mirror of
https://github.com/tahoe-lafs/tahoe-lafs.git
synced 2025-02-02 17:20:50 +00:00
docs: replace emdash characters with plain ASCII
This commit is contained in:
parent
74843948d1
commit
17fcafbb3f
@ -27,7 +27,7 @@ these service providers spend considerable effort and expense trying to
|
|||||||
mitigate these risks.
|
mitigate these risks.
|
||||||
|
|
||||||
What we mean by "security" is something different. *The service provider
|
What we mean by "security" is something different. *The service provider
|
||||||
never has the ability to read or modify your data in the first place—never.*
|
never has the ability to read or modify your data in the first place: never.*
|
||||||
If you use Tahoe-LAFS, then all of the threats described above are non-issues
|
If you use Tahoe-LAFS, then all of the threats described above are non-issues
|
||||||
to you. Not only is it easy and inexpensive for the service provider to
|
to you. Not only is it easy and inexpensive for the service provider to
|
||||||
maintain the security of your data, but in fact they couldn't violate its
|
maintain the security of your data, but in fact they couldn't violate its
|
||||||
@ -38,7 +38,7 @@ This guarantee is integrated naturally into the Tahoe-LAFS storage system and
|
|||||||
doesn't require you to perform a manual pre-encryption step or cumbersome key
|
doesn't require you to perform a manual pre-encryption step or cumbersome key
|
||||||
management. (After all, having to do cumbersome manual operations when
|
management. (After all, having to do cumbersome manual operations when
|
||||||
storing or accessing your data would nullify one of the primary benefits of
|
storing or accessing your data would nullify one of the primary benefits of
|
||||||
using cloud storage in the first place—convenience.)
|
using cloud storage in the first place: convenience.)
|
||||||
|
|
||||||
Here's how it works:
|
Here's how it works:
|
||||||
|
|
||||||
|
@ -22,13 +22,13 @@ Reason`_, `Julian Sanchez / Cato Institute`_.
|
|||||||
|
|
||||||
The core Tahoe developers promise never to change Tahoe-LAFS to facilitate
|
The core Tahoe developers promise never to change Tahoe-LAFS to facilitate
|
||||||
government access to data stored or transmitted by it. Even if it were
|
government access to data stored or transmitted by it. Even if it were
|
||||||
desirable to facilitate such access—which it is not—we believe it would not
|
desirable to facilitate such access -- which it is not -- we believe it would
|
||||||
be technically feasible to do so without severely compromising Tahoe-LAFS'
|
not be technically feasible to do so without severely compromising
|
||||||
security against other attackers. There have been many examples in which
|
Tahoe-LAFS' security against other attackers. There have been many examples
|
||||||
backdoors intended for use by government have introduced vulnerabilities
|
in which backdoors intended for use by government have introduced
|
||||||
exploitable by other parties (a notable example being the Greek cellphone
|
vulnerabilities exploitable by other parties (a notable example being the
|
||||||
eavesdropping scandal in 2004/5). RFCs `1984`_ and `2804`_ elaborate on the
|
Greek cellphone eavesdropping scandal in 2004/5). RFCs `1984`_ and `2804`_
|
||||||
security case against such backdoors.
|
elaborate on the security case against such backdoors.
|
||||||
|
|
||||||
.. _1984: https://tools.ietf.org/html/rfc1984
|
.. _1984: https://tools.ietf.org/html/rfc1984
|
||||||
.. _2804: https://tools.ietf.org/html/rfc2804
|
.. _2804: https://tools.ietf.org/html/rfc2804
|
||||||
|
@ -11,10 +11,10 @@ up, then stored in the client's base directory (<Tahoe's node
|
|||||||
dir>/private/convergence) and re-used after that. So the same file content
|
dir>/private/convergence) and re-used after that. So the same file content
|
||||||
uploaded from the same client will always have the same cap. Uploading the
|
uploaded from the same client will always have the same cap. Uploading the
|
||||||
file from a different client with a different convergence secret would result
|
file from a different client with a different convergence secret would result
|
||||||
in a different cap—and in a second copy of the file's contents stored on the
|
in a different cap -- and in a second copy of the file's contents stored on
|
||||||
grid. If you want files you upload to converge (also known as "deduplicate")
|
the grid. If you want files you upload to converge (also known as
|
||||||
with files uploaded by someone else, just make sure you're using the same
|
"deduplicate") with files uploaded by someone else, just make sure you're
|
||||||
convergence secret when you upload files as they
|
using the same convergence secret when you upload files as they
|
||||||
|
|
||||||
The advantages of deduplication should be clear, but keep in mind that the
|
The advantages of deduplication should be clear, but keep in mind that the
|
||||||
convergence secret was created to protect confidentiality. There are two
|
convergence secret was created to protect confidentiality. There are two
|
||||||
|
@ -56,13 +56,13 @@ functionality) and including versions for a number of dependent libraries,
|
|||||||
like Twisted, Foolscap, pycryptopp, and zfec. "``tahoe --version-and-path``"
|
like Twisted, Foolscap, pycryptopp, and zfec. "``tahoe --version-and-path``"
|
||||||
will also show the path from which each library was imported.
|
will also show the path from which each library was imported.
|
||||||
|
|
||||||
On Unix systems, the shell expands filename wildcards — ``'*'`` and ``'?'`` —
|
On Unix systems, the shell expands filename wildcards (``'*'`` and ``'?'``)
|
||||||
before the program is able to read them, which may produce unexpected
|
before the program is able to read them, which may produce unexpected results
|
||||||
results for many ``tahoe`` comands. We recommend, if you use wildcards,
|
for many ``tahoe`` comands. We recommend, if you use wildcards, to start the
|
||||||
to start the path with "``./``", for example "``tahoe cp -r ./* somewhere:``".
|
path with "``./``", for example "``tahoe cp -r ./* somewhere:``". This
|
||||||
This prevents the expanded filename from being interpreted as an option
|
prevents the expanded filename from being interpreted as an option or as an
|
||||||
or as an alias, allowing filenames that start with a dash or contain
|
alias, allowing filenames that start with a dash or contain colons to be
|
||||||
colons to be handled correctly.
|
handled correctly.
|
||||||
|
|
||||||
On Windows, a single letter followed by a colon is treated as a drive
|
On Windows, a single letter followed by a colon is treated as a drive
|
||||||
specification rather than an alias (and is invalid unless a local path is
|
specification rather than an alias (and is invalid unless a local path is
|
||||||
|
@ -1296,7 +1296,7 @@ Relinking ("Moving") a Child
|
|||||||
This instructs the node to move a child of the given source directory, into
|
This instructs the node to move a child of the given source directory, into
|
||||||
a different directory and/or to a different name. The command is named
|
a different directory and/or to a different name. The command is named
|
||||||
``relink`` because what it does is add a new link to the child from the new
|
``relink`` because what it does is add a new link to the child from the new
|
||||||
location, then remove the old link. Nothing is actually "moved" — the child
|
location, then remove the old link. Nothing is actually "moved": the child
|
||||||
is still reachable through any path from which it was formerly reachable,
|
is still reachable through any path from which it was formerly reachable,
|
||||||
and the storage space occupied by its ciphertext is not affected.
|
and the storage space occupied by its ciphertext is not affected.
|
||||||
|
|
||||||
|
@ -318,7 +318,7 @@ authorization (confidentiality), nor to change the contents of a file
|
|||||||
|
|
||||||
A person could learn the storage index of a file in several ways:
|
A person could learn the storage index of a file in several ways:
|
||||||
|
|
||||||
1. By being granted the authority to read the immutable file—i.e. by being
|
1. By being granted the authority to read the immutable file: i.e. by being
|
||||||
granted a read capability to the file. They can determine the file's
|
granted a read capability to the file. They can determine the file's
|
||||||
storage index from its read capability.
|
storage index from its read capability.
|
||||||
|
|
||||||
@ -347,17 +347,17 @@ if you upgrade a storage server to a fixed release then that server is no
|
|||||||
longer vulnerable to this problem.
|
longer vulnerable to this problem.
|
||||||
|
|
||||||
Note that the issue is local to each storage server independently of other
|
Note that the issue is local to each storage server independently of other
|
||||||
storage servers—when you upgrade a storage server then that particular
|
storage servers: when you upgrade a storage server then that particular
|
||||||
storage server can no longer be tricked into deleting its shares of the
|
storage server can no longer be tricked into deleting its shares of the
|
||||||
target file.
|
target file.
|
||||||
|
|
||||||
If you can't immediately upgrade your storage server to a version of
|
If you can't immediately upgrade your storage server to a version of
|
||||||
Tahoe-LAFS that eliminates this vulnerability, then you could temporarily
|
Tahoe-LAFS that eliminates this vulnerability, then you could temporarily
|
||||||
shut down your storage server. This would of course negatively impact
|
shut down your storage server. This would of course negatively impact
|
||||||
availability—clients would not be able to upload or download shares to that
|
availability -- clients would not be able to upload or download shares to
|
||||||
particular storage server while it was shut down—but it would protect the
|
that particular storage server while it was shut down -- but it would protect
|
||||||
shares already stored on that server from being deleted as long as the server
|
the shares already stored on that server from being deleted as long as the
|
||||||
is shut down.
|
server is shut down.
|
||||||
|
|
||||||
If the servers that store shares of your file are running a version of
|
If the servers that store shares of your file are running a version of
|
||||||
Tahoe-LAFS with this vulnerability, then you should think about whether
|
Tahoe-LAFS with this vulnerability, then you should think about whether
|
||||||
|
@ -175,8 +175,8 @@ In this section we analyze the costs of the proposed design in terms of network,
|
|||||||
disk, memory, cloud storage, and API usage.
|
disk, memory, cloud storage, and API usage.
|
||||||
|
|
||||||
|
|
||||||
Network usage—bandwidth and number-of-round-trips
|
Network usage: bandwidth and number-of-round-trips
|
||||||
-------------------------------------------------
|
--------------------------------------------------
|
||||||
|
|
||||||
When a Tahoe-LAFS storage client allocates a new share on a storage server,
|
When a Tahoe-LAFS storage client allocates a new share on a storage server,
|
||||||
the backend will request a list of the existing cloud objects with the
|
the backend will request a list of the existing cloud objects with the
|
||||||
@ -324,14 +324,15 @@ Known Issues
|
|||||||
============
|
============
|
||||||
|
|
||||||
This design worsens a known “write hole” issue in Tahoe-LAFS when updating
|
This design worsens a known “write hole” issue in Tahoe-LAFS when updating
|
||||||
the contents of mutable files. An update to a mutable file can require changing
|
the contents of mutable files. An update to a mutable file can require
|
||||||
the contents of multiple chunks, and if the client fails or is disconnected
|
changing the contents of multiple chunks, and if the client fails or is
|
||||||
during the operation the resulting state of the stored cloud objects may be
|
disconnected during the operation the resulting state of the stored cloud
|
||||||
inconsistent—no longer containing all of the old version, but not yet containing
|
objects may be inconsistent: no longer containing all of the old version, but
|
||||||
all of the new version. A mutable share can be left in an inconsistent state
|
not yet containing all of the new version. A mutable share can be left in an
|
||||||
even by the existing Tahoe-LAFS disk backend if it fails during a write, but
|
inconsistent state even by the existing Tahoe-LAFS disk backend if it fails
|
||||||
that has a smaller chance of occurrence because the current client behavior
|
during a write, but that has a smaller chance of occurrence because the
|
||||||
leads to mutable shares being written to disk in a single system call.
|
current client behavior leads to mutable shares being written to disk in a
|
||||||
|
single system call.
|
||||||
|
|
||||||
The best fix for this issue probably requires changing the Tahoe-LAFS storage
|
The best fix for this issue probably requires changing the Tahoe-LAFS storage
|
||||||
protocol, perhaps by extending it to use a two-phase or three-phase commit
|
protocol, perhaps by extending it to use a two-phase or three-phase commit
|
||||||
|
Loading…
x
Reference in New Issue
Block a user