Description

This computer ships with Libreboot pre-installed, which replaces proprietary BIOS/UEFI firmware, offering greater security and fast boot speeds. Debian Linux pre-installed (operating system), or your choice of other distro/BSD. This product is intended for those security conscious people who believe in the ideology of software freedom, and want a truly privacy-respecting computer product that is easy to get started with. *You* control your Libreboot machine, not the other way around. It is your property. KDE Plasma desktop environment provided by default, along with common applications such as web browser, productivity suite, text editors and so on. You can easily install from tens of thousands of available software packages via your Linux distro’s package manager, if you wish, for a given computational task that you wish to perform. KDE is a well-respected and powerful desktop environment, yet easy to use even for novice computer users.

Shipping worldwide! Minifree ships to USA, Canada, South America, Europe, Australia, Asia, and everywhere else, shipping globally from Minifree’s lab in the United Kingdom. Free 5 year warranty provided on all orders. The correct power cable is provided (e.g. USA, EU, UK), for each customer; the power supply is 120-240V auto-switching, so it works in every country. A compatible 65W DC power supply will be provided.

This is a high-performance workstation based on heavy modification of the Lenovo ThinkPad T480 and T480S, running free/opensource BIOS replacement Libreboot plus Debian Linux (operating system), other Linux distro or a BSD of your choice (e.g. FreeBSD). Full driver support in Linux and BSD operating systems, including WiFi. Libreboot is maintained and funded directly by Minifree; Minifree’s owner (Leah Rowe) is also the founder of Libreboot. Your purchase funds Libreboot. Source code for Libreboot and Debian Linux are provided with all orders.

Libreboot offers many advanced security features that you can’t get anywhere else, such as the ability to boot a *truly* fully encrypted Linux system, where /boot is also encrypted, and the ability to check GPG signatures of your Linux kernel and other files at bootup. More information is available on Libreboot’s GRUB hardening guide. We call this *Secure libreBoot*, and it’s far superior to UEFI SecureBoot, in that you are in full control of it and it provides actually stronger encryption by default. Libreboot also patches the GRUB payload to add Argon2id KDF support (for LUKS2), NVMe SSD support and xHCI (USB 3.0) support, and other fixes unavailable in GNU’s official GRUB releases.

Your purchase will directly provide funding for further Libreboot development. Minifree directly funds the Libreboot project; Libreboot’s founder, Leah Rowe, is also in charge of Minifree.

Thermal efficiency

Since this is a laptop, there is no IHS (integrated heat spreader). Instead, the main cooling block interfaces directly with the CPU die. This is called on-die cooling, and it’s standard for basically any laptop you’ll find on the market.

Minifree replaces the existing factory paste between the CPU die and cooling block, with Arctic MX-6 or Thermal Grizzly Kryonaut, improving thermal efficiency further still. This results in much lower system temperature, improving overall reliability and longevity.

Your freedom. Your Libreboot.

Most people use proprietary boot firmware, even if they use free operating systems. Many computers today are known to contain malware, chief among them being Intel’s Management Engine (ME). Our systems are different. Your Libreboot system will *never* spy on you, and it will never leak your data to anyone. Your privacy and security is critical. You are the owner of your machine. We believe free software is a fundamental right, something that everyone *must* have.

Your Libreboot T480 obeys you, and nobody else! It’s Libreboot inside! The Intel ME is *disabled* on every machine, using me_cleaner which disables the ME after BringUp – this is done for your security, and privacy. You have the freedom to tinker with every part of the machine; full source code is also available, for Libreboot and the installed Linux/BSD operating system of your choice.

Additionally: this machine makes use of the excellent deguard utility, alongside me_cleaner. Deguard disables the Intel Boot Guard, which is the reason why coreboot (and therefore Libreboot) can support this hardware!

Debian Linux is secure, easy to use

*Encrypted* Debian GNU+Linux is pre-installed to keep your data secure, with *full* driver support including WiFi. Other distros or a BSD (e.g. OpenBSD, FreeBSD) can be preinstall on your request, for no additional cost. Libreboot is a Free Software project, which replaces proprietary BIOS/UEFI firmware. These sales are conducted to fund development of Libreboot, lead by Leah Rowe who is Libreboot’s founder and lead developer, and the director of Minifree Ltd.

By default, Minifree ships with *encrypted* Debian (KDE Plasma desktop environment).

Debian is a solid, robust OS with a strong security team and release engineering team behind it. It’s the bedrock of the Linux world, upon which many distros are built. It has a proven track record of reliability, and it’s easy to use for most new people while being extremely flexible for advanced users. It’s an all-round good default choice, which is why Minifree ships it.

More info about Debian can be found here: https://www.debian.org/

Qubes is also compatible; please request this specifically, in the textbox on the checkout page.

WiFi upgrade available!

WiFi upgrade available (Intel AX210 card): available for a fee. Offers much faster speeds. It supports the newer 802.11ax, 802.11ac and 802.11n standards. See: https://minifree.org/product/intel-ax210/

Most people will be happy with the default Intel 8265 WiFi. Intel AX210 offers slightly higher performance and the chipset can handle 802.11x if you wish.

Intel ME disabled! Intel Boot Guard also disabled!

The Intel Management Engine is entirely *disabled*, using me_cleaner. See: https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F

Intel Boot Guard has been disabled, using deguard. The Intel Boot Guard normally prevents coreboot, because it enforces cryptographic signature verification on the bootblock; vendors can choose whether to enable it during manufacturing. The *deguard* utility disables it on MEv11, by exploiting a known bug that permits unsigned code execution on the ME. This allows *you* full control of the ME, if you wish, and it’s the reason coreboot (and therefore Libreboot) are able to support this machine, because the Boot Guard is disabled by a special modification to the Intel ME, which Libreboot applies automatically.

You can then lock your flash, if you wish, which offers a greater security guarantee in our opinion. Security is a good thing, but only when it’s under the user’s control. Libreboot is under *your* control. Libreboot also has advanced GRUB hardening available that offers security surpassing that of even something like UEFI SecureBoot, and it’s completely under your control; please read Libreboot’s GRUB hardening guide: https://libreboot.org/docs/linux/grub_hardening.html

Updated ThunderBolt firmware pre-installed

The ThunderBolt controller, which also handles the USB-C slot (for charging and such), has its own firmware separate from the main boot firmware, on its own dedicated flash IC. This is what implements USB-PD for example.

Minifree updates the ThunderBolt firmware on that IC, to fix a bug in the older firmware; the older firmware writes debug data constantly, to a NOR flash on the board, which causes the ThunderBolt functionality to stop working after it fills up. The updated firmware fixes this by not writing the data at all, and (with external flashing method) can also fix machines where this issue already occured. This bug was present when Lenovo originally manufactured the ThinkPad T480 aswell as several other ThinkPad models of this generation.

Minifree already installs the corrected firmware for you, so you don’t have to worry. In the current Libreboot release, battery charging and external video output both work perfectly, when using either the USB-C or ThunderBolt port. Traditional USB-A ports are also available, and they work perfectly. PCI-E functionality on the ThunderBolt slot is currently disabled, in Libreboot, but will be enabled in a future update. Minifree provides free technical support to every customer, and updating to newer Libreboot releases is very easy with a few simple commands, running from Linux/BSD on your T480; you will not need to disassemble your ThinkPad.

Why use *these* machines?

These machines are provided because we in the Free Software movement believe Free Software is a *right* that everyone must have; free refers to freedom. It is software for which source code is available that you can freely use, study, modify and share without restriction. These machines are intended for security-conscious people who value the ideals of the free software movement, and want something easy to use that is in the control of the *user* (not the vendor). Free software is a global movement that started in the 1980s with the BSD and GNU projects, but its roots go all the way back to the very early days of computing; free software is used and developed today by millions of people, and it runs some of the most critical infrastructure on the internet.

Many people nowadays use bloated, inefficient software, a description that often applies to proprietary software; Free Software isn’t beholden to corporate greed, and many of the people who work on it care passionately about writing the most well-audited, high quality code. Modern versions of Windows use *gigabytes* of RAM, whereas a Linux/BSD system with a lightweight (yet modern) desktop environment will use far less than that, aswell as few CPU cycles and disk I/O; in other words, Linux systems can have much lower system requirements. Minifree shares in this *lightweight* software design philosophy. Libreboot itself (lead by the same person who owns Minifree) is designed to be as simple as possible, in terms of project infrastructure, build system, and actual coreboot configuration, providing firmware that boots as quickly as possible, and with a simple user interface (SeaBIOS and/or GRUB payload) that most people can just use, intuitively. Libreboot *heavily* patches the various upstream projects used, such as coreboot and GNU GRUB, fixing various upstream issues and providing more reliable operation for the user.

Libreboot releases focus on stability, providing well-tested firmware that is rock-solid on all of the supported hardware, and with a unified user interface across (where possible) all boards. That means, if you learn to use one Libreboot system, you can most likely use another with little fuss. Libreboot does away with nasty anti-features such as UEFI SecureBoot (nasty because it makes using free operating systems harder), instead implementing its own optional security methods that are completely within the user’s control, such as GPG signature checking of your Linux kernel from GRUB, which runs directly in the flash (which you can write-protect, if you wish), or the ability to have *true* Full Disk Encryption, including /boot. In *most* setups (on x86 hardware), Libreboot directly boots GNU GRUB from the flash (with its own config file), which is configured to automatically find and boot your distro’s own GRUB, EXTLINUX or SYSLINUX configuration (and manual configuration is possible), even in cases where it resides in an EFI System Partition (ESP), or a btrfs sub volume – GRUB is extremely powerful in this setup, as a *coreboot payload*, more flexible than any standard BIOS- or UEFI-based setup, and it works because Linux/BSD systems are able to run directly on bare metal, without calling into BIOS/UEFI. Libreboot provides a direct video framebuffer, that any operating system can use if it supports Kernel Mode Setting (all Linux/BSD systems do nowadays). This is a much cleaner way to boot your operating system, and GRUB is highly efficient.

A coreboot payload called *SeaBIOS* is also provided, which you can optionally use (useful for BSD bootloaders, prior to loading the BSD kernels). SeaBIOS implements a standard x86 PC BIOS, whereas GRUB provides *multiboot* functionality to directly boot a Linux kernel (along with drivers for the disk, filesystem, etc – and an often overlooked but extremely powerful user shell, that behaves very similarly to a full BASH shell with many commands available – more info available in the GRUB documentation, though Minifree configures these systems to Just Work so you can simply turn them on and use them).

Libreboot *even* includes MemTest86+ directly in the flash! You can boot it from the GRUB or SeaBIOS payload. No more messing about with bootable USB media. It comes preinstalled! Coreboot is very different than proprietary firmware, in that you can run whatever you want. You’re not restricted to whatever the vendor gives you. You could *even* compile your own OS (e.g. Linux with busybox/musl) and put it in the flash, if you wanted to, and run whatever applications you want, without ever touching your SSD; chainload it from the GRUB payload, or reconfigure coreboot to load Linux directly (from flash).

Jargon aside, one thing that many people will ask is: does Libreboot work with standard Linux/BSD systems, without modification? The answer is yes. Minifree uses *standard* Linux/BSD installer images, provided by the respective upstreams (e.g. Debian, Archlinux, FreeBSD). You can use your Libreboot machine more or less just as you would a typical BIOS/UEFI system; Windows is also compatible, though we recommend that you stick to Linux/BSD, for your freedom. More information is available on the Libreboot documentation.

These are the same machines used for Libreboot development. Leah Rowe, the founder and lead developer of Libreboot, also runs Minifree. Sales fund the project, and these machines are *used* by Leah day to day for all tasks. Many people are surprised when they turn on a Libreboot machine, and it gets to the bootloader (e.g. GRUB) in a few seconds or less, booting faster than even a brand new (non-Libreboot) machine. This is the power of Libreboot, and free software in general, in allowing the hardware to run *much* more efficiently.

Put simply: we want to live in a world where everyone can easily and comfortably use *free software*, liberated from the shackles of proprietary software. We want to live in a world where your property is *your* property; extended to computing, this makes free software a fundamental right that *everyone* *must* have.

Libreboot also provides a U-Boot payload these days on x86-64, present since Libreboot 20241206; it will be further developed in subsequent Libreboot releases. Not enabled on every board (currently disabled on the T480), and provides a sensible UEFI implementation. Libreboot still recommends the GRUB payload for the forseeable future, as it’s more stable and provides a lot more security features.

Information about the product

Several video connectors are available for external monitors, if you wish; HDMI and USB-C video outputs both work. If using USB-C video, note that you will need an appropriate hub for that (it’ll show up as a DisplayPort in xrandr).

Libreboot T480/T480s will typically ship with a UK keyboard (occasionally US). UK/US keyboards are virtually identical, except for a few symbols being swapped e.g. ” and @. If you want something different, please ask. Also: this machine will ship with the updated Thunderbolt firmware, to prevent instability. This is flashed separately to Libreboot.

Libreboot T80s (S model) advertised with 32GB RAM, but actually comes with either 36GB or 40GB (usually 40GB). This is because there is additional onboard memory (4GB or 8GB, usually 8GB), alongside a singular slot on which Minifree installs 32GB RAM. T480 (non-S) instead has two module slots so Minifree installs 2x32GB, making 64GB RAM.

If choosing the 4K upgrade, Minifree installs BOE NV140QUM-N53 panel with 01YR503 eDP cable (replacing 01YR502 if present). 4K at this screen size with proper DPI scaling makes text much nicer to read, and the 4K screen offers much higher brightness/contrast and colour accuracy, making movies much nicer to watch and it’s much nicer for photo/video editing. KDE Plasma offers excellent DPI scaling that works quite well and you can adjust it to your needs.

Included accessories

• Battery included, fully tested
• AC-DC adapter (charger) included (100-240V auto-switching, works in all countries) – NOTE: the charger port is actually USB-C so you can use any power supply you like, rated at least 65W. Minifree will supply a compatible power supply that works in your country.
• UK, EU or US power cable included along with external power supply, depending on country (USB-C power suppply).
  

Laptop specifications:

• 3.4GHz Intel Core i5-8250U processor
• Graphics: Intel UHD Graphics 620
• Screen: 14″ 1920×1080 TFT LCD (upgrades available)
• Gigabit ethernet as standard
• Ports: Dual mic/headphone jack, RJ-45 ethernet, HDMI, USB-C, Thunderbolt, 2x USB 3.0, SD card reader, (not all models, and smartcard reader untested) smartcard reader
• Backlight (brightness) control is fully functional in Libreboot on this laptop; buttons not working in Libreboot 20241206, but you can control the backlight in software e.g. slider control in KDE plasma.
• Battery: Up to 65Wh; T480 can have an additional internal 24Wh battery. Power consumption depends on use; on light usage, except around 10 hours at a minimum (can be much longer on very light use). On heavy use you might expect about 3-5 hours (very heavy CPU usage and so on).
• WiFi: Intel 8265 AC 802.11ac card. — Intel AX210 upgrade available
  
• Memory: max 36GB/40GB on T480S, 64GB on T480. DDR4-2400.
• More specifications shown here: https://psref.lenovo.com/syspool/Sys/PDF/ThinkPad/ThinkPad_T480/ThinkPad_T480_Spec.PDF
• T480S (S model) specs: https://psref.lenovo.com/syspool/Sys/PDF/ThinkPad/ThinkPad_T480s/ThinkPad_T480s_Spec.pdf
• NOTE: Lenovo spec sheet says 16GB max per slot, but this only refers to what they sold. The actual limit is 32GB per slot. On T480 S model, there is 1 slot plus onboard 4GB/8GB, making the total 36GB or 40GB. On T480 (non-S model), 2 slots are available, 32GB each, therefore allowing up to 64GB RAM.

When new Libreboot versions are released, it is possible to update to those newer versions using software (no disassembling required). Full instructions are provided.