Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Introducing the Infinit file system

blog.infinit.one

Post reply on HN
Print view View original

11–20 of 63 posts

Re: Introducing the Infinit file system

#11

Post by deprave »

hlieberman wrote: post #10
deprave wrote: post #9

This looks really great and I love the direction. Hopefully they're working on making it more consumer-friendly. ;) Questions: 1. They say that "While most solutions (Dropbox, GlusterFS, OwnCloud etc.) store your files unprotected in the cloud or on a specific server, we took a diametrically opposed direction by relying heavily on encryption. Whenever a file is stored in Infinit, it is cut into chunks, every chunk is…

I think the big difference they're implying (though I haven't been able to actually /verify/ the implication yet) is that Dropbox holds the keys to decrypt that content. Infinit doesn't.

I see, that wasn't clear to me, thank you!

Re: Introducing the Infinit file system

#12

Post by JadeNB »

hlieberman wrote: post #10
deprave wrote: post #9

This looks really great and I love the direction. Hopefully they're working on making it more consumer-friendly. ;) Questions: 1. They say that "While most solutions (Dropbox, GlusterFS, OwnCloud etc.) store your files unprotected in the cloud or on a specific server, we took a diametrically opposed direction by relying heavily on encryption. Whenever a file is stored in Infinit, it is cut into chunks, every chunk is…

I think the big difference they're implying (though I haven't been able to actually /verify/ the implication yet) is that Dropbox holds the keys to decrypt that content. Infinit doesn't.

> though I haven't been able to actually /verify/ the implication yet

Honest question: how would you verify such a thing? Even if you audit the code, once they open-source it, how do you know that what you see is the same as what they run on their end? (Or do you mean 'verify' just in the informal sense of having them state that that is what they mean, rather than in some more formal trust-free sense?)

Re: Introducing the Infinit file system

#13

Post by hlieberman »

JadeNB wrote: post #12
hlieberman wrote: post #10

Earlier quoted context omitted.

I think the big difference they're implying (though I haven't been able to actually /verify/ the implication yet) is that Dropbox holds the keys to decrypt that content. Infinit doesn't.

> though I haven't been able to actually /verify/ the implication yet Honest question: how would you verify such a thing? Even if you audit the code, once they open-source it, how do you know that what you see is the same as what they run on their end? (Or do you mean 'verify' just in the informal sense of having them state that that is what they mean, rather than in some more formal trust-free sense?)

The first seems more important (no sense going through all the work of verifying something is true before making sure the authors are actually stating it!), but, both, really.

In the latter case, you'd look at the software that /you/ run to validate that:

1. It's using some sane form of key generation. 2. It's actually using those keys to perform encryption on the files prior to them being transmitted. 3. The original files, as well as the key material, aren't read anywhere else in the code base not necessary to do the above two.

Then, only run that version of the software. It's non-trivial, and generally expensive. This is why a lot of people prefer tools which call out to other trusted programs to actually handle the key management and encryption. Less complicated code to audit that way. (cf tarsnap)

Re: Introducing the Infinit file system

#14

Post by philjohn »

deprave wrote: post #9

This looks really great and I love the direction. Hopefully they're working on making it more consumer-friendly. ;) Questions: 1. They say that "While most solutions (Dropbox, GlusterFS, OwnCloud etc.) store your files unprotected in the cloud or on a specific server, we took a diametrically opposed direction by relying heavily on encryption. Whenever a file is stored in Infinit, it is cut into chunks, every chunk is…

Dropbox deduplicate content ... so a file that several people have uploaded is only actually stored once.

They also allow you to access your files over a web interface, and no decryption happens "in browser". So yes, DropBox most certainly have the decryption keys. Your data is protected at rest, and on the wire using TLS, but it's not end-to-end encryption.

Re: Introducing the Infinit file system

#15

Post by wtbob »

JadeNB wrote: post #12
hlieberman wrote: post #10

Earlier quoted context omitted.

I think the big difference they're implying (though I haven't been able to actually /verify/ the implication yet) is that Dropbox holds the keys to decrypt that content. Infinit doesn't.

> though I haven't been able to actually /verify/ the implication yet Honest question: how would you verify such a thing? Even if you audit the code, once they open-source it, how do you know that what you see is the same as what they run on their end? (Or do you mean 'verify' just in the informal sense of having them state that that is what they mean, rather than in some more formal trust-free sense?)

> Even if you audit the code, once they open-source it, how do you know that what you see is the same as what they run on their end?

If it's actually secure, then the only thing which matters is what I run on my end, since the key would be generated on my end and the chunks would be encrypted on my end. If I send a server my data, then the system cannot be secure.

Re: Introducing the Infinit file system

#17

Post by toomuchtodo »

sigmonsays wrote: post #2

my bandwidth kills things like this. I have so little upload in the US that I can't host anything and still have a usable network connection

You could get a virtual machine somewhere cheap for $5-10/month and use that as your canonical storage reference.

Re: Introducing the Infinit file system

#20

Post by kefka » 

     1. Protocol level filesystems featured by a company (single point of failure)
     2. Uses existing services in ways those other companies may not like. (Serf in someone else's walled garden)
     3. Closed-source, with maybe promises of open sourcing later
     4. Hard to search, given the name is -e from a real word
     5. Relies on extensive network bandwidth, especially in cases upload is scarce
To think of a few.... As converse, I'm looking at IPFS. It works great, now.
Post reply on HN