3 ms·

Amazing adventure and great write up! It reads like an adventure novel :-) > Unfortunately, Lenovo continues to implement a stupid network card whitelist that

Amazing adventure and great write up! It reads like an adventure novel :-) > Unfortunately, Lenovo continues to implement a stupid network card whitelist that IBM started over 20 years ago on its ThinkPad models. If the card in the M.2 slot is not advertising a known PCI vendor and product ID in the whitelist contained in the BIOS (now UEFI firmware), the ThinkPad will refuse to boot. Why?? Are there legitimate reasons for this sort of design behavior other than anticompetitiveness?

Spooky23 2y ago
Supply chain integrity comes to mind.
- adolph 2y ago
  The tao of hardware supply chains. Surely they can do the checksums tho. https://www.theverge.com/2013/12/29/5253226/nsa-cia-fbi-laptop-usb-plant-spy https://www.theverge.com/2013/12/29/5253226/nsa-cia-fbi-lapt...
  - Spooky23 2y ago
    That’s one scenario. Around COVID times, my then employer got stuck with about 40,000 devices, 30% of which had undetectable, counterfeit memory that would eventually cause a complete failure. Replacement was a $80M lesson for that vendor.
    - MonaroVXR 2y ago
      How did you for out? And what kind of steps are you taking right now?
jamesy0ung 2y ago
Yeah it's such a horrible idea. It sucks the ending was just hijacking the usb bus used by the fingerprint sensor :(
utensil4778 2y ago
The usual line that Lenovo gives is that this is for FCC reasons. The argument goes that the laptop is FCC certified as an entire unit, and changing the WiFi card technically invalidates this. This is quite plainly nonsense. Every other manufacturer allows WiFi adapter replacements because every module on the market must be individually FCC certified. Technically, the claim does make sense under a creative interpretation of the FCC rules. I think the real reason is likely so you'll buy replacement FRUs from Lenovo under your enterprise support contract, as well as ensuring you use a module that is known to work reliably with the software stack shipped on the machine. Basically yeah, its an anticompetitive measure.
- numpad0 2y ago
  Other manufacturers such as Dell and HP do in fact implement BIOS whitelist. I think this is the reason why Internet listings of Wi-Fi cards are advertised with brand names that the cards are intended for.
- nemosaltat 2y ago
  If that sounds silly, while working in commercial construction in Los Angeles, we encountered pushback for placing UL-listed devices in a UL-listed enclosure. The city determined that to be a “new assembly” and required UL listing for the entire unit. UL has a category for this situation; the enclosure is “UL recognized” because all of the devices and the enclosure are UL-listed. Their proposed solution, which UL was happy to oblige, was to come and field-inspect the installed units and have them certified in situ, at our (significant) expense, of course.
  - gamblor956 2y ago
    TBH that doesn't sound ridiculous at all. "UL recognized" is not the same thing as "UL listed." The former means that the assembly is assumed to meet UL specifications; the second means that it has been inspected by UL and confirmed that the assembly actually does meet specifications. Making sure that things meet specifications is the entire point of the building department's inspections.
realusername 2y ago
That's also probably against the last right to repair EU laws if the laptop is sold in the EU.

Spooky23 2y ago

Supply chain integrity comes to mind.

adolph 2y ago
The tao of hardware supply chains. Surely they can do the checksums tho. https://www.theverge.com/2013/12/29/5253226/nsa-cia-fbi-laptop-usb-plant-spy https://www.theverge.com/2013/12/29/5253226/nsa-cia-fbi-lapt...
- Spooky23 2y ago
  That’s one scenario. Around COVID times, my then employer got stuck with about 40,000 devices, 30% of which had undetectable, counterfeit memory that would eventually cause a complete failure. Replacement was a $80M lesson for that vendor.
  - MonaroVXR 2y ago
    How did you for out? And what kind of steps are you taking right now?

jamesy0ung 2y ago

Yeah it's such a horrible idea. It sucks the ending was just hijacking the usb bus used by the fingerprint sensor :(

utensil4778 2y ago

The usual line that Lenovo gives is that this is for FCC reasons. The argument goes that the laptop is FCC certified as an entire unit, and changing the WiFi card technically invalidates this. This is quite plainly nonsense. Every other manufacturer allows WiFi adapter replacements because every module on the market must be individually FCC certified. Technically, the claim does make sense under a creative interpretation of the FCC rules. I think the real reason is likely so you'll buy replacement FRUs from Lenovo under your enterprise support contract, as well as ensuring you use a module that is known to work reliably with the software stack shipped on the machine. Basically yeah, its an anticompetitive measure.

numpad0 2y ago
Other manufacturers such as Dell and HP do in fact implement BIOS whitelist. I think this is the reason why Internet listings of Wi-Fi cards are advertised with brand names that the cards are intended for.
nemosaltat 2y ago
If that sounds silly, while working in commercial construction in Los Angeles, we encountered pushback for placing UL-listed devices in a UL-listed enclosure. The city determined that to be a “new assembly” and required UL listing for the entire unit. UL has a category for this situation; the enclosure is “UL recognized” because all of the devices and the enclosure are UL-listed. Their proposed solution, which UL was happy to oblige, was to come and field-inspect the installed units and have them certified in situ, at our (significant) expense, of course.
- gamblor956 2y ago
  TBH that doesn't sound ridiculous at all. "UL recognized" is not the same thing as "UL listed." The former means that the assembly is assumed to meet UL specifications; the second means that it has been inspected by UL and confirmed that the assembly actually does meet specifications. Making sure that things meet specifications is the entire point of the building department's inspections.

realusername 2y ago

That's also probably against the last right to repair EU laws if the laptop is sold in the EU.