Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Don’t format a drive of M1 Macs from recovery mode

giuliomagnifico.medium.com

Post reply on HN
Print view View original

141–150 of 154 posts

Re: Don’t format a drive of M1 Macs from recovery mode

#141

Post by blacksmith_tb »

southerntofu wrote: post #134
blacksmith_tb wrote: post #110

Earlier quoted context omitted.

I think the argument that locking down hardware is unfair to thieves is not likely to garner a lot of support. But the larger argument that it's unfair to users should. The majority of whom didn't know they were signing up for a machine that is so theft-proof they can't give it to a grandparent or donate it to a school. I don't think it's unreasonable to say that easily-bricked hardware leads to more sales for Apple…

> I think the argument that locking down hardware is unfair to thieves That was not my point. Most times, users of a stolen device are unaware and not complicit in the fact it was stolen in the first place. They usually have acquired it from legitimate second-hand markets.

That's a good point, thanks for clarifying it.

Re: Don’t format a drive of M1 Macs from recovery mode

#142

Post by m1mac »

m1mac wrote: post #88
marcan_42 wrote: post #54

M1 Macs are not like Intel macs, Apple have done a dismal job of documenting them, and their "for users" tooling is still buggy and broken because the launch was clearly rushed. Here is what you need to know to actually understand these things: The SSD has 3 partitions. Each partition is an APFS container. Each container contains multiple APFS volumes. Your OS, and everything you care about, is on the second partitio…

By the way, how do you get into OS recovery (not 1TR)? `man bputil` does allude to a distinction between the two, as you mention: > Boot environment requirements: software-launched macOS Recovery or 1TR. The only way I know of to get to any recovery mode is by holding down the power button, which the man page says is 1TR (though I know you mention seeing that boot into regular recovery anyway).

Apple released a new platform security guide today. [1] According to that, there is a "fallback recovery OS" that can be accessed if you "[f]rom a shutdown state, double-press and hold the power button." I wonder if this one works if you zero the disk.

It also answers my question about the distinction between OS recovery and 1TR:

> Note: Apple uses the term One True recoveryOS (1TR) to indicate a boot into the primary recoveryOS which is achieved using a physical power button press. This is different from a normal recoveryOS boot, which can be achieved using NVRAM or which may happen when errors occur on startup. The physical button press increases trust that the boot environment isn’t reachable by a software-only attacker who has broken into macOS.

[1] https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/app...

Re: Don’t format a drive of M1 Macs from recovery mode

#143

Post by jaywalk »

southerntofu wrote: post #133
jaywalk wrote: post #93

Earlier quoted context omitted.

Your arguments are 100% nonsense and 0% facts, so most people will see it as a waste of time to try and have a discussion with you.

> The truth behind iCloud lock is Apple has been involved in mafia-style dealings with national mobile phone operators (which involved promises/contracts to sell millions of units), inundating the market with operator-sponsored iPhones, and they really don't want a second-hand market at all because they are a luxury brand. Apple investigated for "planned" obsolescence by the French government: https://www.bbc.com/new…

See, you keep saying "second-hand market" when you're really referring to stolen devices.

For legitimate second-hand sales, Apple even has a page on their website to explain how to check for activation lock before buying a phone, and how to disable it before it's sold or given away: https://support.apple.com/en-us/HT201365

So just stop with your crap. You believe you're some kind of Robinhood or whatever, and want to be able to steal shit without consequence. Guess what, the vast majority of people don't want their shit stolen and are happy that Apple makes your "job" harder.

Re: Don’t format a drive of M1 Macs from recovery mode

#144

Post by simonh »

southerntofu wrote: post #132
simonh wrote: post #113

Earlier quoted context omitted.

Most victims of crime are also socially disadvantaged, so enough with the Robin Hood crap. Theft is also strongly associated with violence, intimidation and mental stress on the victims. Promoting or justifying crimes in your comments here is reckless and irresponsible. If someone wants to sell a device second hand it's pretty easy to voluntarily wipe your device. Apple devices have very long lives, receive software…

> Most victims of crime are also socially disadvantaged True in most cases, but not when it comes to owning a recent iPhone. Millions of people struggle for eating decently, and most of these folks are certainly not spending >500€ on a phone. What may not have been clear in my original comment is most users who have a stolen device don't have knowledge of it, and are not complicit in it. So why do they have to be the…

There’s no way to slice out crime against owners of a ‘recent iPhone’ as being acceptable, crime doesn’t work like that. There’s no way you can know when buying a stolen phone who it was taken from but disproportionately they come form people who can least afford to lose them.

There are over a billion iOS devices active right now, are all of those people rich exploiters who deserve to have their phones stolen? What your saying isn’t anti-capitalist, it’s advocating disproportionate oppression of the most vulnerable in society and you should be thoroughly ashamed of yourself.

How dare you come here, advocate crime and criticise owners of devices with the highest recyclability, lowest ecological impact and longest device lifetimes in the industry on moral grounds.

I’m sure your perfectly aware of what the purpose of those software updates were, to extend device lifetimes when batteries start to fail, but you’re perfectly prepared to betray your ecological ideals which should be in favour of this in order to score points. It’s absolutely disgraceful. These arguments might work against people unaware of the facts, but you’re not going to get away with this disingenuous claptrap here.

Re: Don’t format a drive of M1 Macs from recovery mode

#145

Post by garmaine »

hnarn wrote: post #97
garmaine wrote: post #45

Earlier quoted context omitted.

I bricked my first TouchBar MacBook the day I received it, trying to do a factory reset as my company's security policies demanded. Not sure exactly how I triggered that state. Thankfully Apple took it back as a return. It should not be possible to brick a device by pushing the wrong button. I was shocked that this wasn't caught by anyone at Apple before release.

> It should not be possible to brick a device by pushing the wrong button So you think all Apple devices should be shipped without root? Or that anything disk-related should only be allowed through CLI as root?

No that’s not what I mean. I bricked the device. I’m not saying I wiped the hard disk and just can’t boot. I’m saying I put the machine in a state where it would NEVER AGAIN boot. Completely unrecoverable.

Re: Don’t format a drive of M1 Macs from recovery mode

#146

Post by jtl999 »

jsmith45 wrote: post #106
userbinator wrote: post #99

Earlier quoted context omitted.

Their low-level design is much closer to an embedded device like a Raspberry Pi, minus the SD card slot. ...or like a iPhone. From that article you linked: Some PC motherboards implement a similar feature as part of a separate chip, which can flash the UEFI firmware from a USB stick without actually turning on the motherboard normally, but this is only common in higher-end stand alone motherboards. That might be refe…

How would boot block recovery work without a CPU installed at all? Because modern bios flashback does indeed read from the USB and write to one of the bios chips without even the CPU in place. Obviously there is some form of micro-controller performing this. On intel, I suppose it would be possible for the management engine CPU in the chipset to do this, but I doubt intel lets motherboard makers run custom code on th…

> This all makes me think there is some other microcontroller somewhere that controls the bios flashback process, which would almost certainly be an extra chip.

I believe they just have some sort of extra microcontroller wired to a USB port and the SPI flash chip that stores the BIOS, probably with some sort of switch to ensure the host can't touch the SPI flash when the external microcontroller is attempting to flash it.

Re: Don’t format a drive of M1 Macs from recovery mode

#147

Post by southerntofu »

jaywalk wrote: post #143
southerntofu wrote: post #133

Earlier quoted context omitted.

> The truth behind iCloud lock is Apple has been involved in mafia-style dealings with national mobile phone operators (which involved promises/contracts to sell millions of units), inundating the market with operator-sponsored iPhones, and they really don't want a second-hand market at all because they are a luxury brand. Apple investigated for "planned" obsolescence by the French government: https://www.bbc.com/new…

See, you keep saying "second-hand market" when you're really referring to stolen devices. For legitimate second-hand sales, Apple even has a page on their website to explain how to check for activation lock before buying a phone, and how to disable it before it's sold or given away: https://support.apple.com/en-us/HT201365 So just stop with your crap. You believe you're some kind of Robinhood or whatever, and want to…

> See, you keep saying "second-hand market" when you're really referring to stolen devices.

No, i'm refering to the actual second-hand market, eg. second-hand stores and open markets, where a lot of less-privileged folks do their shopping anyway. In there, stolen hardware represents a tiny minority of the tons of devices, but it's still a reality.

Even hardware donated in good faith is sometimes locked. Sometimes, it's possible to find the original owner and have them unlock their device. Sometimes, this person who gave away an old phone to a local association, a "ressourcerie" or sold it for a very low price to a second-hand shop cannot be found again.

Sometimes, you find them but they have forgotten the code to a device they haven't used in years. When it's not an iPhone (think laptop), we just setup a new OS and the device is good to go for another few years. When it's an iPhone, we're left with a brick.

> So just stop with your crap. (...) Apple makes your "job" harder.

This kind of personal attack is not okay. You are assuming things that are entirely untrue based on my political opinions ("property is theft"). I do not sell anything, and i certainly do not steal iPhones, whether for money or for fun. i am a free-software person and i have avoided apple for years because of the reasons we are discussing in this thread. No economic incentives in it for me, i'm just criticizing Apple for being user-hostile, in a way that particularly affect the poorest people who rely on second-hand devices because they can't afford brand new ones.

Re: Don’t format a drive of M1 Macs from recovery mode

#148

Post by willstrafach »

acomjean wrote: post #90
user-the-name wrote: post #67

Earlier quoted context omitted.

Erasing the drive doesn't let you do this, the Apple ID of the owner is stored elsewhere and you have to log in to restore the machine.

The weird thing is that when my partner turned in an old Mac mini to Apple for recycling they wouldn’t do it because her account was still on there and there was a system password. But we couldn’t figure out what they were talking about, we had reinstalled the OS. It’s embeded in there somewhere deep.

If it had a T2, that will store the Apple ID.

Re: Don’t format a drive of M1 Macs from recovery mode

#149

Post by garmaine »

hnarn wrote: post #97
garmaine wrote: post #45

Earlier quoted context omitted.

I bricked my first TouchBar MacBook the day I received it, trying to do a factory reset as my company's security policies demanded. Not sure exactly how I triggered that state. Thankfully Apple took it back as a return. It should not be possible to brick a device by pushing the wrong button. I was shocked that this wasn't caught by anyone at Apple before release.

> It should not be possible to brick a device by pushing the wrong button So you think all Apple devices should be shipped without root? Or that anything disk-related should only be allowed through CLI as root?

Adding another comment since the edit window on my sibling reply has elapsed. To be clear, I'm an IT professional who knows how to restore a device from boot media. I once managed a university computer lab, and wrote the linux-based image management software for 2000+ campus computers. I've written my own hobby operating, including the boot an initialization process.

I thought any problem encountered reinstalling an OS is something I could handle. But that was not the case. Near as I could tell when I followed up with Apple after the incident, the boot process involved the security chip reading some data off the drive and validating it before handing off control. If that data (which is on the Apple reserved partition) was wiped, the firmware would not boot. And since the security chip was configured to not boot from media (the default state, IIRC), it was effectively bricked.

So the very first generation of TouchBar MacBooks would not boot into recovery mode if you wipe the drive, nor would they boot any kind of recovery media. It's a state that required shipping to Apple for refurbishment to fix. It's my understanding that this was fixed in later models, perhaps even as a result of my incident.

Re: Don’t format a drive of M1 Macs from recovery mode

#150

Post by marcan_42 »

ulzeraj wrote: post #137
marcan_42 wrote: post #57

Earlier quoted context omitted.

You absolutely can wipe the main APFS container on M1, from 1TR mode (the recovery menu that you get by holding down power). That will wipe the OS along with user data. Unless you have something broken in system firmware at that point, it's a clean start. This works from the GUI Disk Utility too, usually, though that tool is flaky sometimes. It definitely works from the command line.

The thing it doesn't look like we are actually erasing the device but a volume group inside it. I say that because there seems to be a protected partition that contains the OS installer. I could be wrong tho but I've reinstalled at least 2 systems like that.

You are erasing the container (as in one APFS container of multiple volumes) that contains the OS and data and everything else that is what, on a PC, you would consider "the whole drive" for fresh-install purposes. On an M1, that is only one GPT partition, but that doesn't really matter. The point is that that (plus perhaps clearing xART data) will fix pretty much any "normal" issues you have in the machine, equivalent to a fresh reinstall with full data wipe. The filesystem data structures are independent at the volume group level, so this will also fix any filesystem issues you might have (it would be very rare to have FS problems in the other two system APFS volume groups, as they are very rarely written to, and even more rarely have metadata/complex changes).

Compare: this is like wiping boot, system, data, and vendor on an Android phone. You wipe the whole OS and user data. You do not wipe the bootloader and other partitions (because if you did, you'd brick the phone). This is as much of a "factory reset" as almost anyone will ever need.

If you really want to wipe the whole drive, you need Apple Configurator 2 and another Mac to re-install, as the machine is then unable to boot in anything except DFU mode if you wipe the system containers. Unlike Android phones though, this is supported by Apple, so you can't in fact brick these Macs like that - just be aware that this option does (currently) require another Mac to do the re-install.

Post reply on HN