4 ms·
interesting threat vector. would CEO having sole access to Cloudflare R2 clone satisfy at least data durability? since full continuity without AWS is probably i
by swyx 5y ago
interesting threat vector. would CEO having sole access to Cloudflare R2 clone satisfy at least data durability? since full continuity without AWS is probably impossible for most real life scenarios.
- brazzy 5y agoIf the CEO has sole access to it, how do the backups get there?
- AdamN 5y agoHaving different read/write permissions is an important durability consideration. In this case the CEO has read privs (not write) and the archive utilities have write privs, not read. There are other problems of course, CEO being hit by a bus being the most obvious.
- brazzy 5y ago> In this case the CEO has read privs (not write) and the archive utilities have write privs, not read. Not sure you could really make this work. The archive utilities would also need to be barred from overwriting or deleting backups. If that's automated, who configures it? And how do you do differential backups without read privileges?
- AdamN 5y agoThe archive utility, when run as the backup user, cannot read the file but it can read file metadata or have a database of backup state so it knows where to send differential backups. The archive utility, run as the recover user, can only read the file.