4 ms·

> Full migration to Apple Silicon Macs still isn’t feasible … is the important take-away for me here.

tastysmores 5y ago
I mean it's a pretty limited use case, isn't it? The author is basically saying that if: - you run a production line on a Mac which uses external SSDs; - you need to check the health of those SSDs regularly; - those SSDs connect by USB C; and - you're not prepared to run an install of Mac OS on your internal drive with SIP disabled (which I presume is the security setting they're being required to downgrade), then you can't fully migrate all of your activities to an Apple Silicon Mac. I don't know how many people that would apply to, but I doubt it would be a huge number, and it's hardly unusual to have either a dedicated machine or separate environment to conduct side tasks that aren't able to be completed in your main environment. One thing I wasn't clear on was why the author didn't want to format the internal drive to create a separate partition for the SIP-disabled instance of Mac OS. I don't actually see why that would be different (from a security perspective) to running it from an external drive, given that the insecure install wouldn't be running when booted from the secure install (even if they're on the same drive). The author seems to treat it as a binary choice for the main drive in the Mac Studio (ie that it must be 'secure' or 'insecure'), but that's not really how it would work from the perspective of making a second partition's Mac OS install insecure, given that that insecure OS isn't doing anything when you're not booted into it. If the author was still set on running the install from an external drive, they could partition the internal drive, install Mac OS, disable SIP and install the kext, then clone the partition onto the external drive. If external drives just need to be ejected during the DriveDx install process, this shouldn't stop anyone from running an OS with DriveDx from an external drive after the install. This is obviously a pain, but hardly that much worse from the hoops I've had do jump through on Windows over the years. I must admit, I'm not familiar enough with SAT SMART or external SSDs that connect by USB C to know why there's no alternative to turning off SIP, or why this was possible on Intel Macs but not Apple Silicon Macs, but it seems like a pretty niche use case from which to extrapolate the conclusion that full migration to Apple Silicon Macs isn't feasible full stop.
- Twisell 5y ago
  Yeah seem like a limitation of the third party kext more than anything. It sucks but i don't see how this is a MacOS or a M1 issue. It's not like this kext was able to run without downgrading security previously.
  - Maursault 5y ago
    > downgrading security Used in article, but only you and GP have mentioned. What is this garbage nomenclature? First of all, what in God's name does "security" mean in this context? It is obviously supposed to stand for somethings specific, this is not just an in general mention of security. What? And "downgrading?" What is happening here? I am completely and utterly lost on this word and why it is used, here, in this context (the article author's use... and since both you and GP used it, I hoped either could explain to me what is going on with security downgrade like this is a thing, when I expect it really isn't a real thing, someone chose bad words for nonissue, but if not, thx).
    - Twisell 5y ago
      I'll try but by all mean do your own research, it's not in my comfort area of expertise. It refer to System Integrity Protection* on MacOs which when enabled (by default) is supposed to tightly control which and how privileged code is allowed to run at kernel level. https://support.apple.com/fr-fr/guide/security/sec8e454101b/web https://support.apple.com/fr-fr/guide/security/sec8e454101b/... It seems like OP issue is that in order to run a third party legacy kernel extension that doesn't follow most recent guidelines he need to disable this safety altogether for the whole OS. (And there is a separate issue because the third party legacy kernel installer require all external storage to be unmounted at install time, thus preventing installation on an external storage) I tried to be clear, english is not my mother thong, hope it might help. *Edit : System Integrity Protection is maybe the more adequate term instead of secure boot
      - Maursault 5y ago
        Thank you. So, "security" is System Integrity Protection, a feature of macOS, and "downgrading" merely means disabling it. Sounds like a great big nothing burger.

I mean it's a pretty limited use case, isn't it? The author is basically saying that if: - you run a production line on a Mac which uses external SSDs; - you need to check the health of those SSDs regularly; - those SSDs connect by USB C; and - you're not prepared to run an install of Mac OS on your internal drive with SIP disabled (which I presume is the security setting they're being required to downgrade), then you can't fully migrate all of your activities to an Apple Silicon Mac. I don't know how many people that would apply to, but I doubt it would be a huge number, and it's hardly unusual to have either a dedicated machine or separate environment to conduct side tasks that aren't able to be completed in your main environment. One thing I wasn't clear on was why the author didn't want to format the internal drive to create a separate partition for the SIP-disabled instance of Mac OS. I don't actually see why that would be different (from a security perspective) to running it from an external drive, given that the insecure install wouldn't be running when booted from the secure install (even if they're on the same drive). The author seems to treat it as a binary choice for the main drive in the Mac Studio (ie that it must be 'secure' or 'insecure'), but that's not really how it would work from the perspective of making a second partition's Mac OS install insecure, given that that insecure OS isn't doing anything when you're not booted into it. If the author was still set on running the install from an external drive, they could partition the internal drive, install Mac OS, disable SIP and install the kext, then clone the partition onto the external drive. If external drives just need to be ejected during the DriveDx install process, this shouldn't stop anyone from running an OS with DriveDx from an external drive after the install. This is obviously a pain, but hardly that much worse from the hoops I've had do jump through on Windows over the years. I must admit, I'm not familiar enough with SAT SMART or external SSDs that connect by USB C to know why there's no alternative to turning off SIP, or why this was possible on Intel Macs but not Apple Silicon Macs, but it seems like a pretty niche use case from which to extrapolate the conclusion that full migration to Apple Silicon Macs isn't feasible full stop.

Twisell 5y ago
Yeah seem like a limitation of the third party kext more than anything. It sucks but i don't see how this is a MacOS or a M1 issue. It's not like this kext was able to run without downgrading security previously.
- Maursault 5y ago
  > downgrading security Used in article, but only you and GP have mentioned. What is this garbage nomenclature? First of all, what in God's name does "security" mean in this context? It is obviously supposed to stand for somethings specific, this is not just an in general mention of security. What? And "downgrading?" What is happening here? I am completely and utterly lost on this word and why it is used, here, in this context (the article author's use... and since both you and GP used it, I hoped either could explain to me what is going on with security downgrade like this is a thing, when I expect it really isn't a real thing, someone chose bad words for nonissue, but if not, thx).
  - Twisell 5y ago
    I'll try but by all mean do your own research, it's not in my comfort area of expertise. It refer to System Integrity Protection* on MacOs which when enabled (by default) is supposed to tightly control which and how privileged code is allowed to run at kernel level. https://support.apple.com/fr-fr/guide/security/sec8e454101b/web https://support.apple.com/fr-fr/guide/security/sec8e454101b/... It seems like OP issue is that in order to run a third party legacy kernel extension that doesn't follow most recent guidelines he need to disable this safety altogether for the whole OS. (And there is a separate issue because the third party legacy kernel installer require all external storage to be unmounted at install time, thus preventing installation on an external storage) I tried to be clear, english is not my mother thong, hope it might help. *Edit : System Integrity Protection is maybe the more adequate term instead of secure boot
    - Maursault 5y ago
      Thank you. So, "security" is System Integrity Protection, a feature of macOS, and "downgrading" merely means disabling it. Sounds like a great big nothing burger.