4 ms·

This is great, but I can't trust a Lenovo device and I'm always a bit shocked when I see developers buying ThinkPads from a company that's demonstrated it can't

by duped 3y ago

This is great, but I can't trust a Lenovo device and I'm always a bit shocked when I see developers buying ThinkPads from a company that's demonstrated it can't be trusted to give you a secure device.

foooorsyth 3y ago
I’m out of the loop. Is this sentiment due to Chinese ownership or previous mishaps? Both?
- jowea 3y ago
  I remember the superfish incident https://en.wikipedia.org/wiki/Lenovo#Superfish https://en.wikipedia.org/wiki/Lenovo#Superfish
- duped 3y ago
  Superfish is the big one.
- deleted 3y ago
  [deleted]
deleted 3y ago
[deleted]
intalentive 3y ago
Doesn’t every CPU have a state-enforced back door? I assume no device is secure.
- duped 3y ago
  I'm not really worried about state actors that don't have state sponsored industrial espionage.
  - concinds 3y ago
    The US also does extensive industrial espionage. You just don’t hear about it because other developed countries don’t want to harm their relations with the US, and authoritarian countries see no propaganda purpose in disclosing that they’re constantly getting hacked.
itsoktocry 3y ago
>from a company that's demonstrated it can't be trusted to give you a secure device. Is there a single technology company that you can't say this about?
- yjftsjthsd-h 3y ago
  Really depends on your threat model; I think most companies stop short of shipping malware from their UEFI implementation. That said, I don't think Framework has yet done anything questionable?
  - susanthenerd 3y ago
    The problem with Framework is that BIOS updates are really rare. I been running the 3.0.6-beta for my 12th gen for almost 8 months I think and the full release has yet to come. I bet it will never happen as they are focusing on AMD and 13th gen + 16" one at the moment.
  - progval 3y ago
    At least the 12th gen is very vulnerable to hardware access as you can't disable unauthenticated DMA access through the USB ports (it's what https://www.dell.com/community/en/conversations/latitude/demystifying-thunderbolt-3-security-levels/647f8742f4ccf8a8de66b949 https://www.dell.com/community/en/conversations/latitude/dem... calls SL0). I asked their support and they aren't planning to fix it in the forseeable future.

by duped 3y ago

foooorsyth 3y ago

I’m out of the loop. Is this sentiment due to Chinese ownership or previous mishaps? Both?

jowea 3y ago
I remember the superfish incident https://en.wikipedia.org/wiki/Lenovo#Superfish https://en.wikipedia.org/wiki/Lenovo#Superfish
duped 3y ago
Superfish is the big one.
deleted 3y ago
[deleted]

deleted 3y ago

[deleted]

intalentive 3y ago

Doesn’t every CPU have a state-enforced back door? I assume no device is secure.

duped 3y ago
I'm not really worried about state actors that don't have state sponsored industrial espionage.
- concinds 3y ago
  The US also does extensive industrial espionage. You just don’t hear about it because other developed countries don’t want to harm their relations with the US, and authoritarian countries see no propaganda purpose in disclosing that they’re constantly getting hacked.

itsoktocry 3y ago

>from a company that's demonstrated it can't be trusted to give you a secure device. Is there a single technology company that you can't say this about?

yjftsjthsd-h 3y ago
Really depends on your threat model; I think most companies stop short of shipping malware from their UEFI implementation. That said, I don't think Framework has yet done anything questionable?
- susanthenerd 3y ago
  The problem with Framework is that BIOS updates are really rare. I been running the 3.0.6-beta for my 12th gen for almost 8 months I think and the full release has yet to come. I bet it will never happen as they are focusing on AMD and 13th gen + 16" one at the moment.
- progval 3y ago
  At least the 12th gen is very vulnerable to hardware access as you can't disable unauthenticated DMA access through the USB ports (it's what https://www.dell.com/community/en/conversations/latitude/demystifying-thunderbolt-3-security-levels/647f8742f4ccf8a8de66b949 https://www.dell.com/community/en/conversations/latitude/dem... calls SL0). I asked their support and they aren't planning to fix it in the forseeable future.