« HP's Whac-A-Mole VTL | Main | Whac-A-Mole Part II »

July 16, 2008


Feed You can follow this conversation by subscribing to the comment feed for this post.

Kostadis Roussos


My name is Kostadis Roussos and I am a Technical Director at NetApp.

In spite of the claims in the original post, NetApp SnapLock Compliance continues to work.

Why did we not communicate before now? We are certain that it would take malicious intent AND more architectural knowledge than anyone other than our own design engineers possess to exploit the issue. The flaw can not be exploited by accident.

Was Customer data at risk? Only if our customers have staff criminally intent on destroying data. It would become apparent very quickly at a customer site if the flaw had been exploited. In fact the key point of note is that no vendor can guarantee with 100% assurance that data will never be lost due to any circumstance.

The Compliance business is all about trust and due diligence. NetApp discovered the flaw during rigorous multi-product testing. We have fixed the flaw in a timely manner.

All software companies have bugs, some are more serious than others. If, in NetApp’s judgement, an earlier warning had been warranted, we would have published it. No customer has reported lost or corrupted Compliance data due to this flaw. This was not an issue which warranted earlier communication. That even a required upgrade notification can be so badly distorted, into an unwarranted assertion that the product was never compliant, only calls into question the motives and credibility of the poster.

Due diligence says customers should upgrade now that we have released versions which fix the flaw.

You can read my blog at


The comment is reasonable and informative so I am putting it up for the readers.

I do understand the "obscurity vs. disclosure" argument when it comes to security flaws. At the end of the day, this is a pretty serious one. It prevents/damages the core function of the software. I can appreciate NetApp's position, but I still wouldn't want to be the one to explain to an auditor how long I was going to be non-compliant for.

Edit: I am going to append this with one more comment. Having incite the invective machine over at NetApp (again), I would love a genuine legal opinion on this: if you store something in a non-compliant way for a year, can you later make it compliant? If a chain of custody is broken, can it be re-forged? If all that data under SnapLock isn't compliant now, and you can't prove that it is authentic now, then upgrading SnapLock is no more than letting the horse out after the barn has burned down. All that data? Never compliant again.

The comments to this entry are closed.

Search The Backup Blog

  • Search