Yeah, if I remember correctly the initial business model of paybyphone was precisely that they were pocketing the overlap between parking sessions and using that to deploy at no cost for the city and invisible cost for the drivers
Just replace AI by block chain or Internet and you'll see that none of these arguments hold water to claim there's no bubble.
> I don't think the rhetoric about the AI bubble is really about finances
But that's purely what bubbles are about though. People see something become popular, want to be in, over invest, and the thing becomes overvalued.
Internet was a bubble. I don't think anyone would claim the value people saw in it doesn't exist, and there's way more investment in internet today than there was when the dotcom bubble burst. It was a bubble nonetheless.
I'm not sure what codex helped with for the Lenovo case, if all that was required was open the stick and stick the sdcard into a computer.
It's crazy that Lenovo will still be trusted to build secured hardware after that. It's not even a vulnerability at this point, I'm not sure how this could pass any form of security review, let alone having anyone review the design and approve it. They must have known it was nothing they pretended and still decide to sell it.
How can I be sure my lenovo laptop is safe? I have a clean install, but should I dump the motherboard firmware and ask ai to decompile it? Is there another place they could hide bloatware? Besides main storage / motherboard firmware?
Should I check network card firmware?) Maybe they added a rule to forward certain instructions to the OS embedded in the CPU
They can hide it in your storage firmware. Sprites Mods attached a jtag to a consumer hard drive, identified the CPUs, dumped the firmware, modified it, wrote it back. When it sees a certain string in any write to the disk, it enters evil mode. Then whenever it sees something that looks like a unix password file, it substitutes it for some known value. As in, hit your webserver with the magic string in the query string portion of the request, then ssh to the box and log in with a known password. Reinstalling your OS does nothing for you since it's in the drive firmware. Also was able to reprogram the firmware online, not requiring physical access to the drive. But literally anything can be compromised. You could have DIMMs that look for magic bits and when they see them they substitute code so the nation state can have code running on your computer anytime they want. Your cpu could do the same. Once it seems some long ass string of bytes that have a particular checksum, it switches to ring 0 or ring -1 or smm mode.
True, but Lenovo has repeatedly demonstrated that they're willing to do it, lie to customers giving them a false sense of security while leaving them vulnerable, and will continue to put their customers at risk even after being caught several times.
That's a cool thought experiment, but it doesn't work in practice.
> When it sees a certain string in any write to the disk
dm-crypt or zfs encryption or any other commonly used encryption will encrypt the data before it's written to disk, so the disk controller will not be able to do anything with writes or reads since it will not have the encryption key.
The general point related to the topic of the article is that the many controllers running on your device (not limited to Lenovo BTW) are black boxes almost impossible to inspect. The encryption engine on a hardware encrypted USB stick is making everything even harder. It can implement something like this but it's probably made to be extremely difficult to dump the firmware or inspect the features implemented in silicon.
If I'm doing software encryption like dm-crypt or zfs encryption then I don't need to bother with hardware encryption too. It's easier to trust software encryption. We have many interoperable and even open source implementations of the same encryption methods, the output is readable in open formats, so they can be validated against each other if needed.
>> will encrypt the data before it's written to disk
The people buying much of these "hardware encryption" products do so because they believe it removes the need for software encryption to/from the device.
They were still pre-installing malware in people's systems in 2016. They were caught with a hardcoded password in their fingerprint scanner after that. In 2019 they still couldn't be trusted not to backdoor their devices, they released a alarm clock with a hard-coded SSH password. They are not a company any should be trusting with anything.
Sure? All of that seems post-2010ish. I think we're agreeing with each other, but placing that comment in response to mine instead of a different one gives off a different impression.
There's a world of difference between "we can't be sure that other companies won't backdoor our systems" and "We know for a fact that lenovo has done it multiple times and repeatedly lied to customers about it when found out and even once released a patch which they claimed fixed the problem but which actually still left their customers vulnerable."
All people are capable of being untrustworthy, but that doesn't make all people the same as those who have already demonstrated that they are.
ThinkPad is still a decently "trustable" brand (at a price, if buying new), but that indeed doesn't extend to their other product lines!
And of course even pedigreed ThinkPads have changed a lot from the X201/T410/T510 age (that's the first generation Intel i-series) in subjective but generally criticized ways :) :(
Maybe Clevo, since they are more of an OEM producer for other brands meaning they don't control all the eyes on the hardware all the way to the sale point, i.e. to sneak things in.
At this I can't think of anyone I'd trust less. People have their complaints about every manufacture, but as far as I know, none of them have a track record as bad and as consistent as levono. Personally, I'm looking at system76 and Framework for my next laptop.
Who do you have to trust the least? The other two choices are Chromebooks and Macbooks, or some homegrown Linux solution. Of those, only Chromebooks are locked down to the point that you can't do anything with it unless you intentionally unlock it. Which means it's safe for some kinds of things but not others, depending on your threat model.
Dell is the one that may break, but their service is great. Next business day on site repair.
Maybe HP business stuff as well? HP are inconsistent, but some of their stuff is good. I've had an HP ZR24w screen with great picture quality that still works like new after 15 years and 30k hours. The ZBook G1a laptop ("mobile workstation in ultrabook form factor") also seems great so far, after a little under a year. Almost everything about it is very good, including the touchpad.
He used codex on other devices. He just opened the Lenovo USB case no AI needed because the sd card can be read by using a reader. The USB connection is disabled/enabled by the fingerprint reader.
So many boxes to tick, and with a company culture that leans towards box ticking and apathy (regulatory checklists without the extra checkbox “is that last checkbox a real checkbox" then you have to talk to the nerd department who's too busy for your stupid questions... Etc. Etc.) What can we expect? I'm disappointed in Lenovo for this, but my own apathy expects no one will be held accountable!
I probably missed on something, but I stopped there
reply