5 ms·

I get using the T2 to encrypt the drives, as I understand it makes for very good hardware security, but what I do not get is why the machine cannot either: A. W

I get using the T2 to encrypt the drives, as I understand it makes for very good hardware security, but what I do not get is why the machine cannot either: A. Wipe and then 'claim' an SSD, adding it the T2 by itself without another machine, or B. Give you a big fat warning when reinstalling macOS that your drive will not be encrypted. Maybe Apple figures it's not a big deal to require another Mac simply because these machines are priced such and targeted at professionals and corporations.. having an old Macbook or something around isn't unlikely.. this is the kind of thing that would be a deal breaker for me but that's moot since I don't think anyone like me would ever buy one.

deleted 6y ago
[deleted]
deleted 6y ago
[deleted]
kmeisthax 6y ago
Part of the problem is that swapping the SSD at all was originally not a thing. T2 drive encryption started off on laptops with soldered-on SSDs where I would imagine Apple had zero intent of supporting any attempt by a user (or, more likely, Louis Rossman) to swap chips out. When they shipped the Mac Pro with socketed SSD modules they needed to hack together a way to actually pair the T2 and new SSDs, so they released Apple Configurator to let that happen. The main problem I could see with a field-pairing mechanism is properly messaging it to the user while the SSD is in an unusable state. Remember: once you change the SSD pairing, the data on the old drive is unreadable by anyone and the new drive will be wiped accordingly. So it absolutely should not be an automatic process - what if someone swaps the SSD modules without knowing about the drive encryption? At the very least, you need to flash a warning up on screen and accept a user acknowledgement, which means you need display drivers, USB, and so on all working in the boot ROM. It's not insurmountable, but it is a technical challenge.
- Kwpolska 6y ago
  > At the very least, you need to flash a warning up on screen and accept a user acknowledgement, which means you need display drivers, USB, and so on all working in the boot ROM. Pretty sure Apple has some form of this. On Intel Macs, the boot picker [0] supports displaying text and graphics, accepting keyboard and mouse input, and even connecting to Wi-Fi. There’s also the FileVault password screen, which does not live in the firmware, but it’s a full-screen UEFI app resembling macOS’ login UI. It’s also a thing in the PC world these days. The UEFI setup menu on modern machines is a bitmap-graphics GUI with mouse and keyboard support, for example [1] (a random YouTube video). [0]: https://www.ninjastik.com/support/how-to-choose-a-startup-disk-on-your-mac-to-boot-from-usb/ https://www.ninjastik.com/support/how-to-choose-a-startup-di... [1]: https://www.youtube.com/watch?v=Q1NDjD2RuGM https://www.youtube.com/watch?v=Q1NDjD2RuGM
- TomSwirly 6y ago
  > T2 drive encryption started off on laptops with soldered-on SSDs Deliberately unrepairable products should be against the law. The consequences of that first unethical decision just cascade. No, I don't buy the argument that people would choose to make their laptop 5 grams lighter or whatever and give up repairability, and to be honest, they shouldn't have that choice. It's simply irresponsible to buy an expensive machine full of unrecyclable parts produced at great cost to the planet, and expect to throw the whole thing out when any part goes bad.
EricE 6y ago
I suspect the code to do the pairing is fairly complex, and putting it into firmware that can work on a computer with NO storage while also not bricking the rest of the machine is more trouble than just requiring a second computer to do all the grunt work. I think I have swapped hard drives three times in over 10 years on my Mac Pro (that I still use!) Also acting like it's extreme hardship for a Mac Pro (!) user to have access to more than one Mac is a bit bombastic. TL;dr - this whole thing is a hell of a lot of fuss for a non-issue for what I would wager is an utterly minuscule number of people. And if you are upgrading a Mac Pro SSD drive, even if you had to buy a Mac Mini, use it once to bless the drive and toss it, it would probably be a fraction of the cost of the SSD you are putting in your Mac Pro and still cheaper than buying a similar sized drive from Apple (even if Apple offered a larger SSD - which is the main reason I would suspect someone would be wanting to upgrade the SSD in the first place).

deleted 6y ago

[deleted]

deleted 6y ago

[deleted]

kmeisthax 6y ago

Part of the problem is that swapping the SSD at all was originally not a thing. T2 drive encryption started off on laptops with soldered-on SSDs where I would imagine Apple had zero intent of supporting any attempt by a user (or, more likely, Louis Rossman) to swap chips out. When they shipped the Mac Pro with socketed SSD modules they needed to hack together a way to actually pair the T2 and new SSDs, so they released Apple Configurator to let that happen. The main problem I could see with a field-pairing mechanism is properly messaging it to the user while the SSD is in an unusable state. Remember: once you change the SSD pairing, the data on the old drive is unreadable by anyone and the new drive will be wiped accordingly. So it absolutely should not be an automatic process - what if someone swaps the SSD modules without knowing about the drive encryption? At the very least, you need to flash a warning up on screen and accept a user acknowledgement, which means you need display drivers, USB, and so on all working in the boot ROM. It's not insurmountable, but it is a technical challenge.

Kwpolska 6y ago
> At the very least, you need to flash a warning up on screen and accept a user acknowledgement, which means you need display drivers, USB, and so on all working in the boot ROM. Pretty sure Apple has some form of this. On Intel Macs, the boot picker [0] supports displaying text and graphics, accepting keyboard and mouse input, and even connecting to Wi-Fi. There’s also the FileVault password screen, which does not live in the firmware, but it’s a full-screen UEFI app resembling macOS’ login UI. It’s also a thing in the PC world these days. The UEFI setup menu on modern machines is a bitmap-graphics GUI with mouse and keyboard support, for example [1] (a random YouTube video). [0]: https://www.ninjastik.com/support/how-to-choose-a-startup-disk-on-your-mac-to-boot-from-usb/ https://www.ninjastik.com/support/how-to-choose-a-startup-di... [1]: https://www.youtube.com/watch?v=Q1NDjD2RuGM https://www.youtube.com/watch?v=Q1NDjD2RuGM
TomSwirly 6y ago
> T2 drive encryption started off on laptops with soldered-on SSDs Deliberately unrepairable products should be against the law. The consequences of that first unethical decision just cascade. No, I don't buy the argument that people would choose to make their laptop 5 grams lighter or whatever and give up repairability, and to be honest, they shouldn't have that choice. It's simply irresponsible to buy an expensive machine full of unrecyclable parts produced at great cost to the planet, and expect to throw the whole thing out when any part goes bad.

EricE 6y ago

I suspect the code to do the pairing is fairly complex, and putting it into firmware that can work on a computer with NO storage while also not bricking the rest of the machine is more trouble than just requiring a second computer to do all the grunt work. I think I have swapped hard drives three times in over 10 years on my Mac Pro (that I still use!) Also acting like it's extreme hardship for a Mac Pro (!) user to have access to more than one Mac is a bit bombastic. TL;dr - this whole thing is a hell of a lot of fuss for a non-issue for what I would wager is an utterly minuscule number of people. And if you are upgrading a Mac Pro SSD drive, even if you had to buy a Mac Mini, use it once to bless the drive and toss it, it would probably be a fraction of the cost of the SSD you are putting in your Mac Pro and still cheaper than buying a similar sized drive from Apple (even if Apple offered a larger SSD - which is the main reason I would suspect someone would be wanting to upgrade the SSD in the first place).