Item — HN Reader

Having different read/write permissions is an important durability consideration. In this case the CEO has read privs (not write) and the archive utilities have write privs, not read.

There are other problems of course, CEO being hit by a bus being the most obvious.

1 comments

> In this case the CEO has read privs (not write) and the archive utilities have write privs, not read.

Not sure you could really make this work.

The archive utilities would also need to be barred from overwriting or deleting backups. If that's automated, who configures it? And how do you do differential backups without read privileges?

The archive utility, when run as the backup user, cannot read the file but it can read file metadata or have a database of backup state so it knows where to send differential backups.

The archive utility, run as the recover user, can only read the file.