Hacker News Reader

Comment by rswail | Hacker News Reader

I get the outrage, but I also understand where the problem originates in terms of Apple's use of the T2 chip.

To maintain the security of the T2, which is tied to the encryption of the SSD, the SSD is bound to the T2 in a non-reversible way.

So when you change the SSD, you have to rebind it with the T2. This is not a "field supported" operation of the T2 standalone, so requires the use of a secure path via Apple Configurator, with, I assume, a tunnel back to Apple's RA equivalent.

Should they make this a function of the T2 that is available in the field standalone? Absolutely.

Why haven't they? I can think of any number of reasons, some nefarious (the "remove right to repair") side of things, but, more likely, you don't muck around with a security chip too often or without a real need.

View on HN

Security chips shouldn't be black boxes in the first place.

Agreed, what's going on should be completely transparent. The security of the system must only depend on the private keys and implementation correctness.

While security by obscurity is not ideal, it is an additional hurdle. Apple knows that security flaws in their stuff is very valuable for both nefarious and state hackers, so the chances of someone finding an issue and reporting it to them to resolve it are kinda low.

Not if the bounty is high enough and payable to an anonymous recipient (perhaps vis cryptocurrency).

I don't think state-affiliated hackers really care about money.

Good point, though I imagine a large bounty payable to an anonymous bitcoin address could encourage individuals within such an organization to divulge vuln info.

It being a black box seems to be a seperate unrelated issue?

Not really since it generated the requirement that is the topic of the article in the first place.

For example, if it wasn't a black box it could be re-configured with alternative firmware negating this requirement.

Not that I'm interested in such a thing, but I can see how it would have value to a non-trivial group of users.

I guess it depends how we're defining "black box".

T2 and its firmware could be completely open source - arguably its no longer a "black box" because its completely transparent now - but unless you have the keys you still can't reprogram it.

And you should have all the keys for a device you bought. It should be a legal requirement.

That isn't related to the issue at all. On Linux, you can have a TPM + Secure Boot + Full-Disk Encryption setup with the TPM schematics all open and you will have your SSD bound to your system similarly, which is good security practice.

For such maintenance operations, you could support a mode where a barebones OS is copied into RAM. Then you can remove any SSD you want.

Do SSDs support hot plugging? Can you unplug them from a Mac Pro without removing power from the system?

Even if they do, I wouldn’t expect anybody to test that enough to make it absolutely reliable.

I don't know about the Mac hardware specifically, but SSDs can be hotplugged in linux boxes. If your sata controller doesn't support hotplugging, you will have to reboot for the block device to be accessible but that does not seem like an insurmountable problem in this case. Hotplugging is also a pretty basic feature for such an expensive computer.

The SSDs in this case are M.2 NVME which is a PCIe-based standard. I have no clue if the M.2 or NVME standards address hotplugging but PCIe based hotplug is almost never a thing on consumer hardware iirc.

Isn't Thunderbolt basically hotplug PCIe?

I wonder if hotplug M.2 NVMe requires any kind of special hardware or if it's pure software.

I just heard Lenovo is locking server chips to the motherbord now which is a similar story: you know that major chips on the board are authentic but when somebody tries to recycle the cpu later it doesn't work.

It's really hard to design secure systems that do not harm convenience, serviceability, etc., since someone trying to compromise the system is... "servicing" it.

Not sure if it's the specific thing you're thinking of, but AMD EPYC chips can be vendor locked and Dell EMC does this. They blow eFuses in the CPU so they'll only work with Dell motherboards with the correct code signature.

https://www.servethehome.com/amd-psb-vendor-locks-epyc-cpus-...

Yes it is. Lenovo and Dell both do it.

So what happens if the SSD goes bad or refuses to mount....you have a mult-thousand dollar brick because of a hundred dollar part?

I assume you can recover from corruption...but what if its a hardware defect.

No, you can swap the SSD, you just have to have another Mac on hand to reset the security chip and encrypt and install into your new SSDs.

And if you don’t have one?

I have exactly one Mac in my house. I also have linux and windows in various forms. But only one Mac.

And the nearest “Genius Bar” is 200 miles away with only affiliate repairs (or whatever they call them) locally.

Then you have a machine that's unusable until you find one, but it's not bricked (which means that the hardware is irreversibly unusable).

>(which means that the hardware is irreversibly unusable).

In my case that would in effect be a distinction without a difference...

Apple is assuming all supported repairs and replacements are being performed by an AASP, where external troubleshooting is the norm.

Perhaps someone could tell us what the order would look like in GSX?

>Apple is assuming all supported repairs and replacements are being performed by an AASP, where external troubleshooting is the norm.

If that were the case they wouldn't have published the technote publicly using software they also freely make available (Apple Configurator). Having more than one Mac is hardly something novel, and even if you don't have a second of your own how many Mac owners don't know someone with a Mac they could borrow for 10 minutes to do the pairing?

Would it be nice if the firmware for the Mac Pro could do this without needing a second computer? Sure. Is it a hardship warranting this level of scrutiny? Seems a bit overblown to me.

This isn't apologism, but at least Apple provided a way for customers to fix this and a plethora of other issues without strictly needing an AASP.

We frequently have to revive T2 Macs whose batteries won't charge, and the only way to do that in the not too distant past was to ship it off for a logic board replacement.

Telling customers they can fix things themselves means the 10% of people who want to on their own now can, but it's already negated a turnaround of 1-3 months for Apple repairs sent to facilities that are being impacted by covid-19. It's safe to suspect myriad causes.

Reply on news.ycombinator.com