Very tempted by the Gluglug X60, but the following concerns are preventing me
from purchasing one:
(1) It's not clear what measures Francis Rowe is taking with respect to CPU
microcode. There are three options:
(1A) Provide no microcode. BAD option, because of the serious bugs in Core
Solo/Duo/2 Duo: http://marc.info/?l=openbsd-misc&m=118296441702631&w=2
(1B) Provide closed-source (e.g. Intel) microcode. BAD option, because that
may introduce other bugs undisclosed by Intel and perhaps unknown to anyone
else because of being closed-source (unless researchers have e.g. fuzzed the
microcode-upgraded CPUs - has anyone done this?).
(1C) Provide open-source microcode. GOOD option, but I don't know whether any
such thing yet exists for the CPUs used by the X60(s). Anyone here know
whether such a thing exists?
(2) Order form at http://shop.gluglug.org.uk/checkout/ requires full name and
billing address for payment, but is by default served over HTTP. I don't like
sending such information in the clear.
(3) Order form at https://shop.gluglug.org.uk/checkout/ (note the "s"!) has a
certificate mismatch: it sends a certificate from a completely different
domain (*.ispnoc.net). I don't fancy sending my full name and billing address
to a site perhaps masquerading as another site!
(4) http://who.is/whois/gluglug.org.uk states that gluglug.org.uk is
registered to Francis Rowe, and says, "The registrant is a non-trading
individual who has opted to have their address omitted from the WHOIS
service." Yet if Rowe/Gluglug is selling laptops, then clearly the registrant
is trading.
(5) According to http://who.is/whois/gluglug.org.uk , ns2.ispnoc.net is a
nameserver for gluglug.org.uk , but according to
http://whois.net/whois/ispnoc.net , ispnoc.net is registered to "DC Koop" in
the Netherlands, and does not appear to have anything to do with Francis Rowe
or Gluglug or with gluglug.org.uk's registrar, lcn.com.
