5 ms·

This is a little misleading. The T2 firmware needs to be restored after modifying the SSD amount. This upgrade is typically reserved for an Apple Authorized S

by mproud 6y ago

This is a little misleading. The T2 firmware needs to be restored after modifying the SSD amount. This upgrade is typically reserved for an Apple Authorized Service Provider, but sure, if you have another Mac, you can do it all alone yourself.

deleted 6y ago
[deleted]
PostThisTooFast 6y ago
So.. it’s not misleading.
traceroute66 6y ago
I agree very misleading. What is it with HN recently and all this childish Apple bashing ? If I want Apple bashing, I'll head on over to The Register where its a well known fact they hold a long-term grudge against Apple because of some decade's old fight they picked with Apple's PR department. Back to the case in point, this HN post is disgustingly misleading. What the Apple support article is actually saying is that if you have : (1) A spare mac with Apple Configurator 2 installed (2) A USB-C/USB-C cable or USB-C/USB-A cable Then you can do the repair yourself. This is not exactly a significant obstacle ! (1) Apple Configurator is a FREE download from the App Store (2) You can run Apple Configurator on any Apple machine, you DO NOT NEED another Mac Pro! (3) Any self-respecting tech will already have USB cables by the dozen Yes, you need "another mac", but let's face it, if you use a Mac Pro at work or at home, then you most likely have "another mac" of some description around the place. And if you don't, you probably have one or more friends who have one !
- andybak 6y ago
  > disgustingly misleading That strikes me as rather emotive phrasing for an discussion about SSD upgrades. Anyway - surely the point is that something that used to be simple (upgrading storage in a personal computer) now has a potentially large hurdle in it's way. Does finding that to be a step backwards make one an anti-Apply fanboy?
  - my123 6y ago
    It’s more like changing the BIOS/UEFI chip, as that’s stored there. You can always plug in a second SSD via a PCIe slot too.
  - traceroute66 6y ago
    > That strikes me as rather emotive phrasing for an discussion about SSD upgrades. Only emotive in the context of people using HN for clickbaity Apple bashing that is unsubstantiated by actual facts. If you could be bothered to actually read the Apple Support document, you would see the reason access to Apple Configurator is required is because the SSD is tied to the T2 security chip. So you are not "just swapping out an SSD", there is a security element too. Frankly I think that is a good thing that changing hard drives is linked to the security chip.
    - andybak 6y ago
      > If you could be bothered Again - please take the temperature down a notch. I'm significantly less invested in this topic than you seem to be. And to respond to your specific point - I'm not clear on how a new blank drive would be a security concern. There might be a technical reason why it has to be this way - or it could just be poor design. At this stage I'm curious to know the thinking behind this. > Frankly I think that is a good thing that changing hard drives is linked to the security chip. I'm trying to think of an attack where "needing a second computer" is a major hurdle once you've got physical access.
      - traceroute66 6y ago
        > I'm trying to think of an attack where "needing a second computer" is a major hurdle once you've got physical access. Yawn. Two words. Audit Trail. Changing a hard drive goes from something you wouldn't know has happened, so something that has a trail associated with it, potentially in more than one place. Anyone in IT will tell you "physical access = game over", but at least you'll know !
      - EricE 6y ago
        >And to respond to your specific point - I'm not clear on how a new blank drive would be a security concern. There might be a technical reason why it has to be this way - or it could just be poor design. At this stage I'm curious to know the thinking behind this. The Apple security guide spells it out but I can hopefully summarize: the firmware for the T2 is stored on the the SSD, and it gets signed with hardware keys present in the T2 itself so the system can know if it's code is intact or has been modified. If you remove the existing SSD and install a new one, there is no longer any T2 firmware present. Without it, the T2 can't start and since the T2 is the starting point for the entire boot process - well, hopefully it's obvious as to why this is an issue. Why not embed the firmware on the motherboard? Well, being able to update it is a nice thing. Not having to worry about running out of storage in firmware memory embedded on a motherboard years before is also a good thing too; especially when the trade off is a pretty darn minor hassle - IF you ever upgrade your drive (which the vast majority of people never do). If you think this is outrageous, then you must be pretty ignorant of more than a few really gross problems with Intel's TPM (analog to Apple's T2) - many of which can't be fixed without new hardware. At least with this approach issues can be addressed and aren't burned into silicon. Intel could have made parts of their firmware updatable but they punted since it's pretty hard to maintain a secure chain; especially if you are relying just on resources in the computer you are also mucking around with at a pretty low level to update pretty sensitive things. I'd much rather be able to keep my machine secure even if it requires occasional simultaneous access to a 2nd Mac vs. being stuck forevermore with issues in hardware. And even if you use Linux, those TPM bits are still exposed :p Ultimately, claiming access to a second Mac for a Mac Pro (!) owner is any kind of hardship is utterly ridiculous. Every single Mac Pro owner I know (and I have and still use a cheesegrater Mac Pro) also has a Mac laptop since, you know, Mac Pro's are far from portable. And even if I didn't, as a Mac user I have many Mac friends I could bum a laptop off of for the 10 minutes it would take to swap an SSD and install.
varispeed 6y ago
Why such a simple upgrade has to require AAS or another Mac?
- coldtea 6y ago
  Because it was simple in the time of lax security, not in the time of current security measures...
  - varispeed 6y ago
    Why is it still simple for other manufacturers, even with added security measures?
    - coldtea 6y ago
      Because they're OK with things like this: https://www.pandasecurity.com/en/mediacenter/mobile-security/android-more-infected-than-ios/ https://www.pandasecurity.com/en/mediacenter/mobile-security...
    - EricE 6y ago
      Other manufacturers security models don't work in the same way. Good luck updating your Intel TPM firmware :p Every approach has pro's and con's. Overall not a huge fan of secure enclave type solutions but I do think their benefits still outweigh the hassles. Security/Convenience - always a tug of war.
- EricE 6y ago
  The firmware is stored on the primary storage of the computer. Which is absent if you are replacing it. So when you put new primary storage in the machine, a new firmware that is cryptographically signed with the hardware keys that are unique to the T2 in each computer are used. If they didn't use Apple Configurator running on a second Mac for this they would have to put all of that functionality in firmware on the machine somewhere. Driving up cost and complexity for an obscure task on a low volume machine in the first place. Yes, sounds like a valid use of engineering resources to overcome the "hardship" of having access to a second Mac for the 10 minutes (or less) the swap requires.

by mproud 6y ago

deleted 6y ago

[deleted]

PostThisTooFast 6y ago

So.. it’s not misleading.

traceroute66 6y ago

I agree very misleading. What is it with HN recently and all this childish Apple bashing ? If I want Apple bashing, I'll head on over to The Register where its a well known fact they hold a long-term grudge against Apple because of some decade's old fight they picked with Apple's PR department. Back to the case in point, this HN post is disgustingly misleading. What the Apple support article is actually saying is that if you have : (1) A spare mac with Apple Configurator 2 installed (2) A USB-C/USB-C cable or USB-C/USB-A cable Then you can do the repair yourself. This is not exactly a significant obstacle ! (1) Apple Configurator is a FREE download from the App Store (2) You can run Apple Configurator on any Apple machine, you DO NOT NEED another Mac Pro! (3) Any self-respecting tech will already have USB cables by the dozen Yes, you need "another mac", but let's face it, if you use a Mac Pro at work or at home, then you most likely have "another mac" of some description around the place. And if you don't, you probably have one or more friends who have one !

andybak 6y ago
> disgustingly misleading That strikes me as rather emotive phrasing for an discussion about SSD upgrades. Anyway - surely the point is that something that used to be simple (upgrading storage in a personal computer) now has a potentially large hurdle in it's way. Does finding that to be a step backwards make one an anti-Apply fanboy?
- my123 6y ago
  It’s more like changing the BIOS/UEFI chip, as that’s stored there. You can always plug in a second SSD via a PCIe slot too.
- traceroute66 6y ago
  > That strikes me as rather emotive phrasing for an discussion about SSD upgrades. Only emotive in the context of people using HN for clickbaity Apple bashing that is unsubstantiated by actual facts. If you could be bothered to actually read the Apple Support document, you would see the reason access to Apple Configurator is required is because the SSD is tied to the T2 security chip. So you are not "just swapping out an SSD", there is a security element too. Frankly I think that is a good thing that changing hard drives is linked to the security chip.
  - andybak 6y ago
    > If you could be bothered Again - please take the temperature down a notch. I'm significantly less invested in this topic than you seem to be. And to respond to your specific point - I'm not clear on how a new blank drive would be a security concern. There might be a technical reason why it has to be this way - or it could just be poor design. At this stage I'm curious to know the thinking behind this. > Frankly I think that is a good thing that changing hard drives is linked to the security chip. I'm trying to think of an attack where "needing a second computer" is a major hurdle once you've got physical access.
    - traceroute66 6y ago
      > I'm trying to think of an attack where "needing a second computer" is a major hurdle once you've got physical access. Yawn. Two words. Audit Trail. Changing a hard drive goes from something you wouldn't know has happened, so something that has a trail associated with it, potentially in more than one place. Anyone in IT will tell you "physical access = game over", but at least you'll know !
    - EricE 6y ago
      >And to respond to your specific point - I'm not clear on how a new blank drive would be a security concern. There might be a technical reason why it has to be this way - or it could just be poor design. At this stage I'm curious to know the thinking behind this. The Apple security guide spells it out but I can hopefully summarize: the firmware for the T2 is stored on the the SSD, and it gets signed with hardware keys present in the T2 itself so the system can know if it's code is intact or has been modified. If you remove the existing SSD and install a new one, there is no longer any T2 firmware present. Without it, the T2 can't start and since the T2 is the starting point for the entire boot process - well, hopefully it's obvious as to why this is an issue. Why not embed the firmware on the motherboard? Well, being able to update it is a nice thing. Not having to worry about running out of storage in firmware memory embedded on a motherboard years before is also a good thing too; especially when the trade off is a pretty darn minor hassle - IF you ever upgrade your drive (which the vast majority of people never do). If you think this is outrageous, then you must be pretty ignorant of more than a few really gross problems with Intel's TPM (analog to Apple's T2) - many of which can't be fixed without new hardware. At least with this approach issues can be addressed and aren't burned into silicon. Intel could have made parts of their firmware updatable but they punted since it's pretty hard to maintain a secure chain; especially if you are relying just on resources in the computer you are also mucking around with at a pretty low level to update pretty sensitive things. I'd much rather be able to keep my machine secure even if it requires occasional simultaneous access to a 2nd Mac vs. being stuck forevermore with issues in hardware. And even if you use Linux, those TPM bits are still exposed :p Ultimately, claiming access to a second Mac for a Mac Pro (!) owner is any kind of hardship is utterly ridiculous. Every single Mac Pro owner I know (and I have and still use a cheesegrater Mac Pro) also has a Mac laptop since, you know, Mac Pro's are far from portable. And even if I didn't, as a Mac user I have many Mac friends I could bum a laptop off of for the 10 minutes it would take to swap an SSD and install.

varispeed 6y ago

Why such a simple upgrade has to require AAS or another Mac?

coldtea 6y ago
Because it was simple in the time of lax security, not in the time of current security measures...
- varispeed 6y ago
  Why is it still simple for other manufacturers, even with added security measures?
  - coldtea 6y ago
    Because they're OK with things like this: https://www.pandasecurity.com/en/mediacenter/mobile-security/android-more-infected-than-ios/ https://www.pandasecurity.com/en/mediacenter/mobile-security...
  - EricE 6y ago
    Other manufacturers security models don't work in the same way. Good luck updating your Intel TPM firmware :p Every approach has pro's and con's. Overall not a huge fan of secure enclave type solutions but I do think their benefits still outweigh the hassles. Security/Convenience - always a tug of war.
EricE 6y ago
The firmware is stored on the primary storage of the computer. Which is absent if you are replacing it. So when you put new primary storage in the machine, a new firmware that is cryptographically signed with the hardware keys that are unique to the T2 in each computer are used. If they didn't use Apple Configurator running on a second Mac for this they would have to put all of that functionality in firmware on the machine somewhere. Driving up cost and complexity for an obscure task on a low volume machine in the first place. Yes, sounds like a valid use of engineering resources to overcome the "hardship" of having access to a second Mac for the 10 minutes (or less) the swap requires.