Hacker News Reader

Comment by endgame | Hacker News Reader

Lenovo are on my personal shitlist after superfish and abusing the windows platform binary table. When my current laptop dies (a thinkpad T440p that I'm reasonably happy with), I may have to suck up the performance hit and go to minifree for a machine I can actually trust.

View on HN

ThinkPads never had Superfish nor the Lenovo Service Engine (the Windows Platform Binary Table thing you're referring to).

Of course you're right that Lenovo never should have put those on any of their machines, but my impression is that ThinkPads and the consumer line are run by very different groups within Lenovo.

https://support.lenovo.com/us/en/product_security/superfish

https://support.lenovo.com/us/en/product_security/lse_bios_n...

Unfortunately, even a recent (Aug 2016) new Thinkpad T460p included a Lenovo Windows app that apparently runs daily to send "usage data" to Lenovo. It is easily disabled, but still troubling because most customers will be unaware that it exists.

http://www.computerworld.com/article/2984889/windows-pcs/len...

https://support.lenovo.com/us/en/documents/ht102023

> As of September 2015: Lenovo systems may include software components that communicate with servers on the internet - All ThinkCentre, All ThinkStation, All ThinkPad

To be fair, if it comes with a preinstalled version of windows you can never really be sure what is on the machine, can you?

I suspect that if a company really wanted to hide something they probably could. So unless you install windows or another OS on it yourself, you don't know what the manufacturer put on it.

I guess it would not be too hard to find in general if it shows up in the list of processes, but they could make it quite obscure and hard to find.

But yeah, I agree that this is quite an annoying move from Lenovo. The least they could do is make it opt-in instead of on by default.

> you can never really be sure what is on the machine, can you?

Yes, but "not sure if it has spyware preinstalled" is much better than "sure it has spyware preinstalled".

If you are not sure if it has spyware installed, you also do not know what the spyware is doing exactly and it could potentially be worse than what the spyware you know of is doing.

I guess I could argue that the former is actually worse. If you know spyware is installed, you can opt to remove it. If you are not aware of the existance of spyware on the system, and it happens to have spyware, you are more vulnerable.

You could of course take the risk and assume that it does not have spyware, and maybe you're right and everything is fine, but you can not _know_ that it is fine.

That is completely inane. You're telling me that a superset of something is worse than the thing itself, which can only be true if "I know it has no spyware" is worse than "I know it has spyware".

The rest of your comment disingenuously assumes that a computer can only have one piece of spyware, and if you know what it is you can remove it and now you're safe. What if there's more spyware you don't know about? And if your remover is completely safe, why not just run it on all your computers, safe or not?

Not to mention that removing spyware from a computer turns it into a computer that might or might not have spyware.

consider that "sure it has spyware installed" also includes "not sure if it has _other, 'unknown-unknown'_ spyware installed". it's strictly worse.

Lenovo have been repeatedly caught doing this. They have shown that they do not want or plan to have this as an opt-in - instead they are trying to hide it better. It's obvious that it's their strategy, not some one time "mistake". (They put it in BIOS even! (!)). http://thehackernews.com/2015/09/lenovo-laptop-virus.html

I'd recommend going with another vendor than Ministry of Freedom (by Leah Rowe). I ordered a laptop from there and it took months to get the payment processed and the laptop shipped, with barely any contact in between. I thought it was very unprofessional and it definitely was the worst online shopping experience I've had so far.

Expect to wait at least three weeks for every time you send them an email.

The laptop is OK, though it was dirty when it arrived. It had a bunch of some kind of sticker glue on it.

Any vendors you'd recommend? (Non-x86 is fine.)

This is the only other option that has the FSF RYF certificate:

https://shop.libiquity.com/product/taurinus-x200

One piece of hardware I'm very excited about is LowRISC: they're developing a fully open-source SoC, including open source chips, SoC and firmware.

I think it's the most promising platform for formally verified computing, because it's open and thus possible to model and verify all the way down.

Thank you, but it doesn't ship outside the US. Are you aware of any other decent libreboot machines, even if they can't be liberated end-to-end?

I'm afraid I don't know of any premade options.

I've been considering building my own and have recently dropped out to start working for myself; I'm thinking, perhaps I could build one for you?

It'd depend on how soon you need it and to what spec, as I'll have to source it from scratch. If you leave some means of contacting you I will, I'm quite interested in building these things for another purpose than "I like having and making these".

I'm passively looking for a machine at the moment but not really actively looking yet - this one's still got a fair amount of life in it. If you want to reach me, the email in my profile works.

Are you planning to do a libre hardware startup or something?

I don't currently have much of a plan aside from "do contracting for personal development and sustenance, while looking for interesting opportunities".

"Secure hardware + software for the masses" is one area I'd really like to work on.

Personally I think the FSF ideology taken too far is pretty ridiculous anyway.

Any reason? I'm not sure I disagree, but it would be helpful for you to provide some justification for calling them "ridiculous".

microcode updates, for one

Sounds like a non-problem if you are going to wipe out Windows and install Linux anyway?

And additionally a non-problem with the ThinkPad line, which is far less susceptible to this sort of tomfoolery.

Why would it be less susceptible? Isn't it the same company that makes them?

Yes, but the ThinkPads have a much bigger reputation on the line than the IdeaPads. Lenovo seems to know better than to annoy the businesses and power users that typically buy ThinkPads, whereas the IdeaPad-buying ordinary user is more tolerant of bloatware.

Not if they have shown that they can go so far as to put in BIOS. Imagine the level of effort it requires to develop something like this? If that is true, why not develop a small dedicated chip for it and put it somewhere unaccessible on the motherboard? (I mean, it's likely that they did or will do this.) http://thehackernews.com/2015/09/lenovo-laptop-virus.html

One thing to consider w.r.t. SuperFish is it was two years ago, and Lenovo did apologise for it. Sometimes you have to keep a grudge, but my opinion on this is it was something that pretty much any laptop manufacturer could have done and they did deal with it. YMMV.

I have avoided buying anything significant made by Todhiba for 30 years. It's probably time for me to drop my grudge against them (it has to do with milling machines and corporate misconduct during the Cold War).

For those of us that were somewhat puzzled about the mention of misconduct, I think this is what todd8 was referring to.

https://en.wikipedia.org/wiki/Toshiba-Kongsberg_scandal

Ah, "consumer" vs "business" computers. I wonder whether this distinction even makes sense. I think the biggest reason it still exists at this point is Best Buy and similar retail outlets, right?

The consumer space at Best Buy is focusing on whatever shit can be made and sold for < $500 dollars. And they are incredible at making stuff cheaper (whatever they may need to drop and break to reach that price).

Business require better built laptops than that, they've got money to pay and they want to have decent services and support. As a special characteristics, they also never bother to have a GPU (save money and power but missing for some consumer folks).

They seem to have signed up for the MS Signature program, so you might now get pure Win10 without bloat.

I'm not sure Win10 is any better than Superfish..

Superfish MITMed SSL communications in a way that created serious security problems.

If you're genuinely not sure then that shows a not-very-good judgement in my opinion. If it is a joke, then it's getting old.

I have a signature ThinkPad bought at a Microsoft store and it came with plenty of software that I would consider bloat. Lenovo ships a lot of extra software on their systems. I'd still recommend a reformat and reinstall of Windows.

Reply on news.ycombinator.com