6 ms·

I've always wondered why Windows and other OSes don't offer a 'cold storage' area where you need thaw out files before editing. Files not modified within a sele

by cube00 9y ago

I've always wondered why Windows and other OSes don't offer a 'cold storage' area where you need thaw out files before editing. Files not modified within a selected time freeze from further modification. I've got plenty of files that are archived that I'd never want to change, but it's a hassle to unmount/remount just to add a new file to an existing directory.

VectorLock 9y ago
How is 'thawing' your files more/less of a hassle than mounting a drive?
- masklinn 9y ago
  The file would still be there and available, even more so as it would be "frozen readonly", you just get a request on write access. Whereas with drives you don't have access to the file if it's not mounted, you have to know on which drive the file you're looking for is, go through the mounting process, then actually find the file. And if you want to alter the file you have to remount the entire thing, and possibly need to track down that one daemon which still has a handle open and prevents you from unmounting it.
  - KekDemaga 9y ago
    An idea I have is implement simple versioning on the thaw folder. If edited the changes can then be reverted.
    - elmigranto 9y ago
      And I have counter idea — encrypt N times, so every shadow copy is borked; certainly you are not storing "infinite" history?
      - KekDemaga 9y ago
        I presume the thaw folder would have an upper limit on storage, once hit you forbid writes entirely.
    - masklinn 9y ago
      Isn't that just a CoW filesystem? Just use e.g. ZFS and configure it to take regular snapshots (though you may want to be careful, a few years back if a zpool got completely full things got wonky, dunno if they've fixed it, so you may want to keep some disk space outside the zpool just in case, so you can expand the zpool enough to work if it gets completely full)
      - rainbowzootsuit 9y ago
        OpenSolaris derivatives (eg OmniOS, SmartOS) are able to present the snapshots over SMB as windows previous versions. I have the server at work, which only has windows desktop clients, making 1-minute snapshots with a one-day lifetime in addition to daily, weekly, monthly etc. It's very handy for the occasions where you accidentally save over a document and slap yourself in the head immediately afterwards.
balls187 9y ago
Interesting idea. Can you explain the thawing procedure, and how a normal everday user would experience it?
- cube00 9y ago
  For Windows it could just prompt the user when an application attempts a write operation; just like UAC, if permission is granted the calling application wouldn't even notice the difference except for the pause while the open for write access call blocks pending user permission. Done at the same level as UAC in theory it should be impossible for malware to bypass approval, heck I'd even be happy typing my user account password to thaw it out.
  - balls187 9y ago
    Thats how I would envision working as well. Seems like the classic tradeoff between better security and better UX. Users would complain, and/or try to disable it.
megamindbrian 9y ago
How about just enabling Shadow copies by default! I don't understand why Windows has great "Time machine like features", but every fucking time I right click and go to Properties and look at the "Previous versions" tab and it is completely empty.
- gruez 9y ago
  ransomware typically delete shadow copies (and any other local backups they can get their hands on)
- sgift 9y ago
  Probably because the typical anti-MS comments would be worse for them than the risk of ransomware (from their perspective): "Windows eats all my hard disk!! I've updated to <windows xy>/Windows did an update and now all my disk space is gone!!! Don't update!!!!" "New MS update steals your disk space, here's how to stop it" And so on, and so on.
  - cm2187 9y ago
    No it wouldn't be turned on by default. If it was every software that you run occasionally would break. This would be opt-in for certain folders.
    - brainfire 9y ago
      No, this thread is about shadow copies being turned on by default.
  - drdaeman 9y ago
    Could be worse, like a circulating recipe how to completely remove VSS by removing system files related to shadow copy services, or something like that.
- mc32 9y ago
  My observation is that people who buy Macs also buy an external drive for Time Machine but Windows PC buyers don't usually buy an external drive and turn on File History. Slightly different culture, I guess.
mtgx 9y ago
I'd also really like Microsoft to develop the Application Guard (app in a VM) feature faster and make it widely available to almost any app, or at least any browser, and of course to everyone, not just enterprise users. Microsoft has some interesting new security features on its roadmap. Unfortunately, 90% of them are for enterprise users-only and some only for its own applications. It also wouldn't hurt to overhaul/replace UAC with something better, but I imagine that would require deeper architectural changes (which I think would be worth the pain). Microsoft should also push users towards creating a Standard account when installing Windows, and setting up an Admin password, too. It shouldn't be too difficult/disruptive. They just need to create an easy process for it at installation. The vast majority of Windows malware infections happen because users are also Admins. This alone would give Windows a huge security boost on average. https://www.avecto.com/news-and-events/news/94-of-critical-microsoft-vulnerabilities-mitigated-by-removing-admin-rights https://www.avecto.com/news-and-events/news/94-of-critical-m... Once they do this, they could also start encrypting Windows devices by default with the Admin key, similar to how Android does default encryption. Windows is pretty much the last major operating system not to encrypt by default. Hopefully, if they do this, they at least give users the option to keep the key locally, and not automatically upload it to Microsoft's servers, as they do now if you login to your Microsoft account.
- pjmlp 9y ago
  It still won't help against dumb users that think security is only about inconvenience. Go to macOS user forums and you will see lots of discussions about how to turn off Gatekeeper or be "always root" user.
rbanffy 9y ago
> don't offer a 'cold storage' If the malware gets privileged access, it's game over. If it can't, good file system permissioning fixes the problem.

by cube00 9y ago

VectorLock 9y ago

How is 'thawing' your files more/less of a hassle than mounting a drive?

masklinn 9y ago
The file would still be there and available, even more so as it would be "frozen readonly", you just get a request on write access. Whereas with drives you don't have access to the file if it's not mounted, you have to know on which drive the file you're looking for is, go through the mounting process, then actually find the file. And if you want to alter the file you have to remount the entire thing, and possibly need to track down that one daemon which still has a handle open and prevents you from unmounting it.
- KekDemaga 9y ago
  An idea I have is implement simple versioning on the thaw folder. If edited the changes can then be reverted.
  - elmigranto 9y ago
    And I have counter idea — encrypt N times, so every shadow copy is borked; certainly you are not storing "infinite" history?
    - KekDemaga 9y ago
      I presume the thaw folder would have an upper limit on storage, once hit you forbid writes entirely.
  - masklinn 9y ago
    Isn't that just a CoW filesystem? Just use e.g. ZFS and configure it to take regular snapshots (though you may want to be careful, a few years back if a zpool got completely full things got wonky, dunno if they've fixed it, so you may want to keep some disk space outside the zpool just in case, so you can expand the zpool enough to work if it gets completely full)
    - rainbowzootsuit 9y ago
      OpenSolaris derivatives (eg OmniOS, SmartOS) are able to present the snapshots over SMB as windows previous versions. I have the server at work, which only has windows desktop clients, making 1-minute snapshots with a one-day lifetime in addition to daily, weekly, monthly etc. It's very handy for the occasions where you accidentally save over a document and slap yourself in the head immediately afterwards.

balls187 9y ago

Interesting idea. Can you explain the thawing procedure, and how a normal everday user would experience it?

cube00 9y ago
For Windows it could just prompt the user when an application attempts a write operation; just like UAC, if permission is granted the calling application wouldn't even notice the difference except for the pause while the open for write access call blocks pending user permission. Done at the same level as UAC in theory it should be impossible for malware to bypass approval, heck I'd even be happy typing my user account password to thaw it out.
- balls187 9y ago
  Thats how I would envision working as well. Seems like the classic tradeoff between better security and better UX. Users would complain, and/or try to disable it.

megamindbrian 9y ago

How about just enabling Shadow copies by default! I don't understand why Windows has great "Time machine like features", but every fucking time I right click and go to Properties and look at the "Previous versions" tab and it is completely empty.

gruez 9y ago
ransomware typically delete shadow copies (and any other local backups they can get their hands on)
sgift 9y ago
Probably because the typical anti-MS comments would be worse for them than the risk of ransomware (from their perspective): "Windows eats all my hard disk!! I've updated to <windows xy>/Windows did an update and now all my disk space is gone!!! Don't update!!!!" "New MS update steals your disk space, here's how to stop it" And so on, and so on.
- cm2187 9y ago
  No it wouldn't be turned on by default. If it was every software that you run occasionally would break. This would be opt-in for certain folders.
  - brainfire 9y ago
    No, this thread is about shadow copies being turned on by default.
- drdaeman 9y ago
  Could be worse, like a circulating recipe how to completely remove VSS by removing system files related to shadow copy services, or something like that.
mc32 9y ago
My observation is that people who buy Macs also buy an external drive for Time Machine but Windows PC buyers don't usually buy an external drive and turn on File History. Slightly different culture, I guess.

mtgx 9y ago

I'd also really like Microsoft to develop the Application Guard (app in a VM) feature faster and make it widely available to almost any app, or at least any browser, and of course to everyone, not just enterprise users. Microsoft has some interesting new security features on its roadmap. Unfortunately, 90% of them are for enterprise users-only and some only for its own applications. It also wouldn't hurt to overhaul/replace UAC with something better, but I imagine that would require deeper architectural changes (which I think would be worth the pain). Microsoft should also push users towards creating a Standard account when installing Windows, and setting up an Admin password, too. It shouldn't be too difficult/disruptive. They just need to create an easy process for it at installation. The vast majority of Windows malware infections happen because users are also Admins. This alone would give Windows a huge security boost on average. https://www.avecto.com/news-and-events/news/94-of-critical-microsoft-vulnerabilities-mitigated-by-removing-admin-rights https://www.avecto.com/news-and-events/news/94-of-critical-m... Once they do this, they could also start encrypting Windows devices by default with the Admin key, similar to how Android does default encryption. Windows is pretty much the last major operating system not to encrypt by default. Hopefully, if they do this, they at least give users the option to keep the key locally, and not automatically upload it to Microsoft's servers, as they do now if you login to your Microsoft account.

pjmlp 9y ago
It still won't help against dumb users that think security is only about inconvenience. Go to macOS user forums and you will see lots of discussions about how to turn off Gatekeeper or be "always root" user.

rbanffy 9y ago

> don't offer a 'cold storage' If the malware gets privileged access, it's game over. If it can't, good file system permissioning fixes the problem.