r/homeassistant • u/Quiet-Ad-7989 • 7d ago
💬 Discussion PSA: Matter-over-Thread devices can access the internet, and Apple won’t let you restrict it
This may be obvious to some, but I can imagine that a lot of people don’t know about this: Matter-over-Thread devices can access the internet through your Thread Border Router (HomePod, Apple TV, etc.), even if they don’t require an internet connection to function.
And you can’t block their internet access through your router or via VLAN unless you block internet access for those Apple devices too.
37
u/MAndris90 7d ago
The fun part on this. Bought another smlight device for a border router purposes, on the mikrotik's firewall its blocked on ipv4 both mac and ip, blocked on ipv6 mac+ address plus all outgoing traffic to internet. Yet the damn device still acces the internet somehow
16
u/MrSnowflake 7d ago
If you can, you should make an IoT vlan, in which you put all these devicea and block all non local traffic from them. this is way easier and thus less error prone to the firewall rules per device.
9
u/SimpleFile 7d ago
Can you do that without blocking Home assistant from accessing the internet? Since Home Assistant acts as a router of sorts aren't the devices "hidden" behind it?
8
u/SkynetUser1 7d ago
You make a 2nd NIC. For an example, my HA VM has a NIC on the .43 VLAN which is trusted internet-facing systems. It also has a NIC on the .44 VLAN which is where the IOT devices live. That creates the connection.
3
u/MrSnowflake 7d ago
My Home Assistant runs in my "normal" Vlan, while my Wifi IoT devices are in the IoT vlan (no internet access). But there is communication possible between both vlans. So yeah that works
2
u/MAndris90 6d ago
Its halfway done just need to enable vlan filtering on 4mikrotik switches and the router itself, thats gonna be a fun ride.
But its still a mistery how on earth does it have acces to the internet without outgoing or existing connection to the outside world
2
u/MrSnowflake 6d ago
I would like to help you out, but it's a bit hard doing it from my desk :). You are missing something, surely. And that missing part is something that a vlan could make easier.
Btw: When I upgraded my home network, I was looking into mikrotik (because European), but ultimately went with Ubiquiti. They have a nice integrated piece of software that makes management really easy and is automatically applied to all devices. I think mikrotik has very nice hardware, but their software is not as well integrated.
6
u/SirEDCaLot 6d ago
on the mikrotik's firewall its blocked on ipv4 both mac and ip, blocked on ipv6 mac+ address plus all outgoing traffic to internet. Yet the damn device still acces the internet somehow
It probably has another MAC and IPv6 for the thread interface, and then each thread device has its own MAC and IPv6.
2
u/MAndris90 6d ago
Which should not be visible as its behind the border router. Blocked every address which is in the smlight web interface, its running the otbr on itself so it should be isolated from everything, yet it sees internet and their own firmware servers. And i dont see the connection on the firewall
3
u/SirEDCaLot 6d ago
Why not? Don't Thread devices have their own IPv6 addresses? So wouldn't the connection appear to come from the device's IPv6 rather than the border router?
Not seeing the connection on the firewall is much more interesting though.
34
u/ikschbloda270 6d ago
Thread 1.4 makes NAT64 mandatory so that’s why you can’t disable it. IPv6 communication can be firewalled by device. Put your TBR on an IPv6 only network.
7
u/ManufacturerOk8154 6d ago
Are you sure about that? As my HA and DIRIGERA hub are both on Thread 1.4 and I can still turn it off. Also the Thread 1.4 whitepaper doesn’t mention it being mandatory. It only states it’s on by default, which is also weird as it has never been on in my HA OTBR instance.
5
1
u/RydderRichards 6d ago
My openthread border router runs in a vm. Do I turn off ipv4 for the vm and then block the mot devices on the router?
2
u/ikschbloda270 6d ago
You could do that or just block internet access for the VM entirely if you’re just using it for OTBR I guess
1
u/RydderRichards 6d ago
I'll give that a try, thank you!
Don't know why somebody Downvoted you, sounds logical to me.
43
u/Accomplished-Hat-85 6d ago
That was one of the reasons why I didn't look for Matter devices (Matter over Thread or wifi). I don't want a bunch of IoT devices in my home network with a possible uncontrollable connection to it's manufacturer. Bunch of YouTube influencers sing about Matter pluses for a couple years and mostly "forget" to mention that local control does NOT mean that noone can brick your device, push ads through it, set paywall on already existing function or steal your private information (and if so many ppl pushing only Matter pluses there is only one 100% conclusion - someone is ready to pay for it...). So taking into account that this is a part of your network, it should live on a separate VLAN without internet and main VLAN connection as a minimum, or as my preferred choice - ZigBee, protocol which doesn't connect to the internet at all (as long as it's controller doesn't). Quite hard to put a paywall or brick a device which doesn't know about the internet and manufacturer cloud 😉
3
38
u/derBackfisch-_- 7d ago
nice, I just bought chinese smoke detectors because it was the only MoT option with adressable sirens.
I thought it would be fine because MoT is separate to my network.
44
u/amd2800barton 7d ago
Are they UL listed? If not, you should probably throw them out. Your insurance company will absolutely fuck you if you ever have a fire and it turns out your smoke detectors were an AliExpress special.
Really, don’t go smart for smoke detectors. Go for mains voltage hardwired interconnected. Get a reputable brand. If you want to get smart notifications if they alarm, get a relay module. The SM120X runs less than $30, and can trigger your alarm panel, a raspberry pi, or any contact sensor when a detector goes off.
11
u/MrSnowflake 7d ago edited 7d ago
Hardwired smoke detectors are nigh unexistent in
(western) EuropeBelgium. Probably because we use way less wood and everything is bricks and concrete, which makes adding powerlines quite the job. So battery detectors is the way to go.This mainly is true for aftermarket smoke detectors, new buildings have different requirements.
9
u/sceptic-al 7d ago edited 7d ago
Bullshit. In the UK, hardwired and interlinked smoke detectors are mandatory in new domestic properties.
When an extension was added to my house, hardwired smoke alarms were mandated across the house.
So hardwired alarms are stocked by electrical wholesalers and DIY shops.
I can’t imagine it’s much different in the rest of Europe. The fact that we build in brick and concrete doesn’t make the risk of fire any less.
Edit: Ireland, Netherlands and most of the Nordics all require hardwired smoke alarms, at least on new builds.
4
u/derBackfisch-_- 7d ago
Never heard of UL. They do conform to the norm necessary for smoke detectors in my country.
My home is already built, I will not run power cables to every sensor. This would be the best option of course, but its not realistic
3
u/MrSnowflake 7d ago edited 6d ago
UL is something from north america.
I might be wrong, but I think it's similar to the CE mark.I was wrong, it is more similar to getting TüV certified, which requires labo tests.0
2
u/cr0ft 7d ago
Must be hundreds of millions of homes out there that have dumb single fire alarms dotted out in the rooms that only do anything for you if you're at home that still get insurance covered. So just put up a token one of those...
I'm not opposed to adding hardwired stuff as you specify (that has a backup battery in case of power failure) but anything is better than nothing.
And on that note I just installed three Heiman Zigbee smoke detectors through the house with Zigbee. At least now there's a solid chance I'll get phone alerts if the house starts burning when I'm not in it... and those, as well as the water leak detectors cause every color capable light bulb in the house to start flashing red in case I've gone deaf.
2
u/sgtm7 7d ago
Hardwired power for a piece of safety equipment? Only if it has a battery backup. Otherwise, what do you do if there is a power outage?
7
u/amd2800barton 7d ago
Hardwired smoke detectors have an onboard battery. Typically this was a 9V, or a few AA / AAA cells, but nowadays you can also get them with internal lithium cells good for 10 years. In the event of a power outage, they continue on battery backup. Assuming they are interconnected they will still all alarm together even in a power outage, as the interconnection wire trips them all.
So when talking about smoke alarms, hardwired power just means for primary power. They do still have a battery.
0
7d ago
4
u/amd2800barton 7d ago
Underwriters labs are a thing in many countries, including Germany (where their username suggests they’re from). UL is not a US exclusive thing.
2
u/CptCheesus 7d ago
I can highly recommend x sense if you can get them. Rf makes its range great, enough for four story house with the thing in the basement and they will tell you where you need to look. Some models come with a carbon monoxide detector wich is another plus. And i think you could abuse the siren for other things if you'd want to trough homeassistant. I run this since 2 years and never had a single problem tough they are on the higher price end regarding smoke detectors but thats pretty worth it
1
u/derBackfisch-_- 7d ago
well thanks, but I already got my detectors. And they do work fine. I think ill read more into isolating MoT as a whole from my Network
36
u/CallTheKhlul-hloo 7d ago edited 7d ago
The amount i got downvoted by dumb dumbs for mentioning that matter was a privacy nightmare. Zigbee is the way.
1
u/Consistent-Hat-8008 6d ago
By bots. At one point corpobros thought smart home was the new big thing and they pushed Matter like crazy. That is, until they realized they can just play circular accounting in a now unregulated country, and pivoted to pushing LLM slop on everyone.
40
u/KD2ITW 7d ago
Given that you have UniFi network infrastructure, you can monitor the flows for each device and check the destinations.
10
u/SunshineNoClouds 7d ago
How can I learn more about this as a complete beginner who just got Unifi gear? That’s interesting I didn’t think it was possible - neat.
4
u/rockhunther 7d ago
Ditto. Just got a UDR 7and would LOVE to put these things in firewall hell, but they don't show up in devices.
2
7d ago
2
u/rockhunther 7d ago
I got some semblance of an answer.
Technically you can block IPv6 on the TBR and that would block MoT traffic as long as the TBR does not simply redirect them via NAT.
Not a great solution, but it's a start I guess.
2
u/TorenRenne 7d ago
So being a UDR7 amateur, here's what I've learnt/done... Under Insights > Flows is where you can view your traffic, however this only appears to show things being blocked, not accepted. So the only way to utilise this is to block everything then monitor the insights.
In addition, if a device already has a session, it may not immediately appear, you either need to wait for it to reconnect at some point (could be days/weeks), or you reboot the devices in question (I suspect rebooting the UDR7 would achieve the same result).
This then allows you to identify the traffic. The UDR7 has limited logging though, so I've had to setup a rsyslog server to store all the logs for better analysis in case I miss something. Also when setting up a firewall rule, you'll need to enable logging via the tickbox in the firewall rule.
Hope that helps!
2
u/MrSnowflake 6d ago
But it can't distinguish between genuine traffic of say an Apple TV vs Thread originating internet traffic from that Apple TV. Unless you buy that tbr from Unifi.
3
u/g0ndsman 5d ago
You don't have to buy it from unifi, you just have to use a TBR that lets you disable NAT64. This way every thread device can only use their own address and everything is traceable (and not connected to the internet by default).
1
u/MrSnowflake 5d ago
You are correct, but I thought we were talking about Unifi configuration. But you are right. And if you have a lan zigbee router that too can easily be blocked.
61
u/Cheetawolf 7d ago edited 6d ago
This is why I will never trust MoT.
It's just one "Required Security Update" away from "Oops, sorry, now you need a subscription to control all your 'Locally Controlled' devices~!"
Zigbee/Z-Wave or Bust. If it uses the Internet or touches the Cloud in ANY WAY WHATSOEVER, it WILL be enshittified.
42
u/gergles 7d ago
The "commissioning" process for MoT devices that requires Internet access and manufacturer approval ("distributed compliance ledger") makes it dead in the water to me.
20
u/cr0ft 7d ago
Yeah I was legit confused when I read about how you'd get Thread devices to talk to Home Assistant... "run an app and get Google to approve it for you"? What?
It's unfortunate for the non-Thread fans, since everybody and their grandmother is shouting that Thread is the future, and the manufacturers are beginning to move to it in droves.
Zigbee door locks are growing thin on the ground already, it seems. IKEA bailed on Zigbee, and some failures aside their smart bulbs were a great option with 90 CRI.
I'm really concerned about the Zigbee 4.0 standard basically going nowhere, if all the manufacturers go hurr durr thread and don't make devices we're all screwed sooner or later anyway.
4
u/DeutschePizza 7d ago
This is my issue, MoT has just to much more stuff than ZigBee and in general cheaper. Shelly is being sold to someone I don't trust and Sonoff has not a lot of variety.
2
u/Consistent-Hat-8008 6d ago
There must have been an orchestrated bot campaign because when I was telling this to people a year ago, I was getting dogpiled from all directions.
9
u/g0ndsman 7d ago
The commissioning part doesn't require internet access and it doesn't require the manufacturer approval in fact.
The onboarding is described in the spec to be entirely local, your matter server just needs access to the ledger, which you can download to a cache file if you want. But since the whole process doesn't involve any internet access, it would be pretty trivial to write a matter server that doesn't care about the validity of the certificates at all. Which is similar to what the server already does to commission "test" devices you can build yourself with esphome for example.
Also you're talking about a hypothetical situation that has never happened to anyone. And even in this hypothetical situation, it would be possible to make it work.
There are exactly zero chances that anyone can remotely stop you from commissioning a matter over thread lightbulb.
1
u/nathderbyshire 7d ago
There's an option to add manually now and it just asks for the written code, seems to skip going through the phone altogether because it can be done through the browser as well
1
u/spazturtle 6d ago
HA needs a reasonably up to date copy of the ledger and certificate revocation list to do that, so HA still needs at least periodic internet access for that to workm
1
4
u/JoshS1 6d ago
My tinfoil hat theory since Matter and Thread came out and all the larger companies jumped on it was because future ability or ease to push into either product/ecosystem lockdown, or just the general possibility of outside control (loss of sovereignty) like if legislation was passed allowing the local power company to adjust your thermostat as an example the companies could push an update directly to devices, or to thread border routers to make this possible.
0
u/Consistent-Hat-8008 6d ago edited 6d ago
That's the end goal. Social media was also supposed to be "a place to talk to people online" and now it's a dystopian hellscape where you must upload a face scan so everything you do can be datamined, profiled, monetized, and fed to a machine by trillionaire gigacorps chasing yet another investor scam.
There's a reason why the list of names behind Matter is composed of all the usual suspects.
34
u/EffectiveClient5080 7d ago
Yep, this is the dirty secret of border routers. The traffic egresses from the HomePod/ATV itself, so your firewall never sees per-device rules. If you want real isolation, run your own OTBR on a Pi or HA Yellow.
14
u/Top-Flounder-7561 7d ago
What no they don’t? Every thread device has an IPv6 address, I was literally writing firewall rules this morning for my thread network
32
u/marmarama 7d ago
Your firewall rules only work if your TBR assigns Globally Unique Addresses (I.e. routable addresses) to Thread devices.
Most TBRs don't, they assign "private" Unique Local Addresses and then use NAT64 to give the Thread devices access. So the traffic from inside the Thread network appears as IPv4 traffic coming direct from the TBR.
4
u/Top-Flounder-7561 7d ago
My thread border router is a HomePod mini and my matter server runs on a raspberry pi, its firewall definitely sees the unique IPv6 addresses for each device
3
u/marmarama 7d ago
Interesting. I guess there must be some circumstances where Apple TBRs just use plain IPv6 routing mode. Maybe if you have a routable IPv6 prefix and it otherwise likes the look of your IPv6 connectivity.
6
u/EscapeOption 7d ago
In the sense that the dirty secret of any switch or router is that traffic egresses from the switch or router itself. TBRs don’t do NAT, and apple TBRs (and almost all others right now) don’t provision GUAs for thread devices, so all traffic has to be local.
9
u/marmarama 7d ago
TBRs don’t do NAT
Is there some documentation on that? My understanding was, and all the documentation I can find says that Apple TBRs do in fact do NAT64.
2
u/g0ndsman 6d ago
The thread specs actually mandate that the routers support NAT64 as far as I understand.
The difference is that other devices (at least SMLIGHT because I personally have one, but I assume also OTBR on a rpi for example) also allow you to disable it entirely, so the problem described by OP goes away completely. Apple doesn't let you, so this PSA is more of a "don't use apple devices as border routers" than anything else.
6
u/Yangman3x 6d ago
Wait... are you saying that If I use a matter compatible light, or something thar works with apple homekit, but i control it through an home assistant satellite, it can still phone home???
7
u/spazturtle 6d ago
Yes, if even one of your Thread Border Routers have internet access then all Thread devices can access the internet.
5
u/privatetudor 6d ago
Zigbee is still the better option to me, largely because of this.
It’s a clean separation.
And it just works.
20
u/OfficialBadger 7d ago
IPv6 != NAT
17
u/dakiller 7d ago
NAT has never stopped devices from connecting out to the internet.
Firewall rules are the only fix for this, whether you are IPv4 or IPv6
13
u/iReallyDontLikeSpez 7d ago
What u/OfficialBadger means is that unless the TBR is NATing the traffic you can see that it's the rogue light bulb not the Apple TV and thus all your normal rules at the firewall apply
8
u/marmarama 7d ago
Unfortunately the reality is that the majority of TBRs do NAT by default.
2
u/JHerbY2K 7d ago
They will do NAT64 yes because not everyone has ipv6, and these devices should behave the same way regardless. It’s in the spec
28
u/Shadowbajfeelsbadman 7d ago
Fairly sure the tbr only accesses internet and ships approved updates to the devices.
Device itself does not have any access, rather it can request updates from the TBR.
44
u/marmarama 7d ago
NAT64 is mandatory for Thread Border Routers from Thread 1.4, and it was commonplace on TBRs following previous versions of the standard.
OP is correct, Matter over Thread gives direct access from Thread devices to the internet unless you take steps to avoid it, which is difficult with mass market TBRs.
14
u/Any-Efficiency5308 7d ago
OP is correct, the devices can access the internet on their own.
Case in point: nuki run their entire remote app experience through the thread connection.
11
u/nicely_sour_gale 7d ago
guess that's one way to make sure your lightbulb can phone home about your bedtime
3
u/LightBroom 7d ago
Probably more than this.
These devices can track.everything, when you sleep, when you eat, how mucb timr you spend in the bathroom, etc.
I'm sure they'renever going to be misused /s
1
u/g0ndsman 6d ago
This is where the matter/thread distinction is confusing.
Matter states that everything should be local. Thread is just a way to form an IP network, so indeed a thread device could be routed to the internet and phone home outside of the matter protocol, unless the route is blocked somehow (usually a firewall).
71
u/Low_Volume_Noise 7d ago edited 7d ago
Matter over Thread is an IP based protocol, meaning devices everywhere (not just Apple) can technically reach the internet; for 100% airtight local isolation, use Zigbee, BLE, or Z-Wave instead, as they don't use IP addresses at all.
145
u/Ok_Explanation7491 7d ago
IP based doesn't mean automatically that it can access the internet. And your Zigbee and Z-Wave Bridges could also just NAT the Zigbee ID (small number) into an IP address (big number). So it depends very much on the Bridge or Border Router.
28
u/iReallyDontLikeSpez 7d ago
IDK why you're getting downvoted - this is correct lol
0
7d ago
2
u/taylortbb 7d ago edited 7d ago
NAT works that way. But it would theoretically be possible to create a NAT-like translating proxy between Zigbee IDs and IP addresses.
AFAIK no such standard exists. But u/Ok_Explanation7491 is right that it's ultimately up to the bridge or border router to ensure security, rather than an inherent feature of the protocol.
The existence of CVE-2020-6007 does prove that it's possible to make the jump from Zigbee to IP under the right circumstances (the right vulnerabilities in the Zigbee stack). So Zigbee shouldn't be said to provide "100% airtight" isolation.
Edit: clarified
2
u/alex2003super 7d ago
I mean, Hue Bridges are Internet controllable devices which speak to the Hue devices and allow control over the Internet. I don't think they do any real encapsulation of one protocol over the other, but it doesn't really matter. The only way for two things to be "air gapped" from each other is for there to be no physical link between them. A ZigBee router/bridge by definition all but guarantees there will be no air-gap between the 802.15.4 network and the IP one.
1
u/Consistent-Hat-8008 6d ago edited 6d ago
I don't know what poeple expected. Matter is just another case of techbro dystopian corporate trying to hijack yet another space.
1
u/nodeas 7d ago
Create a vlan e.g. lan100 then ceate a negation rule on that interface for ipv4 and ipv6: direction: in, block any to !vlan100 Now you've isolated the whole vlan100.
3
u/IsThereAnythingLeft- 7d ago
You can’t do that if it goes through the border router which you do want to reach the internet
-2
u/nodeas 7d ago
which you do want to reach the internet
Why?
5
u/RunningAfterRabbits 7d ago
If you use an apple TV as border router, you're probably using it for other things as well, like watching netflix. Which requires internet
-7
u/calinet6 7d ago
Yet another win for Zigbee, and majorly complex architectural flaw for Matter/Thread.
I’m starting to wonder why Matter/Thread even exist. They seem to have a purpose wholly departed from what users actually want and need.
5
u/JHerbY2K 7d ago
I agree to an extent. I understand the use case but haven’t needed or wanted a single thread device so far. Zigbee and zwave work great and my curtains have no business on the web.
1
u/calinet6 6d ago
I gladly sacrifice my karma for my hot take, but yeah I agree. Zigbee works great. I’m simply not sure why Thread has to exist, it’s a very complex solution looking for a problem.
5
u/sgtm7 7d ago
I don't use Apple products, so I am not familiar. You are saying, that the issue is the Apple devices, and if not for them, you could block internet access? If so, the solution seems obvious to me.
2
u/eeqqcc 6d ago
No it is not limited to Apple products. Thread border routers translate the IPv6 addresses to v4 (NAT64). If you’re able to switch off NAT64, you can block access for those Thread-devices. I’m not sure if you can turn off NAT64 on Apple TBRs such as AppleTV and HomePod.
You can block access for the TBR as a whole, but that may limit its functionality.1
u/spazturtle 6d ago
NAT64 is required as part of the Thread 1.4 spec, so you are no longer allowed to turn it off.
2
u/g0ndsman 6d ago
You are definitely allowed to turn it off, it just has to provide support for it. I know because I just did after reading this thread.
1
u/RydderRichards 6d ago
So what can we do if we're running our own border routers like openthread border router?
1
u/ManufacturerOk8154 6d ago
Are you sure about that? As my HA and DIRIGERA hub are both on Thread 1.4 and I can still turn it off. Also the Thread 1.4 whitepaper doesn’t mention it being mandatory.
1
u/ManufacturerOk8154 6d ago
Are you sure about that? As my HA and DIRIGERA hub are both on Thread 1.4 and I can still turn it off. Also the Thread 1.4 whitepaper doesn’t mention it being mandatory.
14
u/Ok_Explanation7491 7d ago
And how did you came to this conclusion? What devices have you tested? Or what is your source?
12
u/portalqubes 7d ago
It’s how this technology works. Your Wi-Fi router doesn't see a rogue smart bulb trying to reach the internet; it only sees your trusted Apple TV or smart speaker handling network traffic. Because your router trusts the Apple TV, it lets the traffic through.
→ More replies (4)
2
u/aei__ou___ 1d ago
This turned out to be quite an interesting experiment. I first set up my OTBR to be the highest preference nat64 translator and also monitored all outbound ipv6 traffic. As I sort of expected there was no traffic other than my test traffic. I then discovered that there is a way to do this totally from the infrastructure side without even having to touch the configuration of any TBR on the network. In my case with a mikrotik it was:
/ipv6/nd/set [find interface=tbrif] pref64=whatever::/96
That will route to whatever device/vm you want to do nat64 translation (or not). In my case I used a tayga container on my router.
tldr; you can block access via nat64 if your router is capable of advertising pref64 RAs.
5
u/SlipperyNoodle6 7d ago
i still cant get a straight answer form anyone about why you would choose to connect iot devices to any form of lan instead of just using a completely separated protocol like zigbee or zwave, like wtf is the advantage? why even bother?
→ More replies (4)5
u/arienh4 7d ago
The main advantage is existing infrastructure. I have a Zigbee network, but it takes a lot of repeaters to get full coverage due to the building's construction. As such, I also have wired Wi-Fi APs on every floor.
With Thread being IPv6, I can use the same wiring I already have in place to put TBRs on every floor, and most of the traffic can go through the wires rather than using airtime. It also means that the network will keep working even if a TBR fails.
If Zigbee had some way to have multiple receivers work together like that I'd be all for it. But while there are certainly downsides to MoT, it makes sense they designed it this way.
→ More replies (5)
4
1
u/scytob 7d ago
It’s up to your router to do this. Not Apple.
6
u/cr0ft 7d ago
Yes, but the problem is that if all the Matter stuff talks to the Apple device, and then relay off that Apple device to go to the Internet, it becomes basically impossible to firewall that separately. If it were unencrypted traffic you could do advanced packet inspection stuff and block it but that would be way beyond a home user's expected capabilities, and the traffic is encrypted anyway since this is 2026.
In fact, since my few Wifi IoT devices are on a separate VLAN from my main network, it becomes trivial for me to prevent them from talking to either my home network or the Internet, or any combination of permissions of those two; I do keep my HA on the main network so they can only talk to that. Leading to an absurd situation where I can secure Wifi devices but not MoT.
→ More replies (2)
29
u/StainedMemories 7d ago
Are there any official or authoritative sources for this? Specifically what Apple TBRs do? It’s nice and all that you’re sharing this PSA, but there are many experts here and only trust-me-bro statements with no way to confirm.