3 ms·

yup see rincebrain's first reply where nearly every word in the sentence is a url to a different encryption issue > [I recommend](https://github.com/openzfs/zf

yup see rincebrain's first reply where nearly every word in the sentence is a url to a different encryption issue > [I recommend](https://github.com/openzfs/zfs/issues/11679 https://github.com/openzfs/zfs/issues/11679) [not using](https://github.com/openzfs/zfs/issues/12014 https://github.com/openzfs/zfs/issues/12014) [native encryption](https://www.illumos.org/issues/14003 https://www.illumos.org/issues/14003) [until it gets](https://github.com/openzfs/zfs/issues/12270 https://github.com/openzfs/zfs/issues/12270) [a fair bit](https://github.com/openzfs/zfs/issues/12439 https://github.com/openzfs/zfs/issues/12439) [more polish](https://github.com/openzfs/zfs/issues/12418 https://github.com/openzfs/zfs/issues/12418) [in the future](https://github.com/openzfs/zfs/issues/11983 https://github.com/openzfs/zfs/issues/11983) ([I'm only so hopeful](https://openzfs.topicbox.com/groups/developer/T86620b1082ed947a/would-anyone-be-able-to-help-with-11679 https://openzfs.topicbox.com/groups/developer/T86620b1082ed9...)). Unfortunately this knowledge isn't wide-spread, and as far as I see the zfs devs seem to NOT recommend using encryption right now without accepting the risks of dataloss

uniqueuid 4y ago
Right, that's the comment I linked to.
rincebrain 4y ago
Most of the devs seem to be of the opinion "we don't use it so we have no opinion", or there wouldn't be horrifying bugs in it over 3 years old. That said, very few if any of them have involved actual irrecoverable data loss versus just requiring lots of handholding to get your data back. edit: I suppose at the point where I'm being quoted on HN about this, I might as well link my list of encryption bugs. https://docs.google.com/spreadsheets/d/1OfRSXibZ2nIE9DGK6swwBZXgXwdCPKgp4SbPZwTexCg/edit?usp=sharing https://docs.google.com/spreadsheets/d/1OfRSXibZ2nIE9DGK6sww... I still need to add a couple of new bugs, but almost all of them are dupes or related to one of two flaws - a narrow race in the ARC (...probably), where you can sometimes NULL dereference for fun and sadness, and zfs change-key and send -i resulting in the receiver incorrectly resetting the metadata for which key an encryptionroot is encrypted by.

uniqueuid 4y ago

Right, that's the comment I linked to.

rincebrain 4y ago

Most of the devs seem to be of the opinion "we don't use it so we have no opinion", or there wouldn't be horrifying bugs in it over 3 years old. That said, very few if any of them have involved actual irrecoverable data loss versus just requiring lots of handholding to get your data back. edit: I suppose at the point where I'm being quoted on HN about this, I might as well link my list of encryption bugs. https://docs.google.com/spreadsheets/d/1OfRSXibZ2nIE9DGK6swwBZXgXwdCPKgp4SbPZwTexCg/edit?usp=sharing https://docs.google.com/spreadsheets/d/1OfRSXibZ2nIE9DGK6sww... I still need to add a couple of new bugs, but almost all of them are dupes or related to one of two flaws - a narrow race in the ARC (...probably), where you can sometimes NULL dereference for fun and sadness, and zfs change-key and send -i resulting in the receiver incorrectly resetting the metadata for which key an encryptionroot is encrypted by.