Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Secure Boot in the Era of the T2

duo.com

Post reply on HN
Print view View original

91–97 of 97 posts

Re: Secure Boot in the Era of the T2

#91

Post by lisper »

geofft wrote: post #89
lisper wrote: post #78

Earlier quoted context omitted.

> This is a step forward for most users and not a step backwards for any users. Maybe. What happens when the check box goes away on a future version of MacOS? If my freedom depends entirely on an obscure checkbox rather than the ability to install my own keys, that seems like a thin reed to me.

Er, the option to install your own keys could go away too as easily, right?

That depends on how that option is deployed and how it interacts with the hardware. It is at least possible to deploy a key-based option that Apple could not arbitrarily rescind. It's not possible to do that with a check box in a control panel.

Re: Secure Boot in the Era of the T2

#92

Post by geofft »

angelsl wrote: post #66
geofft wrote: post #65

Earlier quoted context omitted.

What software of your choice have you attempted to use, where did it fail, and what's the stack trace? Given that Windows works, it's hard to believe that any issues accessing internal storage are a result of permissions. It just sounds like nobody's implemented Linux support for the hardware. Why don't you? If you're not able to either spend time writing a driver or hiring someone to do so, you have no meaningful ab…

Windows works on the new MacBook not because it has special drivers for NVMe-via-T2 but because Apple trusts Microsoft's EFI key. So no, stop it with all this "Linux works if you just disable Secure Boot" nonsense. It doesn't. You can run Linux from a USB key, sure, but it can't access the internal NVMe SSD!

Please provide evidence for this causal link. It is true that (with Boot Camp enabled) the firmware trusts the Windows key and not the MS third-party key. It is true that Windows can access the disk and Linux cannot. It is not obvious that these are related.

Re: Secure Boot in the Era of the T2

#93

Post by geofft »

vetinari wrote: post #75
geofft wrote: post #65

Earlier quoted context omitted.

What software of your choice have you attempted to use, where did it fail, and what's the stack trace? Given that Windows works, it's hard to believe that any issues accessing internal storage are a result of permissions. It just sounds like nobody's implemented Linux support for the hardware. Why don't you? If you're not able to either spend time writing a driver or hiring someone to do so, you have no meaningful ab…

No matter now much time you spend writing your driver, until your kernel has the "correct" signature, it was wasted effort. So unless you point out a method, how to factor the right key, all your suggestions are a waste of resources that lead nowhere.

Please provide evidence for this claim.

Re: Secure Boot in the Era of the T2

#94

Post by kartickv »

michaelmrose wrote: post #86
kartickv wrote: post #70

Earlier quoted context omitted.

According to https://www.omgubuntu.co.uk/2018/11/apple-t2-chip-cant-boot-... you just have to turn off the extra security.

Nobody ever said you can't disable secure boot and boot from an external drive. The point is that you can't access the expensive and essential internal storage where all your data lives. Here is an equivalent product a thunderbolt external nvme ssd 480GB for about $300. https://www.amazon.com/Plugable-Thunderbolt-External-Compati... If you don't mind spending hundreds of dollars, carrying around a second slightly awk…

People are responding this way because there are contradictory reports out there. Some sources, like the one I linked to and Apple's T2 security document, say you can run Linux without mentioning that you need an external drive. Have you tried disabling security as Apple suggests and installing Linux?

Re: Secure Boot in the Era of the T2

#95

Post by michaelmrose »

geofft wrote: post #90
michaelmrose wrote: post #87

Earlier quoted context omitted.

Why don't I in my free time implement driver support for a machine I can't afford for a company with almost 300 billion in cash equivalents who has benefited massively from open source but wont even provide specification so that someone can do the free work for them effectively? Why don't they send me a laptop along with the specs one of their engineers feels sufficient to implement support?

"No one is going to give you the education you need to overthrow them." "The master's tools will never dismantle the master's house." If you want freedom—real freedom—you'll have to work for it. You can't just wish for the powerful to let you borrow some of their freedom.

I build custom desktops on which I install linux. My router runs linux. I have a thinkpad on which I've installed... you guessed it linux.

I'd love to give something like the librem phone a whirl but I really can't upgrade from my nexus 5 just now.

I am just calling out Apple for boiling a bunch of frogs slowly.

Re: Secure Boot in the Era of the T2

#96

Post by michaelmrose »

kartickv wrote: post #94
michaelmrose wrote: post #86

Earlier quoted context omitted.

Nobody ever said you can't disable secure boot and boot from an external drive. The point is that you can't access the expensive and essential internal storage where all your data lives. Here is an equivalent product a thunderbolt external nvme ssd 480GB for about $300. https://www.amazon.com/Plugable-Thunderbolt-External-Compati... If you don't mind spending hundreds of dollars, carrying around a second slightly awk…

People are responding this way because there are contradictory reports out there. Some sources, like the one I linked to and Apple's T2 security document, say you can run Linux without mentioning that you need an external drive. Have you tried disabling security as Apple suggests and installing Linux?

There seem to be several individuals making the claim that you can boot linux if you disable secure boot I have heard zero people claim that linux can access the internal device.

As far as I can see all primary sources are saying the same things. Then people who don't have the hardware are misreading said reports and spreading misinformation.

I don't have the hardware either so I can give you no direct report myself. I just bothered to read what people are saying instead of skimming and guessing.

Re: Secure Boot in the Era of the T2

#97

Post by saagarjha »

Dunedan wrote: post #32
saagarjha wrote: post #28

Earlier quoted context omitted.

> the T2 chip administers access to the built in SSD, so it will be completely inaccessible for Linux to use for anything. This isn’t true. You can install Linux on this, providing you disable Secure Boot. You can’t currently access the SSD, but that’s more the result of a driver not existing than it being inherently disallowed.

> You can’t currently access the SSD, but that’s more the result of a driver not existing than it being inherently disallowed. That's not clear yet. There is a NVMe driver available in Linux which works fine with pre-T2 Macs. On T2 Macs however the whole platform resets a few seconds after initializing the NVMe controller. The question is: Is that a bug in the driver or NVMe implementation of the T2 chip or something…

That's interesting; I was not aware of the exact circumstances around why this driver didn't exist. Do you know where I could look to find more detail on the state of development for this?
Post reply on HN