Principles of storage worth trusting, and why I built a community-run network around them.
Every guide to backups repeats the same rule: three copies of your data, on two different kinds of media, one of them somewhere else. Most of us implement "somewhere else" by uploading to a cloud provider and calling it done.
That is not wrong. But it is worth noticing what you actually bought. You did not buy redundancy, geographic distribution, or privacy. You bought a promise about those things from a company, priced monthly, governed by terms of service that can change, running on infrastructure you cannot see, in a jurisdiction you may not have chosen. The copy exists as long as the company does and as long as it wants to keep serving you.
I spent the last year building an alternative, not because the cloud is bad, but because I wanted to understand which properties of "a safe place for my data" are essential, and whether a community of ordinary people with ordinary hardware could provide them for each other. The project is called RedundaNet. This article is about the principles behind it more than the engineering, and about why those principles are useful to anyone, including companies, who wants to own their storage instead of renting it.
Where it started: a box that wanted to be a commons
In 2019 I backed a Kickstarter for a product called Cubbit. The pitch was lovely: a small box you plug in at home. Your files get encrypted, split into pieces, and spread across everyone else's boxes. No data center. Storage as a shared commons, where each participant contributes a little disk and gets back a resilient, private place for their data.
I got the box. Then the company did what companies must sometimes do: it pivoted to enterprise object storage. A reasonable business decision, and I hold nothing against them. But it illustrates the first principle better than any argument could: a network owned by a company can pivot away from the people using it. The idea I cared about was not wrong, it was orphaned.
The only kind of network that cannot pivot away from its members is one the members run themselves.
Seven principles for storage worth trusting
Building the thing forced me to be explicit about what "safe" means. These are the properties I ended up designing for. They apply whether you use a cloud provider, a NAS in your closet, or a community network.
1. Redundancy you can count, not assume
A single copy is not a backup. Two copies on the same disk are not a backup either. Real redundancy means the loss of any one machine, disk, or site leaves your data intact and retrievable.
The elegant way to do this is called erasure coding. Instead of storing whole copies, a file is split into a number of pieces, and any few of them are enough to rebuild the original. Store it as, say, four pieces of which any two suffice, and you can lose two machines and lose nothing, at the storage cost of two full copies. The mathematics has been around for decades; RAID uses a version of it inside one box. Distributed storage uses it across many boxes.
What matters more than the scheme is verification. RedundaNet has a public status page that counts, continuously, how many copies of every stored object actually exist on distinct machines. I have deliberately shut nodes down and downloaded files through the survivors to confirm they come back byte for byte. Redundancy you have never tested is a hope, not a property.
2. Geographic distribution
Fire, flood, theft, a burst pipe, a burglar who takes "the electronics." Every one of these takes your local copy and your local backup together. Distance is the only defense: copies should live in different buildings, ideally different cities.
A community network gets this for free. Its members are already spread out: a Raspberry Pi in one apartment, an old laptop in another, a home server across the country. No single event touches more than one of them.
3. Privacy by construction, not by policy
The honest version of most privacy policies is: "we can read your data, but we promise not to." The stronger version is: "we cannot read your data, and here is why."
The difference is where encryption happens. If your files are encrypted on your own device before they leave it, and the key never leaves with them, then whoever stores them holds ciphertext and nothing else. It does not matter whether the host is a company, a stranger's Raspberry Pi, or a subpoena. There is nothing there to read.
This was non-negotiable for RedundaNet, because the people storing your data are, by design, other members of the community. You should not have to trust them, and they should not have to trust you. Everyone holds pieces of everyone else's ciphertext, and nobody can open anything but their own.
4. Data sovereignty
Sovereignty is a word that gets used for governments, but it applies to individuals and organizations too. It means: who ultimately controls the existence of your data? Who can delete it, change the price of keeping it, lock you out of your account, or hand it to a third party?
With a provider, the answer is the provider. You hold the login; they hold everything else.
With storage you run, the answer is you. You hold the keys, you hold the infrastructure, and the rules are written in files you can read. In RedundaNet, the entire definition of the network, its members, their addresses, the redundancy scheme, lives in a Git repository. Membership is a line in a file. Changing the rules is a pull request that a human reviews and merges.
5. No central authority, and the right to leave
A system with a single indispensable party has a single point of failure that is not technical but political. Even with good intentions, that party can go bankrupt, get acquired, or lose interest.
So the question to ask of any storage system is: what happens if the people who run it disappear tomorrow?
For RedundaNet the answer is: nothing, structurally. Identity is a cryptographic key you generate and own. The network definition is a Git repository anyone can clone. The software is open source under the GPL. If I vanished, the members could keep running the network, or fork the repository and start their own, without asking anyone.
That right to leave, to fork, is not a fallback. It is the feature.
6. Honesty about trust
Every system trusts something. The mistake is hiding what.
RedundaNet does not pretend to be a trustless network of anonymous strangers. Membership is a social process: you apply, your cryptographic identity is verified, and a person approves you. Members are known humans. That single decision makes a lot of other things simpler and more honest. Some rules can be enforced by software; others can be an honor system among people who vouched for each other, and we say so openly instead of pretending the code does it.
This is closer to how a co-op works than to how a marketplace works, and I think that is the right model for infrastructure shared among people who actually know each other.
7. Boring operations
The final principle is the least glamorous and the most important: the thing must be easy to run, or nobody will keep running it. A community network is only as reliable as the least technical member's willingness to keep their node on.
Everything in RedundaNet is one configuration file and one command to start, a self-update that checks the node is healthy and rolls itself back if it is not, and a status page that tells you what is wrong before someone has to ask. A network that needs a sysadmin is a network that will not outlive its sysadmin.
What it looks like in practice
For the curious, the stack in one paragraph: files are encrypted and erasure-coded by Tahoe-LAFS, a storage system designed from the start on the assumption that storage servers are untrusted. Nodes talk over a private mesh VPN that works behind ordinary home routers. Each node's identity is a GPG key, published to the same public key servers people have used for decades. Docker packages it so that a node is a Raspberry Pi, an old laptop, or a home server with a spare disk. A small hub with a public address helps nodes find each other and serves the public status page.
To join, you generate a key, submit its fingerprint through a form, a bot verifies the key exists and matches exactly, and a maintainer merges the pull request that adds you. A few minutes later, the network knows you. You are storing pieces of other people's data, and they are storing pieces of yours.
It is not a replacement for a fast synced folder. It is an archive: the place you put the things that must survive. My own node exposes a normal network share to my home; what lands there is quietly and continuously replicated into the network.
The part I find most interesting: anyone can fork this
RedundaNet is one network, run by one community of friends. But the model is a template, and the template is where the real value is.
The repository, the join process, the identity system and the tooling are all general. Fork it, edit one file with your own network name and members, and you have your own private storage commons, governed by your own rules, with no dependency on me or on the original network.
Consider who has hardware and does not use it:
- A company with hundreds of thin clients or desktops, each with a disk mostly empty and a network that is idle at night. That is a large, geographically distributed, already-paid-for storage fleet. Erasure-coded across those machines, it becomes a highly available archive that survives any office losing power, at a marginal cost of zero. The data never leaves the company's own devices, which for many regulated industries is not a nicety but a requirement.
- A university or research group spread across buildings and campuses, with the same idle disks and a real need to keep datasets for years.
- A family or a group of friends who would each buy a small box if it meant their photos survived any one house.
- Any organization uncomfortable with a single provider holding all its data, for reasons of cost, jurisdiction, or simple prudence.
In each case the principles above are not abstract. They are the reasons the company, the university, or the family should own the network rather than rent it: redundancy they can verify, distribution they already have, privacy that does not depend on a policy, and sovereignty that does not depend on anyone else's business plan.
The invitation
If you have a spare Raspberry Pi and a few hundred gigabytes, and the idea of co-owning a piece of infrastructure with other people appeals to you, the door to RedundaNet is a pull request away.
If you run an organization sitting on idle disks, fork it and build your own. The code is open, the design is documented, and the network has been running in production long enough to have made, and fixed, the interesting mistakes.
Either way, the principles are the point. Ask them of whatever you use today. Can you count your copies? Are they far apart? Can the host read them? Who decides whether they still exist next year? And what happens if that someone disappears?
If you do not like the answers, you now know it is possible to change them.
About the author
Alessandro De Filippo works at Celonis in Munich, Germany. Originally from Prato, Italy, he co-founded the Pistoia Linux User Group in 2003 and served as its vice president for nearly a decade, has been a Fellow of the Free Software Foundation Europe since 2012, and is a member of the IEEE and the IEEE Communications Society. He has a long-standing interest in the infrastructure behind everyday life: telephony with Asterisk, home automation, and servers he would rather own than rent. RedundaNet is the current expression of that interest: storage run by a community, not a company.
Find him on LinkedIn and GitHub.
RedundaNet is open source (GPL): redundanet.com · live status page · source on GitHub
