4 ms·

> TrueOS® soars above the competition with advanced security features, such as PersonaCrypt and GELI disk level encryption, to keep your important data safe and

by eeZi 10y ago

> TrueOS® soars above the competition with advanced security features, such as PersonaCrypt and GELI disk level encryption, to keep your important data safe and secure. Has it got kernel/userland ASLR yet?

urza 10y ago
Does their ZFS implementation supports dataset level encryption?
- AndyMcConachie 10y ago
  Both ZFS and ASLR are more interesting for servers than for desktops. I would like ASLR on my desktop OS, but it's a rather high hanging mediocre fruit. WRT to ZFS, I couldn't care less if it existed on my desktop OS.
  - binarycrusader 10y ago
    > Both ZFS and ASLR are more interesting for servers than for desktops. On what basis are these claims made? I'm tired of hearing this excuse trotted out every time someone posts about ZFS or ASLR. ZFS (or a filesystem possessing many of the same characteristics) is absolutely still valuable even on desktops. With consumer storage devices reaching ever loftier maximum capacities, data integrity becomes even more important as the loss of that data can have a profound impact on a person's life. Given the questionable quality of hardware in many consumer devices, having a filesystem that detects corruption as it is happening, and works to ensure that it is corrected automatically when possible, seems like an obvious win. While a typical consumer is unlikely to have a ZFS raid device even if they had ZFS, they would still benefit from all of the other protections it offers. It should be fairly telling that Apple is adopting many of the same technologies ZFS offers in their own consumer filesystem (except, regrettably, checksumming) because they too understand that it does matter. As for ASLR, that's important too because it's yet another mitigation tool to make it less likely that an individual system is compromised. Haven't the past few years of various malware/ransomware announcements been enough? We should consider every practical tool available at our disposal to mitigate such attacks as valuable.
  - woodman 10y ago
    > ... I couldn't care less if it existed on my desktop OS. Then you either don't know about snapshots, don't care about data integrity, or have a backup system in place and don't want to replace it with: zfs send zroot@snap63 | gzip > /mnt/remotebackup/snap63.gz
    - joseph 10y ago
      I remember just before Oracle took over Sun, OpenSolaris was a pretty viable desktop machine. They had a feature called "Time Slider" that was built into Nautilus. It was like Apple's Time Machine, only based on ZFS snapshots instead of backups to a separate disk. You could slide a widget back to get to a previous snapshot of the disk. OS upgrades also worked together with ZFS snapshots so that you could atomically roll back to a previous version just before the upgrade took place. It was all really awesome.
      - woodman 10y ago
        Yeah, out of the box FreeBSD just barely scratches the surface when it comes to ZFS - there is a lot of untapped potential. Same story with jails and vnet.
      - JdeBP 10y ago
        PC-BSD ... sorry ... TrueOS Desktop (and Server) has had that idea of ZFS snapshots for "boot environments" for some time. * https://blog.pcbsd.org/2012/07/9-1-feature-multiple-boot-environments/ https://blog.pcbsd.org/2012/07/9-1-feature-multiple-boot-env... * https://blog.pcbsd.org/2013/06/pc-bsd-status-update/ https://blog.pcbsd.org/2013/06/pc-bsd-status-update/ * https://www.ixsystems.com/blog/a-closer-look-at-the-changes-in-pc-bsd-trueos-9-2-part-1/ https://www.ixsystems.com/blog/a-closer-look-at-the-changes-... * https://www.ixsystems.com/blog/the-revamped-life-preserver/ https://www.ixsystems.com/blog/the-revamped-life-preserver/
        woodman 10y ago
        Beadm first appeared in Solaris, long before it hit FreeBSD (and then PC-BSD) - so the idea had been around for a while. The issue is fit and finish. Solaris had it tightly integrated and made full use of it. I haven't used PC-BSD for a very long time, but I don't remember it coming anywhere close to Solaris in that regard.

by eeZi 10y ago

urza 10y ago

Does their ZFS implementation supports dataset level encryption?

AndyMcConachie 10y ago
Both ZFS and ASLR are more interesting for servers than for desktops. I would like ASLR on my desktop OS, but it's a rather high hanging mediocre fruit. WRT to ZFS, I couldn't care less if it existed on my desktop OS.
- binarycrusader 10y ago
  > Both ZFS and ASLR are more interesting for servers than for desktops. On what basis are these claims made? I'm tired of hearing this excuse trotted out every time someone posts about ZFS or ASLR. ZFS (or a filesystem possessing many of the same characteristics) is absolutely still valuable even on desktops. With consumer storage devices reaching ever loftier maximum capacities, data integrity becomes even more important as the loss of that data can have a profound impact on a person's life. Given the questionable quality of hardware in many consumer devices, having a filesystem that detects corruption as it is happening, and works to ensure that it is corrected automatically when possible, seems like an obvious win. While a typical consumer is unlikely to have a ZFS raid device even if they had ZFS, they would still benefit from all of the other protections it offers. It should be fairly telling that Apple is adopting many of the same technologies ZFS offers in their own consumer filesystem (except, regrettably, checksumming) because they too understand that it does matter. As for ASLR, that's important too because it's yet another mitigation tool to make it less likely that an individual system is compromised. Haven't the past few years of various malware/ransomware announcements been enough? We should consider every practical tool available at our disposal to mitigate such attacks as valuable.
- woodman 10y ago
  > ... I couldn't care less if it existed on my desktop OS. Then you either don't know about snapshots, don't care about data integrity, or have a backup system in place and don't want to replace it with: zfs send zroot@snap63 | gzip > /mnt/remotebackup/snap63.gz
  - joseph 10y ago
    I remember just before Oracle took over Sun, OpenSolaris was a pretty viable desktop machine. They had a feature called "Time Slider" that was built into Nautilus. It was like Apple's Time Machine, only based on ZFS snapshots instead of backups to a separate disk. You could slide a widget back to get to a previous snapshot of the disk. OS upgrades also worked together with ZFS snapshots so that you could atomically roll back to a previous version just before the upgrade took place. It was all really awesome.
    - woodman 10y ago
      Yeah, out of the box FreeBSD just barely scratches the surface when it comes to ZFS - there is a lot of untapped potential. Same story with jails and vnet.
    - JdeBP 10y ago
      PC-BSD ... sorry ... TrueOS Desktop (and Server) has had that idea of ZFS snapshots for "boot environments" for some time. * https://blog.pcbsd.org/2012/07/9-1-feature-multiple-boot-environments/ https://blog.pcbsd.org/2012/07/9-1-feature-multiple-boot-env... * https://blog.pcbsd.org/2013/06/pc-bsd-status-update/ https://blog.pcbsd.org/2013/06/pc-bsd-status-update/ * https://www.ixsystems.com/blog/a-closer-look-at-the-changes-in-pc-bsd-trueos-9-2-part-1/ https://www.ixsystems.com/blog/a-closer-look-at-the-changes-... * https://www.ixsystems.com/blog/the-revamped-life-preserver/ https://www.ixsystems.com/blog/the-revamped-life-preserver/
      - woodman 10y ago
        Beadm first appeared in Solaris, long before it hit FreeBSD (and then PC-BSD) - so the idea had been around for a while. The issue is fit and finish. Solaris had it tightly integrated and made full use of it. I haven't used PC-BSD for a very long time, but I don't remember it coming anywhere close to Solaris in that regard.