Let me give you a set of basic, specific operational facts that I discerned a few years ago. NFS as a protocol engages in clear text transfers of filesystem da

Let me give you a set of basic, specific operational facts that I discerned a few years ago. NFS as a protocol engages in clear text transfers of filesystem data between the client and server. I had some experience with stunnel, and I found a way to push NFS traffic through it, forcing either aes-gcm or (with TLS 1.3), chacha20-poly1305. The method and complaint that I raised was heard by protocol maintainers, and resulted in a draft RFC to embed TLS at the RPC level, extending encryption to all RPC services beyond NFS. I also later found notes of the NFSv4.2 approval suggesting that TLS should be added, but it was not. That fell to me. I don't think that this was subjective. If I google "onc RPC encryption," I find: https://tools.ietf.org/id/draft-ietf-nfsv4-rpc-tls-01.html https://tools.ietf.org/id/draft-ietf-nfsv4-rpc-tls-01.html "Special mention goes to Charles Fisher, author of "Encrypting NFSv4 with Stunnel TLS" . His article inspired the mechanism described in this document." If I google "NFS encryption," I find me: https://www.linuxjournal.com/content/encrypting-nfsv4-stunnel-tls https://www.linuxjournal.com/content/encrypting-nfsv4-stunne... I think that it was worth the effort. It was in the back of my mind for some time, and I probably should have been more motivated to do it, for the impact it had.