7 ms·

Not only that, but their security situation is terrible. Their OS is full of EOL'ed stuff. On products you can buy TODAY, you find: - Their Btrfs filesystem

Not only that, but their security situation is terrible. Their OS is full of EOL'ed stuff. On products you can buy TODAY, you find: - Their Btrfs filesystem is a fork of a very old branch and doesn't have modern patches - A custom, non standard, self built, ACL system for the filesystem - Kernel 4.4 - PHP 7.4 (requirement for their Hyperbackup app) - smbd 4.15 - PostgreSQL 11.11 - smbd 8.2p1 - Redis 6.2.8 - ... They claim it's OK because they've backported all security fixes to their versions. I don't believe them. The (theoretical) huge effort needed for doing that would allow them to grow a way better product. And it's not only about security, but about features (well, some are security features too). We're missing new kernel features (network hardware offload, security, wireguard...), filesystem (btrfs features, performance and error patches...), file servers (new features and compatibility, as Parallel NFS or Multichannel CIFS/SMB), and so on... I think they got stuck on 4.4 because of their btrfs fork, and now they're too deep on their own hole. Also, their backend is a mess. A bunch of different apps developed on different ways that mostly don't talk to each other. They sometimes overlap with each other and have very essential features that don't work and don't plan to fix. Meanwhile, they're busy releasing AI stuff features for the "Office" app. Edit note: For myself and some business stuff, I have a bunch of TrueNAS deployments, from a small Jonsbo box for my home, to a +16 disk rack server. This was for a client that wanted to migrate from another Synology they had on loan, and I didn't want to push a server on them, as they're a bit far away from me, and I wanted it to be serviceable by anyone. I regret it.

Shank 1y ago
The encryption is also broken. If you use encrypted shared folders, you have an arbitrary filename limit (https://kb.synology.com/en-ro/DSM/tutorial/File_folder_path_name_too_long https://kb.synology.com/en-ro/DSM/tutorial/File_folder_path_...). If you use volume encryption, your encryption key is stored on the NAS itself, which is capable of decrypting the data, unless you buy a second Synology NAS (https://blog.elcomsoft.com/2023/06/volume-encryption-in-synology-dsm-7-2-luks-with-questionable-key-management/ https://blog.elcomsoft.com/2023/06/volume-encryption-in-syno...) to act as a key vault. Synology claims that volume encryption protects if you if the storage drives are stolen, but in what world would the drives, and not the NAS itself, be stolen?
- tecleandor 1y ago
  Ah, I forgot about that. I had to take the key out of the NAS too, to a different device. That made no sense at all. And almost all of the implementations of the key server you need cost thousands of dollars in licenses. Edit: what they deploy on their NAS is an old version of a testing implementation of the KMIP protocol. PyKMIP: https://github.com/OpenKMIP/PyKMIP https://github.com/OpenKMIP/PyKMIP
- cyberpunk 1y ago
  maybe it has a kensington lock?
  - layer8 1y ago
    The drive bays also have individual locks, but neither would prevent a thief who knows what they are doing.
    - gog 1y ago
      Not on all of the models.
- 8fingerlouie 1y ago
  The filename limit comes from ecryptfs (https://www.ecryptfs.org/ https://www.ecryptfs.org/) which is what Synology uses for encrypted shared folders. As for full disk encryption, you can select where to store the key, which may be on the NAS itself (rendering FDE more or less useless) or on a USB key or similar.
  - tecleandor 1y ago
    For full disk encryption you need DSM >= 7.2 and you can either, store it locally (useless) or in a KMIP server. [0] As a KMIP server you use: - Another Synology NAS with DSM >= 7.2 - A KMIP compatible key server Except for the demo implementation that Synology uses (PyKMIP), all the KMIP compatible servers I've found have licenses in the tens of thousands a year. So if anybody has any suggestions to substitute PyKMIP... -- 0: https://kb.synology.com/en-global/DSM/tutorial/Which_models_support_encrypted_volumes
torben-friis 1y ago
My main issue with their system is how closed it is. I got an issue where mind would randomly start writing disk like crazy and maxing cpu usage, to the point I was bothered by the noise. I’d stop all containers, leave it as close to idle as I could manage, still spiking. There was no way I could learn what was causing it. I would like to assume it was a disk maintenance process or something, but for all I know it could be mining bitcoin and I’d be none the wiser. It went on for some weeks then stopped.
- lostlogin 1y ago
  > writing disk like crazy and maxing cpu usage, to the point I was bothered by the noise. Mine is in the basement for this reason. When it’s still and quiet after midnight I can still hear it grinding away. God I hate the sound.
- nolok 1y ago
  Ever since they added the "universal search" thingy, their NAS do that anytime they reach a decently large video file. Even if you turn down search indexing, media indexing, media thumbnails, ... It still kills itself with no throttling processing those files. May or may not be what you encountered, but had a customer caught by this and found out the hard way you can't stop it. My issue is not the processing, it's the throttling, it's so crazy how the entire NAS gets taken down for like ten minutes (and that was on a racked xeon model), no samba no nfs no nothing answering anymore.
  - torben-friis 1y ago
    That might be it, I use it for radarr/sonarr so there’s a good amount of large video files in there. And yes, the lack of trotting is an issue, since you can’t even reach an administration panel. When it’s bad even ssh struggles.
- tetris11 1y ago
  There are guides on how to mainline Synology NAS's to run up-to-date debian on them https://forum.doozan.com/list.php https://forum.doozan.com/list.php
jraph 1y ago
Why do they need to use an old Brtfs fork? What is missing in the mainline kernel for them?
- ethersteeds 1y ago
  As I understand it, they forked years ago when btrfs was very much not ready to be used for production NAS storage. Their value prop was they took it and added lots of their own special patches that they claimed made it highly dependable. Over time their advantage has eroded as upstream has caught up, to the point that it looks ridiculously out of date today.
  - arp242 1y ago
    And given they're using very old versions of everything, it just sounds like dysfunction and/or moribund development.
- kalleboo 1y ago
  I don't know if this is the reason, but supposedly their btrfs fork contains a custom integration with mdraid/lvm so that when btrfs detects a bad block, it signals lvm to do a repair. This is their solution to avoid using btrfs raid5/6 which is still marked unstable.
dansmith1919 1y ago
> A custom, non standard, self built, ACL system for the filesystem But don't you love it when companies invent their own security instead of using battle-tested open-source systems?
ffsm8 1y ago
You regret switching them from Synology to Trueness? Am I misunderstanding your final note? It's confusing me after the preceding displeasure wrt Synology
- happytoexplain 1y ago
  "This" in the last paragraph refers to the rest of the comment, not to the preceding sentence.
- tecleandor 1y ago
  I regret not pushing a bit more for deploying a custom storage solution with TrueNAS (or something similar) instead of Synology. All the TrueNAS devices I have are mine, not from my clients. They already had one Synology device, they don't have any IT employees on site, and I'd need to take a flight to go to their offices, so I thought that using another Synology device would be better for maintenance. They (and I) were also worried about the noise: it's an small office, and they needed at least 8*3.5" drives, and most of the decent solutions I found for 8 or more drives were big and noisy. The Jonsbo N5 appeared a bit later, that looks like a good candidate today. Now I found that all their applications are half done, they don't upgrade or fix them regularly, security-wise is a mess, and everything on the backend is super old...
8fingerlouie 1y ago
> Multichannel CIFS/SMB) My DS918+ has multichannel SMB and possibly also parallel NFS. It only works if you have multiple NICs connected. Other than that, i completely agree. Their tech stack is horribly outdated, and while i understand their reasoning for not upgrading, there's a limit to how long you can do that. Their reasoning is that they know the software that's currently running, warts and all, and can better guarantee stability across millions of devices with fewer moving parts.
- tecleandor 1y ago
  I think multichannel works, but pNFS doesn't. But I also think I had another different feature in mind, I was just reciting by memory :P :)
edem 1y ago
I have a DS 923+. These extremely old softwares you mentioned were always weird to me but everything worked fine so far. What I'm not happy about is the vendor lock in, and the abysmal virtualization / transcoding performance. I want a NAS that comes with a similar ease of use as the DSM, but can double down as a __very lightweight__ virtualization platform for my local test deployments and as a media PC that I can rely on. What would you suggest?
- Marsymars 1y ago
  I'd suggest separate systems for NAS and media serving. I've a Ryzen Embedded system with lost of RAM as my NAS box and a small Intel N-series based system as my Plex server that pulls media off the NAS box.
  - benoau 1y ago
    Yeah but these days you can easily have one system with 10 - 20 cores so you should be able to handle both workloads very well.
    - Marsymars 1y ago
      You can, but for media serving and transcoding you ideally want Intel Quick Sync, and it's simpler to have separate systems for your Quick Sync system and your "many cores" system.
      - benoau 1y ago
        Both of the CPUs you mention are low-power I don't think this a problem for slightly meatier processors unless you need the GPU or Quick Sync for multiple purposes?
        Marsymars 1y ago
        Sure, you can get a meaty recent-gen Intel processor and get Quick Sync and plenty of cores, it just gives you awkward dependencies - you then a) can't get a non-Intel-based system without losing Quick Sync even if they're better value/performance/performance-per-watt and b) you can't upgrade your transcoding CPU without doing a whole new build of your meaty system, which is high-cost if you've got an especially meaty system. (You might want to upgrade your transcoding box to a newer generation processor that supports, say, AV1 encoding.) And FWIW my Ryzen Embedded system isn't especially low-power by design, it was just the most accessible way of getting ECC memory for me.
OptionOfT 1y ago
They also have this weird full disk encryption that doesn't validate that the boot partition is compromised, allowing exploits like this: https://forums.spacerex.co/t/bounty-first-person-to-share-how-to-break-into-dsm-7-2-encryption-keys-stored-on-box-gets-a-ds923/641/7 https://forums.spacerex.co/t/bounty-first-person-to-share-ho... This breaks both the 'store key locally' and the KMIP setup. And for their file-based encryption you cannot change the password. You need to create a new folder with a new password and copy all files over.
finaard 1y ago
At a customer I ended up having to help one department running two Synology boxes as a side project. I came in with low expectations, and still was thoroughly disappointed. - one device died, was EOL at that point, and newer ones no longer can read the disks - stupid limits for array size. Depending on your setup adding disks can mean "copy everything off, delete arrays, and then create new ones". Also, want one 200TB array with your disks? Depending on model size you'll have to do multiple arrays instead with a bit to way lower capacity - syncing a share to another instance is broken, with pretty much no useful debug information. Already the setup is stupid (doesn't let you select which array it goes on the target machine), and then seems to change access permissions of the sync user on the target box (i.e., you can do one sync, after that you'll need to reset the access permissions). I wanted to avoid doing my own sync script, but seems I'll have to do that in the end - stupid disk compatibility warnings (which currently you can disable when you have SSH access) - wireguard only via third party addons. It's 2025. I didn't even check before if those things can do wireguard - it didn't occur to me that a device sold nowadays might not be able to do that. While debugging I also noticed that pretty much every software component is from the stone age.

Shank 1y ago

The encryption is also broken. If you use encrypted shared folders, you have an arbitrary filename limit (https://kb.synology.com/en-ro/DSM/tutorial/File_folder_path_name_too_long https://kb.synology.com/en-ro/DSM/tutorial/File_folder_path_...). If you use volume encryption, your encryption key is stored on the NAS itself, which is capable of decrypting the data, unless you buy a second Synology NAS (https://blog.elcomsoft.com/2023/06/volume-encryption-in-synology-dsm-7-2-luks-with-questionable-key-management/ https://blog.elcomsoft.com/2023/06/volume-encryption-in-syno...) to act as a key vault. Synology claims that volume encryption protects if you if the storage drives are stolen, but in what world would the drives, and not the NAS itself, be stolen?

tecleandor 1y ago
Ah, I forgot about that. I had to take the key out of the NAS too, to a different device. That made no sense at all. And almost all of the implementations of the key server you need cost thousands of dollars in licenses. Edit: what they deploy on their NAS is an old version of a testing implementation of the KMIP protocol. PyKMIP: https://github.com/OpenKMIP/PyKMIP https://github.com/OpenKMIP/PyKMIP
cyberpunk 1y ago
maybe it has a kensington lock?
- layer8 1y ago
  The drive bays also have individual locks, but neither would prevent a thief who knows what they are doing.
  - gog 1y ago
    Not on all of the models.
8fingerlouie 1y ago
The filename limit comes from ecryptfs (https://www.ecryptfs.org/ https://www.ecryptfs.org/) which is what Synology uses for encrypted shared folders. As for full disk encryption, you can select where to store the key, which may be on the NAS itself (rendering FDE more or less useless) or on a USB key or similar.
- tecleandor 1y ago
  For full disk encryption you need DSM >= 7.2 and you can either, store it locally (useless) or in a KMIP server. [0] As a KMIP server you use: - Another Synology NAS with DSM >= 7.2 - A KMIP compatible key server Except for the demo implementation that Synology uses (PyKMIP), all the KMIP compatible servers I've found have licenses in the tens of thousands a year. So if anybody has any suggestions to substitute PyKMIP... -- 0: https://kb.synology.com/en-global/DSM/tutorial/Which_models_support_encrypted_volumes

torben-friis 1y ago

My main issue with their system is how closed it is. I got an issue where mind would randomly start writing disk like crazy and maxing cpu usage, to the point I was bothered by the noise. I’d stop all containers, leave it as close to idle as I could manage, still spiking. There was no way I could learn what was causing it. I would like to assume it was a disk maintenance process or something, but for all I know it could be mining bitcoin and I’d be none the wiser. It went on for some weeks then stopped.

lostlogin 1y ago
> writing disk like crazy and maxing cpu usage, to the point I was bothered by the noise. Mine is in the basement for this reason. When it’s still and quiet after midnight I can still hear it grinding away. God I hate the sound.
nolok 1y ago
Ever since they added the "universal search" thingy, their NAS do that anytime they reach a decently large video file. Even if you turn down search indexing, media indexing, media thumbnails, ... It still kills itself with no throttling processing those files. May or may not be what you encountered, but had a customer caught by this and found out the hard way you can't stop it. My issue is not the processing, it's the throttling, it's so crazy how the entire NAS gets taken down for like ten minutes (and that was on a racked xeon model), no samba no nfs no nothing answering anymore.
- torben-friis 1y ago
  That might be it, I use it for radarr/sonarr so there’s a good amount of large video files in there. And yes, the lack of trotting is an issue, since you can’t even reach an administration panel. When it’s bad even ssh struggles.
tetris11 1y ago
There are guides on how to mainline Synology NAS's to run up-to-date debian on them https://forum.doozan.com/list.php https://forum.doozan.com/list.php

jraph 1y ago

Why do they need to use an old Brtfs fork? What is missing in the mainline kernel for them?

ethersteeds 1y ago
As I understand it, they forked years ago when btrfs was very much not ready to be used for production NAS storage. Their value prop was they took it and added lots of their own special patches that they claimed made it highly dependable. Over time their advantage has eroded as upstream has caught up, to the point that it looks ridiculously out of date today.
- arp242 1y ago
  And given they're using very old versions of everything, it just sounds like dysfunction and/or moribund development.
kalleboo 1y ago
I don't know if this is the reason, but supposedly their btrfs fork contains a custom integration with mdraid/lvm so that when btrfs detects a bad block, it signals lvm to do a repair. This is their solution to avoid using btrfs raid5/6 which is still marked unstable.

dansmith1919 1y ago

> A custom, non standard, self built, ACL system for the filesystem But don't you love it when companies invent their own security instead of using battle-tested open-source systems?

ffsm8 1y ago

You regret switching them from Synology to Trueness? Am I misunderstanding your final note? It's confusing me after the preceding displeasure wrt Synology

happytoexplain 1y ago
"This" in the last paragraph refers to the rest of the comment, not to the preceding sentence.
tecleandor 1y ago
I regret not pushing a bit more for deploying a custom storage solution with TrueNAS (or something similar) instead of Synology. All the TrueNAS devices I have are mine, not from my clients. They already had one Synology device, they don't have any IT employees on site, and I'd need to take a flight to go to their offices, so I thought that using another Synology device would be better for maintenance. They (and I) were also worried about the noise: it's an small office, and they needed at least 8*3.5" drives, and most of the decent solutions I found for 8 or more drives were big and noisy. The Jonsbo N5 appeared a bit later, that looks like a good candidate today. Now I found that all their applications are half done, they don't upgrade or fix them regularly, security-wise is a mess, and everything on the backend is super old...

8fingerlouie 1y ago

> Multichannel CIFS/SMB) My DS918+ has multichannel SMB and possibly also parallel NFS. It only works if you have multiple NICs connected. Other than that, i completely agree. Their tech stack is horribly outdated, and while i understand their reasoning for not upgrading, there's a limit to how long you can do that. Their reasoning is that they know the software that's currently running, warts and all, and can better guarantee stability across millions of devices with fewer moving parts.

tecleandor 1y ago
I think multichannel works, but pNFS doesn't. But I also think I had another different feature in mind, I was just reciting by memory :P :)

edem 1y ago

I have a DS 923+. These extremely old softwares you mentioned were always weird to me but everything worked fine so far. What I'm not happy about is the vendor lock in, and the abysmal virtualization / transcoding performance. I want a NAS that comes with a similar ease of use as the DSM, but can double down as a __very lightweight__ virtualization platform for my local test deployments and as a media PC that I can rely on. What would you suggest?

Marsymars 1y ago
I'd suggest separate systems for NAS and media serving. I've a Ryzen Embedded system with lost of RAM as my NAS box and a small Intel N-series based system as my Plex server that pulls media off the NAS box.
- benoau 1y ago
  Yeah but these days you can easily have one system with 10 - 20 cores so you should be able to handle both workloads very well.
  - Marsymars 1y ago
    You can, but for media serving and transcoding you ideally want Intel Quick Sync, and it's simpler to have separate systems for your Quick Sync system and your "many cores" system.
    - benoau 1y ago
      Both of the CPUs you mention are low-power I don't think this a problem for slightly meatier processors unless you need the GPU or Quick Sync for multiple purposes?
      - Marsymars 1y ago
        Sure, you can get a meaty recent-gen Intel processor and get Quick Sync and plenty of cores, it just gives you awkward dependencies - you then a) can't get a non-Intel-based system without losing Quick Sync even if they're better value/performance/performance-per-watt and b) you can't upgrade your transcoding CPU without doing a whole new build of your meaty system, which is high-cost if you've got an especially meaty system. (You might want to upgrade your transcoding box to a newer generation processor that supports, say, AV1 encoding.) And FWIW my Ryzen Embedded system isn't especially low-power by design, it was just the most accessible way of getting ECC memory for me.

OptionOfT 1y ago

They also have this weird full disk encryption that doesn't validate that the boot partition is compromised, allowing exploits like this: https://forums.spacerex.co/t/bounty-first-person-to-share-how-to-break-into-dsm-7-2-encryption-keys-stored-on-box-gets-a-ds923/641/7 https://forums.spacerex.co/t/bounty-first-person-to-share-ho... This breaks both the 'store key locally' and the KMIP setup. And for their file-based encryption you cannot change the password. You need to create a new folder with a new password and copy all files over.

finaard 1y ago

At a customer I ended up having to help one department running two Synology boxes as a side project. I came in with low expectations, and still was thoroughly disappointed. - one device died, was EOL at that point, and newer ones no longer can read the disks - stupid limits for array size. Depending on your setup adding disks can mean "copy everything off, delete arrays, and then create new ones". Also, want one 200TB array with your disks? Depending on model size you'll have to do multiple arrays instead with a bit to way lower capacity - syncing a share to another instance is broken, with pretty much no useful debug information. Already the setup is stupid (doesn't let you select which array it goes on the target machine), and then seems to change access permissions of the sync user on the target box (i.e., you can do one sync, after that you'll need to reset the access permissions). I wanted to avoid doing my own sync script, but seems I'll have to do that in the end - stupid disk compatibility warnings (which currently you can disable when you have SSH access) - wireguard only via third party addons. It's 2025. I didn't even check before if those things can do wireguard - it didn't occur to me that a device sold nowadays might not be able to do that. While debugging I also noticed that pretty much every software component is from the stone age.