[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

Re: Shredding private/confidential information‏

From: Blair Zajac <blair_at_orcaware.com>
Date: Mon, 27 Apr 2009 17:56:35 -0700

Ryan Schmidt wrote:
> On Apr 27, 2009, at 17:19, Todd C. Gleason wrote:
>
>> I'm not arguing against a universal OS solution, but I wouldn't
>> hold my breath for one either. I was merely pointing out that
>> Subversion could choose to offer security enhancements in this
>> area. If you did put shredding in, you might want an svn
>> subcommand to shred an entire WC as well.
>>
>> Note that I'm also not debating the priority of such a feature
>> (because I don't personally need it).
>>
>> However, arguing that some things are out of your control seems to
>> me like saying that it's not worthwhile to do X unless everybody
>> else is doing it. (Pick your favorite altruistic cause here.)
>> Besides, for those non-svn areas the user may already have
>> shredding utilities, and simply want something to cover the svn
>> portion.
>
> But, to your first paragraph, there would be absolutely no difference
> in shredding an entire working copy vs. shredding any other directory
> on your computer. Just install a secure deletion program and use it
> on the working copy, or any other file or directory.

There are temporary log files and other files svn client will use during its
normal operation which will get deleted, so the bytes will still exist on the
disk platter.

The best bets are to:

1) Sponsor the work in svn so that the deletions are secure :)
2) Put /tmp, $TMPDIR and the working copy on an encrypted filesystem.

Regards,
Blair

------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=1065&dsMessageId=1955189

To unsubscribe from this discussion, e-mail: [users-unsubscribe_at_subversion.tigris.org].
Received on 2009-04-28 02:58:45 CEST

This is an archived mail posted to the Subversion Users mailing list.

This site is subject to the Apache Privacy Policy and the Apache Public Forum Archive Policy.