4 ms·

The part about GlusterFS storing files unencrypted is untrue, BTW. We've had full at-rest encryption using client-only keys for years before they came along.

The part about GlusterFS storing files unencrypted is untrue, BTW. We've had full at-rest encryption using client-only keys for years before they came along. Makes me wonder how many of their other "original ideas" are just failure to do basic research before jumping in to make a buck.

nickpsecurity 11y ago
I was going to agree but decided to load up web site to be sure: https://www.gluster.org/ https://www.gluster.org/ I don't see a list of features at all here or an obvious link to them. Most sites have something like this (see "Why Sector/Sphere?"): http://sector.sourceforge.net/ http://sector.sourceforge.net/ Or this: http://lustre.org/about/ http://lustre.org/about/ Wait, that one almost sucks as much as GlusterFS site. It could also use a page detailing exactly what it can and can't do with obvious link on front-page. At least it had obvious link and basic description, though. So, hard to judge writer of recent post on what features were in GlusterFS, etc if their page doesn't go through the trouble to list them without us having to dig. I'd have to point two fingers. Fortunately, Wikipedia to rescue doing what site didn't do: https://en.wikipedia.org/wiki/GlusterFS https://en.wikipedia.org/wiki/GlusterFS Note: Oh shit, it still doesn't mention encryption. Not in the comparison or list of distributed filesystems either. Still undocumented for casual researcher.
- notacoward 11y ago
  Let me Google "GlusterFS encryption" for you. http://www.gluster.org/community/documentation/index.php/Features/disk-encryption http://www.gluster.org/community/documentation/index.php/Fea... https://www.gluster.org/community/documentation/images/e/e2/GlusterFS_transparent_encryption.pdf https://www.gluster.org/community/documentation/images/e/e2/... ...and more. I think that still falls under "casual research" ... besides which, implementers and promoters should be doing more than casual research anyway. The fact that the Gluster documentation sucks doesn't change that. Plenty of others have implemented such end-to-end encryption as well, and the trend is already increasing. (I find that quite gratifying BTW since I felt like a lone voice in the wilderness when I was writing about the importance of keeping keys on the clients five-plus years ago.) What they present as a differentiator is very much a me-too nowadays so, again, it calls their other claims of originality or uniqueness into question.
  - nickpsecurity 11y ago
    Why would I Google GlusterFS encryption? You think a casual researcher should type every feature of importance into Google with an apps name to confirm if it has that feature? That's ridiculous. It's features or benefits should be easy to find on the homepage. Documentation, esp "What This Does," is critical to OSS success. Here's what Gluster doc menu said: one that goes to instsllation page; more detailed installation; admin guide; developer guide; upgrade guide. Geez, I don't need any of that. Just want to know what the hell it does with what features. They need to fix it.
    - notacoward 11y ago
      If somebody is going to make a specific claim, in a published document, about another project having or not having a feature, then damn right they should Google for the combination. A lot of OSS projects end up having pieces of information scattered all over presentations and blog posts and who the hell knows what else. All of your goalpost-moving about what should be on the Gluster website doesn't change the fact that Infinit's characterization was inaccurate and trivially revealed as such by a single obvious Google search.
      - nickpsecurity 11y ago
        You're semi-right here. People saying why their offering is better than competitors better know what the competition offers. Marketing 101 says dig deep to find that plus differentiators. That much I agree with. That said, your excuse for GlusterFS site being screwed up is that other projects are screwups, too. Makes no sense. Let's put it into perspective: Gluster people could spend under 5 minutes typing up and posting that page. Instead, they expect all potential users or contributors to spend 10m-1hr digginh through docs for same information. Meanwhile, many FOSS pages state clearly what their software does. So, no excuses. It's just laziness and foolish on top of that given they want more adoption of a tool they won't describe haha. The responsibility is on them to present their work in a clear way given that goal. They're failing on that right now.
        11y ago

nickpsecurity 11y ago

I was going to agree but decided to load up web site to be sure: https://www.gluster.org/ https://www.gluster.org/ I don't see a list of features at all here or an obvious link to them. Most sites have something like this (see "Why Sector/Sphere?"): http://sector.sourceforge.net/ http://sector.sourceforge.net/ Or this: http://lustre.org/about/ http://lustre.org/about/ Wait, that one almost sucks as much as GlusterFS site. It could also use a page detailing exactly what it can and can't do with obvious link on front-page. At least it had obvious link and basic description, though. So, hard to judge writer of recent post on what features were in GlusterFS, etc if their page doesn't go through the trouble to list them without us having to dig. I'd have to point two fingers. Fortunately, Wikipedia to rescue doing what site didn't do: https://en.wikipedia.org/wiki/GlusterFS https://en.wikipedia.org/wiki/GlusterFS Note: Oh shit, it still doesn't mention encryption. Not in the comparison or list of distributed filesystems either. Still undocumented for casual researcher.

notacoward 11y ago
Let me Google "GlusterFS encryption" for you. http://www.gluster.org/community/documentation/index.php/Features/disk-encryption http://www.gluster.org/community/documentation/index.php/Fea... https://www.gluster.org/community/documentation/images/e/e2/GlusterFS_transparent_encryption.pdf https://www.gluster.org/community/documentation/images/e/e2/... ...and more. I think that still falls under "casual research" ... besides which, implementers and promoters should be doing more than casual research anyway. The fact that the Gluster documentation sucks doesn't change that. Plenty of others have implemented such end-to-end encryption as well, and the trend is already increasing. (I find that quite gratifying BTW since I felt like a lone voice in the wilderness when I was writing about the importance of keeping keys on the clients five-plus years ago.) What they present as a differentiator is very much a me-too nowadays so, again, it calls their other claims of originality or uniqueness into question.
- nickpsecurity 11y ago
  Why would I Google GlusterFS encryption? You think a casual researcher should type every feature of importance into Google with an apps name to confirm if it has that feature? That's ridiculous. It's features or benefits should be easy to find on the homepage. Documentation, esp "What This Does," is critical to OSS success. Here's what Gluster doc menu said: one that goes to instsllation page; more detailed installation; admin guide; developer guide; upgrade guide. Geez, I don't need any of that. Just want to know what the hell it does with what features. They need to fix it.
  - notacoward 11y ago
    If somebody is going to make a specific claim, in a published document, about another project having or not having a feature, then damn right they should Google for the combination. A lot of OSS projects end up having pieces of information scattered all over presentations and blog posts and who the hell knows what else. All of your goalpost-moving about what should be on the Gluster website doesn't change the fact that Infinit's characterization was inaccurate and trivially revealed as such by a single obvious Google search.
    - nickpsecurity 11y ago
      You're semi-right here. People saying why their offering is better than competitors better know what the competition offers. Marketing 101 says dig deep to find that plus differentiators. That much I agree with. That said, your excuse for GlusterFS site being screwed up is that other projects are screwups, too. Makes no sense. Let's put it into perspective: Gluster people could spend under 5 minutes typing up and posting that page. Instead, they expect all potential users or contributors to spend 10m-1hr digginh through docs for same information. Meanwhile, many FOSS pages state clearly what their software does. So, no excuses. It's just laziness and foolish on top of that given they want more adoption of a tool they won't describe haha. The responsibility is on them to present their work in a clear way given that goal. They're failing on that right now.
      - 11y ago