Citation on that? Never heard that before, and I own two ThinkPads (including a four-month-old T480).
Or who could forget Lenovo's surveillance malware that performed man-in-the-middle attacks on SSL traffic? Seriously, these machines should be banned for sale in the U.S. on national security grounds.
Intel has its ME, which is much worse than any of these.
AMD has its own ME-equivalent.
Intel ME is worrisome. Lenovo's behavior was actually malicious. There's kind of a difference.
Superfish was removable. The ME is far from it.
There are alternatives to using Lenovo software or hardware, thus Superfish is even completely avoidable. The ME and its AMD equivalent are not.
Both are worrisome. Backdoor-in-hardware is far more worrisome.
With proper hardware tooling and care, perhaps. (Side question: even for latest gen chips?)
For the vast majority of people, ME is not removable. For the AMD users, AMD's ME equivalent is not removable.
> Lenovo's suspend feature relies on an unsigned binary blob from China sideloaded during system boot over an unsecure HTTP connection
it talks about Lenovo Service Engine, Superfish, Lenovo Solution Center, and Lenovo Customer Feedback.
if you blow away the default install of windows, including the UEFI partition, and install (windows or linux or whatever) from scratch, how could any of those things affect you?
It should still work great on your w520, except there were several power management issues related to the optimus GPU I just couldn't fix.
Oh and careful with the RAM if you use 32G as some brands will not work well, because of raminit issue (I haven't followed, maybe they are fixed now)
Of course, malicious firmware doesn't really depend on the OS's cooperation. It would just be harder to implement and the result a lot more flaky.
https://www.pcworld.com/article/2969365/security/lenovos-ser...
It says the Thinkpad lines were never affected by this