Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Silicon Macs can't boot from external drive if internal drive failed

bombich.com

Post reply on HN
Print view View original

371–380 of 422 posts

Re: Apple Silicon Macs can't boot from external drive if internal drive failed

#371

Post by NaturalPhallacy »

funnyflamigo wrote: post #44
GhettoComputers wrote: post #17

Earlier quoted context omitted.

Silly idea in tech, the hardware will be long outdated before someone look for parts which are going to be overpriced, and the company might be gone forever. You can buy common business laptops such as thinkpad and swap the parts easily and cheaply. People aren’t swapping their 2011 i3 for a 2011 i7 if they care about performance; they’re getting an i5 from 2018. None of these swappable parts are unique aside from th…

I disagree. My thinkpad x230t is still going strong nearly 10 years later (extreme example). With 16GB of ram and an SSD it's still a decently capable machine. If you're the type of person that needs the _fastest_ computer then yeah obviously you're upgrading every year. Or if you work on large codebases, etc. But if you don't care about that, you can easily go 4+ years with your laptop. Yes computers have gotten fas…

>And we're comparing this to apple, a company that has been basically DRM'ing components - even if you can buy the replacement you can't use it without it being "programmed" by apple.

Bit of a devil's advocate here, but by doing this they prevent themselves getting blamed when low quality replacement parts are cranked out on the cheap by companies who don't care if their customers' customers die in a fire.

The headline if an iPhone with a third party battery exploding and injuring someone will be "This iPhone Exploded, You Won't Believe Her Injuries", not "iPhone with Knock Off Battery Explodes".

Apple wouldn't be as profitable as they are if they weren't anticipating things like this and planning for it years in advance.

Re: Apple Silicon Macs can't boot from external drive if internal drive failed

#372

Post by mikewarot »

CelestialTeapot wrote: post #200
donkeyd wrote: post #193

Earlier quoted context omitted.

> soldered-to-the-motherboard, everything-utterly-encrypted approach is that it's almost impossible to do data recovery Well, that's kind of the point. > You just have to be damn sure that you back it up correctly. Exactly. And that's as easy as plugging in an external hard drive occasionally, or storing critical files in the cloud.

>> soldered-to-the-motherboard, everything-utterly-encrypted approach is that it's almost impossible to do data recovery >Well, that's kind of the point. Not that I don't appreciate a security-minded platform, it just seems overkill for 99% of the people who'll purchase them, and do nothing but cause heartache when the internal SSD fails. And fail they do. it's rare, but I've had several SSDs (Toshiba and Crucial, if…

I recently learned that my hard drive was encrypted with Bitlocker, had I not been attempting to get Genode running off a USB stick, I might have gone on for a year or to in blissful ignorance of how remarkable insecure my stuff was as a result of this.

It took about 12 hours to decrypt it, and restore sanity.

Availability is part of security, if it's encrypted, and you don't (or can't) boot just the way Microsoft wants, all your data is gone.

Re: Apple Silicon Macs can't boot from external drive if internal drive failed

#373

Post by judge2020 »

notriddle wrote: post #331
smoldesu wrote: post #322

Earlier quoted context omitted.

>E2E encrypting the whole world is also the best defense against the government passing laws that make E2E encryption illegal. The government doesn't need to pass laws to ban encryption (at least in America) since they design the encryption standards themselves. It's basically common knowledge at this point that everything NIST cranks out is vulnerable to differential cryptanalysis beyond the domain of public underst…

>It's basically common knowledge at this point What is asserted without evidence can be dismissed without evidence. And what's really annoying is that you are doing a bad job of arguing for a position that I actually kinda agree with. NIST has published a backdoored elliptic curve-based RNG[1]; don't trust them. Encryption algorithms need some sort of verifiable provenance for where those numbers came from. [1]: http…

On that note, it's unfortunate that T2 can only create ecdsa-sha2-nistp256 secret keys. Right now I use Secretive but I might resort to a different utility that generates ed25519 and stores it within keychain, if there is one.

Re: Apple Silicon Macs can't boot from external drive if internal drive failed

#374

Post by judge2020 »

nottorp wrote: post #247
Heliosmaster wrote: post #242

Earlier quoted context omitted.

with different machines? The framework laptop doesn't work this way, afaik

Too bad i switched to Mac OS from Linux. The OS matters to me and OS X is still the least annoying.

That really just shows that everything has tradeoffs. I'd Love if Windows could run on top of the Linux kernel (as in, nvidia drivers and all the Windows compatibility while being able to do stuff like `lspci` to see my real hardware - WSL2 doesn't do full PCI device passthrough yet) but that's unlikely to happen with how much the Windows team is seemingly trying to simplify their testing infrastructure (removing CPU support and removing user choice).

Re: Apple Silicon Macs can't boot from external drive if internal drive failed

#375

Post by judge2020 »

thefz wrote: post #221
donkeyd wrote: post #193

Earlier quoted context omitted.

> soldered-to-the-motherboard, everything-utterly-encrypted approach is that it's almost impossible to do data recovery Well, that's kind of the point. > You just have to be damn sure that you back it up correctly. Exactly. And that's as easy as plugging in an external hard drive occasionally, or storing critical files in the cloud.

> or storing critical files in the cloud. No. I refuse to let my vacation photos, hard drive images or hell, even my wallpaper collection to leave my house. No. I refuse. My data is my data.

Encrypt it? There are some strong algorithms that allow you to enjoy the most highly secured, fault-resistant buildings on earth without letting the capitalists that own them view your data even if they were to hook your storage up to their entire GPU/ASIC/etc farm.

Re: Apple Silicon Macs can't boot from external drive if internal drive failed

#376

Post by ece »

KennyBlanken wrote: post #141
liminalsunset wrote: post #26

General grumpiness about this particular design decision aside, it appears that since the T2 Macs, the main SSD was being used to store core system firmware. On T2 I think it's BridgeOS that sends the EFI image to the Intel side to boot it, and it does the firmware verification and loading. This setup has a benefit; namely, it is now impossible to brick the system with a bad BIOS/EFI flash, and you'll never need to u…

> This setup has a benefit; namely, it is now impossible to brick the system with a bad BIOS/EFI flash, and you'll never need to use a hardware SPI flasher to recover. Apple-branded SSD module failures are pretty common. Bricked BIOS/EFI images are not. I've been supporting Mac users for two decades and the only time I've used a hardware SPI flasher was when I needed to pull my firmware image, modify the EFI bootload…

Some PC motherboards and laptops also have dual BIOSes/BIOS recovery[1] to prevent bricking. You can build a redundant system capable of surviving failures. Apple just doesn't want to spend the cost/volume of a couple 32Mbit roms, or however big iBoot is. Yes, simple is good, but it doesn't need to be this simple at the cost of longevity and upgradeability of the device.

Look at how much TLC NAND has improved in the last ~5 years, and ask yourself if QLC will improve as much. It probably will.

[1] https://www.dell.com/support/kbdoc/en-us/000132453/how-to-re...

Re: Apple Silicon Macs can't boot from external drive if internal drive failed

#377

Post by sroussey »

grishka wrote: post #362
sroussey wrote: post #356

Earlier quoted context omitted.

I think that’s a joke? I mean, why even encrypt it in that case? It’s not like the drive is a web service that will detect and block your password attempts…

No it's not a joke. If the password is sufficiently complex, it can't be brute forced in a reasonable amount of time. But it's still a way for you to get your data back having only the SSD on which it is stored. Or, well, fine, let there be an active element. But let me export the master key then. It's my device, I have root access to it, I should be allowed to do that. And, yes, do still put the SSD into a slot. > I…

I mean, just turn off encryption if that’s what you want.

I don’t think you grasp how the encryption keys are generated, derived, and stored.

And I doubt you are using a password the length of the key. Well, maybe you create a USB human interface device that fits on your keyring to type it for you. I do have something like that for one time codes, but if that is your sophistication level, then we wouldn’t have this discussion really.

I feel for the “it’s mine, I bought it” logic, and I miss the days when our rights were more absolute. But that’s not today.

Re: Apple Silicon Macs can't boot from external drive if internal drive failed

#378

Post by xxs »

sroussey wrote: post #356
grishka wrote: post #305

Earlier quoted context omitted.

> Well, that's kind of the point. Being able to yoink the SSD from the original machine, plug it into another compatible one, and decrypt the contents with your password, is not a vulnerability, it's a feature.

I think that’s a joke? I mean, why even encrypt it in that case? It’s not like the drive is a web service that will detect and block your password attempts…

Encryption is based on math, not on some hardware gimmick. I'd absolutely clone my laptop drive and move it to a new one if I want to, having exactly the same setup.

Re: Apple Silicon Macs can't boot from external drive if internal drive failed

#379

Post by xxs »

threeseed wrote: post #348
dirkg wrote: post #335

Earlier quoted context omitted.

the motivation for soldered everything is profit margins and the ripoff prices for upgrades. Not security. There is no additional security here

Of course there is additional security. You can't just physically remove the SSD from the machine, place it in another and brute force the encryption.

of course you can desolder and move the chips - all you need is a hot air station and some flux. It's of course harder but nothing even remotely close to breaking the encryption itself, like orders of magnitude easier - any hobbist can do it.

It's another story, a part of the encryption is stored in yet another place on Macs, which it'd be still stored there if the SSD could be moved in/out.

Re: Apple Silicon Macs can't boot from external drive if internal drive failed

#380

Post by xxs »

liminalsunset wrote: post #26

General grumpiness about this particular design decision aside, it appears that since the T2 Macs, the main SSD was being used to store core system firmware. On T2 I think it's BridgeOS that sends the EFI image to the Intel side to boot it, and it does the firmware verification and loading. This setup has a benefit; namely, it is now impossible to brick the system with a bad BIOS/EFI flash, and you'll never need to u…

>This kind of failure (high voltage parts close to low voltage ones, close to liquid damage prone areas, without any underfilling) is documented by Louis Rossmann. It is, however, not always feasible or possible to entirely prevent.

Why not feasible or possible? Laptops are not even used in any harsh conditions at all, they die off on the most minuscule water ingress. Take a washing machine - full of electronics with proper power lines and microprocessors - lots and lots of vibration and humidity. While washing machine PCBs tend to be silicone potted for instance, yet conformal coating goes a very long way compared to bare copper and solder joints. Putting high voltage power lines next to lower one is a rookie mistake, every single wall charger has an air gap between primary and secondary (or at least it should) and decent creepage distance. Alternatively they could have added protection devices (e.g. MOVs, diodes) to clamp down the voltages.

Post reply on HN