FYI- Synology launches DSM 4 (the NAS OS)

[stevech]

http://forum.synology.com/enu/viewtopic.php?f=1&t=48073

 

[claykin]

so, what do you like about DSM4?

 

[stevech]

I haven't used it yet. Reading about it. Reading about 1st adopters.
I like to not be an early adopter for something like a NAS!

I need to try the on-line interactive demo.
There's a what's-new in DSM 4 on their web site but it's not detailed.

Overnight, I did a full backup of the NAS to a USB3 NTFS drive so when I get the nerve to try DSM4...

 

[claykin]

I assume you saw my note about Cloudstation not being encrypted?

Check this out on Syno forums. People are using the feature request forum to request end to end encryption. Really pathetic that Synology engineers would allow data to transition the Internet unencrypted. We're not talking about encryption while at rest, Cloudstation has no end to end (link to link) encryption so you send files over the net naked. Very 1999 is you ask me.

This type of stupidity has kept me from using Synology products.

http://forum.synology.com/enu/viewtopic.php?f=194&t=48329

 

[stevech]

I'm pleased with the DS212.
They do have HTTPS and SSL/TLS for other apps, remote backup, etc.
I've not tried out CloudStore or whatever it's called. Curious what is brings that isn't in DSM3.

I've used several on-line storage services, some free, some I paid for. My worry isn't about transport security... but rather compromise in the long duration of storage. Compromise due to them having the keys to decrypt (required to meet court order). Problem is a disgruntled employee at the service company (even if access to keys is restricted to certain employees). This happened recently to OpenDrive (which is their own lousy management's fault). Encryption while in storage is a Synology capability.
My really sensitive financial info is an encrypted via SafeHouse app on windows yielding a virtual disk (one file) on the NAS, so TLS isn't a big issue with me.

Not excusing lack of TLS though.

 

[claykin]

With the Syno NAS Cloudstation app, my worry is transport encryption. Further without encryption I imagine the conenction/handshake is done in the clear which could reveal to a hacker how to connect to your NAS..... On the other hand, data at rest is on your Syno NAS located in your facility where you maintain control over who has access. All this assumes that you network is secure and that the Syno NAS doesn't allow unwanted visitors in.

This is very different than typical cloud storage.

I do 100% agree with you about typical Cloud storage and thats why I continue to use Jungledisk. I hold the keys and there's no backdoors. Plus in 5+ years of using Jungledisk I have not yet had a single issue with my data. Nor has the app/service crashed, that I can recall.

 

[stevech]

yeah, I used (paid) JungleDisk for several months, but decided the cost per GB was not what I want, versus $0.00 for a USB drive taken offsite.

I'm no SSL/TLS ex-spurt, but in reading how I get SSL going on my DS212, it seems I need to pay a fair amount for a certificate from a trusted authority or take a chance with something less. Or put up with warnings that the self-signed certificate is a risk.

Right?

 

[stevech]

At least DropBox tells users this must be done (under US law anyway):

Dropbox employees are prohibited from viewing the content of files you store in your Dropbox account, and are only permitted to view file metadata (e.g., file names and locations). Like most online services, we have a small number of employees who must be able to access user data for the reasons stated in our privacy policy (e.g., when legally required to do so).​

But hard economic times cause things like using outside contractors to do work that gets them access, poor scrutiny of employee trust, and the occasional unpreventable berserk employee who sells out for fortunes.

 

[claykin]

There's many things I don't care for with Dropbox. One being the deduplication they do across accounts. I don't mind dedup across my accounts to save me $$ in storage and upload times, but I don't want my data dedup'd against other users.

Dropbox has also had a host of questionable security issues as well as exposed flaws. 3rd parties are taking steps to offer encryption solutions. There's a few like Secretsync and Boxcryptor.

 

[stevech]

Where can I read about Dropbox security issues?
Recently I was at my financial advisor's office and they used a tablet computer to show me documents private to the two of us. At first, I thought they were using office secure WiFi to their servers. Then I noticed the tablet was using Dropbox.

I objected, but they dismissed me as a paranoid geek.

MODERATOR: Apologies, this thread has drifted off of the Synology related theme. Feel free to take action.

 

[claykin]

Google search "Dropbox security flaws" and other derivatives of similar.

 

[nutz77]

Where can I read about Dropbox security issues?
Recently I was at my financial advisor's office and they used a tablet computer to show me documents private to the two of us. At first, I thought they were using office secure WiFi to their servers. Then I noticed the tablet was using Dropbox.

I objected, but they dismissed me as a paranoid geek.

MODERATOR: Apologies, this thread has drifted off of the Synology related theme. Feel free to take action.

Well this is normal for non IT people, they just use it to their convienience, while we have worry about security and data theft and loss.

It just takes 1 disgrunted stuff to grab some customer data and probably it's avail somewhere else.


But anyhow i've been using the new DSM version. It is great so far, i use the Cloud function to share files with my colleagues overseas. Feel that it is more secure to me. But the few weakness is it still does not allow of files greater then 1 GB and also does not support Mac also.

They have some new tools like Antivirus, but i don't think that it is necessary to run it on the Nas