Successor to the old Thinkpad

Let's get it out of the way, I don't care about battery life. I don't go outside, and when I do, I have a full AC adapter in my EDC like an absolute loser. Is the librebooted Thinkpad X200 still the most secure computer you can own? Bring me up to speed. Is the old CPU that hasn't had microcode updates in years free range for skids? Or the old network firmware that comes in contact with raw network traffic?

>>28057 Graphene OS in desktop mode, plugged into a monitor, is guaranteed to be more secure than what you could get on a traditional PC architecture. It's at least harder to mess up, and the boot chain is also more protected than what you could get with Heads, probably. (Unsure how Heads compares)

>>28057 >Brazil.png I suspect your country of origin might be related to the problems you are having.

>>28059 Qubes OS is way more secure in terms of cross-identity isolation (GrapheneOS' profile based model is really poorly suited for this) and general runtime security. Admittedly though, GrapheneOS is decades ahead of Qubes OS when it comes to its verified boot (while Qubes OS, well, doesn't support it at all). >>28057 You'll always be facing a tradeoff between hardware mitigations (and lack of hardware vulnerabilities) or freedom from potential backdoors. It takes time for researchers to analyze hardware for intentional security holes, and sometimes hardware vulns get discovered before a relatively libre firmware stack is developed. Overall, pick any modern laptop that supports Coreboot (maybe deguarded T480?). If you're too poor for that - pick anything not vulnerable to Spectre/Meltdown/whatever.

>>28067 Without discounting from that, what makes it so hard to upgrade is also that the X200 was about the last Intel board from which me_cleaner could fully remove the backdoor known as Intel ME. I wonder if there are any alternatives nowadays that don't have Intel ME or AMD's PSP. I'm willing to look into ARM machines if any of them doesn't force on you anything analogous to Intel ME. >>28066 >I suspect your country of origin might be related to the problems you are having. How? I can buy new hardware, it's just that the world seemingly hasn't made non-backdoored hardware since 2008-ish

>>28068 >I can't find non-backdoored hardware made since 2008-ish >I immediately believe the Jewish propaganda that some "random anon" mentioned skill issue

>>28071 >>28071 >>28071 >>28071 >>28071 im not going to vouch for the size of the hat but there is a coordunated effort to control all machines.

>Is the librebooted Thinkpad X200 still the most secure computer you can own privacy != security

>>28083 I do think a X200 from which you've removed Intel ME, during the time the hardware was fairly recent, was more private and more secure than any alternative. A government & greatest ally backdoor can be used by anyone that discovers it. It's a security grievance. In the case of Intel ME (Intel AMT) you had vulnerabilities publicly disclosed around 2017-2018 that existed for a decade, in computers made after 2008. Anyone could've discovered and used them. https://nvd.nist.gov/vuln/search#/nvd/home?cpeFilterMode=cpe&cpeName=cpe:2.3:o:intel:active_management_technology_firmware:-:*:*:*:*:*:*:*&resultType=records

>>28084 >A government & greatest ally backdoor can be used by anyone that discovers it That is a naive view. Three letter agencies don't want to be vulnerable to adversaries either, so if they plant a backdoor in every modern device, they will take care to make it only exploitable with a cryptographic secret that can't be obtained from reverse engineering.

>>28092 They've been pretty sloppy thus far though, e.g. the list of CVEs in Intel ME. None of that would be a problem if you didn't have a god-chip with DMA access and network access that can run while your computer is off.

>>28092 bold of you to assume that three letter agencies are any more competent than any other large bureaucratic organization. Especially now that they've basically purged all the competent people in favor of political toadies.

>>28095 Can these actually be exploited over the network?

>>28067 >cross-identity isolation (GrapheneOS' profile based model is really poorly suited for this) >general runtime security Can you provide further reading? >>28098 Intel chips, yes. PSP is a much smaller code base and doesn't include any networking.

>>28107 I was asking if an RCE exploit floats around for any of the Intel ME CVEs. Most CVEs are on the level of "software will crash for very obscure situation that an attacker will have to convince user to get into", which is on a completely different level than the backdoor claimed in this thread. Of course it still is like kicking dead whales down the beach that there is buggy code running on a coprocessor that I can't fix nor disable, but it is still much better than a backdoor.