Hacker News Reader

Comment by cat_plus_plus | Hacker News Reader

Cool that we are still discovering new things about old hardware. My only fear is that new hardware is too locked down to extends its life for either practical or hobby use. For example, modern Intel management engine could be used to have an always on webserver that consumes very little power when idle by turning off the main processor and only monitoring a network port in low power management microcontroller. But I am sure it's all DRMed and unaccessible.

View on HN

At this point we have to distrust the chips in our own devices. These chips are clearly not being designed to serve us (the owners of the devices that contain them). I'd even be fine with slower processors so long as we had the ability to verify exactly what they are and are not doing. With hardware we could trust not to betray us or prevent us from doing whatever we wanted we'd be better off than with locked down processors that prevent us from doing what we want but perform 'approved' operations faster.

It’s time to bring back old hardware sitting in closets as while they may be obsolete from a performance perspective they are ahead in terms of privacy. Let’s stop stripping old hardware support out of the Linux kernel and keep distros for old hardware alive.

done exactly this - reading & commenting from an old ThinkPad running OpenBSD. I don't buy new computers, I buy old ones from craigslist (in fact, multiple, so I can use the same system & compatible parts for many years to come). :)

> reading & commenting from an old ThinkPad running OpenBSD

How old? IBM Thinkpads were often decent enough that I'd pick one up if I saw a good deal, but Lenovo makes them now and they've got a long history of pre-installing malware and backdoors in their products (often in exchange for money). It's a shame, because I hear they play very well with linux.

I'm not sure a Lenovo device would be any safer than the latest processors

> they've got a long history of pre-installing malware and backdoors in their products (often in exchange for money)

Source for this?

Superfish, https://support.lenovo.com/us/en/product_security/ps500035-s...

That looks like some windows malware. All OeMs bundle that sort of stuff in windows, I think Microsoft does too.

Pretty much all OEMs preinstall adware. Microsoft infects their own OS with crapware.

They don't all ship with malware infested UEFI so that even reinstalling your OS won't remove the bloatware they installed. Also Lenovo has, multiple times now, installed adware on systems that seriously compromised the security of the user and/or the device.

Adware is bad, remote code execution is much worse.

For what I read superfish is some crap spyware with a root certificate that’s wiped the minute you boot the machine from your usb install disk.

Any luck is to uefi based malware?

(Personally I prefer a nice old fashioned bios)

I'd start here: https://en.wikipedia.org/wiki/Lenovo#Security_and_privacy_in...

Superfish was bad enough, but once the public became aware that the malware existed and was so insecure that it made their devices vulnerable to be hacked Lenovo provided people with a fix to remove the malware, but it left the security vulnerability that the malware introduced to the system in place leaving everyone to think they solved the problem when they were still vulnerable. People had to track down news articles and social media posts for information on how to correct the problem until Lenovo updated their instructions. (https://arstechnica.com/information-technology/2015/02/how-t...)

Further reading: https://www.eset.com/int/about/newsroom/press-releases/resea...

https://www.osnews.com/story/30736/lenovo-companies-working-...

https://news.ycombinator.com/item?id=18025645

https://www.theregister.com/2022/07/14/lenovo_uefi_vuln/

https://www.bleepingcomputer.com/news/security/lenovo-discov...

https://wccftech.com/lenovo-fingerprint-scanner-hardcoded-pa...

https://grahamcluley.com/lenovo-used-12345678-hard-coded-pas...

I've heard stories of Thinkpads with UEFI-level rootkits, flashed a modified UEFI myself (though my edits didn't achieve what I set out to do), and read about white-hat exploits putting keyloggers on the EC (power/keyboard controller): https://hackaday.com/2021/07/20/extracting-the-wifi-firmware.... I wouldn't fully trust used computers, to the extent I'd trust a Precursor, single-tasking microcontroller, or pre-2000 game console.

OpenBSD Intel Atom n270+1GB RAM netbook user there, among others.

Lariza as the big webkit2gtk4 browser, Links and Lynx as normal browser, with media bound to mpv+yt-dlp and nsxiv. MuPDF and a pipe with einfo -pp | lynx... | less for ebooks. ImageMagick, FFMPEG, sox. C, Perl for programming.

Bitlbee and Swirc for multi IM chat, sfeed for RSS news and podcasts, slrn for Usenet news.

A slightly hacked PCSX4ALL emulator (PSX) plus Mednafen for retrogaming among Slashem, BSDGames and Frotz for IF games.

Who said slow? OK, no Google Earth but I can use some TCL/TK based OSM map viewer from the TkIMG demos, and no Wine to play the games for that era. But, meh, I only get GL 1.4, not enough for proper DirectX9 translation (GL 2.1 it's the true basic DX9->GL mapping), so I've got lots of libre alternatives from https://osgameclones.com and a custom ScummVM compiled from ports with --enable-all-engines added to the configure script so I can play games from the Apple II era, passing thru Ultima IV, Maniac Mansion, Broken Sword up to Blade Runner and, soon, Sanitarium.

People understimate its old machines...

> I'd even be fine with slower processors so long as we had the ability to verify exactly what they are and are not doing. With hardware we could trust not to betray us or prevent us from doing whatever we wanted we'd be better off than with locked down processors that prevent us from doing what we want but perform 'approved' operations faster.

This might be what you're looking for. https://www.raptorcs.com/content/TL2WK2/intro.html

These days I would bet all internal/debugging features are gated behind asymmetric crypto-based challenge/response. And it's probably physically impossible to decap a <10nm chip and inspect visually. I don't see a way around it other than hoping for implementation bugs. It might be the end of the road for the hackers :(

Certainly makes you appreciate the "crypto is a munition" sentiment.

The AMD FX 8320 tower that I bought 2 weekends ago was one of the last CPUs from AMD to not have a PSP, platform security processor. Which is part of why I bought it...

Reply on news.ycombinator.com