The malware was only found on the IdeaPad series (their consumer line). From reporting on it, the management team is separate from their business (Thinkpad) line, and the malware came from the 3rd party software packages that were included to subsidize the production of the low-end lines.

Those 3rd party packages are not a concern for the Thinkpad lines, since the higher business price point supports the lines without the need for subsidizing.

That was IdeaPad, nothing to do with ThinkPad.

Good to know, thanks! Do both lines have completely different engineering and management leadership? That might put me at some ease.

The ThinkPad team is still Tokyo based https://en.wikipedia.org/wiki/IBM_Yamato_Facility the IdePad is from China.

The Ideapads are built like the cheap piece of crap x86 Windows laptops you can buy from anyone. They are fine for grandma checking her email but they are not meant to be on the move or do anything hard. I'm assuming the engineering teams are totally different. Thinkpads aren't cheap and the build quality generally shows that.

Thinkpad quality is nowhere near what it was when IBM was building them however :(

I think the perceived quality of older TPs is higher, but the objective quality is not so.

They do. Thinkpads are made out of magnesium and are super durable. Build quality is pretty great. Should be more reliable than a mac.

Mac build quality really isn't all that great. Lots of glue and plastic hinges. Motherboard design is also atrocious. Check out Louis rossman on YouTube. I remember seeing a video where the webcam died because a thermal sensor stopped working and for some reason the webcam was wired into the same bus.

They also solder in ram and ssds now. They removed the data recovery port so if your ssd kicks the bucket there's no way to recover anything. That's what the T2 chip is for- they market it as some magical coprocessor but it's just an ARM chip that acts as a drive and ram controller so they can use soldered parts on the cheap.

When I bought my thinkpad I booted directly to the Debian installer via USB and wiped the disk. I get great battery life (check the Arch wiki for tips on your specific machine to fix a few issues that may give it bad battery at first install).

The keyboard is wonderful and everything except the fingerprint scanner works great.

I get twenty goddamn hours from my X270 and it's incredible. I never use the fingerprint scanner, so I recommend Thinkpads all the time. Good connectivity too, although I'd appreciate maybe another USB port or two.

well, you can do what I do and wipe the OS. Though, that's a bit of a time investment.

Didn't the firmware add their malware to windows boot files, if detected? Not an issue if you can use another os, but if you need windows for some reason...

That's obvious, and certainly the first thing I'd do upon receiving such a device. But given how Lenovo got caught more than once pushing malware (after promising they'd fix it), I worry the problem could be deeply engrained in their product philosophy, and as such, I don't know that I'd even trust their firmware.

But maybe people change, and maybe I'm just being paranoid and depriving myself unnecessarily from hardware that I would like. (FWIW, I have used Thinkpads and greatly liked their keyboards, enough that I do consider them for every hardware refresh).

The harddrive that came with my ThinkPad hasn't seen electricity since it left the factory, I replaced it before I ever turned the laptop on.

The hard drive isn't the only place malware can live (the BIOS would be one example of another place).

Well, you do what you can.

Just reinstall the OS