Re: Non-RW media; WORM hopes

Unfortunately, just like other RW media DVD-RAM won't work for this
purpose - they all allow complete deletion/overwrite of files &
inodes, which is unacceptable for WORM (write-once, read-many).  The
drawback of the media "getting smaller and smaller as files are
deleted" would be considered a feature, especially considering many
people *never* want certain files (esp. logs) deleted, regardless of
who attempts to do so.  Imagine, if you will, the following scenario:

1.  Mount DVD-R via pktcdvd under /var/log/WORM
2.  Direct syslog daemon to write a copy of all log files to
/var/log/WORM/somefilename
3.  System is compromised, attacker attempts to [clumsily] erase their
tracks by removing log files
4.  Logs are recoverable by adding '-o unhide,undelete' when mounting
the DVD from another system during post-mortem.

Of course, a simple cron job similar to tape-change reminders would
have to be set up to aid in managing the space available, but that
would be the easiest part.  If someone tried to be more subtle and
just modify part of a file, it would be terribly obvious as well,
since an inode out of the middle of a previously linear file would
suddenly leapfrog forward.

I'm sure there are additional use scenarios, but this is the specific
one I'm trying to address and am bit surprised that no one seems to
have brought it up before.  I can see & understand everyone's
fascination with rewritable media as cheap temporary storage, but a
readily available, cheap storage medium that is _physically_ immutable
short of destruction has equally fascinating applications, especially
if we were able to write to it incrementally.


RB