4 ms·
If it was a lifespan issue they could just encrypt the partitions (minimal overhead with AES) and then destroy the key with the droplet. Due to the way that SS
by nwh 13y ago
If it was a lifespan issue they could just encrypt the partitions (minimal overhead with AES) and then destroy the key with the droplet.
Due to the way that SSDs wear level, even if every block returns 0, you don't know if that's the same block or if the real data is squirrelled away on out-of-life blocks. From what I understand the SSD has a lot more capacity than advertised and moves the blocks forward as sections of the chip wear out. Assuming you could reprogram the controller (or use a different one), you could go back and read the old blocks and recover data in the clear.
- spullara 13y agoYou're right. Encryption is the right answer. What does Amazon do with their SSDs? Anyone know?
- jlawer 13y agoI would expect any sane large provider to zero the disks simply to make it easier to overcommit on the storage layer.
- pilsetnieks 13y agoNot several times more capacity, it's generally about 7% (that's why you often see 120 GB or 240 GB drives that are in reality 128 GB or 256 GB.)
- rythie 13y agoThe problem with encryption at that level is that trim no longer works as there are no longer any zeroed blocks - so writes are slower. Also there will be more write applification as every write will cause a block to be erased.
- quotemstr 13y agoOf course it works. The filesystem knows which blocks the underlying storage device can forget and tell it using TRIM. That the content of the block was encrypted is irrelevant. TRIM is for putting blocks in some undefined state when no longer needed, not for zeroing them. See http://worldsmostsecret.blogspot.com/2012/04/how-to-activate-trim-on-luks-encrypted.html http://worldsmostsecret.blogspot.com/2012/04/how-to-activate...
- rythie 13y agoOh it looks like I'm a bit out of date, it took years but I can see they now support this. Of course this comes at the cost of being less secure (giving away the used block locations), though it shouldn't matter for this use case.