tecleandor
a day ago
Not only that, but their security situation is terrible. Their OS is full of EOL'ed stuff.
On products you can buy TODAY, you find:
- Their Btrfs filesystem is a fork of a very old branch and doesn't have modern patches
- A custom, non standard, self built, ACL system for the filesystem
- Kernel 4.4
- PHP 7.4 (requirement for their Hyperbackup app)
- smbd 4.15
- PostgreSQL 11.11
- smbd 8.2p1
- Redis 6.2.8
- ...
They claim it's OK because they've backported all security fixes to their versions. I don't believe them. The (theoretical) huge effort needed for doing that would allow them to grow a way better product.And it's not only about security, but about features (well, some are security features too). We're missing new kernel features (network hardware offload, security, wireguard...), filesystem (btrfs features, performance and error patches...), file servers (new features and compatibility, as Parallel NFS or Multichannel CIFS/SMB), and so on...
I think they got stuck on 4.4 because of their btrfs fork, and now they're too deep on their own hole.
Also, their backend is a mess. A bunch of different apps developed on different ways that mostly don't talk to each other. They sometimes overlap with each other and have very essential features that don't work and don't plan to fix. Meanwhile, they're busy releasing AI stuff features for the "Office" app.
Edit note: For myself and some business stuff, I have a bunch of TrueNAS deployments, from a small Jonsbo box for my home, to a +16 disk rack server. This was for a client that wanted to migrate from another Synology they had on loan, and I didn't want to push a server on them, as they're a bit far away from me, and I wanted it to be serviceable by anyone. I regret it.
Shank
a day ago
The encryption is also broken. If you use encrypted shared folders, you have an arbitrary filename limit (https://kb.synology.com/en-ro/DSM/tutorial/File_folder_path_...). If you use volume encryption, your encryption key is stored on the NAS itself, which is capable of decrypting the data, unless you buy a second Synology NAS (https://blog.elcomsoft.com/2023/06/volume-encryption-in-syno...) to act as a key vault. Synology claims that volume encryption protects if you if the storage drives are stolen, but in what world would the drives, and not the NAS itself, be stolen?
HighGoldstein
18 minutes ago
> but in what world would the drives, and not the NAS itself, be stolen?
Not to defend Synology, but popping a drive out of the NAS so that it won't be noticed (or noticed much later) is a much easier way to steal data than carrying off the whole NAS. I assume they're guarding against the kind of scenario where an employee steals steals drives rather than ski-masked thieves breaching the office and making off with the NAS.
8fingerlouie
21 hours ago
The filename limit comes from ecryptfs (https://www.ecryptfs.org/) which is what Synology uses for encrypted shared folders.
As for full disk encryption, you can select where to store the key, which may be on the NAS itself (rendering FDE more or less useless) or on a USB key or similar.
tecleandor
19 hours ago
For full disk encryption you need DSM >= 7.2 and you can either, store it locally (useless) or in a KMIP server. [0]
As a KMIP server you use:
- Another Synology NAS with DSM >= 7.2
- A KMIP compatible key server
Except for the demo implementation that Synology uses (PyKMIP), all the KMIP compatible servers I've found have licenses in the tens of thousands a year. So if anybody has any suggestions to substitute PyKMIP...--
0: https://kb.synology.com/en-global/DSM/tutorial/Which_models_support_encrypted_volumes
8fingerlouie
16 hours ago
I remembered wrong. I’m fairly certain that Synology, at some point, allowed you to store the encryption vault on an external (USB) drive, but apparently not anymore.
MobileVet
14 hours ago
You didn't remember wrong, I have mine stored on an external drive. I am using DS 6.x though
aborsy
8 hours ago
Why can’t the user enter the encryption passphrase in DSM, which is actually the default in LUKS and allowed in TrueNAS etc?
The DSM itself lives in an unencrypted partition or volume. Applications with data in encrypted volumes will be inaccessible until the volumes are unlocked.
As usual, there is an easy workaround. You can run a KMIP server in a docker container and set up an external keystore. Once synology allows you to proceed with volume encryption, you can discard the KMIP server if you want and use the recovery keys.
mtillman
14 hours ago
My disk station uploaded 54gb to synology servers the other day before I had my router block outbound. Trash product.
tecleandor
a day ago
Ah, I forgot about that. I had to take the key out of the NAS too, to a different device. That made no sense at all. And almost all of the implementations of the key server you need cost thousands of dollars in licenses.
Edit: what they deploy on their NAS is an old version of a testing implementation of the KMIP protocol. PyKMIP: https://github.com/OpenKMIP/PyKMIP
cyberpunk
a day ago
maybe it has a kensington lock?
cyberax
16 hours ago
You can move out the key from the device using KMIP. I have an implementation that uses a Go-based service to store it in Nitrohsm. I'll clean it up and post a release announcement on Reddit...
tecleandor
14 hours ago
That'd be great, as the PyKMIP implementation wasn't very intuitive... (Nor Synology docs...)
cyberax
12 hours ago
Synology actually uses PyKMIP under the hood. They basically use it as a key-value storage for the encryption key, nothing advanced.
I went down the rabbit hole and implemented the KMIP client and server, that pass the tests from OASIS.
Sidenote: please, somebody nuke the OASIS from orbit. To be sure.
kace91
a day ago
My main issue with their system is how closed it is.
I got an issue where mind would randomly start writing disk like crazy and maxing cpu usage, to the point I was bothered by the noise. I’d stop all containers, leave it as close to idle as I could manage, still spiking.
There was no way I could learn what was causing it.
I would like to assume it was a disk maintenance process or something, but for all I know it could be mining bitcoin and I’d be none the wiser. It went on for some weeks then stopped.
nolok
a day ago
Ever since they added the "universal search" thingy, their NAS do that anytime they reach a decently large video file. Even if you turn down search indexing, media indexing, media thumbnails, ... It still kills itself with no throttling processing those files.
May or may not be what you encountered, but had a customer caught by this and found out the hard way you can't stop it. My issue is not the processing, it's the throttling, it's so crazy how the entire NAS gets taken down for like ten minutes (and that was on a racked xeon model), no samba no nfs no nothing answering anymore.
kace91
19 hours ago
That might be it, I use it for radarr/sonarr so there’s a good amount of large video files in there.
And yes, the lack of trotting is an issue, since you can’t even reach an administration panel. When it’s bad even ssh struggles.
lostlogin
a day ago
> writing disk like crazy and maxing cpu usage, to the point I was bothered by the noise.
Mine is in the basement for this reason. When it’s still and quiet after midnight I can still hear it grinding away. God I hate the sound.
tetris11
19 hours ago
There are guides on how to mainline Synology NAS's to run up-to-date debian on them
jauntywundrkind
17 hours ago
People seem very attracted to Synology because it requires very little thought & effort.
FWIW the new Ugreen NAS run Debian. I don't know a ton about it, but it's be great if they could stay a little more up to date. This Synology story with ancient forks & weird encryption sounds truly bogus.
tetris11
16 hours ago
I'm attracted to them because you can find them secondhand on ebay for very cheap, and their power draw / performance ratio is quite decent compared to other systems.
I will say that the Ugreen NAS seems to offer more performance for less watts, so it's definitely something I will keep an eye on in the future if it pops up on Ebay.
> This Synology story with ancient forks & weird encryption sounds truly bogus.
It's not. My Synology is running Linux kernel v4, and I opted to use their "SHR" RAID configuration and can confirm that it's some weird BTRFS variant that is likely deadlocked due to the kernel.
The encrypted volumes I've made also look very much like the EcryptFS files I've been seeing on other setups.
I'm currently in the process of mainlining it to kernel v6 to reap the better power and idle / hibernation rewards, as well as just using a standard Ext4 FS with updates
import
9 hours ago
I have a Ugreen, just got the latest update runs on kernel 6.12
layer8
12 hours ago
If you want to run Debian instead of DSM, you have a much wider choice of NAS hardware than just Synology.
Kototama
18 hours ago
You could activate the sshd service and log in to the NAS.
OptionOfT
11 hours ago
They also have this weird full disk encryption that doesn't validate that the boot partition is compromised, allowing exploits like this: https://forums.spacerex.co/t/bounty-first-person-to-share-ho...
This breaks both the 'store key locally' and the KMIP setup.
And for their file-based encryption you cannot change the password. You need to create a new folder with a new password and copy all files over.
dansmith1919
a day ago
> A custom, non standard, self built, ACL system for the filesystem
But don't you love it when companies invent their own security instead of using battle-tested open-source systems?
8fingerlouie
21 hours ago
> Multichannel CIFS/SMB)
My DS918+ has multichannel SMB and possibly also parallel NFS. It only works if you have multiple NICs connected.
Other than that, i completely agree. Their tech stack is horribly outdated, and while i understand their reasoning for not upgrading, there's a limit to how long you can do that. Their reasoning is that they know the software that's currently running, warts and all, and can better guarantee stability across millions of devices with fewer moving parts.
tecleandor
19 hours ago
I think multichannel works, but pNFS doesn't. But I also think I had another different feature in mind, I was just reciting by memory :P :)
jraph
a day ago
Why do they need to use an old Brtfs fork? What is missing in the mainline kernel for them?
kalleboo
8 hours ago
I don't know if this is the reason, but supposedly their btrfs fork contains a custom integration with mdraid/lvm so that when btrfs detects a bad block, it signals lvm to do a repair. This is their solution to avoid using btrfs raid5/6 which is still marked unstable.
ethersteeds
20 hours ago
As I understand it, they forked years ago when btrfs was very much not ready to be used for production NAS storage. Their value prop was they took it and added lots of their own special patches that they claimed made it highly dependable.
Over time their advantage has eroded as upstream has caught up, to the point that it looks ridiculously out of date today.
arp242
17 hours ago
And given they're using very old versions of everything, it just sounds like dysfunction and/or moribund development.
ffsm8
a day ago
You regret switching them from Synology to Trueness? Am I misunderstanding your final note?
It's confusing me after the preceding displeasure wrt Synology
tecleandor
19 hours ago
I regret not pushing a bit more for deploying a custom storage solution with TrueNAS (or something similar) instead of Synology. All the TrueNAS devices I have are mine, not from my clients.
They already had one Synology device, they don't have any IT employees on site, and I'd need to take a flight to go to their offices, so I thought that using another Synology device would be better for maintenance. They (and I) were also worried about the noise: it's an small office, and they needed at least 8*3.5" drives, and most of the decent solutions I found for 8 or more drives were big and noisy. The Jonsbo N5 appeared a bit later, that looks like a good candidate today.
Now I found that all their applications are half done, they don't upgrade or fix them regularly, security-wise is a mess, and everything on the backend is super old...
happytoexplain
21 hours ago
"This" in the last paragraph refers to the rest of the comment, not to the preceding sentence.
edem
14 hours ago
I have a DS 923+. These extremely old softwares you mentioned were always weird to me but everything worked fine so far. What I'm not happy about is the vendor lock in, and the abysmal virtualization / transcoding performance. I want a NAS that comes with a similar ease of use as the DSM, but can double down as a __very lightweight__ virtualization platform for my local test deployments and as a media PC that I can rely on. What would you suggest?
Marsymars
13 hours ago
I'd suggest separate systems for NAS and media serving.
I've a Ryzen Embedded system with lost of RAM as my NAS box and a small Intel N-series based system as my Plex server that pulls media off the NAS box.
benoau
13 hours ago
Yeah but these days you can easily have one system with 10 - 20 cores so you should be able to handle both workloads very well.
Marsymars
13 hours ago
You can, but for media serving and transcoding you ideally want Intel Quick Sync, and it's simpler to have separate systems for your Quick Sync system and your "many cores" system.
benoau
11 hours ago
Both of the CPUs you mention are low-power I don't think this a problem for slightly meatier processors unless you need the GPU or Quick Sync for multiple purposes?
Marsymars
10 hours ago
Sure, you can get a meaty recent-gen Intel processor and get Quick Sync and plenty of cores, it just gives you awkward dependencies - you then a) can't get a non-Intel-based system without losing Quick Sync even if they're better value/performance/performance-per-watt and b) you can't upgrade your transcoding CPU without doing a whole new build of your meaty system, which is high-cost if you've got an especially meaty system.
(You might want to upgrade your transcoding box to a newer generation processor that supports, say, AV1 encoding.)
And FWIW my Ryzen Embedded system isn't especially low-power by design, it was just the most accessible way of getting ECC memory for me.
edem
10 hours ago
What does Quick Sync do? I'm new to this.
Marsymars
9 hours ago
It decodes and encodes video streams with very low power draw and CPU load, so you can transcode media in realtime if your player device doesn't support the media format in question or you have bandwidth limits out-of-home.
Can do the same with various GPUs, but Quick Sync tends to be the lowest-power and most well-supported at the software level.
Mars008
10 hours ago
How about miniPC + USB x bay enclosure? I'm thinking about it. Have 4 Synology NAS mostly as long offline storage. No problems with them in this role so far.
nh43215rgb
13 hours ago
Truenas scale?