[chrisss395]

Do folks have any security concerns with Lenovo? An IT leader at a medium-large US bank recently told me they won't use Lenovo due to security risks from Chinese firmware (or something to that effect, referencing and older incident I don't recall). I've only seen such policies with defense players ten or so years ago.

That said, I've owned them personally for 10+ years, so looking for objective thoughts outside repairability as the article covers.

[kemotep]

Would that not be a concern for most computers? Aren’t most of these motherboards manufactured in China (or at least close proximity to China? Taiwan, Korea, Japan, Vietnam, Malaysia, etc.)

But older Thinkpads (not sure about newer (~5 years old) ones, certainly not brand brand new models) have great support of alternative firmware such as coreboot and libreboot, other projects that disable Intel ME and the like.

[SamuelAdams]

Reminds me of the film Armageddon 1998, where the Russian astronaut had some complaints:

<in reference to hardware buttons in the spaceship control panel>

USA astronaut: "This is an American aircraft, you don't know the parts"

Russian astronaut: "Ah, American parts, Russian parts... all made in Taiwan!"

[cromka]

It's the firmware that is made in China that's problematic, not where the motherboard is soldered. Framework assembled there, too, but use open source coreboot firmware. Doesn't get any better than that.

Almost every upgrade of firmware for my Lenovo laptop is CVEs recently. I have no doubts they share that with their government and keep some backdoors opened.

[justaj]

Perhaps, but lots of (older) Thinkpads are supported by Libreboot, so that cuts down on the binary blobs significantly.

[iso-logi]

The bigger threat is the US, which injects spyware capabilities into every AMD, Intel and Nvidia die.

[imglorp]

Maybe? The Lenovo Superfish thing was pretty bad.

Anyway, every die? citation needed.

Also. If true, what's the alternative?

[naruhodo]

"Every"? Maybe not, but... from a brief web search, IME should give you the heebie-jeebies due to it's network access.[1]

AMD's PSP (now ASP) seems to be more of a local attack surface[2] that has its fair share of vulnerabilities.[3]

[1] https://www.franksworld.com/2025/09/18/the-intel-backdoor-no...

[2] https://www.digit.in/features/laptops/intel-me-and-amd-psp-t...

[3] https://www.amd.com/en/resources/product-security/bulletin/a...