11 ms·

Booting a Mac Studio from an external SSD, and what it doesn’t solve

63 points by zdw 5y ago

pupppet 5y ago
I hope we eventually figure out how to replace the internal SSD in the Mac Studio. I was able to replace it in my 2013 iMac and it extended the life another four+ years.
- bpye 5y ago
  From a previous Twitter thread [0] it seems that Apple could easily provide new modules, and perhaps they’ll keep the same form factor in the future, but I don’t think a third party could. Whilst the flash itself is seemingly standard there is an Apple specific controller too. [0] - https://mobile.twitter.com/marcan42/status/1506022589357260801 https://mobile.twitter.com/marcan42/status/15060225893572608...
Shadeoffen 5y ago
Back up all the documents, files, pictures, videos, and other accumulated stuff on your Mac. You can do this with the built-in Time Machine tool or copy your folders manually. Place the SSD in the case, then connect it to your Mac using the included USB cable. Open "Disk Utility" and format your SSD to A PDF format if available, or to "Mac OS Extended with GUID partition scheme" (on older versions of macOS). For additional data backup, use https://www.salvagedata.com/ https://www.salvagedata.com/. I renewed my old 2014 iMac this way, and the effect of the SSD exceeded all expectations.
andybak 5y ago
Or Apple could just start supporting SMART?
- uuyi 5y ago
  Err they do. You can just brew install smartmontools and use it. Even disk utility reports the device status.
  - hesk 5y ago
    Doesn't work on my external hard disks which are connected over USB 3.0. Both diskutil and smartctl report that SMART is not supported. Under Linux, these work just fine.
  - duncanc4 5y ago
    There was a post on HN recently talking about how SMART isn’t available over USB without a third part kernel extension: https://news.ycombinator.com/item?id=30976160 https://news.ycombinator.com/item?id=30976160
    - CharlesW 5y ago
      FWIW it's not a big deal for semi-technical folks to install, and some tools (like macOS SMART monitor DriveDx) include it: https://binaryfruit.com/drivedx/usb-drive-support https://binaryfruit.com/drivedx/usb-drive-support
classified 5y ago
> Full migration to Apple Silicon Macs still isn’t feasible … is the important take-away for me here.
- tastysmores 5y ago
  I mean it's a pretty limited use case, isn't it? The author is basically saying that if: - you run a production line on a Mac which uses external SSDs; - you need to check the health of those SSDs regularly; - those SSDs connect by USB C; and - you're not prepared to run an install of Mac OS on your internal drive with SIP disabled (which I presume is the security setting they're being required to downgrade), then you can't fully migrate all of your activities to an Apple Silicon Mac. I don't know how many people that would apply to, but I doubt it would be a huge number, and it's hardly unusual to have either a dedicated machine or separate environment to conduct side tasks that aren't able to be completed in your main environment. One thing I wasn't clear on was why the author didn't want to format the internal drive to create a separate partition for the SIP-disabled instance of Mac OS. I don't actually see why that would be different (from a security perspective) to running it from an external drive, given that the insecure install wouldn't be running when booted from the secure install (even if they're on the same drive). The author seems to treat it as a binary choice for the main drive in the Mac Studio (ie that it must be 'secure' or 'insecure'), but that's not really how it would work from the perspective of making a second partition's Mac OS install insecure, given that that insecure OS isn't doing anything when you're not booted into it. If the author was still set on running the install from an external drive, they could partition the internal drive, install Mac OS, disable SIP and install the kext, then clone the partition onto the external drive. If external drives just need to be ejected during the DriveDx install process, this shouldn't stop anyone from running an OS with DriveDx from an external drive after the install. This is obviously a pain, but hardly that much worse from the hoops I've had do jump through on Windows over the years. I must admit, I'm not familiar enough with SAT SMART or external SSDs that connect by USB C to know why there's no alternative to turning off SIP, or why this was possible on Intel Macs but not Apple Silicon Macs, but it seems like a pretty niche use case from which to extrapolate the conclusion that full migration to Apple Silicon Macs isn't feasible full stop.
nottorp 5y ago
What I don't get is why enabling 3rd party extensions is somehow more dangerous on arm macs than on x86 macs...
- mrkwse 5y ago
  It's a strange shift and one I've fallen into the trap of. Discord requires kernel extensions for screen sharing and requires the reduced security toggle as a result. I've gladly used screen sharing in the past with presumably the same mechanisms, and not thought twice about it. Yet for some reason I'm hesitant to reduce the security of my main personal machine, even if that 'reduction' results in a consistent level of security with my old 2015 x64 MacBook. The reality is that I probably need to go and determine if there are a greater volume of more prevalent kernel level exploits to figure out what the factor of risk really is - it may be that these features are exploited more regularly and to greater effect than they were in 2015.
  - saagarjha 5y ago
    > Discord requires kernel extensions for screen sharing and requires the reduced security toggle as a result. Are you sure? There are several userspace APIs to do this so a kext would be very concerning and, quite frankly, inappropriate for this usecase.
    - Y-bar 5y ago
      It's an Electron limitation (because of course it is): > [...] does not work on macOS for audio capture due to a fundamental limitation whereby apps that want to access the system's audio require a signed kernel extension. Chromium, and by extension Electron, does not provide this. https://www.electronjs.org/docs/latest/api/desktop-capturer#caveats https://www.electronjs.org/docs/latest/api/desktop-capturer#...
      - moron4hire 5y ago
        How does Chrome on its own do it?
dwighttk 5y ago
Why is it okay to reduce security to install kexts on an external disk or a MacBook Pro but not on his Mac Studio?
- coldtea 5y ago
  Perhaps he uses the Mac Studio for more important work?
  - dwighttk 5y ago
    Sure but what is the reason? Is it just “I want maximum available security on this computer”? Or is there a known exploit?
    - umanghere 5y ago
      Just allowing kexts to be loaded should not increase the attack surface or expose the author to any currently known exploits. The reason that people avoid doing it anyways is because third party kexts have a history of obvious vulnerabilities and don't receive the same amount of eyeballs that first party kernel extensions do. As you put it, it really is a desire for maximum security at play here.
      - dwighttk 5y ago
        (Not trying to be difficult, just one more question) Booting that computer from an external drive with third party kexts would also increase the attack surface, right?
      - coldtea 5y ago
        >Just allowing kexts to be loaded should not increase the attack surface or expose the author to any currently known exploits "Just allowing kexts to be loaded" sure, it wont. But "just allowing kexts to be loaded" makes no sense as an action, unless you also actually intend to and do load at least one kext. In which case, it absolutely increases the attack surface.
    - deleted 5y ago
s_dev 5y ago
I have Monterey running on an external Samsung drive on my M1. However I've found it difficult to do this with my older Intel laptop specifically with Monterey though I have used Catalina as an external drive on the Intel MacBook. I have an external drive with Windows for the Intel MacBook as well. I don't really have a lot of insight to offer despite this being my standard MO on most machines. Running from an external drive is a great way to operate -- even though it seems like an unnecessary step it offers a lot of flexibility and would encourage others to familiarize themselves with the practice even if you opt for internal drives.
uuyi 5y ago
I've done several migrations from Intel Mac to M1 Mac with zero problems. I did not do it this way. I suspect this is complicating the issue for no reason. Time machine backup to external disk. Turn on new mac, restore it. Job done. Even the slowest of the migrations, the piecemeal first one was done just shipping data on an SSD. At no point did I need to boot anything other than the internal disk on either machine.
- justusthane 5y ago
  I’m not sure that you actually read the post—that’s not what the author was trying to do.
  - uuyi 5y ago
    Yes aware of that but looking at it from an XY perspective it looks like the thing escalated from the approach. Regarding USB / TB external disks, they do support SMART but only if the controller does forward the info to the Mac. The Mac doesn't give a shit about what's on the other side of the controller. This is where you get some reporting and some not. DriveDx is being used to circumvent that issue by I assume intercepting the commands and forwarding them to the drive. And of course at this point you have to break the secure boot chain by loading kexts that can intercept the disk traffic. Now worthy of mentioning here, brew installed smartmontools does report SMART status fully on my 970 EVO in the cheapest USB-C enclosure on amazon. It doesn't report it in disk utility but does on the terminal. YMMV but the problem here may be using the wrong analysis tool or the wrong migration approach. The disk health and integrity doesn't ensure the data integrity either as it may fail after the health is checked so the validation should be done at a higher level (sha256 the whole migration before and after etc)
deleted 5y ago
[deleted]
whitexn--g28h 5y ago
Seems like you could install the kext to the internal drive, then use a tool like Carbon Copy Cloner to build a bootable external copy of the internal system with the kext installed.
thrill 5y ago
Does the Mac OS support allowing VM kernels to access the USB ports?
dann0 5y ago
I have an Intel Mac with a small internal SSD. Pointing the user directories to an external drive is trivial while maintaining the advantages of booting from an internal device.

63 points by zdw 5y ago

I hope we eventually figure out how to replace the internal SSD in the Mac Studio. I was able to replace it in my 2013 iMac and it extended the life another four+ years.

bpye 5y ago
From a previous Twitter thread [0] it seems that Apple could easily provide new modules, and perhaps they’ll keep the same form factor in the future, but I don’t think a third party could. Whilst the flash itself is seemingly standard there is an Apple specific controller too. [0] - https://mobile.twitter.com/marcan42/status/1506022589357260801 https://mobile.twitter.com/marcan42/status/15060225893572608...

Shadeoffen 5y ago

Back up all the documents, files, pictures, videos, and other accumulated stuff on your Mac. You can do this with the built-in Time Machine tool or copy your folders manually. Place the SSD in the case, then connect it to your Mac using the included USB cable. Open "Disk Utility" and format your SSD to A PDF format if available, or to "Mac OS Extended with GUID partition scheme" (on older versions of macOS). For additional data backup, use https://www.salvagedata.com/ https://www.salvagedata.com/. I renewed my old 2014 iMac this way, and the effect of the SSD exceeded all expectations.

andybak 5y ago

Or Apple could just start supporting SMART?

uuyi 5y ago
Err they do. You can just brew install smartmontools and use it. Even disk utility reports the device status.
- hesk 5y ago
  Doesn't work on my external hard disks which are connected over USB 3.0. Both diskutil and smartctl report that SMART is not supported. Under Linux, these work just fine.
- duncanc4 5y ago
  There was a post on HN recently talking about how SMART isn’t available over USB without a third part kernel extension: https://news.ycombinator.com/item?id=30976160 https://news.ycombinator.com/item?id=30976160
  - CharlesW 5y ago
    FWIW it's not a big deal for semi-technical folks to install, and some tools (like macOS SMART monitor DriveDx) include it: https://binaryfruit.com/drivedx/usb-drive-support https://binaryfruit.com/drivedx/usb-drive-support

classified 5y ago

> Full migration to Apple Silicon Macs still isn’t feasible … is the important take-away for me here.

tastysmores 5y ago
I mean it's a pretty limited use case, isn't it? The author is basically saying that if: - you run a production line on a Mac which uses external SSDs; - you need to check the health of those SSDs regularly; - those SSDs connect by USB C; and - you're not prepared to run an install of Mac OS on your internal drive with SIP disabled (which I presume is the security setting they're being required to downgrade), then you can't fully migrate all of your activities to an Apple Silicon Mac. I don't know how many people that would apply to, but I doubt it would be a huge number, and it's hardly unusual to have either a dedicated machine or separate environment to conduct side tasks that aren't able to be completed in your main environment. One thing I wasn't clear on was why the author didn't want to format the internal drive to create a separate partition for the SIP-disabled instance of Mac OS. I don't actually see why that would be different (from a security perspective) to running it from an external drive, given that the insecure install wouldn't be running when booted from the secure install (even if they're on the same drive). The author seems to treat it as a binary choice for the main drive in the Mac Studio (ie that it must be 'secure' or 'insecure'), but that's not really how it would work from the perspective of making a second partition's Mac OS install insecure, given that that insecure OS isn't doing anything when you're not booted into it. If the author was still set on running the install from an external drive, they could partition the internal drive, install Mac OS, disable SIP and install the kext, then clone the partition onto the external drive. If external drives just need to be ejected during the DriveDx install process, this shouldn't stop anyone from running an OS with DriveDx from an external drive after the install. This is obviously a pain, but hardly that much worse from the hoops I've had do jump through on Windows over the years. I must admit, I'm not familiar enough with SAT SMART or external SSDs that connect by USB C to know why there's no alternative to turning off SIP, or why this was possible on Intel Macs but not Apple Silicon Macs, but it seems like a pretty niche use case from which to extrapolate the conclusion that full migration to Apple Silicon Macs isn't feasible full stop.

nottorp 5y ago

What I don't get is why enabling 3rd party extensions is somehow more dangerous on arm macs than on x86 macs...

mrkwse 5y ago
It's a strange shift and one I've fallen into the trap of. Discord requires kernel extensions for screen sharing and requires the reduced security toggle as a result. I've gladly used screen sharing in the past with presumably the same mechanisms, and not thought twice about it. Yet for some reason I'm hesitant to reduce the security of my main personal machine, even if that 'reduction' results in a consistent level of security with my old 2015 x64 MacBook. The reality is that I probably need to go and determine if there are a greater volume of more prevalent kernel level exploits to figure out what the factor of risk really is - it may be that these features are exploited more regularly and to greater effect than they were in 2015.
- saagarjha 5y ago
  > Discord requires kernel extensions for screen sharing and requires the reduced security toggle as a result. Are you sure? There are several userspace APIs to do this so a kext would be very concerning and, quite frankly, inappropriate for this usecase.
  - Y-bar 5y ago
    It's an Electron limitation (because of course it is): > [...] does not work on macOS for audio capture due to a fundamental limitation whereby apps that want to access the system's audio require a signed kernel extension. Chromium, and by extension Electron, does not provide this. https://www.electronjs.org/docs/latest/api/desktop-capturer#caveats https://www.electronjs.org/docs/latest/api/desktop-capturer#...
    - moron4hire 5y ago
      How does Chrome on its own do it?

dwighttk 5y ago

Why is it okay to reduce security to install kexts on an external disk or a MacBook Pro but not on his Mac Studio?

coldtea 5y ago
Perhaps he uses the Mac Studio for more important work?
- dwighttk 5y ago
  Sure but what is the reason? Is it just “I want maximum available security on this computer”? Or is there a known exploit?
  - umanghere 5y ago
    Just allowing kexts to be loaded should not increase the attack surface or expose the author to any currently known exploits. The reason that people avoid doing it anyways is because third party kexts have a history of obvious vulnerabilities and don't receive the same amount of eyeballs that first party kernel extensions do. As you put it, it really is a desire for maximum security at play here.
    - dwighttk 5y ago
      (Not trying to be difficult, just one more question) Booting that computer from an external drive with third party kexts would also increase the attack surface, right?
    - coldtea 5y ago
      >Just allowing kexts to be loaded should not increase the attack surface or expose the author to any currently known exploits "Just allowing kexts to be loaded" sure, it wont. But "just allowing kexts to be loaded" makes no sense as an action, unless you also actually intend to and do load at least one kext. In which case, it absolutely increases the attack surface.
  - deleted 5y ago

s_dev 5y ago

I have Monterey running on an external Samsung drive on my M1. However I've found it difficult to do this with my older Intel laptop specifically with Monterey though I have used Catalina as an external drive on the Intel MacBook. I have an external drive with Windows for the Intel MacBook as well. I don't really have a lot of insight to offer despite this being my standard MO on most machines. Running from an external drive is a great way to operate -- even though it seems like an unnecessary step it offers a lot of flexibility and would encourage others to familiarize themselves with the practice even if you opt for internal drives.

uuyi 5y ago

I've done several migrations from Intel Mac to M1 Mac with zero problems. I did not do it this way. I suspect this is complicating the issue for no reason. Time machine backup to external disk. Turn on new mac, restore it. Job done. Even the slowest of the migrations, the piecemeal first one was done just shipping data on an SSD. At no point did I need to boot anything other than the internal disk on either machine.

justusthane 5y ago
I’m not sure that you actually read the post—that’s not what the author was trying to do.
- uuyi 5y ago
  Yes aware of that but looking at it from an XY perspective it looks like the thing escalated from the approach. Regarding USB / TB external disks, they do support SMART but only if the controller does forward the info to the Mac. The Mac doesn't give a shit about what's on the other side of the controller. This is where you get some reporting and some not. DriveDx is being used to circumvent that issue by I assume intercepting the commands and forwarding them to the drive. And of course at this point you have to break the secure boot chain by loading kexts that can intercept the disk traffic. Now worthy of mentioning here, brew installed smartmontools does report SMART status fully on my 970 EVO in the cheapest USB-C enclosure on amazon. It doesn't report it in disk utility but does on the terminal. YMMV but the problem here may be using the wrong analysis tool or the wrong migration approach. The disk health and integrity doesn't ensure the data integrity either as it may fail after the health is checked so the validation should be done at a higher level (sha256 the whole migration before and after etc)

deleted 5y ago

[deleted]

whitexn--g28h 5y ago

Seems like you could install the kext to the internal drive, then use a tool like Carbon Copy Cloner to build a bootable external copy of the internal system with the kext installed.

thrill 5y ago

Does the Mac OS support allowing VM kernels to access the USB ports?

dann0 5y ago

I have an Intel Mac with a small internal SSD. Pointing the user directories to an external drive is trivial while maintaining the advantages of booting from an internal device.