Apple’s T2 Security Chip Has Created a Nightmare for MacBook Refurbishers | Hacker News Reader

Apple’s T2 Security Chip Has Created a Nightmare for MacBook Refurbishers

vice.com

30 pointsemptybits26 comments

Apple has become monstrous. This is an egregious waste of the planet's resources. I am an Apple developer and huge Mac/IOS fan, and I have grown to hate the company with a burning passion. I will not buy one thing from Apple.

They lie outrageously when the claim to be "green". Their security for both IOS and Mac are solely profit-motivated. They could easily allow someone with an iCloud or T2 locked device to generate a message to the Apple ID of the user, who could then agree to unlocking if the device had been donated, sold, or recycled, but they refuse.

They could easily implement a simple tracing program online or through the Apple store that allowed people to file a case for unlocking if the device were not listed as stolen, but no, they would rather contribute to the destruction of the planet by padding the bottom line.

I am called on to recommend hardware for a lot of people and companies, and my advice now is "Don't buy Apple". It will take a few years, but eventually they will decline because of techs like me giving this advice.

The first thing I do when I am considering any new product is to look at the repairability score. Apple is not doing well. You would have to be a complete dolt to buy AirPods.

Also for admins. I had to send back an iMac Pro because we installed it from a backup. This skipped the T2 setup during install, and left it in a completely broken/uninitialized state that only apple could fix (presumably by throwing the entire mac away).

Our company has a strict "NO T2" policy, and after we can't get T2 less macs anymore, we're gonna switch to windows after 30 years of being a mac shop.

I know its no help to you now as you have already sent it back but if the T2 on the iMac Pro was simply uninitialized or corrupted you can put it in to DFU mode and use another mac and Apple Configurator 2 to restore the T2's firmware. https://help.apple.com/configurator/mac/2.7.1/#/apdebea5be51

I had a lengthy talk with apple support about this. They've advised against that, since the specific version of the T2 that specific iMac Pro shipped with, had a failure case where resetting the firmware would also brick it. At least that's what I've been told, could be that apple rather pays the shipping costs, than the support hours if something goes wrong ofc.

But you already had a brick so not a lot to lose esp if you are expecting Apple just tossing the mainboard when it’s returned anyway ;-)

It’s a known issue that a MacOS restore can upset the T2.

But yeah, if you can live without the iMac while Apple do their thing there is a valid argument to say “why waste a tech’s time researching and attempting a fix when Apple will cover the cost of sorting it.”

Yeah, it's on their clock if they have to fix it. Also as a company you have a much narrower margin of time to return, than as a private person. And we didn't want to be stuck with a mac that kinda sorta works, but might break at any time.

We solved the problem by returning the iMac Pro entirely, and instead getting a prev-gen iMac with maxed out specs.

Got us into a similar capability range, no pesky T2, and saved like 3k.

>Our company has a strict "NO T2" policy,

Can I ask why? I don't see the downside.

With a T2 chip you can no longer use Disk Cloning as a viable means to make backups, because there are ID's stored in the new APFS that have to match the ID of the T2 chip. It sometimes somewhat works, but it's an invitation to get burned.

I've talked with various seniority levels on apples tech support team and they all recommended against it, because they themselves know that it can bring the system into undefined states.

So how to do backups then? Apple recommends the Os X Migration Assistant. But that tool is so broken that it sometimes takes multiple migrations to transfer all the data, and even then you won't get things like financial applications which dig themselves deep into system files.

Again I've talked to many people at Apple tech support, and they've all reached the conclusion that Migration Assistant can't be trusted 100%.

Having a computer that we can't upgrade, or replace in a failure scenario is a no-go.

I guess my first comment would be that cloning disks isn't a viable backup strategy. It hasn't been for a long time, especially since you don't have the ability to swap internal disks anyway. Apple provides time machine, which should give you a good backup capability.

Also, I'm not convinced the T2 chip is the problem here. I think an incorrect corporate backup workflow and deployment strategy is the problem.

Now you need to explain, how is that not a viable backup strategy? And with the utmost respect, if you seriously recommend time machine, for anything besides a quick "oops didn't mean to delete that", then you can't have used/deployed it in anger.

With a 40Gbit Thunderbolt SSD you can theoretically restore an internal PCIE Drive in 1.5 Minutes. No internal drive access needed, if it boots into target disk mode you're good.

Compare that with days for the Time Machine case, because it has to move all the tiny little files, and recreate a file system tree. And even then you're not guaranteed to be good, because a restore will use the Os X migration Assistant too, which, as mentioned before, has a tendency to just. not. work.

TM is an unreliable technological nightmare. It could have worked if apple had bought ZFS, but since that fell through due to licensing, they had to rely on a hot mess of folder HARD-Links to try to build some kind of snapshotting file system. Even with APFS you're not 100% good, because APFS is an extremely young file system with plenty of bugs, remember that Disk eating APFS Os X Upgrade. Combine that with Programs that manage taxes and are written BASIC with no idea on how to behave on a modern operating system, yeah no thanks. I'd rather have that 1.5 minute repair time instead of waiting days for multiple iterations of the Migration Assistant, only then having to reinstall all the software that got broken in the process.

What does "incorrect corporate backup workflow and deployment strategy" even mean. We're two guys completely in charge of IT. I wish we had Linux or Windows, at least there is some form of "Deployments". With Macs, it's all manual labour, because any thing remotely resembling automation, gets discontinued or API-broken in the next release.

The best you can do on a Mac in terms of reproducible deployment is set it up once, and copy the entire disk wherever you go.

You're apparently buried in a use case that isn't really modernizable it seems.

Windows isn't going to help you either, cloning disks in that ecosystem is a royal pain as well. They often simply don't boot properly and require quite a bit of work to make that workflow possible (been there...)

What I generally recommend to people who have to run software that's 20+ years old is to stuff that software into a VM and then you can use VM tools to keep images that work. OSX can be run in a vm on Mac hosts using vmware fusion and that might be a safer option for you. I think either way you go, you're going to wind up running something unsupported for whatever software package you're using that's causing your headaches.

But again, this has nothing to do with the T2 chip. You've got other issues to deal with.

This has nothing to do with our "exotic use case" which is "being an advertisement company that uses mac and photoshop, with the occasional accountant and management machine."

This is EXACTLY the use case Apple advertises its machines for.

This is also new software like photoshop, and various font management tools.

You also didn't address TM or Backup reliability, nor TM backup restore time which is simply limited by the realities of computer hardware.

It's completely the T2's, APFS and Apples fault if simple posix operations like cloning block devices break.

Also you couldn't provide a single backup solution that Apple support actually recommends. Because they full well know how broken TM and Migration assistant is.

But I guess they're gonna get away with their bulls* as long as there are fans who defend them no matter what.

Have a nice life as an MS customer. I think you'll find it's not quite so rosy as you believe on that side of the fence.

It sounds like the recyclers need to co-ordinate with their customers better. If they can't send it in unlocked then refuse the item. It can't be that hard to administer.

Personally I'm glad these devices are useless if they are stolen.

There's no way you're gonna get these devices unlocked if they're from a company that has gone under, I guarantee there will be either no time to reset the devices properly, or the people who could have done this have been let go long before everything went bust completely.

If there's thousands of these devices then it's a design flaw not a user fault.

Theft protection is orthogonal to recycling. If apple wanted they could easily setup a system that allows users to mark macs as stolen, which locks them down, and notifies the police/owner whenever they are powered on. But which would still allow "certified recyclers" to unlock and wipe macs that haven't been marked, so that they can be gifted to people in poverty, schools, students, and other non-profit causes.

I bet such a system would even increase return rate, as recycling companies have no interested in keeping a stolen macbook if they are able to unlock all the disposed ones instead.

Apple can market this however they want, the T2 has one main goal, reduce reuse and increase turnover and sales.

It's exactly the same as with the Sonos Bricking, except that Sonos has come to their senses and disabled it, while Apple has the diehard support of their fan base, no matter how hard they screw people over.

There's no way you're gonna get these devices unlocked if they're from a company that has gone under,

You can always find an edge case but in general we are better off if these devices can't be stolen.

This is so negative sum thought. It's not even zero sum.

"If I cant have it NOBODY CAN! <stomps foot>"

As much as theft hurts, destroying a device that costs so much environmental resources just to be vindictive to a thief over is abhorrent.

They could do this without the destroying hardware by linking serial numbers to people, making it trivial to look up who owns a serial number, and then enforcing receive stolen property a crime.

It's not to be vindictive to a thief, it's to deter a thief. There is no point in steeling something that has no value.

They could do this without the destroying hardware by linking serial numbers to people, making it trivial to look up who owns a serial number, and then enforcing receive stolen property a crime.

Who is they? Apple? The state? The number of ways that could go wrong is endless.

>> They could do this without the destroying hardware by linking serial numbers to people, making it trivial to look up who owns a serial number, and then enforcing receive stolen property a crime.

> Who is they? Apple? The state? The number of ways that could go wrong is endless.

Well, Apple, insurance and the state all have their part.

The government can enforce the crime of receiving stolen property. However on the other side, is whenever higher dollar merchandise is sold, to also record the owner. We already do this with vehicles and the VIN. Manufacturers already do this for warranty and recalls.

And Apple usually also knows who you are from the AppleID, which almost always has payment and addresses on file.

And, everything has endless ways it can go wrong. But there's a pretty well known finite ways of it going, with weird legal edge cases. Apple, Insurance, and the state can handle at least the more common cases.

This is a feature not a bug, no one will want to steal a mac if it's not worth anything.

However there should a way (possibly in iCloud) to remove protection from old laptop that you gave to someone.

What a waist of resources. "Apple is committed to the environment" is such BS. Apple is basically "taking green cars off the road to build new ones and polluting the environment in the process".

Isn't that the point?

Reply on news.ycombinator.com