Tenant encryption certs/keys in host memory
by Justin Clift
Hi guys,
With the way HekaFS is encrypting data (tenant specific certs), it's pretty clear the data will be safe "at rest".
How do we protect against the hosting provider from reading certs/keys out of tenant memory while it's running, and keeping them for later?
Asking because apparently it isn't hard to extract encryption passwords from traditional encrypted file systems if they're running in a VM (and you're superuser on the host). So, same thought, but with the certs.
?
CC'd Richard Jones, as he pointed out the password extraction thought to me ages ago, and is more across this kind of thing.
Regards and best wishes,
Justin Clift
--
Aeolus Community Manager
http://www.aeolusproject.org
12 years, 6 months
CloudFS: Why - one line doesn't make sense to me...
by Justin Clift
Hi guys,
On the CloudFS Blog, in the initial "Why?" reading material, it says this one of the things people look for is this:
* Performance and consistency for small writes in large files are not reduced to near zero by doing read/modify/write on whole files.
That's not making sense to me. Specifically the "not" bit in it.
Why wouldn't people be wanting small write in large files to be fast?
This is the URL btw:
http://cloudfs.org/?p=7
Regards and best wishes,
Justin Clift
--
Aeolus Community Manager
http://www.aeolusproject.org
12 years, 6 months
HekaFS with Infiniband?
by Justin Clift
Hi guys,
Can HekaFS be configured for Infiniband use, without the need to use IP (ie IP-over-Infiniband) which has less performance?
Just asking because Gluster can use Infiniband natively (last I checked anyway), and we have Infiniband test gear in the lab that can be used. :)
Regards and best wishes,
Justin Clift
--
Aeolus Community Manager
http://www.aeolusproject.org
12 years, 6 months
