4 ms·
> "Never mind the whole lockdown unless you flip that "developer" switch." Speaking of which, it would be nice if that were a physical switch on Pixels. With
by Crito 12y ago
> "Never mind the whole lockdown unless you flip that "developer" switch."
Speaking of which, it would be nice if that were a physical switch on Pixels. With the original Pixel at least, there is an issue that if your battery runs completely dead, the bit that tells the computer it should be in developer mode is unset. When that happens, if you have linux installed on it, you are hosed. Everything on the drive becomes inaccessible, and the only thing you can do is reflash ChromeOS.
If I am wrong about that, somebody please tell me. It is making me paranoid as hell about leaving it unplugged.
- 32ppki 12y agohttps://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices/workaround-for-battery-discharge-in-dev-mode https://www.chromium.org/chromium-os/developer-information-f...
- pgeorgi 12y agoThe issue is fixed on Pixel 2: "And yes the issue with dev/legacy enable state being lost when the battery drains has been fixed as the state is now saved in the TPM instead of CMOS" (comment to https://plus.google.com/+OlofJohansson/posts/1yopVMjEhjK https://plus.google.com/+OlofJohansson/posts/1yopVMjEhjK)
- digi_owl 12y agoA TPM? Not sure i like the sound of that. Who holds the final keys? Also, what happened to giving the CMOS a backup battery?
- pgeorgi 12y agoThe backup battery is gone because Intel datasheets advised against it for years, and they got more insistent over time. It's surprising enough that they still didn't manage to kill of that part of the PC80 architecture (RTC clock and associated memory). They certainly try for years by now. As for the TPM, Chromebooks come with them for a long time now. They're cleared when entering or leaving developer mode. The main difference is that after clearing, the devmode mechanism also records the state there (instead of in CMOS). If you're concerned about "final keys", read the spec (eg. http://www.trustedcomputinggroup.org/resources/tpm_main_specification http://www.trustedcomputinggroup.org/resources/tpm_main_spec..., Part 1, Section 9.5). The only key that is never deleted is the "Endorsement Key". That one is similarly annoying as the Pentium III serial number (ie. it allows secure identification of the TPM if you let software send requests to the TPM).