4 ms·

I used to be a user of both Syncthing and Resilio Sync, but i've replaced both with regular cloud storage with Cryptomator or rclone+crypt instead (Cryptomator

I used to be a user of both Syncthing and Resilio Sync, but i've replaced both with regular cloud storage with Cryptomator or rclone+crypt instead (Cryptomator for clients). It turns out that the power consumption of keeping redundant hardware running at home is about twice as high as just buying the same storage in the cloud, and then you need to figure in the cost of hardware as well. I.e. Microsoft Family 365 can be had for €60/year (with HUP), and offers 6x1TB OneDrive storage. With power at €0.44/kwh, you have a power budget of 15W before your home server costs more than the cloud offering.

flipbrad 5y ago
I use far less than 15W using an old laptop or RasPi their cost is negligible over their useful lifetime
- 8fingerlouie 5y ago
  The 15W doesn't account for hardware. As soon as you add in hardware (and redundancy), you're looking at a lower budget. If i was to self host something similar, i would use a server (could be RPi4) with a set of 2x6TB drives in RAID1(for availability), and a remote backup somewhere (so another 6TB drive). The hardware cost of a single 6TB (Seagate Ironwolf 6TB, €202 at Amazon) harddrive could pay for 3 years of Family 365. So we're looking at 6 years of Family 365 to buy the harddrives alone (and 9 months more if you buy a RPi 4). I'm not counting the backup drive as you'll need that as well even if running in the cloud. Assuming a lifespan of 5 years, and an operating power of 5W average, you're looking at 44 KWh per harddrive per year, so 2x44x5 = 440 KWh over 5 years, or €194 (at €0.44/KWh). So the total cost of running your own setup over 5 years would be: €404 2 x 6TB harddrives €194 power consumption (not counting server power) Thats €598 for 5 years, or €119.5 per year, and that's also assuming no hardware breaks down. Compare that to the €60 that Family 365 costs per year.
rglullis 5y ago
I run a NAS with syncthing and a dappnode at home. The dappnode runs Storj, which I allocated about 2TB. It is paying me now about 6€/month, which is barely enough to cover the electricity costs and the cost of the drive. It certainly hasn't helped to cover any of the cost from the NAS. Decentralized solutions are always going to be less cost-effective than central services. We still should do it anyway. Optimizing for cost is a mistake. It makes us overly dependent on the big companies. It makes us fragile and susceptible to any change in their terms.
- 8fingerlouie 5y ago
  > It makes us fragile and susceptible to any change in their terms. Which is why you should backup your data locally (or somewhere else), but even if self hosting, you should still have a backup of your data. I personally backup everything at home, and if/when their terms change, it's simply a matter of restoring data onto the new solution (local or remote), and i'm up and running again.
  - rglullis 5y ago
    Yes, of course. Syncthing is not a backup solution. Luckily the amount of data that I have that is considered private and valuable is not that much (~100GB of family photos and videos, some scanned documents) so my backup strategy has been good old SneakerNet. I have a couple of thumb drives that I leave with family, and occasionally get them back to check/refresh.
    - 8fingerlouie 5y ago
      I keep my data in the cloud, a local (versioned) backup, and for irreplaceable data like photos, i also burn identical M-disc media at least every year. One stored at home, another in a remote location. While i will probably have worse problems to deal with in case the cloud disappears and my local data is gone as well, chances are that once those are solved, my family photos will not be a problem after those :)
      - rglullis 5y ago
        I think for me the original comment was not just about the data, it was also about "what if the cloud disappears". Financially, it might make sense to pay MS a few bucks an year for a service. Philosophically, the idea is much harder to stomach. I am far from being a card-carrying member of /r/datahoarder, but I don't like the idea of supporting (much less depending on) streaming services, and I would pay for a subscription service if it was based on open source.
aborsy 5y ago
Are you sure that encryption software has no vulnerabilities? What if encryption keys are stolen?
- 8fingerlouie 5y ago
  I could say that both projects are open source, but no, i haven't audited them. Cryptomator has been audited by Cure53 (https://cryptomator.org/audits/2017-11-27%20crypto%20cure53.pdf https://cryptomator.org/audits/2017-11-27%20crypto%20cure53....) In any case, i guess it depends on your threat model. I have no illusion that a sufficiently determined attacker will gain access to my files, but that's true no matter if i store the files at home or in the cloud - We're talking files accessible "on the move" here, so it's not like i can just airgap the server. The cloud offers far better physical security than what i have at home, and if not better, at least equal network security with dedicated teams on board to resolve issues. The (major) cloud also offers far more geographical redundancy (Google 3 sites, Apple 2-3 sites, Microsoft 2 sites), each with redundancy in power/internet/hardware, as well as fire/flood protection. And of course, the most common reason for broken encryption is a weak password, so don't do that.
  - aborsy 5y ago
    Files encrypted with rclone were actually plaintext for about a year: https://www.cvedetails.com/vulnerability-list/vendor_id-18942/Rclone.html https://www.cvedetails.com/vulnerability-list/vendor_id-1894... Because a developer didn’t know the pitfall of taking a random seed from the current time. Cryptomator takes encryption from a Java library. I don’t know the quality of this ecosystem. Searching it in HN doesn’t return much. With cloud, you need to clarify if the provider and governments are in your model or not.
    - 8fingerlouie 5y ago
      > Files encrypted with rclone were actually plaintext for about a year: It had a severe weakness yes, but it was not plaintext. From the CVE : "dictionary of all possible passwords with about 38 million entries per password length". For an attacker to attempt to break the encryption, they also still need to defeat the cloud providers security measures like 2FA. > Cryptomator takes encryption from Java library. I don’t know the quality of this ecosystem. Considering that it's used by banks/goverments, i'd say that it's probably either full of backdoors, or at least somewhat OK :) > With cloud, you need to clarify if the provider and governments are in your model or not. I have no illusion that i can keep encrypted files out of government hands, or any other sufficiently motivated attacker. One could argue that the data might even be better protected in the cloud than in my home. Also : https://xkcd.com/538/ https://xkcd.com/538/ If storing illegal content is "your thing", you'd be better off looking for other solutions. My personal needs are storing maybe not generally sensitive files, but files i consider sensitive, like photos of my family, tax documents, etc. It's all files that would probably not make much of an impact if they were public available, but i prefer keeping them private. The thing about encryption is that if you don't trust it, it doesn't make much sense using it at all. That goes for both cloud and private. The threat vectors are different, but one could argue that a datacenter network is probably better protected than the average users Zyxel/Netgear/whatever router that probably has about a dozen unpatched CVEs, along with an ISP "backdoor" if supplied by the ISP.

flipbrad 5y ago

I use far less than 15W using an old laptop or RasPi their cost is negligible over their useful lifetime

8fingerlouie 5y ago
The 15W doesn't account for hardware. As soon as you add in hardware (and redundancy), you're looking at a lower budget. If i was to self host something similar, i would use a server (could be RPi4) with a set of 2x6TB drives in RAID1(for availability), and a remote backup somewhere (so another 6TB drive). The hardware cost of a single 6TB (Seagate Ironwolf 6TB, €202 at Amazon) harddrive could pay for 3 years of Family 365. So we're looking at 6 years of Family 365 to buy the harddrives alone (and 9 months more if you buy a RPi 4). I'm not counting the backup drive as you'll need that as well even if running in the cloud. Assuming a lifespan of 5 years, and an operating power of 5W average, you're looking at 44 KWh per harddrive per year, so 2x44x5 = 440 KWh over 5 years, or €194 (at €0.44/KWh). So the total cost of running your own setup over 5 years would be: €404 2 x 6TB harddrives €194 power consumption (not counting server power) Thats €598 for 5 years, or €119.5 per year, and that's also assuming no hardware breaks down. Compare that to the €60 that Family 365 costs per year.

rglullis 5y ago

I run a NAS with syncthing and a dappnode at home. The dappnode runs Storj, which I allocated about 2TB. It is paying me now about 6€/month, which is barely enough to cover the electricity costs and the cost of the drive. It certainly hasn't helped to cover any of the cost from the NAS. Decentralized solutions are always going to be less cost-effective than central services. We still should do it anyway. Optimizing for cost is a mistake. It makes us overly dependent on the big companies. It makes us fragile and susceptible to any change in their terms.

8fingerlouie 5y ago
> It makes us fragile and susceptible to any change in their terms. Which is why you should backup your data locally (or somewhere else), but even if self hosting, you should still have a backup of your data. I personally backup everything at home, and if/when their terms change, it's simply a matter of restoring data onto the new solution (local or remote), and i'm up and running again.
- rglullis 5y ago
  Yes, of course. Syncthing is not a backup solution. Luckily the amount of data that I have that is considered private and valuable is not that much (~100GB of family photos and videos, some scanned documents) so my backup strategy has been good old SneakerNet. I have a couple of thumb drives that I leave with family, and occasionally get them back to check/refresh.
  - 8fingerlouie 5y ago
    I keep my data in the cloud, a local (versioned) backup, and for irreplaceable data like photos, i also burn identical M-disc media at least every year. One stored at home, another in a remote location. While i will probably have worse problems to deal with in case the cloud disappears and my local data is gone as well, chances are that once those are solved, my family photos will not be a problem after those :)
    - rglullis 5y ago
      I think for me the original comment was not just about the data, it was also about "what if the cloud disappears". Financially, it might make sense to pay MS a few bucks an year for a service. Philosophically, the idea is much harder to stomach. I am far from being a card-carrying member of /r/datahoarder, but I don't like the idea of supporting (much less depending on) streaming services, and I would pay for a subscription service if it was based on open source.

aborsy 5y ago

Are you sure that encryption software has no vulnerabilities? What if encryption keys are stolen?

8fingerlouie 5y ago
I could say that both projects are open source, but no, i haven't audited them. Cryptomator has been audited by Cure53 (https://cryptomator.org/audits/2017-11-27%20crypto%20cure53.pdf https://cryptomator.org/audits/2017-11-27%20crypto%20cure53....) In any case, i guess it depends on your threat model. I have no illusion that a sufficiently determined attacker will gain access to my files, but that's true no matter if i store the files at home or in the cloud - We're talking files accessible "on the move" here, so it's not like i can just airgap the server. The cloud offers far better physical security than what i have at home, and if not better, at least equal network security with dedicated teams on board to resolve issues. The (major) cloud also offers far more geographical redundancy (Google 3 sites, Apple 2-3 sites, Microsoft 2 sites), each with redundancy in power/internet/hardware, as well as fire/flood protection. And of course, the most common reason for broken encryption is a weak password, so don't do that.
- aborsy 5y ago
  Files encrypted with rclone were actually plaintext for about a year: https://www.cvedetails.com/vulnerability-list/vendor_id-18942/Rclone.html https://www.cvedetails.com/vulnerability-list/vendor_id-1894... Because a developer didn’t know the pitfall of taking a random seed from the current time. Cryptomator takes encryption from a Java library. I don’t know the quality of this ecosystem. Searching it in HN doesn’t return much. With cloud, you need to clarify if the provider and governments are in your model or not.
  - 8fingerlouie 5y ago
    > Files encrypted with rclone were actually plaintext for about a year: It had a severe weakness yes, but it was not plaintext. From the CVE : "dictionary of all possible passwords with about 38 million entries per password length". For an attacker to attempt to break the encryption, they also still need to defeat the cloud providers security measures like 2FA. > Cryptomator takes encryption from Java library. I don’t know the quality of this ecosystem. Considering that it's used by banks/goverments, i'd say that it's probably either full of backdoors, or at least somewhat OK :) > With cloud, you need to clarify if the provider and governments are in your model or not. I have no illusion that i can keep encrypted files out of government hands, or any other sufficiently motivated attacker. One could argue that the data might even be better protected in the cloud than in my home. Also : https://xkcd.com/538/ https://xkcd.com/538/ If storing illegal content is "your thing", you'd be better off looking for other solutions. My personal needs are storing maybe not generally sensitive files, but files i consider sensitive, like photos of my family, tax documents, etc. It's all files that would probably not make much of an impact if they were public available, but i prefer keeping them private. The thing about encryption is that if you don't trust it, it doesn't make much sense using it at all. That goes for both cloud and private. The threat vectors are different, but one could argue that a datacenter network is probably better protected than the average users Zyxel/Netgear/whatever router that probably has about a dozen unpatched CVEs, along with an ISP "backdoor" if supplied by the ISP.