Hacker News Reader

Comment by srfilipek | Hacker News Reader

I use FreeNAS (FreeBSD NAS with ZFS). The ZFS snapshotting feature effectively gives me protections from this type of issue.

My home computers push backups regularly throughout the day, and every day I create snapshots of each volume (how long to keep the snapshots is another question). This snapshot can only be accessed or managed on the NAS itself.

This effectively creates an append-only backup NAS thanks to the periodic snapshots.

View on HN

Do those snapshots somehow benefit from the incremental nature of daily backups?

Yes, ZFS snapshots only contain data that changed. ZFS is very efficient, elegant, and reliable.

Even with ZFS deduplication off?

Yes.

These are all good ideas. It seems to me part of the problem with these ransom attacks is the intruders aren't pouncing the minute they get inside the victim's network. They take their time, figure out where everything is (including backups) and then only force-spread the ransom malware after they have staged everything just-so.

To be more precise, ZFS snapshots are mostly just a timestamp reference, similar to how a git commit is just a reference to a git object. Writes don't change the value of the files in the snapshot because they're stored in new places rather than overwriting the existing files on disk.

https://blogs.oracle.com/ahrens/is-it-magic

yes - new writes consume space.

https://docs.oracle.com/cd/E23824_01/html/821-1448/gbciq.htm...

Reply on news.ycombinator.com