talk to the rest of the system in a privileged way. >there absolutely have been serious exploits in ME and PSP, Such as? I wouldn't call any of the found vulnerabilities serious. >that they pose a grave security and privacy threat even outside the context of a government backdoor conspiracy. Okay, but you need to balance those problems with the very real security benefits this allows Intel to offer.
candiddevmike 4y ago
I was looking at porting a mobo to coreboot (Dell) and learned about Intel boot guard. That kind of thing should fall under right to repair and be illegal. My device, my choice on how I flash it.
- charcircuit 4y ago
  > My device, my choice on how I flash it. And how does the device know that it is the owner of the device trying to flash it and not an attacker wanting to bypass secure boot? It's safer to have it assume that everyone flashing it is an attacker. I don't think making secure devices should be made illegal. People who want to buy insecure devices are an outlier which means there isn't much demand for a purposefully insecure device. Using the legal system to force manufactures to purposefully make insecure things doesn't seem right to me.
  - blackpill0w 4y ago
    >It's safer to have it assume that everyone flashing it is an attacker In other words: "let's put everyone in jail because someone might be a thief", I find this way of thinking to be moronic. I wonder how an attacker could get physical access to a machine, disassemble it and flash without getting detected. Plus, if I already have physical access to the machine and plenty of time to execute such an attack, why not just grab the drive? I hate this trend of forcing users to run nonsense programs in order to use their devices, like Windows 11 forcing you to have a Microsoft account during the installation process.
    - charcircuit 4y ago
      >let's put everyone in jail because someone might be a thief No, it's more like devices should consider security holistically and only offer an API that is secure. Hacker News doesn't allow any users to edit any other's comment. Is that putting all users in jail because we don't have a capability which is technically possible? >I wonder how an attacker could get physical access to a machine, disassemble it and flash without getting detected. Just because an attack may be niche it doesn't mean that the vulnerability should be ignored. Some customers like businesses can be extra paranoid of attacks like these and have concerns about these attacks. >why not just grab the drive? Because the drive should be encrypted.
deleted 4y ago
[deleted]
cutler 4y ago
14" max is a bit of a deal breaker for me but otherwise looks good.
javert 4y ago
I don't understand what part of this (if any) I cannot do at home. Couldn't I just run me_cleaner myself and then install the desired OS?
- unixhero 4y ago
  Yes .. But you are not done. As you also have to reflash the system bios to libreboot. That is the crux here.
  - dandongus 4y ago
    That's fairly trivial to do, someone doing it for you is certainly not worth anywhere near £130.00 in my humble opinion.
    - ach_hm 4y ago
      Well I did it on my t440p and I didn't find it entirely trivial including the risk that you may brick the motherboard and that the Laptops sold over their are additionally refurbished if I understood correctly … So £130 is not too much in my opinion. Obviously it is on the high side because low volume and support for free software ·
    - unixhero 4y ago
      If you have nothing else to do. Then your own time is worthless and I would agree with you. If you have family and ir a job, your time is the most valuable asset. 130 pounds seems reasonable for not having to do this one off flash procedure.
gigatexal 4y ago
Leah is doing amazing work. Support them if you can!
- BrotherBisquick 4y ago
  [flagged]
theK 4y ago
16G ram could be cutting it close in a lot of back end Dev workloads... How come there are no bigger options?
egberts1 4y ago
Mmmmm, still could have selected an Ethernet hardware without ME. Why bother to disable ME if you could do the right thing?
deepthought422 4y ago
Minifree operates the one-man version of Libreboot, ladden with insecure blobs. Libreboot.at is the real Libreboot, backed by the FSF, without blobs and mental meltdowns (so far).

270 points by sacrosanct 4y ago

I aplaud the offer. Just this quote is a bit hilarius: "Debian is a solid, robust OS with a strong security team"

I love my T440p, and as a Linux machine it's great. But full disclosure, it's not perfect, a few drawbacks to be aware of: * Batteries can be hard to find, and they last 6 hours at most. * No USB-C docking capabilities (but you can use the old dock that uses the weird port under the laptop). Weirdly enough you can mod it to charge with a USB-C PD cable instead of the thinkpad one. * The iGPU is slow by today's standards. * The keyboard is okay, but was a downgrade from the T420 (aka the old IBM layout). * VS the T430, you don't have a way to connect a plugable PCI-e port. * The default screen it's horrible (but can be upgraded to a nice IPS full hd panel for not that much). If you're okay with that, despite its age it's a great machine, the CPU it's ok for most tasks, and gives you a chance to have an amazing control in your system from OS to BIOS (or well, as close as you can get without digging the full rabbit hole that are firmwares for other components). I say if you only look for bang for the buck... this it's not a machine for you, but it's more if you want a OSS community backed laptop, this it's the one for you in case you don't like the framework laptops.

ach_hm 4y ago
Would agree with that. Great Linux machine with that extra kilometer of freedom. With an upgraded CPU still powerful enough for 2023 and probably a few years to come. Probably one of the most powerful systems you can get with (nearly) free firmware and while not the best bang for the buck, probably the best bang for the buck for freedom that's available. I think all other systems with libre firmware are either way more expensive or less powerful … Would add to your points: * Rather heavy for a laptop (at least for my taste). * Very upgradeable, much cool! * You probably want to upgrade the touchpad to get separate trackpoint buttons. * To flash the firmware yourself you need to get access to both BIOS chips. To get to the second BIOS chip you need to nearly completely disassemble the machine. While not necessarily difficult to do, their is a good chance you have PTSD from breaking plastic clips afterwards …
rozenmd 4y ago
Alternatively, get a T480: https://maxrozen.com/getting-your-own-good-enough-laptop-for-under-500 https://maxrozen.com/getting-your-own-good-enough-laptop-for...
- windexh8er 4y ago
  In the article they (you?) say T480 and explicitly not T470. I own a T470 and have been using it only with Linux since new and would still highly recommend it. Some of the upgrades they did I had ordered from Lenovo upon order (screen, battery, RAM). Mine has a i7-7600U however, which is maybe where the differential they're referring to lies. The newer i5 has double the cores/threads to 4/8 vs 2/4 in the i7 of the T470. Regardless, the T470 is still my daily driver as my personal laptop and everything works as good as the day I bought it. It's still jarring typing on my M1 MBP 16 after spending any time on the T470. Apple still has garbage for keyboards. Have they gotten better? Sure. They're still horrible though.
  - rozenmd 4y ago
    Yeah I suggest a T480 for double the cores, but honestly the T470 isn't bad either.
urbandw311er 4y ago
Out of interest, since you and another commenter have both observed it’s not the best bang-for-buck, could you give an example of something that is? Or, at least, comes close?
- ach_hm 4y ago
  I can't give a specific example sadly. In my opinion it is not the best bang-for-buck because you need to luck for that specific model and the needed parts. I think you can find better deals if you are open e.g. for other Thinkpad models that are currently sold at a better price in your country but can't run Libre/Coreboot. I think T440ps are already out of the "companies are dumping them on the used market"-window so their are probably better deals with a bit younger models …
hsbauauvhabzb 4y ago
I think I have close to this, it’s effectively capped at 8gb of ram (I think 16gb sticks exist, but are very expensive), aside from that it’s perfect for a throw around machine. I buy them off eBay, and toss them to people (family, friends, employees), they’re brilliant all-in-one with cheap access to new power supplies, etc.
f1refly 4y ago
> Weirdly enough you can mod it to charge with a USB-C PD cable instead of the thinkpad one. Not weird at all, you just need a 20V decoy board, those can be bought for about a dollar a piece on ali. They obviously won't transfer data. It just so happens that the barrel charger module is in a nice separated large block of plastic that can be hollowed out to fit the usb c socket inside.
vaxman 4y ago
They buy this LibreBoot (blob-free CoreBoot, for the uninspired) …and then they go ahead and install Ubuntu on it?! No, no, actually they run IBM RHEL or its “free” variants! It’s all about unknown blobs (binary large objects) embedded in the dynamic processor microcode, firmware —even the chips themselves, even the FPGAs, even the sealed SoCs and processors …or is it? Maybe the LibreBoot Boys will actually load some obscure distro being maintained by some ethically challenged college-aged non-college students sharing an apartment and using a lot of mind altering substances? A few lines of obfuscated code here, a digital signature there and they have a backdoor “because they can.” Maybe they grow up, move on and another, more innocent, maintainer takes over and the backdoored project is incorporated into many more projects. SabreDAV? Arch? <DrEvil Voice> ReiserFS? So maybe the LibreBoot Boys are “smart” and run barebones Debian, but then…they start downloading containers because “everyone is doing it” Even if the container images are clean and competent (a big IF), the underlying network/firewall tech in their chosen container orchestration system is at a level of complexity many orders of magnitude above most admin competency —and some of those orchestration apps are also one-man bands, running out of a coffee shop by “some guy”, who probably is late on his rent open to a big bag of cash involving container signatures …or maybe they are just so financially distracted, the complex orchestration software that others are running critical infrastructure on is totally being ignored. How about infected blobs AND containers? Yes, many Chinese network routers/SANs now come this way. They even run forks of mainstream distros (like ImmortalWRT disguised as OpenWRT or some re-adulterated version of Ubuntu, neither of which anyone seems to be able to recreate with a matching binary signature, or even get to boot from the “open source” bits on Github). Some of these devices are then customized by American “brands” and resold to an unsuspecting Western public. ..and the commenters on here talking about wireless cards are spot on, it’s been known for 40 years —-not to mention that here in 2023, the wireless SoCs and network cards in general have reprogrammable firmware, in some cases, remotely reprogrammable firmware. Take a look at ESP32-C6…purpose built to give your devices a mind of their own. Nobody really knows what’s in the firmware. Some have assumptions based on “everyone is doing it” but that’s like eating hotdogs without thinking about how they are made —at least until one day you bite into one and find an eyeball. What to do? Start eating kosher hotdogs for a start and then use computer hardware and software that has passed similar kinds of checks. Oh, that’s right, there is almost nobody performing such checks on computers like there are on the kosher dogs (though Apple is trying). The fact is that we are already under attack like the ancient city of Troy (where a massive wooden horse was left outside the gates before being pulled inside as an accepted peace offering when out popped trojans wielding swords who let the rest of the army in). AT THIS HOUR the CCP military surrounds Taiwan using kinetic munitions during “exercises.” We have physical deterrents, they know it, and yet they keep preparing their military, probably because they can imagine “throwing the switch” and injecting (or triggering) viruses in firmware blobs, containers, “rock” chips, etc. throughout the West. As has repeatedly happened in certain US municipalities, someday our Western leaders could receive the “mother of all Chinese ransomware notes” and have to stand down and watch the world be conquered out of fear of another Great Depression triggered by Chinese computer viruses. Hopefully this saved someone a ticket to RSA (and who wants to get stabbed to death on the streets around Moscone anyway https://www.sfgate.com/bayarea/article/911-audio-released-bob-lee-stabbing-17887129.php https://www.sfgate.com/bayarea/article/911-audio-released-bo... ). Some good vendors are System 76 (pop_OS!), Apple, DELL and Cisco. Make your companies, industry regulators and local governments aware of these issues and maybe someday…

doublepg23 4y ago

I love my x200 with Coreboot. Very fun to hack around on, though I usually use my Ryzen desktop or iPad Pro M1 for anything requiring cpu power.

neilv 4y ago

If you'd like to run a Coreboot/Libreboot laptop, which hardware you use, and whether you have someone do it for you, is probably influenced by how it needs to be flashed. Best case: The particular hardware supports software flashing from the start, with some easily-accessible enable switch or Vulcan nerve pinch boot mode. Medium case: You undo a few screws, and can get easy access with a SOIC test clip, and your ad hoc RasPi programming setup can do a good read or write within a few tries. Worst case: You not only have to desolder SMT, or use a flaky SPI programmer while the flash chip is in-circuit, but you have to pretty completely disassemble and reassemble a laptop. https://www.neilvandyke.org/coreboot/ https://www.neilvandyke.org/coreboot/ All cases might be trivial for an EE technician who does this frequently, but, for software person me, the fun quickly turned to headache. Knowing that, Minifree's prices might look very good. Note: After the initial flash, subsequent flashes (such as for updates, or your own experimenting) could be done purely by software, unless and until that's disabled. This might be less secure, but it could otherwise be very practical. But, even if you have easy subsequent flashes, if one of the flashes breaks the device, you might have to go back to an initial painful flash to fix it.

lousken 4y ago

Since I am daily driving Thinkpad E540 I can say I wouldn't buy a 10 year old device at this point. I maxed out mine, using i7 4702mq, 16GB of RAM and 256GB SSD, AC wifi and fullHD display. The machine doesn't feel slow for regular day to day tasks. However, the memory is getting close to being full (my AVG is 13GBs used) and the lack of USB-C is starting to really hurt my productivity. Using a docking station or a meeting room without pulling all the cables apart is getting quite annoying. Also the trackpad is really subpar. So at this point I am looking for an upgrade to Framework 16.

eimrine 4y ago
E540 has a shitty case in my opinion, totally without metal. Keyboard is vulnerable to liquids and original one is also hard to find. Touchpad is a batshit.
- lousken 4y ago
  Totally agree about the case, I replaced it once because it started cracking on various places. On the current one, the fan grill is broken yet again, but so far that's the only thing. The keyboard was not hard to find though, took me couple minutes on ebay two years ago, when I started to have issues with stuck keys.
  - eimrine 4y ago
    Replacement keyboard is really easy to find for this model but pressing keys in this one is not as smooth as in original one. Fan grill made of plastic is doomed in any laptop. Meanwhile my x220 works perfectly despite of really careless using because of metal case and keyboard which can survive a liquid and does not let it to spill on motherboard. I mean that statement about 10 y.o. laptop is not true especially if talking about good old thinkpads. But E540 does not share any good qualities except of name of that beautiful laptop family.
    - lousken 4y ago
      I don't really understand the argument here. I did point out some flaws with running old laptops, regardless of the model or manufacturer. Touchpads were not great at the time in general (neither screens for that matter), and usb-c is just missing. The specs are also getting to the point where it starts to feel slow, especially with current horribly overbloated webapps. I am not sure about what you mean by "not as smooth" keyboard. What matters to me is the accuracy and speed I perform at. And since I can hit 110wpm with great accuracy, just like on my mechanical keyboard, I don't see any real issue with it. Also for the record - I dropped my laptop twice back in the university where they had those tables tilted and it slipped. It did survive both drops, the cracks started appearing over time. I never spilled anything at or close to the laptop though. I keep my beverages on the left side of the table so I can't accidentally bump them.

neodypsis 4y ago

System76 is a good option if you want modern, performant hardware that runs Coreboot. - https://system76.com https://system76.com - https://github.com/system76/coreboot https://github.com/system76/coreboot

nilespotter 4y ago
As of a year ago they couldn't remove ME on them. I don't know if anything has changed since.
manaskarekar 4y ago
Is there a way to get these machines: - without the branding in such large font? (I understand it's an important form of advertising for small companies). - with a touchpad that has actual physical buttons? Same questions for framework laptops if anyone knows.
- ISL 4y ago
  A sticker or a "skin" might solve the first concern?
- benlivengood 4y ago
  My lemp10 just has stickers for the System76 logo; one letter has worn off already.
- rekado 4y ago
  NovaCustom also sells some of the same laptops with coreboot (there are a few differences in the configurations, but it's close), and you can choose a custom logo or no branding at all. Unfortunately, there's no option for a touchpad with physical buttons.
- fsflover 4y ago
  Purism sells laptops without a branding, but also without actual touchpad buttons.
- larsla 4y ago
  Tuxedo gives you the option to order their laptops with either the Tuxedo logo, a custom logo, or no logo. I ordered the InfinityBook Pro 14 Gen7 without any logo and it looks really clean. I haven't checked Coreboot support before, but now found: https://www.tuxedocomputers.com/en/Infos/Help-Support/Frequently-asked-questions/Coreboot-on-TUXEDO-Computers-devices.tuxedo https://www.tuxedocomputers.com/en/Infos/Help-Support/Freque...

apengwin 4y ago

[flagged]

WJW 4y ago
Yes we all know this. It does not matter in the slightest to any of the users of Linux.
lapinot 4y ago
I don't recall systemd -- perhaps the most important userspace component of most linux distros nowadays -- to be a gnu project.
- fsflover 4y ago
  By the number of lines of codes GNU part is still the largest AFAIK.
nathell 4y ago
https://www.gnu.org/gnu/incorrect-quotation.html https://www.gnu.org/gnu/incorrect-quotation.html
VagueMag 4y ago
Something about the greyed out text makes troll comments like this extra funny.

r3trohack3r 4y ago

I love my Libreboot laptop. But haven’t used it lately, because it’s too fragile for my environment (I work in a swimming pool). Same gripe for Raspberry Pi based laptops. I would love to see a Toughbook based version that’s water resistant.

confounded 4y ago
Out of interest, what kind of work do you do, on Linux, on a laptop, in a swimming pool?
- LoganDark 4y ago
  Obviously none if their laptop is too fragile to be doing any such work :P
- deathgripsss 4y ago
  My guess is a data center that heats a swimming pool. https://www.google.com/amp/s/www.bbc.com/news/technology-64939558.amp https://www.google.com/amp/s/www.bbc.com/news/technology-649...
- r3trohack3r 4y ago
  When I started I was doing platform engineering for Netflix from my pool. Now I do full time consulting in the same space. I use a floating card table for my desk and a CF-31 for the laptop.

therealshiva 4y ago

guys i'm curious... about security: some say intel has a backdoor, but there is this guy Nicola who says it's not true... if it's not true, why is the driver closed source, and why is it impossible to disable ME?

wmf 4y ago
You can get a range of answers to that question but ultimately none of them are provable so the conspiracy theories will continue.
anonym29 4y ago
Intel CSME (formerly ME) and AMT ST (formerly PSP) have many properties that are / would be desireable for someone who is/was building a backdoor (DMA, TCP/IP stack that can use onboard ethernet without the host OS being aware, closed source, unremovable, etc). Keep in mind that even if there has not been a backdoor deliberately added, there absolutely have been serious exploits in ME and PSP, and even for those who are not worried about the government, these security coprocessors still pose grave risk to data privacy and security, potentially handing "ring -3" access to non-government hackers. While I personally share your belief that these are probable backdoors, it is important to remind skeptics that they pose a grave security and privacy threat even outside the context of a government backdoor conspiracy. There's a great talk on the risks posed by the capabilities of these security coprocessors by an extremely well-versed individual at Google who was (leading? involved at a high level?) working on Google's efforts to neutralize these dangerous subsystems at Embedded Linux Con in 2017: https://youtu.be/iffTJ1vPCSo https://youtu.be/iffTJ1vPCSo
- charcircuit 4y ago
  >DMA, TCP/IP stack that can use onboard ethernet without the host OS being aware, closed source, unremovable, etc You do know a wifi card has the same capabilities, right? There are many processors in your computer that can talk to the rest of the system in a privileged way. >there absolutely have been serious exploits in ME and PSP, Such as? I wouldn't call any of the found vulnerabilities serious. >that they pose a grave security and privacy threat even outside the context of a government backdoor conspiracy. Okay, but you need to balance those problems with the very real security benefits this allows Intel to offer.

candiddevmike 4y ago

I was looking at porting a mobo to coreboot (Dell) and learned about Intel boot guard. That kind of thing should fall under right to repair and be illegal. My device, my choice on how I flash it.

charcircuit 4y ago
> My device, my choice on how I flash it. And how does the device know that it is the owner of the device trying to flash it and not an attacker wanting to bypass secure boot? It's safer to have it assume that everyone flashing it is an attacker. I don't think making secure devices should be made illegal. People who want to buy insecure devices are an outlier which means there isn't much demand for a purposefully insecure device. Using the legal system to force manufactures to purposefully make insecure things doesn't seem right to me.
- blackpill0w 4y ago
  >It's safer to have it assume that everyone flashing it is an attacker In other words: "let's put everyone in jail because someone might be a thief", I find this way of thinking to be moronic. I wonder how an attacker could get physical access to a machine, disassemble it and flash without getting detected. Plus, if I already have physical access to the machine and plenty of time to execute such an attack, why not just grab the drive? I hate this trend of forcing users to run nonsense programs in order to use their devices, like Windows 11 forcing you to have a Microsoft account during the installation process.
  - charcircuit 4y ago
    >let's put everyone in jail because someone might be a thief No, it's more like devices should consider security holistically and only offer an API that is secure. Hacker News doesn't allow any users to edit any other's comment. Is that putting all users in jail because we don't have a capability which is technically possible? >I wonder how an attacker could get physical access to a machine, disassemble it and flash without getting detected. Just because an attack may be niche it doesn't mean that the vulnerability should be ignored. Some customers like businesses can be extra paranoid of attacks like these and have concerns about these attacks. >why not just grab the drive? Because the drive should be encrypted.

deleted 4y ago

[deleted]

cutler 4y ago

14" max is a bit of a deal breaker for me but otherwise looks good.

javert 4y ago

I don't understand what part of this (if any) I cannot do at home. Couldn't I just run me_cleaner myself and then install the desired OS?

unixhero 4y ago
Yes .. But you are not done. As you also have to reflash the system bios to libreboot. That is the crux here.
- dandongus 4y ago
  That's fairly trivial to do, someone doing it for you is certainly not worth anywhere near £130.00 in my humble opinion.
  - ach_hm 4y ago
    Well I did it on my t440p and I didn't find it entirely trivial including the risk that you may brick the motherboard and that the Laptops sold over their are additionally refurbished if I understood correctly … So £130 is not too much in my opinion. Obviously it is on the high side because low volume and support for free software ·
  - unixhero 4y ago
    If you have nothing else to do. Then your own time is worthless and I would agree with you. If you have family and ir a job, your time is the most valuable asset. 130 pounds seems reasonable for not having to do this one off flash procedure.

gigatexal 4y ago

Leah is doing amazing work. Support them if you can!

BrotherBisquick 4y ago
[flagged]

theK 4y ago

16G ram could be cutting it close in a lot of back end Dev workloads... How come there are no bigger options?

egberts1 4y ago

Mmmmm, still could have selected an Ethernet hardware without ME. Why bother to disable ME if you could do the right thing?

deepthought422 4y ago

Minifree operates the one-man version of Libreboot, ladden with insecure blobs. Libreboot.at is the real Libreboot, backed by the FSF, without blobs and mental meltdowns (so far).