Due to Intel Management Engine - basically a binary blob, that you don't know what it is doing.

T400 is Core 2 Duo machine and works without IME. T420 is i5/i7 machine and IME is a requirement and you cannot make a BIOS replacement without it.

I didn't know people felt that stongly about arbitrary binary blobs. I know this is hackaday and open hardware and all, but if im going to be worried about binary blobs im going to be worried about a ton of netsec related stuff in other boxes too. Just wonderin' who this is really biting, assuming the intended individual was also already a closed-source, secretive apple fan.

It's not an arbitrary binary blob. It's blob that's running at SMM level. A perfect place for rootkits.

There was an article the other day about a man who lets his children go on the top of his roof. He made a calculation that the probability that harm would occur was low enough to be acceptable. I do a much similar thing; will follow up with you if/when my bios gets rooted.

AFAIK it is not SMM, it is a separate CPU. IMO, the most important lesson everyone should learn however is the laptop anti-theft arms race is horrible too.