Hacker News Reader

Comment by pjmlp | Hacker News Reader

Sadly no. Businesses will still buy Thinkpads like candies.

I'm structurally distrustful of the hardware that I buy so I rip out the drives without ever even booting them and then install Linux on a drive bought through another source. I can still see some potential issues there (drive firmware compromised, bios tricks, chipsets with junk and management devices) but that's a basic precaution against getting something you didn't actually buy.

I think it rapidly turns into "How much effort are you willing to use to make yourself more secure?" There's diminishing returns as you increase your money and effort devoted. $50 and a couple hours will get you another hard drive and a Linux install. How much are you going to spend to guarantee that your BIOS and firmware aren't compromised?

There's a reason why security-conscious folks spend an enormous amount of money on the stuff that we buy for a couple hundred bucks. I'm sure that the NSA pays thousands for $100 hard drives.

There are some interesting corollaries that make this interesting from an InfoSec perspective.

Heart of the matter is that most consumers - whether personal or business users will have little to no visibility into this. And, even a smaller fraction will have the technical chops to remove this garbage unless there's a tool that's openly presented to them.

Since there are a ton of small businesses that purchase and consume laptops just as the come out of the box, I'm really interested in the industrial espionage potential with this.

Couple in all the PRISMish like revelations over the last year and a half, and I simply have trouble putting much faith in their, "oh, it's just to show better ads, sorry..." statement.

As a subcontractor for BIA and DOI, I can sure you that news has gone around and we will add all Lenovo products to the list of items no to purchase.

Yeah and businesses run their own Windows images. Whatever software is preloaded doesn't matter.

Big companies, yes. Small businesses, not so much.

There's certainly an unrealized support cost. But in my experience, it's pretty common to see several different manufacturers and OSs across a small business. When they need a new laptop, they're either picking up what's cheap at Best Buy or handing down machines when the boss gets a new one.

Unless their Windows image is based on the out-of-the-box OEM install.

I would imagine that any company imaging their hardware has their own custom image to coincide with their windows licensing agreement and not on whatever was on the first box.

Yeah, that doesn't happen.

Reply on news.ycombinator.com