5 ms·

This is a very long article with only one real lesson learned. BACK UP! Just get a backblaze account or something.

by jonplackett 6y ago

ajross 6y ago
Two lessons: back up your shit, and prefer hardware with replaceable storage like M.2 slots.
- vxNsr 6y ago
  Yes very much this. A soldered SSD is absolutely putting a real limit to the lifespan of your pc. Not to mention making it unreasonably expensive to try to recover data in event of system board failure.
  - defaultname 6y ago
    Data recovery is impossible [IN THIS SITUATION for those who want to tell a tale about Linux] given full disk encryption. Even if the SSD were removable, and presuming there is no issue with the SSD -- they fail too -- there is nothing he could have gotten from it. This is true on modern Windows devices as well. There are devices that use passphrase encryption, or similes, but they're a usability problem so it isn't what Apple does. Devices are lost (failed, stolen, burned, destroyed) as a simple fact of life. Anyone who doesn't have an immediate recovery process with negligible loss simply isn't being a professional. His laptop could have easily been nicked from a coffee shop. It's why most of us simply don't sweat this at all. I will never be in a situation where I'm desperate to recover what's on a device. Remarkable that the comments are full of people speculating about failures and then, remarkably, getting angry and on a soap box about their speculation. Computing device failed. Amazing story at 11!
    - Aeolun 6y ago
      > I will never be in a situation where I'm desperate to recover what's on a device. I will never be in a situation where I’m desperate to recover two months worth of data, but even losing a day is pretty inconvenient.
    - ajross 6y ago
      > Data recovery is impossible in most situations given full disk encryption. Key escrow has been a solved problem for decades, Apple just doesn't implement it (AFAIK, anyway). And it's not like user-managed keys are that hard anyway. I mean, just install any modern Linux distro with a decent pass phrase and you can securely and safely move that SSD between almost any two laptops on the planet. OS X does board-locked enclave-managed storage because iOS does board-locked enclave-managed storage, not because it's the right choice for the problem area. It's not a phone; the guy in the linked article lost 800G of video editting work!
      - defaultname 6y ago
        Everyone understands the deal with Apple hardware. No one ever thought you could pull out the SSD and stick it in another device. No one is surprised by this reality. No one planned around doing that unless they were profoundly ignorant. If the T2 failed (it is now integrated right into the M1, so any failure of the mainboard), the data is gone. Everyone should know that by now. So he went in with his scheme regardless of that. And his work had so little value that if his laptop were stolen, if a single rank of the storage failed, etc, he'd be in the same situation. He lost data because he was careless in the same foolish way that we read about so often. But people get to beat their ridiculous anti-Apple drums, so here we are. "OS X does board-locked enclave-managed storage because iOS does board-locked enclave-managed storage" This is boorish noise. Apple does it because it provides strong storage encryption while imposing no performance or usability problems. You like something better - good for you. I don't. I have zero issues with this reality. "I lost all my data!" stories are ridiculous nonsense 99% of the time, and this isn't in the 1%.
        ajross 6y ago
        > Everyone understands the deal with Apple hardware. The linked article and this thread argues otherwise. But regardless, even if everyone understands "the deal" that doesn't constitute a reply to an argument that this is a bad deal.
      - brokenmachine 6y ago
        >the guy in the linked article lost 800G of video editting work! In my experience, video editors are the least backed-up PC users. Large videos are too much data to back up quickly and easily, the deadlines are always yesterday, they're always pushing the hardware's limits, the data is ephemeral so just not quite important enough to pay extra for redundancy, and they know just enough about computers to get themselves in trouble.
    - pengaru 6y ago
      err, linux+dmcrypt puts the key on the encrypted disk which you decrypt with a passphrase to open it. That disk can be moved around, you just need the passphrase to open it. We've been doing this for decades now in linux land...
      - deleted 6y ago
        [deleted]
      - rpdillon 6y ago
        Yep, works great, and saved me from an costly backup restore a couple of times.
    - bigiain 6y ago
      > I will never be in a situation where I'm desperate to recover what's on a device. ... again. I suspect by far the majority of people who know this, learned this the hard way. I know I did. (And even _after_ learning that, I once left a backpack with my laptop at an outdoor table at a cafe. It also have both the USB drive with my primary backup and the iPod with my secondary backup. I was extremely fortunate that a friendly waitress grabbed it and told management it was mine, and I only spent one sleepless night before collecting it after calling up the next morning... In my defence, this was back before "cloud backup" and high bandwidth internet to make that practical was a thing here. )
    - perryizgr8 6y ago
      Full disk encryption is still done using a key. The owner of the machine will have that key. So he can decrypt the data with the key. Full disk encryption does not mean data recovery is impossible. Your laptop bring owned by Apple, not you is what makes recovery impossible.
  - Aeolun 6y ago
    You can still un-solder your disk from the motherboard if the MB is already fucked though, right?
    - ajross 6y ago
      In theory yes, but fatality rates for that kind of operation are very high, and having any chance of success requires an expert practitioner. Staffing every Genius Bar with a solder surgeon isn't really practical. BGA chips are simply not designed to be moved.
    - alistairSH 6y ago
      But if it's encrypted properly, you still can't access the data, right?
    - brokenmachine 6y ago
      Yes but it's encrypted to the secure enclave on that MB, so you can't recover data off it.
  - alistairSH 6y ago
    A soldered SSD is absolutely putting a real limit to the lifespan of your pc I hadn't really thought of this, but it's a concern for personal use. Not so much for data - I do backups - but because I tend to keep my laptops for ages (currently using an 8 year old MBA). Something to think about, certainly.
- pier25 6y ago
  Or use an external Thunderbolt drive for project data.
  - jmull 6y ago
    You still need to back that drive up. It’s not a question of if it will fail, just when. If you want that data tomorrow, run an automatic, continuous backup solution.
    - pier25 6y ago
      Sure, but my point is that if the machine fails, the drive won't be soldered. Just plug it to another computer and keep working.
- lloeki 6y ago
  > and prefer hardware with replaceable storage like M.2 slots. I'm not sure how that would have accomplished anything (except a smaller repair bill, but that was footed by the warranty) in this story: either the logic board died and since the storage is encrypted at rest with the key stored in the Secure Enclave, the data is not recoverable; and if the storage is dead, well, the data is gone. Either way the data is as good as gone. So either way, one lesson. Backup. Twice. (Also, a brand new laptop has just as much chance of being stolen or suffering water damage or mistaken file erasure or a thousand other things that would destroy the data. Two months without backup is lunacy)
  - sudosysgen 6y ago
    There's no reason you wouldn't have access to the encryption key, though. In a sensible system it would be derivable from your password and data on the drive.
  - ajross 6y ago
    So many people are making the encryption point, and that seems nonresponsive to me. I mean, the whole point here is a demand for Apple to change their board design. If we're going to do that, it's not at all unreasonable to demand that they also support some form of key escrow or user-managed key storage. The software part of the puzzle is significantly cheaper to implement, especially given that all they need to do is copy one of the gazillion variants already shipping. The drive encryption design is a holdover from iOS, and... a Macbook isn't a phone. People do very different thing with them (the linked article is by a video producer!) and need different solutions.
  - perryizgr8 6y ago
    What's encryption got to do with the "logic board" (whatever that is)? Encryption is done using a key. You are the owner of the machine, so you have the key. Just use that key to decrypt your files. Simple.
    - brokenmachine 6y ago
      #justapplethings
- rvz 6y ago
  > and prefer hardware with replaceable storage like M.2 slots. Heed this advice folks. Even the new Surface Laptop SSDs are replaceable.
Angostura 6y ago
MacOS's Time Machine backup stuff is really good. At the very least, just get an external and plug it in.

This is a very long article with only one real lesson learned. BACK UP! Just get a backblaze account or something.

ajross 6y ago

Two lessons: back up your shit, and prefer hardware with replaceable storage like M.2 slots.

vxNsr 6y ago
Yes very much this. A soldered SSD is absolutely putting a real limit to the lifespan of your pc. Not to mention making it unreasonably expensive to try to recover data in event of system board failure.
- defaultname 6y ago
  Data recovery is impossible [IN THIS SITUATION for those who want to tell a tale about Linux] given full disk encryption. Even if the SSD were removable, and presuming there is no issue with the SSD -- they fail too -- there is nothing he could have gotten from it. This is true on modern Windows devices as well. There are devices that use passphrase encryption, or similes, but they're a usability problem so it isn't what Apple does. Devices are lost (failed, stolen, burned, destroyed) as a simple fact of life. Anyone who doesn't have an immediate recovery process with negligible loss simply isn't being a professional. His laptop could have easily been nicked from a coffee shop. It's why most of us simply don't sweat this at all. I will never be in a situation where I'm desperate to recover what's on a device. Remarkable that the comments are full of people speculating about failures and then, remarkably, getting angry and on a soap box about their speculation. Computing device failed. Amazing story at 11!
  - Aeolun 6y ago
    > I will never be in a situation where I'm desperate to recover what's on a device. I will never be in a situation where I’m desperate to recover two months worth of data, but even losing a day is pretty inconvenient.
  - ajross 6y ago
    > Data recovery is impossible in most situations given full disk encryption. Key escrow has been a solved problem for decades, Apple just doesn't implement it (AFAIK, anyway). And it's not like user-managed keys are that hard anyway. I mean, just install any modern Linux distro with a decent pass phrase and you can securely and safely move that SSD between almost any two laptops on the planet. OS X does board-locked enclave-managed storage because iOS does board-locked enclave-managed storage, not because it's the right choice for the problem area. It's not a phone; the guy in the linked article lost 800G of video editting work!
    - defaultname 6y ago
      Everyone understands the deal with Apple hardware. No one ever thought you could pull out the SSD and stick it in another device. No one is surprised by this reality. No one planned around doing that unless they were profoundly ignorant. If the T2 failed (it is now integrated right into the M1, so any failure of the mainboard), the data is gone. Everyone should know that by now. So he went in with his scheme regardless of that. And his work had so little value that if his laptop were stolen, if a single rank of the storage failed, etc, he'd be in the same situation. He lost data because he was careless in the same foolish way that we read about so often. But people get to beat their ridiculous anti-Apple drums, so here we are. "OS X does board-locked enclave-managed storage because iOS does board-locked enclave-managed storage" This is boorish noise. Apple does it because it provides strong storage encryption while imposing no performance or usability problems. You like something better - good for you. I don't. I have zero issues with this reality. "I lost all my data!" stories are ridiculous nonsense 99% of the time, and this isn't in the 1%.
      - ajross 6y ago
        > Everyone understands the deal with Apple hardware. The linked article and this thread argues otherwise. But regardless, even if everyone understands "the deal" that doesn't constitute a reply to an argument that this is a bad deal.
    - brokenmachine 6y ago
      >the guy in the linked article lost 800G of video editting work! In my experience, video editors are the least backed-up PC users. Large videos are too much data to back up quickly and easily, the deadlines are always yesterday, they're always pushing the hardware's limits, the data is ephemeral so just not quite important enough to pay extra for redundancy, and they know just enough about computers to get themselves in trouble.
  - pengaru 6y ago
    err, linux+dmcrypt puts the key on the encrypted disk which you decrypt with a passphrase to open it. That disk can be moved around, you just need the passphrase to open it. We've been doing this for decades now in linux land...
    - deleted 6y ago
      [deleted]
    - rpdillon 6y ago
      Yep, works great, and saved me from an costly backup restore a couple of times.
  - bigiain 6y ago
    > I will never be in a situation where I'm desperate to recover what's on a device. ... again. I suspect by far the majority of people who know this, learned this the hard way. I know I did. (And even _after_ learning that, I once left a backpack with my laptop at an outdoor table at a cafe. It also have both the USB drive with my primary backup and the iPod with my secondary backup. I was extremely fortunate that a friendly waitress grabbed it and told management it was mine, and I only spent one sleepless night before collecting it after calling up the next morning... In my defence, this was back before "cloud backup" and high bandwidth internet to make that practical was a thing here. )
  - perryizgr8 6y ago
    Full disk encryption is still done using a key. The owner of the machine will have that key. So he can decrypt the data with the key. Full disk encryption does not mean data recovery is impossible. Your laptop bring owned by Apple, not you is what makes recovery impossible.
- Aeolun 6y ago
  You can still un-solder your disk from the motherboard if the MB is already fucked though, right?
  - ajross 6y ago
    In theory yes, but fatality rates for that kind of operation are very high, and having any chance of success requires an expert practitioner. Staffing every Genius Bar with a solder surgeon isn't really practical. BGA chips are simply not designed to be moved.
  - alistairSH 6y ago
    But if it's encrypted properly, you still can't access the data, right?
  - brokenmachine 6y ago
    Yes but it's encrypted to the secure enclave on that MB, so you can't recover data off it.
- alistairSH 6y ago
  A soldered SSD is absolutely putting a real limit to the lifespan of your pc I hadn't really thought of this, but it's a concern for personal use. Not so much for data - I do backups - but because I tend to keep my laptops for ages (currently using an 8 year old MBA). Something to think about, certainly.
pier25 6y ago
Or use an external Thunderbolt drive for project data.
- jmull 6y ago
  You still need to back that drive up. It’s not a question of if it will fail, just when. If you want that data tomorrow, run an automatic, continuous backup solution.
  - pier25 6y ago
    Sure, but my point is that if the machine fails, the drive won't be soldered. Just plug it to another computer and keep working.
lloeki 6y ago
> and prefer hardware with replaceable storage like M.2 slots. I'm not sure how that would have accomplished anything (except a smaller repair bill, but that was footed by the warranty) in this story: either the logic board died and since the storage is encrypted at rest with the key stored in the Secure Enclave, the data is not recoverable; and if the storage is dead, well, the data is gone. Either way the data is as good as gone. So either way, one lesson. Backup. Twice. (Also, a brand new laptop has just as much chance of being stolen or suffering water damage or mistaken file erasure or a thousand other things that would destroy the data. Two months without backup is lunacy)
- sudosysgen 6y ago
  There's no reason you wouldn't have access to the encryption key, though. In a sensible system it would be derivable from your password and data on the drive.
- ajross 6y ago
  So many people are making the encryption point, and that seems nonresponsive to me. I mean, the whole point here is a demand for Apple to change their board design. If we're going to do that, it's not at all unreasonable to demand that they also support some form of key escrow or user-managed key storage. The software part of the puzzle is significantly cheaper to implement, especially given that all they need to do is copy one of the gazillion variants already shipping. The drive encryption design is a holdover from iOS, and... a Macbook isn't a phone. People do very different thing with them (the linked article is by a video producer!) and need different solutions.
- perryizgr8 6y ago
  What's encryption got to do with the "logic board" (whatever that is)? Encryption is done using a key. You are the owner of the machine, so you have the key. Just use that key to decrypt your files. Simple.
  - brokenmachine 6y ago
    #justapplethings
rvz 6y ago
> and prefer hardware with replaceable storage like M.2 slots. Heed this advice folks. Even the new Surface Laptop SSDs are replaceable.

Angostura 6y ago

MacOS's Time Machine backup stuff is really good. At the very least, just get an external and plug it in.