3 ms·

I don't understand this. Don't all Linux processes "run in RAM"? It sounds like what they have actually accomplished here is eliminate all disk I/O requirements

I don't understand this. Don't all Linux processes "run in RAM"? It sounds like what they have actually accomplished here is eliminate all disk I/O requirements from their DNS service, i.e. it works against a read-only mounted root filesystem now. That's not really the same as "running in RAM".

oxygen_crisis 3y ago
Once they have everything running in RAM, they can have racks of servers that contain no persistent storage whatsoever, and are therefore subpoena-proof. > On April 18 [2023] at least six police officers from the National Operations Department (NOA) of the Swedish Police visited the Mullvad VPN office in Gothenburg with a search warrant. They intended to seize computers with customer data. > In line with our policies such customer data did not exist. We argued they had no reason to expect to find what they were looking for and any seizures would therefore be illegal under Swedish law. After demonstrating that this is indeed how our service works and them consulting the prosecutor they left without taking anything and without any customer information. https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subject-to-a-search-warrant-customer-data-not-compromised https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subjec...
- 8organicbits 3y ago
  > contain no persistent storage whatsoever, and are therefore subpoena-proof. Nonsense. The linked post shows that they didn't have the sought information. If the information was present in RAM, they'd just read it from RAM.
  - itslennysfault 3y ago
    I assume they only hold what the server is doing in any given moment in ram and it is overwritten as new requests come in. By the time the police showed up with the subpoena the data they wanted was long gone.
  - theshrike79 3y ago
    Please tell me how you would go about reading something that happened two weeks ago from RAM?
Etheryte 3y ago
This is not what's happening here. The systems don't have a disk, period. The bootloader downloads an OS image from a provisioning server into RAM that's verified and then run. Past the bootloader, the system doesn't have access to the provisioning server. Every program the server needs or may need to run at one point is already in memory. Outside of RAM there is nowhere to read more data from, not even a read-only disk, nor anywhere to write it to.
- ignoramous 3y ago
  If one is already running only "verified" (attested) code (with a read-only partition), diskless doesn't buy you much? Android, for example, does this: The system partition where the OS is remains immutable unless there's a signed update (or the bootloader is "unlocked").
  - ziddoap 3y ago
    They briefly explain some of the reasoning here: https://mullvad.net/en/blog/2022/1/12/diskless-infrastructure-beta-system-transparency-stboot https://mullvad.net/en/blog/2022/1/12/diskless-infrastructur... >If the computer is powered off, moved or confiscated, there is no data to retrieve. >We get the operational benefits of having fewer breakable parts. Disks are among the components that break often. Therefore, switching away from them makes our infrastructure more reliable. >The operational tasks of setting up and upgrading package versions on servers become faster and easier. >Running the system in RAM does not prevent the possibility of logging. It does however minimise the risk of accidentally storing something that can later be retrieved.
    - yjftsjthsd-h 3y ago
      Yeah, I don't have their opsec concerns but I'm very tempted to try implementing something similar just to enforce having a stateless system (easier to manage IMO) with a nice bonus of no longer caring about host disk failures.
- lopkeny12ko 3y ago
ziddoap 3y ago
>In early 2022 we announced the beginning of our migration to using diskless infrastructure with our bootloader known as “stboot”. >We recently announced the completion of our migration to remove all traces of disks in use on our VPN infrastructure. Is this more clear?

oxygen_crisis 3y ago

Once they have everything running in RAM, they can have racks of servers that contain no persistent storage whatsoever, and are therefore subpoena-proof. > On April 18 [2023] at least six police officers from the National Operations Department (NOA) of the Swedish Police visited the Mullvad VPN office in Gothenburg with a search warrant. They intended to seize computers with customer data. > In line with our policies such customer data did not exist. We argued they had no reason to expect to find what they were looking for and any seizures would therefore be illegal under Swedish law. After demonstrating that this is indeed how our service works and them consulting the prosecutor they left without taking anything and without any customer information. https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subject-to-a-search-warrant-customer-data-not-compromised https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subjec...

8organicbits 3y ago
> contain no persistent storage whatsoever, and are therefore subpoena-proof. Nonsense. The linked post shows that they didn't have the sought information. If the information was present in RAM, they'd just read it from RAM.
- itslennysfault 3y ago
  I assume they only hold what the server is doing in any given moment in ram and it is overwritten as new requests come in. By the time the police showed up with the subpoena the data they wanted was long gone.
- theshrike79 3y ago
  Please tell me how you would go about reading something that happened two weeks ago from RAM?

Etheryte 3y ago

This is not what's happening here. The systems don't have a disk, period. The bootloader downloads an OS image from a provisioning server into RAM that's verified and then run. Past the bootloader, the system doesn't have access to the provisioning server. Every program the server needs or may need to run at one point is already in memory. Outside of RAM there is nowhere to read more data from, not even a read-only disk, nor anywhere to write it to.

ignoramous 3y ago
If one is already running only "verified" (attested) code (with a read-only partition), diskless doesn't buy you much? Android, for example, does this: The system partition where the OS is remains immutable unless there's a signed update (or the bootloader is "unlocked").
- ziddoap 3y ago
  They briefly explain some of the reasoning here: https://mullvad.net/en/blog/2022/1/12/diskless-infrastructure-beta-system-transparency-stboot https://mullvad.net/en/blog/2022/1/12/diskless-infrastructur... >If the computer is powered off, moved or confiscated, there is no data to retrieve. >We get the operational benefits of having fewer breakable parts. Disks are among the components that break often. Therefore, switching away from them makes our infrastructure more reliable. >The operational tasks of setting up and upgrading package versions on servers become faster and easier. >Running the system in RAM does not prevent the possibility of logging. It does however minimise the risk of accidentally storing something that can later be retrieved.
  - yjftsjthsd-h 3y ago
    Yeah, I don't have their opsec concerns but I'm very tempted to try implementing something similar just to enforce having a stateless system (easier to manage IMO) with a nice bonus of no longer caring about host disk failures.
lopkeny12ko 3y ago

ziddoap 3y ago

>In early 2022 we announced the beginning of our migration to using diskless infrastructure with our bootloader known as “stboot”. >We recently announced the completion of our migration to remove all traces of disks in use on our VPN infrastructure. Is this more clear?