News for hackers. Stuff that matters.
Re:AWS switch from gzip to zstd – about 30% reduction in com... by goodpoint on Saturday August 20, 2022 @02:44PM (#32534263)
> I'm surprised (and shocked) that letting unencrypted data hit the disk is still common enough

There's very, very little benefit in encrypting data at a filesystem level in a datacenter if you think about it.

Re:AWS switch from gzip to zstd – about 30% reduction in com... by tgsovlerkhgsel on Thursday August 25, 2022 @10:47AM (#32594372)
I explained why I think it does provide a benefit even in a datacenter:

"Even if you just stick the key in the server's TPM without any sealing, an encrypted disk makes it much easier to deal with e.g. drive returns (for warranty or fault analysis) or disposal."

Would you resell usable drives that you no longer want to use (e.g. because they're too small or your needs changed more towards SSDs) if unencrypted data was written to them at some point?

How much effort would you put into making sure that no broken drive that can't be wiped leaves the datacenter without shredding?

Any process you put in place will have gaps - e.g. through human error or malicious acts - and this provides pretty solid protection against that.

Re:AWS switch from gzip to zstd – about 30% reduction in com... by staticassertion on Saturday August 20, 2022 @06:06PM (#32535576)
Unfortunately that's going to really depend. For example, if your threat model is "hard drive gets stolen" there's no point. If your threat model is "attacker can access my database" encrypting the data at the DB level does make sense. But it obviously breaks compression.

And unfortunately compression and encryption are seemingly at odds fundamentally :c