To upgrade the SSD in a Mac Pro, you need a second Mac computer
support.apple.com
support.apple.com
To maintain the security of the T2, which is tied to the encryption of the SSD, the SSD is bound to the T2 in a non-reversible way.
So when you change the SSD, you have to rebind it with the T2. This is not a "field supported" operation of the T2 standalone, so requires the use of a secure path via Apple Configurator, with, I assume, a tunnel back to Apple's RA equivalent.
Should they make this a function of the T2 that is available in the field standalone? Absolutely.
Why haven't they? I can think of any number of reasons, some nefarious (the "remove right to repair") side of things, but, more likely, you don't muck around with a security chip too often or without a real need.
https://www.servethehome.com/amd-psb-vendor-locks-epyc-cpus-...
Even if they do, I wouldn’t expect anybody to test that enough to make it absolutely reliable.
I wonder if hotplug M.2 NVMe requires any kind of special hardware or if it's pure software.
Perhaps someone could tell us what the order would look like in GSX?
If that were the case they wouldn't have published the technote publicly using software they also freely make available (Apple Configurator). Having more than one Mac is hardly something novel, and even if you don't have a second of your own how many Mac owners don't know someone with a Mac they could borrow for 10 minutes to do the pairing?
Would it be nice if the firmware for the Mac Pro could do this without needing a second computer? Sure. Is it a hardship warranting this level of scrutiny? Seems a bit overblown to me.
We frequently have to revive T2 Macs whose batteries won't charge, and the only way to do that in the not too distant past was to ship it off for a logic board replacement.
Telling customers they can fix things themselves means the 10% of people who want to on their own now can, but it's already negated a turnaround of 1-3 months for Apple repairs sent to facilities that are being impacted by covid-19. It's safe to suspect myriad causes.
For example, if it wasn't a black box it could be re-configured with alternative firmware negating this requirement.
Not that I'm interested in such a thing, but I can see how it would have value to a non-trivial group of users.
T2 and its firmware could be completely open source - arguably its no longer a "black box" because its completely transparent now - but unless you have the keys you still can't reprogram it.
I assume you can recover from corruption...but what if its a hardware defect.
I have exactly one Mac in my house. I also have linux and windows in various forms. But only one Mac.
And the nearest “Genius Bar” is 200 miles away with only affiliate repairs (or whatever they call them) locally.
In my case that would in effect be a distinction without a difference...
Maybe Apple figures it's not a big deal to require another Mac simply because these machines are priced such and targeted at professionals and corporations.. having an old Macbook or something around isn't unlikely.. this is the kind of thing that would be a deal breaker for me but that's moot since I don't think anyone like me would ever buy one.
The main problem I could see with a field-pairing mechanism is properly messaging it to the user while the SSD is in an unusable state. Remember: once you change the SSD pairing, the data on the old drive is unreadable by anyone and the new drive will be wiped accordingly. So it absolutely should not be an automatic process - what if someone swaps the SSD modules without knowing about the drive encryption? At the very least, you need to flash a warning up on screen and accept a user acknowledgement, which means you need display drivers, USB, and so on all working in the boot ROM. It's not insurmountable, but it is a technical challenge.
Pretty sure Apple has some form of this. On Intel Macs, the boot picker [0] supports displaying text and graphics, accepting keyboard and mouse input, and even connecting to Wi-Fi. There’s also the FileVault password screen, which does not live in the firmware, but it’s a full-screen UEFI app resembling macOS’ login UI.
It’s also a thing in the PC world these days. The UEFI setup menu on modern machines is a bitmap-graphics GUI with mouse and keyboard support, for example [1] (a random YouTube video).
[0]: https://www.ninjastik.com/support/how-to-choose-a-startup-di... [1]: https://www.youtube.com/watch?v=Q1NDjD2RuGM
Deliberately unrepairable products should be against the law. The consequences of that first unethical decision just cascade.
No, I don't buy the argument that people would choose to make their laptop 5 grams lighter or whatever and give up repairability, and to be honest, they shouldn't have that choice. It's simply irresponsible to buy an expensive machine full of unrecyclable parts produced at great cost to the planet, and expect to throw the whole thing out when any part goes bad.
I think I have swapped hard drives three times in over 10 years on my Mac Pro (that I still use!) Also acting like it's extreme hardship for a Mac Pro (!) user to have access to more than one Mac is a bit bombastic.
TL;dr - this whole thing is a hell of a lot of fuss for a non-issue for what I would wager is an utterly minuscule number of people.
And if you are upgrading a Mac Pro SSD drive, even if you had to buy a Mac Mini, use it once to bless the drive and toss it, it would probably be a fraction of the cost of the SSD you are putting in your Mac Pro and still cheaper than buying a similar sized drive from Apple (even if Apple offered a larger SSD - which is the main reason I would suspect someone would be wanting to upgrade the SSD in the first place).
Of course, that's in no way an official,. supported solution, but it'll work.
Contributing Back
This project can always use your help, time and attention.
I am looking for help (pull-requests!) with the following
work items:
* Create *full* installation (ISO) image without requiring
an existing macOS physical/virtual installation.
...
I mean, you don’t need to be the owner of the Mac you run the restore from, so you can visit a Mac-owning friend, or an Apple Store.
And even if they didn't, the odds of them having a friends Mac they could borrow for the 10 minutes required to mate a new drive is pretty darn high too.
This is hardly a hardship.
Indeed, I'd wager FAR less effort will be spent globally to mate new SSDs to Mac Pro's over the entire lifetime of the global supply of all Mac Pros shipped vs. the level of effort already exerted to express consternation in this thread :p
But seriously, we expect people to have a second computer around when doing anything involved with their hardware. New computer? Need to create a bootable flash drive with an OS. WiFi not working on Linux? Need to download stuff and move it to your machine. Monitor/ethernet/mouse/GPU/anything not working? Plug it into a different machine. Network settings borked? Ping it from the second machine. We're used to this.
And Apple, surprisingly, expects your other machine to be a Mac. Because why wouldn't it be a Mac. They expect you to use a Mac or an iOS device to verify your identity, to contact their support comfortably, AND to restore firmware on your other devices. They expect you to use their ecosystem of devices and software. You may not like it, and that's why you probably don't have a Mac, but it's consistent and it makes sense in the context of their philosophy.
Most people don't have multiple computers and most people that own a Mac are unlikely to have two of them.
The firmware thing is a separate, unfortunate, issue.
Or the more common and easier method is to do an "eraseinstall" which does the same thing but without the need to make the USB media. It does some APFS volume stuff automatically to copy the installer, wipe all other volumes, install, then remove the installer volume.
The need for a second Mac is something most Mac users never encounter as it means something has gone seriously wrong or they are a power user doing something "not normal".
I'm not defending Apple's decision here, I see pros and cons for it. Just saying that for almost all users reinstalling macOS doesn't require a second Mac. I have been a Mac user (and developer so not a "normal" user fwtw) for almost two decades now and never once needed a second Mac for any restore tasks.
OTOH, needing a second machine for that sort of maintenance (installing a second drive iiuc) seems indeed quite a big requirement.
Microsoft sits at the opposite side of the spectrum with most of it's clients being highly critical of it, and passionately angry at nonsense, except in the case of XBox, other gaming consoles also seem to enjoy very high brand loyalty; I also see it with GNOME.
Apple has convinced people that wearing their products give them "uniqueness". Tesla has something similar, but with "change the world".
You will hear other excuses that are more tangible, but those are the brain listing features that have little to do with why someone bought it.
Apples poor record on privacy, security, performance, and ease of use should all be stark reminders that marketing sells products.
It's not typically the brand loyalists that do the hating.
When you can convince people that all they have to do is buy in to your system and everything will be fine, that gets you religious levels of dedication. And of course the people who buy in are deeply invested in their not-easily-reversed decision, so they market you for free!
I keep hearing about this, but except for BSODs (which are super rare these days), but I haven't ever had this happen to me. My guess is that the people complaining about this stuff are the ones abusing their systems, and not telling you that part (the kind that would postpone updates for <<years>> and then wonder why Sasser or whatever were a thing).
yup, save for overclocking (or undervolting, which is essentially the same) I have not seen BSODs for a decade plus. I have seen laptops overheat due to clogged/uncleaned air vents, but that's a hardware issue.
flip note: what's wrong w/ the parent's post to deserve the downvotes.
Probably people are rattled at being told that the well-documented phenomenon of spontaneous Windows reboots are somehow their own fault for "abusing their systems".
There's a toggle switch in update settings to explicitly disallow rebooting without intervention. It was ignored. Checked the system log and everything.
I guess I'm just holding it wrong...
That one is a fair point. I bet it did have 'intervention', showed a message it would reboot in whatever minutes and proceeded later.
Personally I use windows offline updater, and ignore the built-in 'windows updater'. 'shutdown /a' aborts an initiated shutdown
Apple is fully form over function. Macs laptops are anything but good engineering (hardware wise)
I prefer it. I have Windows and Linux boxes (gaming and tinkering respectively) but when I just want to do stuff I reflexively grab for my Macs.
If they don't have the same value to you - great. That's why it's awesome to have choice. But pretending there is no difference in value for everyone because there isn't any for you is silly (and more than a tad narcissistic).
> but the outrage comes from an underlying expectation that Apple products should be flawless.
This is particularly silly. Apple has a reputation for product tying and expecting one to buy other products, also made by Apple. We've all seen the MacBook Wheel parody that, though parodious and exaggerated, shows the reputation it has for form-over-function and consumers that are too loyal to see they are paying more for less.
If Microsoft were to require something such as this, no one would come to it's defence on the same level I've seen with Apple, except, as said, with XBox, but that seems to be a common thing with gaming consoles, but Nintendo seemingly enjoying even higher loyalty.
Why not complain instead about the totally needless complexity of the Mac Pro case and its spacecraft-grade CNC manufacture? Slow, wasteful, expensive - and for what? Nothing in the world I can see, save to satisfy Jony Ive's apparent thing for metal with lots of tiny regular holes in it. I'm not here to kinkshame, but I'm glad dude has finally found a different venue for it.
[1] https://jalopnik.com/this-ancient-laptop-is-the-only-key-to-...
At most, the kind of car we'd be looking at would be an Audi or BMW and they have pretty standard ports and desktop software for tuning the in car firmware. The reason it's standard and widely available is because while their cars are premium end, they're still widely bought and widely driven so those respective car manufacturers need to make maintenance accessible. Apple, on the other hand, are part of an increasing new trend where manufacturers intentionally remove the ability for 3rd parties to maintain their own hardware. So Apple (and others who pull the similar stunts) should absolutely be called up on this unethical practice.
Have you ever noticed how Apple considers Macs a separate platform from PCs? Not as in "Windows or Linux or macOS on a computer", but as in "macOS on a Mac, or anything you want on a PC".
They don't want you to make a bootable macOS disk on Linux, because Macs and PCs are not supposed to be friends. Like PlayStation and Xbox, their hardware is similar and from the outside they both look like general purpose computers, but they're different platforms and they're not friends.
You can run macOS on generic PC hardware (Hackintoshes) and you can run Windows or Linux on Mac hardware, but that's mostly a byproduct of the platforms being similar.
You can disagree with Mac not being a PC and not being an open general computing platform, you can choose not to buy them, use them or develop for them, but I don't think it's a difficult concept to understand that Apple doesn't sell, support or care about PCs.
Apple might consider paying taxes optional, or the moon to be made of cheese. But why should any of us care or be bound by that?
"and PCs are not supposed to be friends."
Wtf does this even mean, how is it helpfull or provable?
Not in this particular case. If you are installing an OS on a new drive, all you need is the installation media. You can get that from someone else or prepare it ahead of time. You certainly don't need a second machine on hand at the time of the upgrade or repair. On Macs of a certain vintage, you did not even need that. The firmware has the ability to download the operating system itself over a network connection.
Even in the other cases, a second computer is not necessary. It may be convenient to test a component that you believe has failed before purchasing a replacement, but you certainly have the option to purchase a replacement without testing it. It is also relatively rare these days to require a computer from the same vendor to do testing. As for pinging a computer on the network, that implies that you have a second computer to network with. It does not have to be from the same vendor.
Even though it is likely an unintentional consequence of Apple's design decisions, this does make a relatively simple upgrade or repair less accessible. About the only thing I can say in Apple's favour is that Mac Pro owners probably have easy access to another Mac. (After all, it is quite an expense to accept without having prior experience with Apple hardware.)
If one's machine be sufficiently destroyed that it can no longer boot from that, I don't think another computer can fix it.
It comes with internet and a web browser.
I wasn't thinking of “resuming installation” so much as “accidentally made my machine inoperable”, which becomes apparent when rebooting after the installation.
If the machine were not made inoperable, I would simply use the web browser that comes with the live medium of the installer.
Requiring specialized tooling should not be required for replacing a modular component. I understand that this case involves the security chip, but surely Apple would be able to implement a solution that is integrated into the system's firmware. Macs are already capable of connecting to a wireless access point to download and install the operating system via the Internet[1], so this seems like a reasonable approach.
[1] At least they had that capability when I purchased a 2012 MacBook. I'm not sure if things have changed since then.
Sometimes we even expect a second computer with a different operating system or even different architecture. I had a retail Seagate harddrive in my Mac that was going bad during the warranty period. Seagate expected me to run their diagnostic software to get an authorization code to return the drive--and at the time that authorization software only ran on DOS or Windows.
I had a Windows PC that I could move the disk to and run the diagnostics on, so just went ahead and did that. I don't know what they would have done if I had not had a PC available.
The box explicitly listed the Mac as being supported and said nothing about a PC being required for warranty replacement so I assume they could have been forced to honor the warranty without running the diagnostic, but don't know how much of a hassle that would be.
There are many reasons. I'm a developer, I like having computers around, so I have multiple computers, including two Macs. Some people just have multiple computers and I'd guess that people who own a Mac Pro will probably have a second, more portable machine.
> Why are you sp eager to defend them?
Because I believe the i3-Linux-Thinkpad crowd needs to be constantly reminded that there are other people using computers with different opinions who may be actually happy and productive on their Apple hardware and who prefer dealing with minor hiccups like these over running Windows or Linux on generic PC hardware.
Yup. When I just want to get work done and not feel like I'm having to spend more time tending to an active science fair project than getting stuff done I turn to my Macs. I have plenty of friends who prefer Windows and even a few masochists who prefer Linux on their desktops. I never feel the need to criticize them for their choices.
I'm not so curious about why someone would defend their choices, but why others who have no idea what someone else's wants or needs are feels that it's OK to pontificate as if their thoughts were relevant or even needed.
Pros are supposedly typically bought by businesses, too, which would have a fleet of devices.
Just explaining—hopefully it helped.
I also have two windows and three linux boxes. I guess I'm a windows and linux defender too? :p
I can create bootable usb both on Windows and Linux. All of the statements are pretty much false.
(Works for restoring T2 Macs too)
It will be nice to be able to service macs bought for cash without having to dox oneself to Apple.
(Yes, this sucks.)
So why are they doing so much and not advertising it more ?
It is basically a DRM system.
https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
Not that I'm defending it. And I also expect Apple to do better and not just pay lip service.
On the other hand, who is doing as much or more? Again, not saying that to excuse them but just point out there is likely far more going on than them just making an arbitrary decision here. Just saying...
Google does end-to-end encryption for Android for free. Just saying...
Has Apple done absolutely everything? No. Have they done a lot? Yes.
Since security is difficult, aggressively marketing your products as secure is fraught with liability. Sooner or later, some oversight is likely to bite you, and if you’ve made promises, you’re now on the hook for those promises.
But if, instead, you just talk about what technical steps you’ve taken to improve security, and then let enough time pass, you can get a reputation for being secure without ever having made any guarantees. You just let people notice how you respond to security issues, and the relative frequency with which you have breaches. That strategy takes longer to work, but it’s harder to sue you for a public perception which you never actually endorsed.
Assuming this is the strategy, I don’t even think it’s particularly nefarious. It’s fairly incentive-aligned, since it only works if your track record is cleaner than your competitors, and it hacks around the fact that consumers aren’t willing to pay the price for actual security guarantees (which would probably involve SLAs, and Apple essentially acting as both a vendor and an insurance broker).
As for hard drives you better call OWC - your insight will be a revelation to them: https://eshop.macsales.com/shop/ssd/owc/imac-27-inch/2013-20...
“For iMac 27-Inch (Late 2013 - 2019)”
It won’t fly in the 2020.
I think it's far simpler than that - this is such an infrequent issue it doesn't warrant engineering time beyond what they already support - using Apple Configurator on a second Mac to sign the drive to install it.
This is likely a dictionary definition of "edge case" after all. Mac Pro's aren't exactly high volume computers (something that is normally touted with great enthusiasm on this site).
What sort of twisted Stockholm Syndrome has afflicted you?
The T2 firmware needs to be restored after modifying the SSD amount.
This upgrade is typically reserved for an Apple Authorized Service Provider, but sure, if you have another Mac, you can do it all alone yourself.
What is it with HN recently and all this childish Apple bashing ? If I want Apple bashing, I'll head on over to The Register where its a well known fact they hold a long-term grudge against Apple because of some decade's old fight they picked with Apple's PR department.
Back to the case in point, this HN post is disgustingly misleading.
What the Apple support article is actually saying is that if you have : (1) A spare mac with Apple Configurator 2 installed (2) A USB-C/USB-C cable or USB-C/USB-A cable
Then you can do the repair yourself.
This is not exactly a significant obstacle !
(1) Apple Configurator is a FREE download from the App Store (2) You can run Apple Configurator on any Apple machine, you DO NOT NEED another Mac Pro! (3) Any self-respecting tech will already have USB cables by the dozen
Yes, you need "another mac", but let's face it, if you use a Mac Pro at work or at home, then you most likely have "another mac" of some description around the place. And if you don't, you probably have one or more friends who have one !
That strikes me as rather emotive phrasing for an discussion about SSD upgrades.
Anyway - surely the point is that something that used to be simple (upgrading storage in a personal computer) now has a potentially large hurdle in it's way.
Does finding that to be a step backwards make one an anti-Apply fanboy?
You can always plug in a second SSD via a PCIe slot too.
Only emotive in the context of people using HN for clickbaity Apple bashing that is unsubstantiated by actual facts.
If you could be bothered to actually read the Apple Support document, you would see the reason access to Apple Configurator is required is because the SSD is tied to the T2 security chip. So you are not "just swapping out an SSD", there is a security element too. Frankly I think that is a good thing that changing hard drives is linked to the security chip.
Again - please take the temperature down a notch. I'm significantly less invested in this topic than you seem to be.
And to respond to your specific point - I'm not clear on how a new blank drive would be a security concern. There might be a technical reason why it has to be this way - or it could just be poor design. At this stage I'm curious to know the thinking behind this.
> Frankly I think that is a good thing that changing hard drives is linked to the security chip.
I'm trying to think of an attack where "needing a second computer" is a major hurdle once you've got physical access.
The Apple security guide spells it out but I can hopefully summarize: the firmware for the T2 is stored on the the SSD, and it gets signed with hardware keys present in the T2 itself so the system can know if it's code is intact or has been modified.
If you remove the existing SSD and install a new one, there is no longer any T2 firmware present. Without it, the T2 can't start and since the T2 is the starting point for the entire boot process - well, hopefully it's obvious as to why this is an issue.
Why not embed the firmware on the motherboard? Well, being able to update it is a nice thing. Not having to worry about running out of storage in firmware memory embedded on a motherboard years before is also a good thing too; especially when the trade off is a pretty darn minor hassle - IF you ever upgrade your drive (which the vast majority of people never do).
If you think this is outrageous, then you must be pretty ignorant of more than a few really gross problems with Intel's TPM (analog to Apple's T2) - many of which can't be fixed without new hardware. At least with this approach issues can be addressed and aren't burned into silicon. Intel could have made parts of their firmware updatable but they punted since it's pretty hard to maintain a secure chain; especially if you are relying just on resources in the computer you are also mucking around with at a pretty low level to update pretty sensitive things.
I'd much rather be able to keep my machine secure even if it requires occasional simultaneous access to a 2nd Mac vs. being stuck forevermore with issues in hardware. And even if you use Linux, those TPM bits are still exposed :p
Ultimately, claiming access to a second Mac for a Mac Pro (!) owner is any kind of hardship is utterly ridiculous. Every single Mac Pro owner I know (and I have and still use a cheesegrater Mac Pro) also has a Mac laptop since, you know, Mac Pro's are far from portable. And even if I didn't, as a Mac user I have many Mac friends I could bum a laptop off of for the 10 minutes it would take to swap an SSD and install.
I must live in a bubble. I don't experience the emotion of disgust. I don't know people who experience the emotion of disgust. I'm honestly not sure how one defines the word, and I get the impression that many people who use the word don't really understand it either.
On the other hand there may be some "in the womb" biological tendency toward caution, aversion to change, that correlates with Republican affiliation. Experiencing disgust may just be one of those things, like how some people taste bitter as intolerable.
I'd describe the feeling I get when seeing my cat puke out a meal, followed by her starting to eat that slimy bloody pudding again, as disgust. Just to name an example. Have you really never experienced that? Lucky you I'd say :)
Apart from that, i.e. the very literal sense ('dis' is like a negative, 'gust' is taste), disgust also gets used in the sense of morally disliking something profoundly. Again not that uncommon.
But I get your point: these days it seems to get used often when it is not very close to the actual meaning. And as such gets hollowed out a bit.
And yet, you went ahead to perfectly describe (in all but the explicit term), how you are effectively disgusted by the supporters of the previous US President, the people who use the word disgust, and Republicans in general - and in a completely unrelated thread to boot.
One could very well ascribe this to virtue signalling and projection.
I'd say implying that having access to a second Mac for 10 minutes to bless a drive in a $6,000+ computer as a "hardship" is not just emotive but bombastic.
Hell it wasn't too long ago that some computers required other computers in order to boot. Yes, I'm being a bit cheeky but we are talking about a procedure affecting a fraction of an already small pool of users - Mac Pro owners.
This is an overblown and sensationalized "story" purely because Apple is involved.
https://www.pandasecurity.com/en/mediacenter/mobile-security...
Every approach has pro's and con's. Overall not a huge fan of secure enclave type solutions but I do think their benefits still outweigh the hassles.
Security/Convenience - always a tug of war.
Which is absent if you are replacing it.
So when you put new primary storage in the machine, a new firmware that is cryptographically signed with the hardware keys that are unique to the T2 in each computer are used.
If they didn't use Apple Configurator running on a second Mac for this they would have to put all of that functionality in firmware on the machine somewhere. Driving up cost and complexity for an obscure task on a low volume machine in the first place. Yes, sounds like a valid use of engineering resources to overcome the "hardship" of having access to a second Mac for the 10 minutes (or less) the swap requires.
Most would just leave It in the fridge or on the counter and eventually throw it away.
All thinkpads that I own are still in use to this day. The newer one is over 5 years old and the rest are 10+ years old.
You know, you can "upgrade" your Mac Pro's firmware quite easily by first removing that tape, then taking the USB-c cable and wrapping it around your laptop, connected to both sides (either of the two ports on each side works).
Then just play with it a bit and see what changes. ;)