
I have struggled with this issue for a while and ultimately the solution is so ridiculously simple, it’s almost comical. (Spoiler: Use a different USB port.)
After performing a macOS update with no errors shown on an Apple Silicon Mac running macOS from an external disk, the system would always boot up fine, but to the very same macOS version installed before the “update”. I could run this again and again – from the UI, from the command line with all sorts and parameter variations of sudo softwareupdate -irR --user <username>. The result was always the same: no error, but also no new macOS version.
Some people apparently have issues with missing “ownership” records on their external drive (Fix: Go to System settings, select your right boot drive and click restart there), but in my case this was not the issue.
Turns out, not all USB/Thunderbolt ports are created equal on Apple Silicon Macs: One of them is special in that it serves as a DFU (Device Firmware Update) port (which can help recover a Mac when it’s internal disk is kaput). Apple’s documentation tells you which port it is on your Mac.
You cannot install macOS to an external disk attached to the DFU port, but you can run it from there without problems. What Apple’s documentation does not tell: This also applies to system updates. Strangely, there is no warning or error anywhere in the update process.
Fix: Plug your external boot drive to another USB / Thunderbolt port and run software update again.
Hint for Mac Mini M4 users: The DFU port is the middle one on the backside. Don’t use that.

Pre-2011 Macs store the system password in a very insecure way which permits easy password recovery if the user can boot into the system and has root / Administrator priviledges. This post details how to simply erase or recover that system password. 


There are plenty of reasons to tunnel one network connection through another without encryption: You might, for instance, want to transparently connect two separate networks (e.g. data centers) through another, or want to use a publicly reachable IP address behind your providers 