tahoe-lafs/trac

Commercial grids need an ability to disallow downloads without deleting data #2084

New issue

Open

opened 2013-09-15 11:14:15 +00:00 by esnyder · 4 comments

esnyder commented

2013-09-15 11:14:15 +00:00

Owner

If you are buying space on a grid, the grid operator presumably wants some way to suspend your ability to download data in the event that you stop paying your bills.

Definitely don't want to delete all the data though; once you pay your bill you should be able to pick up where you left off.

So, need a separate "download authorization" scheme which can be suspended or revoked by the server.

If you are buying space on a grid, the grid operator presumably wants some way to suspend your ability to download data in the event that you stop paying your bills. Definitely don't want to delete all the data though; once you pay your bill you should be able to pick up where you left off. So, need a separate "download authorization" scheme which can be suspended or revoked by the server.

tahoe-lafs added the

labels 2013-09-15 11:14:15 +00:00

tahoe-lafs added this to the undecided milestone 2013-09-15 11:14:15 +00:00

daira was assigned by tahoe-lafs

2013-09-15 11:14:15 +00:00

zooko commented

2013-09-17 19:08:27 +00:00

I wish there were a "+1"/"LIKE"/"me too"/"☺"/"❤" button on trac to show that I like a ticket.

I wish there were a "+1"/"LIKE"/"me too"/"☺"/"❤" button on trac to show that I like a ticket.

daira commented

2013-09-18 01:09:06 +00:00

Replying to zooko:

I wish there were a "+1"/"LIKE"/"me too"/"☺"/"❤" button on trac to show that I like a ticket.

Think of it as a feature: doing it manually shows a bit of personality in which of those you choose ;-) Likes are boring.

Replying to [zooko](/tahoe-lafs/trac/issues/2084#issuecomment-395309): > I wish there were a "+1"/"LIKE"/"me too"/"☺"/"❤" button on trac to show that I like a ticket. Think of it as a feature: doing it manually shows a bit of personality in which of those you choose ;-) Likes are boring.

exarkun commented

2019-05-30 16:30:25 +00:00

I had some thoughts related to this but they outgrew this ticket so I posted them to tahoe-dev instead: https://tahoe-lafs.org/pipermail/tahoe-dev/2019-May/009947.html

I had some thoughts related to this but they outgrew this ticket so I posted them to tahoe-dev instead: <https://tahoe-lafs.org/pipermail/tahoe-dev/2019-May/009947.html>

exarkun commented

2019-07-03 14:47:04 +00:00

So, trying to tie some of those thoughts back into this use-case...

If you have an access control system which can prevent arbitrary lease renewal then you can lean on lease expiration to disallow downloads.

You don't even need to turn on the garbage collector in this case. The shares will remain stored but unreadable. You can authorize the renew lease operation based on your payment processing system to restore access to affected shares to users who pay their bill.

If you also want to be able to eventually garbage collect something then you do need some kind of two-tiered share expiration system. You have some period of time when the share is retained and access is allowed. Then you have some period of time when the share is retained and access is denied. Then you have a point in time when the share becomes fair game for garbage collection.

You could define these periods in terms of intervals. If a lease lasts 31 days then perhaps a "storage grace period" extends for another 31 days beyond the end of the lease. Then 62 days after a lease is taken on a share, the garbage collect may delete the data.

Tahoe-LAFS already has a configuration option which can probably be (ab)used to provide part of what's required here:

[storage]
expire.enabled = true
expire.mode = age
expire.override_lease_duration = 62days

With this configuration, a storage server will not consider garbage collecting shares until the associated lease is at least 62 days old. With an access control system (https://tahoe-lafs.org/trac/tahoe-lafs/milestone/storage%20economics%20plugins) that is separately configurable and enforces denial of operations (except for lease renewal) when the lease is older than some smaller age, the desired behavior is achieved.

This might look like:

[storage]
plugins = tahoelafs-simplepaymentsauthorizerexample-v1

[storage.plugins.tahoelafs-simplepaymentsauthorizerexample-v1]
expire.lease_duration_for_access = 31days

(https://tahoe-lafs.org/trac/tahoe-lafs/ticket/3053)

Thus, access is allowed for 31 days after a lease is added or renewed but the share is retained for 62 days after a lease is added or renewed.

So, trying to tie some of those thoughts back into this use-case... _If_ you have an access control system which can prevent arbitrary lease renewal then you can lean on lease expiration to disallow downloads. You don't even need to turn on the garbage collector in this case. The shares will remain stored but unreadable. You can authorize the renew lease operation based on your payment processing system to restore access to affected shares to users who pay their bill. If you _also_ want to be able to eventually garbage collect something then you do need some kind of two-tiered share expiration system. You have some period of time when the share is retained and access is allowed. Then you have some period of time when the share is retained and access is denied. Then you have a point in time when the share becomes fair game for garbage collection. You could define these periods in terms of intervals. If a lease lasts 31 days then perhaps a "storage grace period" extends for another 31 days beyond the end of the lease. Then 62 days after a lease is taken on a share, the garbage collect may delete the data. Tahoe-LAFS already has a configuration option which can probably be (ab)used to provide part of what's required here: ``` [storage] expire.enabled = true expire.mode = age expire.override_lease_duration = 62days ``` With this configuration, a storage server will not consider garbage collecting shares until the associated lease is at least 62 days old. With an access control system (<https://tahoe-lafs.org/trac/tahoe-lafs/milestone/storage%20economics%20plugins>) that is separately configurable and enforces denial of operations (except for lease renewal) when the lease is older than some smaller age, the desired behavior is achieved. This might look like: ``` [storage] plugins = tahoelafs-simplepaymentsauthorizerexample-v1 [storage.plugins.tahoelafs-simplepaymentsauthorizerexample-v1] expire.lease_duration_for_access = 31days ``` (<https://tahoe-lafs.org/trac/tahoe-lafs/ticket/3053>) Thus, access is allowed for 31 days after a lease is added or renewed but the share is retained for 62 days after a lease is added or renewed.

Sign in to join this conversation.

No labels

c/code-dirnodes

c/code-encoding

c/code-frontend

c/code-frontend-cli

c/code-frontend-ftp-sftp

c/code-frontend-magic-folder

c/code-frontend-web

c/code-nodeadmin

c/code-peerselection

c/dev-infrastructure

kw:AttributeError

kw:DataUnavailable

kw:DeadReferenceError

kw:GetLastError

kw:IFinishableConsumer

kw:LeastAuthority

kw:RIStorageServer

kw:UncoordinatedWriteError

kw:access-control

kw:accessibility

kw:accounting-crawler

kw:anti-censorship

kw:api_auth_token

kw:authentication

kw:availability

kw:backward-compatibility

kw:blocks-cloud-deployment

kw:blocks-cloud-merge

kw:blocks-magic-folder-merge

kw:blocks-merge

kw:blocks-release

kw:brians-opinion-needed

kw:build-helpers

kw:cloud-backend

kw:coding-standards

kw:coding-tools

kw:coding_tools

kw:compatibility

kw:confidentiality

kw:configuration

kw:configuration.txt

kw:connectivity

kw:control.furl

kw:coordination

kw:coveralls.io

kw:create-container

kw:cryptography

kw:cryptography-lib

kw:denial-of-service

kw:desert-island

kw:desert-island-build

kw:design-review-needed

kw:dev-infrastructure

kw:directory-page

kw:disk-backend

kw:earth-dragon

kw:erasure-coding

kw:excess-authority

kw:extensibility

kw:file-descriptor

kw:floatingpoint

kw:forward-compatibility

kw:forward-secrecy

kw:garbage-collection

kw:google-cloud-storage

kw:google-drive-backend

kw:grid-manager

kw:illustration

kw:inlineCallbacks

kw:integration-test

kw:interoperability

kw:interstellar-exploration

kw:introduction

kw:key-value-store

kw:magic-folder

kw:manual-test-needed

kw:more-info-needed

kw:mountain-lion

kw:multiuser-gateway

kw:needs-review

kw:notification

kw:notifyOnDisconnect

kw:openitp-packaging

kw:operation-helpers

kw:optimization

kw:organization

kw:otf-magic-folder-objective1

kw:otf-magic-folder-objective2

kw:otf-magic-folder-objective3

kw:otf-magic-folder-objective4

kw:otf-magic-folder-objective5

kw:otf-magic-folder-objective6

kw:peer-selection

kw:pkg_resources

kw:preservation

kw:pycrypto-lib

kw:pyfilesystem

kw:random-access

kw:raspberry-pi

kw:release-blocker

kw:removable-disk

kw:reserved_space

kw:response-needed

kw:response-time

kw:review-needed

kw:self-contained

kw:servers-of-happiness

kw:setup_requires

kw:setuptools_darcs

kw:simultaneous

kw:space-efficiency

kw:static-analysis

kw:stats_gatherer

kw:tahoe-add-alias

kw:tahoe-archive

kw:tahoe-backup

kw:tahoe-create-alias

kw:tahoe-create-introducer

kw:tahoe-deep-check

kw:tahoe-deepcheck

kw:tahoe-lafs-trac-stream

kw:tahoe-list-aliases

kw:tahoe-magic-folder

kw:tahoe-manifest

kw:tahoe-restart

kw:tahoe-unlink

kw:tahoe-webopen

kw:test-and-set

kw:test-from-egg

kw:ticket999-s3-backend

kw:to-be-closed-on-2011-08-01

kw:tor-protocol

kw:transparency

kw:tub.location

kw:twisted-trial

kw:uncoordinated-writes

kw:unfinished-business

kw:unhandled-error

kw:upload-helper

kw:visualization

kw:volunteergrid2

kw:warners-opinion-needed

kw:welcome-page

kw:windows-related

kw:world-domination

kw:write-enabler

kw:zookos-opinion-needed

kw:zope.interface

p/supercritical

r/cannot reproduce

r/somebody else's problem

r/was already fixed

v/1.9.0-s3branch

No milestone

No project

No assignees

4 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: tahoe-lafs/trac#2084

No description provided.