Rclone: rsync for cloud storage
rclone.org
rclone.org
- create documents on my Mac which autosync to Cloud Drive in encrypted format (this should tick that box)
- be able to access said documents on any device including iOS, which transparently handles the encryption
The use case is I now scan all my documents into PDF format, but keeping them secure and accessing them on iOS seem to be almost mutually exclusive.
I looked at some other solutions for this which had their own iOS app and security mechanism (Boxcryptor mainly) and I didn't like it - I just didn't feel in control. And I got nervous about what happens if Boxcryptor goes under; I don't want to rely on them keeping their app up-to-date to read my documents.
I know Apple will never allow it but wouldn't it be nice to be able to mount your own network drive which all apps could access.
My guess is that Google does not like encryption as it prevents de-duplication between users.
For end-to-end Google Drive encryption you'll an app like BoxCrypter or SyncDocs.
https://cloud.google.com/security/encryption-at-rest/#encryp...
Encrypting when the organization has the keys is only effective when accessing the ciphertext is easier than accessing the key material.
I'd prefer a solution where Google could only store encrypted blobs with no access to my keys and all decryption happens on the client device.
I'd rather store my files on snapchat.
http://observer.com/2016/08/media-orgs-donate-to-clinton-fou...
These days, its pay to play.
This is a really important aspect for many workflows dealing with large files (like TrueCrypt containers). Contrary to what is stated by the rclone developer [1], at least Dropbox supports binary diffs [2].
This should be looked into, at least for Dropbox.
[1] http://rclone.org/faq/#why-doesn-t-rclone-support-partial-tr...
The ideas behind are actually used in multiple places, through the librsync project (https://github.com/librsync/librsync). rdiff-backup and duplicity are 2 known examples, and surely in other projects as well.
https://developers.google.com/drive/v3/web/properties
I wonder if you could add hashes and checksums to files in this way? The trick would be adding the server-side app service manage these.
Binary diffs would be useful if you're syncing big files that change often; but then you have the limitations of the object storage implementations and (most of) their APIs. I'm not familiar with all the storage, but in the case of OpenStack Object Storage (swift), you can't upload part of an object.
You could split each file in chunks and then store those chunks, but the 1:1 mapping wouldn't be there (meaning that you need rclone to get your files back).
As in it encrypts your files, dedups and puts them on S3?
If you don't CBC, wherever is on the cloud side will have two files with one block off. Let's assume the file is a txt file. For smaller cipher block sizes, it is becoming very easy to guess your encryption key.
Tldr, you want any attacker to lose any diff ability on your encrypted data.
Good practice for file encryption is to pad some random bytes to the start of a file. This makes known cyphertext attacks much harder.
So encrypting identical files should result in different files and also slightly different length files.
Colin won the Putnam as an undergraduate student. The Putnam award is not a mathematics research award like the Fields Medal or the Abel Prize. It's a mathematics competition. As such, Colin didn't win the award for any particular work.
It's still quite impressive though. I would say Colin's work developing scrypt has more applicability to cryptography than his Putnam award.
One of the best comebacks in HN history.
A glorious exchange.
That's like saying the Google Drive client or the Dropbox client are "rsync for cloud storage" just because they incrementally add changes to a cloud service.
FWIW, the client is open source: https://github.com/Tarsnap/tarsnap
Aside from the program itself, your documentation is really good, and special +1 for documenting the crypto thoroughly (and another +1 for using NaCl's building blocks in a safe way).
As a related point, I recently bought a Chromebook (still unopened), which pushes you heavily towards storing your files in Google Drive. It makes me uneasy to store certain things unencrypted, so I'll investigate writing a compatible implementation for ChromeOS.
Some of the supported providers (e.g. Amazon Cloud Drive) have a reputation for days-long service outages. Some users of Amazon Cloud Drive have even reported files going missing on occasion.
But the great thing with git-annex is you can have your data on multiple clouds (in addition to being on your own equipment), so partial or complete loss of a cloud provider does not need to result in availability or durability issues.
I'm trying to find a recipe for Rclone to connect to rsync.net since it won't work over the usual path (rsync over SSH) ... but we do support git-annex so ...
Rclone+gitannex, over SSH, to rsync.net ? Want a free account to try it ?
s3s3mirror [0] is another tool for copying data between S3 buckets or the local filesystem. full disclosure: I am the author.
At the time I wrote it, I only needed to work with AWS, and needed something very fast to copy huge amounts of data. It works like a champ, but I do think about what it would take to make it cloud-independent; it wouldn't be easy to maintain the performance that's for sure.
"I started with "s3cmd sync" but found that with buckets containing many thousands of objects, it was incredibly slow to start and consumed massive amounts of memory. So I designed s3s3mirror to start copying immediately with an intelligently chosen "chunk size" and to operate in a highly-threaded, streaming fashion, so memory requirements are much lower.
Running with 100 threads, I found the gating factor to be how fast I could list items from the source bucket (!?!) Which makes me wonder if there is any way to do this faster. I'm sure there must be, but this is pretty damn fast."
It's a shame the S3 Api doesn't let you order by modified date, or this would be trivial to do efficiently.
the main innovations in s3s3mirror are (1) understanding this & going for massive parallelism to speed things up and (2) where possible, comparing etag/metadata instead of all bytes.
so far, it has scaled pretty well, i know of no faster tool to synchronize buckets with millions of objects.
I haven't looked at your project, but based on what you've said I agree the way you're doing it is conceptually as fast as it can be (massively parallel and leveraging metadata) whilst being a general purpose tool that "just works" and has no external dependencies or constraints.
Where are these tarfiles stored? The cloud?
BTW rclone checks size/timestamp and/or checksum to determine what to upload, the same way rsync does. So you don't have incremental "snapshots" the way duplicity does.
"encrypted rsync to S3" is all I ever wanted in the first place so very much hoping this can replace it.
I'll definitely give this a try.
Edit: One feature I would like would be to split files into n chunks to obfuscate the length of files (assuming it wasn't obvious which chunks go together to make up a file), so instead of a 1:1 relationship there was a 1:n for large files. I suspect this is a lot more work though...
Did you check out Duplicity? http://duplicity.nongnu.org/
Is it justified to assume that this is adequate crypto as long as the nonces are choosen correctly (= as random as possible) and the keysize is bigger than 128bit (rclone uses 256bit key derived from user password)?
Documentation of the crypto part can be found here: http://rclone.org/crypt/
EDIT: added constraint regarding keysize.
Ideally you would not allow user-supplied passwords (random password > KDF-ed user password), but it's still solid.
(Speaking as an unqualified outsider) Both Poly1305 and Salsa20 are creations of Daniel Bernstein / djb, who seems about as highly respected as you can be in the crypto community. And NaCl, the library they use that implements them (also by djb), is often highly recommended as a 'good' crypto library to use.
That said, it does go against the usual advice not to trust code from people who make their own encryption rather than using existing standards, but maybe this is the exception?
There was an article recently with some good commentary about how uneasy some people feel with how much of modern crypto being used in production is coming from relatively few people, including djb, but I can't seem to find it now...
Older column by Aaron Swartz on djb: http://www.aaronsw.com/weblog/djb
Relevant tptacek comment: https://news.ycombinator.com/item?id=705165 (no idea if this is still valid)
The other relevant tptacek post is 'Cryptographic Right Answers' [1], which suggests using the NaCl default for encrypting (ie. Secretbox [2][3]), so the rclone author is deferring entirely to NaCl for crypto, as it's recommended.
[1] https://gist.github.com/tqbf/be58d2d39690c3b366ad
I'll check this out instead - thanks for sharing OP.
That is, can you point it at rsync.net (or your own server that is only running ssh) ?
If the author is here, please email us (info@rsync.net) if you'd like a free account to test with.
No. Quoting from notes.txt [0],
Ideas
* support
* rsync over ssh
[0] https://github.com/ncw/rclone/blob/master/notes.txt#L25That's a good feature request.
I don't understand the snark.
I get the irony you're hinting at with regards to the tag line "rsync for cloud storage" but it's harmless IMHO and gets the point across nicely.
It's not in the feature list and my guess is that this would be hard to implement if you can't take assumptions of the underlying file system.
It could store that information as metadata, like it does with the timestamps; and then restore if supported by the destination file system when copying/syncing files back.
I was about to install it anyway, but I saw that it doesn't have bi-directional sync. If 3 people at work shared a google drive folder and they all tried to sync to it, it sounds like whoever synced last would always win and it could potentially delete / alter some file.
I use Kodi on a separate pi to stream the content from Amazon, thereby freeing up space on my NAS.
https://twitter.com/gregsramblings/status/770804483798421504 https://cloud.google.com/storage/transfer/create-manage-tran...
Does anyone have experience for how fast this transfers and is there any info about how efficient the service is in terms of API calls? With a bucket with millions of objects, needless extra calls to List or Get can really add up to a ton of money.
If you don't abuse it it works great.
Are we talking temporary throttling after having transferred hundreds of GB in a short time span (hours? days? do you know how fast they allow you to upload?) or throttling more or less forever once you store just hundredes of GB?
The former, from the people I've heard who run into it. These people are generally uploading tens of terabytes however.
I average 2.465MByte/s which is right at my upload bandwidth and I have 12TB up there as of right now.
I've seen others saturate 300Mbit connections so it might be on my end.
EDIT: Just ran with rclone on the same server and I get about 30Mbit/s with small files (even with --transfers=16). With a single large file, I'm getting ~250Mbit/s. I think my issues in the past have been due to file creation overhead.
EDIT2: Ran again with numerous large files and --transfers=16 and I'm getting ~900Mbit. It seems the bottleneck is the api calls rather than the upload bandwidth.
Don't know, but i do have success with acd_cli : https://github.com/yadayada/acd_cli
Since then I've done bursts of uploading with rclone from two different networks, first a slower one, and then a faster one. Amazon throttles you pretty aggressively, and rclone occasionally just appears to pause indefinitely (on Win64) as it's waiting for the pacer or a response. It's a bit annoying and confusing and I'm not sure how to proceed other than to kill the process.
Luckily it's nondestructive to just start it again with the same args. Though low-tech, a wrapper script around it could automate that away too.
For the latter, it uploads much faster than the shell scripts I had been using, and it has similar utility as an "rsync for the cloud".
If I was only using GCS, I might default to a Google supplied utility, but I have not compared the two.
EDIT: Also, most 'official' cloud drive clients place a folder into your homedir, like ~/Google Drive or ~/OneDrive or ~/Box Sync. Only files placed into these folders get synced up and down. This client allows arbitrary local paths to be synced up or down.
Edit: "unlimited" Services are even cheaper on paper of course, but i don't really trust those.
I haven't been able to find anything in the documentation mentioning this
Works a treat.... highly reccomended!
Their uploader is... something.
Both the website and github seem to feature the same release (v1.33 as of now):
95% of stuff I work with is Linux but that last 5% is done in Windows for work. I use Google Drive but the lack of syncing is really annoying. I also have a NAS that runs Linux that I would love to use to sync my GDrive/Amazon Drive to.
I've been brainstorming ideas including but not limiting to seeing if I could use W10 IOT for the RPi and install Drive on there (Pretty sure its impossible).
It boggles my mind there isn't a elegant solution to this that doesn't require me to pay for a service.