11 ms·
Apple mentioned in the event that these Macs will have hardware verified secure boot. Since I’m not very knowledgeable in this area, can someone explain (or eve
by AnonHP 6y ago
Apple mentioned in the event that these Macs will have hardware verified secure boot. Since I’m not very knowledgeable in this area, can someone explain (or even try to guess) what this would/could mean for running Linux on these? I use Macs way beyond Apple’s support timeframe with OS X/macOS, and Linux is the one that runs on some of the older Macs and provides adequate security and security related software updates.
- OJFord 6y agoI don't know the answer^, but how old is your current old Mac hardware? I don't know about the desktops, but Macbooks from 2016 are not well supported hardware-wise in Linux - things like no WiFi even. There was a good GitHub repo tracking it for up to I think the first touchbar Pro, and basically it was dismal then and only got worse (according to repo owner who consequently stopped bothering iirc). So.. depending what you want to do on these older machines, my point is that this may be the least of your worries. ^(though I think it's fine, because it's the reverse that would be a problem? Bad news for 'hackintosh' if all supported versions of macOS can expect secure boot hardware, I think)
- spear 6y agoYeah, I think you mean this repo: https://github.com/Dunedan/mbp-2016-linux https://github.com/Dunedan/mbp-2016-linux I bought a 2017 MBP hoping the situation would eventually improve but it never did, so I never got around to installing Linux. I'm expecting it'll be even worse for these M1 systems.
- OJFord 6y agoThat's the one, thanks. It is a shame, it's not something I ever really did (or not for long, for a period I do recall having Arch on my 2013 Air) but I like the idea - I like Apple's hardware, just not the software.
- heavyset_go 6y ago> I don't know about the desktops, but Macbooks from 2016 are not well supported hardware-wise in Linux Which is unfortunate, because the 2015 models make great Linux machines. The introduction of the T2 chip made proper Linux support much harder to achieve.
- spijdar 6y agoUntil 2019 Apple sold 13 inch MBPs without the touchbar, and these models did not have a T2 chip. They are still miserable computers to run Linux on, although I think the original 2016 touchbar-less MBP performs better than all the rest, albeit (IIRC) no working audio, very poor suspend/resume functionality, and until pretty recently no keyboard/trackpad functionality. Oh, and Apple's NVMe interface is non-compliant. This is widely reported as Apple locking Linux out with the T2 chip, but that's not really true. The T2 chip will by default prevent unsigned kernels from reading/writing to the SSD, but this can be disabled. Even if it's disabled, the controller is not standards compliant, and Linux won't see the underlying block device. I saw some diffs floating around on github a few years ago that fixed it, but I don't think it was ever mainlined. Basically, post-2016, Apple seems to have incorporated even more custom (and undocumented) hardware that running alternative OSes on them is basically impossible. Windows works because of the Apple-provided HAL + drivers for WinNT.
- fpoling 6y agoEven in Bootcamp Apple did not bother to expose all hardware to Windows . The touchpad is reported as a mouse with a scroll wheel, no option to enable hardware encryption or to use Touch ID to unlock.
- Matthias1 6y agoI have a MacBookPro15,2 (2019, with T2), on which I duel boot Arch Linux. It is perfectly usable. The hardware support is not great. In particular, resuming from suspend is very slow, and I haven't gotten the built-in mic to work. And getting the system to work did require using a patched Linux kernel installed from Github. So not easy, but possible. Your claims about "dismal then and only got worse" are unfounded. The repository you refer to is still active. https://github.com/Dunedan/mbp-2016-linux https://github.com/Dunedan/mbp-2016-linux If anything, activity has slowed down in these threads because it was figured out how to make it work. Even among people who run Linux on these MacBooks, the general recommendation is to keep a macOS partition around for stability. Some of the value you get from any Apple computer is in the software. If you intend on instantly installing Linux or Windows as your only OS, this probably isn't the computer for you. But if you want to or have to use Linux sometimes, these T2-chip Macs can do it.
- OJFord 6y agoI was referring to the hardware support, not the (stellar) efforts of Dunedan and contributors!
- michaelmrose 6y agoAm I wrong to think the T2 means Linux can't access the built in hard drive and you are dual booting from an external drive?
- Matthias1 6y agoYes. There’s nothing preventing me from accessing the internal SSD.
- Dunedan 6y ago> There was a good GitHub repo tracking it for up to I think the first touchbar Pro, and basically it was dismal then and only got worse (according to repo owner who consequently stopped bothering iirc). As I'm said repo owner, let me chime in here quickly to shed some light on that. I used a 13" MacBook Pro 2016 for 3 years with Debian as my sole machine for work. When ordering it back in 2016 I wasn't sure how difficult it'd be to get Linux properly working on it, as at that point it was only known that it's possible to boot Linux, but nobody had figured out even such basics like support for the integrated input devices or the NVMe SSD yet. However as I was using Linux on Macs since 2006 I figured it'd be somehow possible to get it to work for me. Fortunately I wasn't the only one serious about running Linux these 2016+ MacBooks, as I have very limited knowledge of the required lowlevel programming skills. What I did was to provide and moderate a Github repository (https://github.com/Dunedan/mbp-2016-linux https://github.com/Dunedan/mbp-2016-linux) as a central place to document and discuss of the status of hardware support for these MacBook Pros, some little patches and lots of feedback and bug reports. A big shoutout to all contributors who did an incredible job at reverse engineering, implementing and upstreaming drivers for various components! That's quite an achievement for such a complex device with no public hardware documentation at all! After a while it turned out that support for certain components would be rather difficult to get working flawlessly. As an example, even at the end of the 3 years I used the MacBook Pro, I had to use an external adapter to be able to use WiFi. With that in mind I started to reconsider why I bought Apple products: I bought them because of their superior hardware quality. But if I'm not able to use the hardware as intended, what's the point of paying a premium for Apple products? And let's just not talk about the butterfly keyboard or the horrible thermal management. So when it came to replacing my MacBook Pro, I decided to go with a Lenovo Thinkpad X1 Carbon instead. It's not perfect, but I'm way happier now than I ever was with the MacBook Pro 2016, as the hardware just works. As I don't own any 2016+ Apple device anymore, the help for further Linux support I can provide is limited, but I didn't stop bothering at all! I'm still actively managing said Github repository, but activity in general has significantly dropped there over time. Either the devices work well enough for other people now or they also replaced them with non-Apple hardware.
- stjo 6y agoIIRC at WWC Apple said it would still be possible to boot unsigned OS, but it would show some kind of warning.
- sneak 6y agoThis is the best news I’ve heard all day, thank you! I’m totally fine with a chromebook-style unsigned boot warning.
- Asmod4n 6y agoDuring WWDC they said you can't use any other operating System at boot time, only through virtual Machines. Update: here a podcast with Craig Federighi on that matter https://youtu.be/Hg9F1Qjv3iU https://youtu.be/Hg9F1Qjv3iU
- shaicoleman 6y agoLink with timestamp: https://youtu.be/Hg9F1Qjv3iU?t=3772 https://youtu.be/Hg9F1Qjv3iU?t=3772 "we're not direct booting an alternate operating system, it's purely virtualization"
- saagarjha 6y agoYou can, they are just saying Bootcamp isn’t a thing.
- pkulak 6y agoWhy not just support a company that doesn't do this crap?
- wmf 6y agoEven if you could turn off secure boot, Linux doesn't have drivers for Apple Silicon. Maybe in 2030 someone will port Linux to a jailbroken M1 Mac.
- jkaplowitz 6y agoLinux does support many ARM architectures already, and even supports the x86/x64 version of Secure Boot in some configurations. If Apple wants to either allow their Secure Boot to be disabled or to allow end users or Linux distros to somehow get their own keys trusted, I'm sure the port can happen in the coming $smallnum years with enough interest + resources + time. (But not $smallnum months, sadly.) None of this, of course, is to pretend it's easy.
- Asmod4n 6y agoNo Bootcamp for Apple Silicon Macs, you can't install any other Operating System on it. But you can run arm linux in a virtual machine.
- grishka 6y agoSo, a locked bootloader with someone else's public key as the only one trusted? Can you even call that a computer?
- heavyset_go 6y agoThis exact issue is something Stallman[1] and others have talked about for a while now[2]. [1] https://www.gnu.org/philosophy/can-you-trust.en.html https://www.gnu.org/philosophy/can-you-trust.en.html [2] https://www.cl.cam.ac.uk/~rja14/tcpa-faq.html https://www.cl.cam.ac.uk/~rja14/tcpa-faq.html
- stjohnswarts 6y agoI use a mac for work (and paid for by work) but refuse to spend my money on something I can't use the way I would like to use it. I think that these companies shouldn't be able to lock you out of you using your tractor/car/computer like everyone seems to be moving towards. It's a real shame. I understand if they want to void the warranty because a user blew away some critical firmware, but that's another ball of wax and it's on the user to suffer the consequences.
- kjsthree 6y agoAgree wholeheartedly! Void my warranty, boot with a scary splash screen, whatever, but don’t lock me out of the thing I ostensibly own. Or, maybe change the “buy” button to a “license to use” button in your store.
- rconti 6y agoBetteridge's Law of Comments
- brian_herman__ 6y agoProbably something similar to their secure boot with their phone iBoot. https://www.theiphonewiki.com/wiki/IBoot_(Bootloader) https://www.theiphonewiki.com/wiki/IBoot_(Bootloader)
- amelius 6y agoTake action: buy a Mac, and return it. If they want to know why, tell them¹. Repeat for every new model. ¹ They will have to give you a full refund: it's your right as a consumer. Note that this may not work for companies.
- lovelyviking 6y agoWho downvoted your comment and why ? This is a good comment and good strategy to teach them a lesson. Without some efforts those companies would not recall moral values. Richard Stallman was warning us about this development long ago and he was right. Cripled hardware is useless for hacking mind.
- deleted 6y ago[deleted]
- saagarjha 6y agoBecause it’s just creating e-waste, and if you do it enough they’ll stop selling you things.
- qiqitori 6y agoHey, wait a second. You seem to be implying that they'll just (irresponsibly) throw out machines returned for "other" reasons, but is that true?
- saagarjha 6y agoI think the best case is they become refurbished, which means the motherboard is kept and the outside gets scrapped?
- RonanTheGrey 6y ago"How do we get these companies to stop behaving like this?" "Vote with your wallet!" <votes with wallet by doing as OP suggests above. Mind you, NOT buying is noise - buying and returning is signal> "Not like that!!"
- vbezhenar 6y agoIt means that you need to find a vulnerability in bootloader and exploit it to break free from Apple secure garden. Linux works on ARM for years, so I'm sure that it won't be impossible to port it over, but whether enthusiasts will do it or not is another question, as you would need to write drivers for proprietary GPU and storage to make it useful.
- saagarjha 6y agoYou can turn off secure boot.
- vbezhenar 6y agoI don't think so.
- saagarjha 6y agoYou can, there’s a bputil command for it I believe.
- vbezhenar 6y agoHere's WWDC talk claiming that you can't: https://youtu.be/Hg9F1Qjv3iU?t=3772 https://youtu.be/Hg9F1Qjv3iU?t=3772 I'm talking about ARM macs, not Intel ones.
- saagarjha 6y agoThat’s not really what I’d call a “WWDC talk”, but sure, it mentions that Apple won’t provide Boot Camp, and that they are running their OS demos using virtualization. I didn’t see a claim that they won’t let you reduce the boot security.
- vbezhenar 6y ago"We're not direct booting an alternate operating system, it's purely virtualization. Hypervisors can be very efficient, so the need to direct boot shouldn't really be a concern." For me that quote means that they're not allowing booting any alternate operating system and they expect developers to use virtualization if other operating system is needed. I would be happy to be wrong about that.
- submeta 6y agoOh Apple, why are you doing this, taking freedom from your customers. I don‘t want to use Windows, neither do I want to tinker with Ubuntu. But if you keep going that path, you are forcing your power users to think about migrating to platforms that respect users freedom to do whatever they want to do with their machines. After two years of using an otherwise beautiful iPad Pro (along with my MBP) I came to realize that a crippled machine that is very limited in how I use a computer is not the future of computing I like. The device collects dust for quite some time as I prefer a computing environment where I use the terminal a lot, where I use my bash and Python scripts a lot to automate, where I use Emacs a lot to write tech docs, do my project planning, writing, automating workflows, and many more things that are not doable on a crippled (iPad)OS. You keep going toward your vision of a computing platform where your customers are just consumers, not hackers and doers, and us hackers need to look for alternative platforms, most propably Linux.
- boogies 6y ago> neither do I want to tinker with Ubuntu You can get XPS Developer Edition, System76, Purism, or many other laptop brands (eg. any of these https://elementary.io/store/ https://elementary.io/store/ with elementaryOS, whose DE should feel fairly familiar to a macOS user) with GNU preinstalled these days.
- WhyNotHugo 6y agoAlthough very slowly, this list of companies providing good Linux-ready laptops is growing. I do wish someone would dare ship something high-end non-amd64 (e.g.: ARM). Kinda like what we're seeing from Apple.
- wmf 6y agoFirst a high-end ARM chip would have to exist. The 8cx is pretty meh compared to the M1.
- sudosysgen 6y ago
- hankchinaski 6y agoi personally prefer secure hardware at the expense of not being able to play around with other OSes - i am sure i am not alone
- bosswipe 6y agoWhat advantage do you see to "secure hardware", I'm unaware of any recent Mac security issue that would have been prevented by it. It gives Apple a lot more control over the device but I don't see any advantage to the user.
- crummy 6y agoOne advantage I could see would be lowering value for thieves, if it worked out like locked phones that cannot just be wiped and resold.
- WhyNotHugo 6y agoI also prefer secure hardware, but I find macOS completely useless for work. While I can appreciate that some see other-OSs as something of a curiosity, for many of us it's a big deal-breaker, and it's a shame Apple is not willing to provide their hardware to so many potential clients who simply don't want their software.
- derbOac 6y agoYou can have both. Users should control the keys. Not an insurmountable problem.
- WhyNotHugo 6y agoThe reality is that we can't answer this until we have some hands on. It really depends on whether their secure boot architecture can be disabled (unlikely knowing apple), or allow adding ones own keys (unlikely). Bootcamp probably won't happen since windows does not support the architecture: they'll be pushing people to use VMs. They might also provide some untrusted path to boot without it being able to access certain secure features. I wish they did this, but also won't keep my breath! That said, the kernel itself needs to have support for the hardware architecture, and then drivers for all the new hardware they're pushing out. I don't expect this to be soon, though I'd definitely be willing to sponsor anyone willing to work on this.
- kllrnohj 6y ago> Bootcamp probably won't happen since windows does not support the architecture Windows supports ARM and has for a while. But still probably Bootcamp's days are over, yeah.
- fomine3 6y agoIt seems that Mac has now iPhone-based boot system. https://www.reddit.com/r/MacOSBeta/comments/jn7wbf/heres_the_apple_silicon_mac_startup_process_based/ https://www.reddit.com/r/MacOSBeta/comments/jn7wbf/heres_the...
- saagarjha 6y agoThe difference is that you can turn off checks on the Mac.