Well, if you take snapshots every hour then you can always roll back to the latest snapshot if you need to. It would be a nice defence against the traditional "

Well, if you take snapshots every hour then you can always roll back to the latest snapshot if you need to. It would be a nice defence against the traditional "encrypt all writable files" attacks. As long as the root user isn't compromised, using ZFS (or other filesystems with snapshots) should prevent a lot of problems, and not just ones related to ransom-ware attacks.