Your NAS Is Online. That's the Whole Problem.

You bought the box so you could stop worrying. No more renting space on a platform you don't trust. No more wondering who can look at your files on someone else's server. Your own cloud, in your own house, under your own control. It sounded like the grown-up answer.

Then came the night a firmware vulnerability alert woke your phone, and you were up at 2 a.m. reading a security advisory about a product sitting ten feet from your bed. That was the moment the deal revealed itself: you hadn't bought peace of mind. You'd bought a second job — one with no days off, where the shift never ends, because the box never sleeps.

This is the part nobody puts on the box. A NAS is a server, and a server that is reachable from the internet is a target, all day, every day. The question isn't whether you're clever enough to run one. The question is whether you want to spend the rest of your life being your own sysadmin for the things that matter most to you.

You Became Your Own Sysadmin

Be honest about what the purchase actually entailed. Port forwarding rules. Dynamic DNS. User permissions. Firmware updates you have to notice, download, and install yourself. A VPN you set up once and then quietly stopped checking. Somewhere along the way, the hobby became a responsibility, and the responsibility became a low, permanent hum of anxiety.

The self-hosted community knows this feeling well. There's a particular kind of self-irony in it: the person who set out to escape the cloud now spends more time maintaining infrastructure than the cloud company ever asked of them. You wanted freedom from platforms. What you got was a pager that goes off whenever a stranger finds a new hole in your hardware.

And here's the uncomfortable truth about that arrangement: it only takes one lapse. One update you meant to install and didn't. One port you opened for convenience and forgot to close. One password that was good enough until it wasn't. Security built on your sustained attention is security with a single point of failure, and that point of failure is you, on your busiest, most tired day.

The Ransomware Already Knows Your Address

This isn't hypothetical. In 2021, the Qlocker attack went after QNAP home and small-office NAS devices, encrypting people's files remotely and demanding ransom for their return. The eCh0raix ransomware family has returned in new variants over the years, again and again targeting home NAS boxes from Synology. These attacks didn't pick on NAS devices by accident. They picked them because a home NAS is exactly the kind of target ransomware likes: always on, reachable from the internet, and maintained by someone who has a day job that isn't IT security.

Think about the symmetry for a moment. The feature that sold you the box — "access your files from anywhere" — is the same feature an attacker needs. If you can reach it from a hotel room, someone else can try to reach it from anywhere on earth, at any hour, with automated tools that never get tired. Your NAS doesn't distinguish between your legitimate remote login and a thousand illegitimate attempts. It just sits there, listening, around the clock.

Seneca wrote that we suffer more in imagination than in reality, but a NAS owner knows the reverse is also true: the danger you stop imagining doesn't stop existing. The box in the closet keeps listening whether you're thinking about it or not.

The Familiar Alternatives Have the Same Hole

It's worth being fair about the other options, because none of them solve this either — they just move the hole somewhere else.

Phone cloud albums and consumer drives are convenient right up until you ask who else can see them, or what happens when an account gets locked, a subscription lapses, or a provider changes its terms. A single portable hard drive on a shelf is quiet and offline, but it's one copy, and one copy is a story about luck, not about care. A bank safe deposit box is a locked metal drawer in a building with business hours; it protects against theft, not against decay, and it does nothing for the files that need to stay usable. Hiding things at home — the drawer, the attic, the back of the closet — protects them from no one who actually looks, and from nothing that actually decays.

Every one of these is a version of the same bargain: convenience, or control, or secrecy, but never all three at once, and never with anyone actually responsible for the outcome. You're still the one watching, remembering, maintaining, worrying. The job just changes shape.

Offline Is Not Old-Fashioned. It's the Only Door That Isn't Open.

Here's the reframe that matters: taking something offline is not going backward. It's the only move that removes the attack surface entirely. A drive that is not connected to anything cannot be reached by ransomware, because ransomware travels over networks, and there is no network to travel over. No port to scan. No firmware to exploit. No login page to hammer at 3 a.m. The absence of a connection isn't a limitation of the medium. It's the whole point.

Arendt observed that what makes a thing durable is not that it is hidden, but that it is cared for in a world that keeps moving past it. A drive on a shelf in your house is not being cared for; it's being ignored, which is a different thing entirely. Real care has a shape: a number assigned, a seal applied, a photograph taken, a second person verifying what the first person did. A record that the thing exists, that it is intact, that nobody has touched it since. That is what professional custody looks like, and it is the opposite of a box blinking in your closet while you sleep.

What you actually want from all of this was never the box. It was the feeling the box promised and couldn't deliver: that the things that must never be found by anyone are safe, that they will still be there in ten years, and that you can stop thinking about them. That feeling doesn't come from better administration. It comes from handing the responsibility to people whose entire job is the responsibility — people who check the seal and photograph the outside of the package twice a year without ever opening it, who only ever look closer if you have asked them to in writing, and who treat your drive the way a good archive treats a manuscript: as something entrusted, not something stored.

So ask yourself the question the NAS never asks you: do you want to spend the next decade being on call for your own secrets? Or do you want them somewhere no network can reach, in the hands of people who do nothing else but keep them, sealed, numbered, and verified?

The box was a good idea. It just solved the wrong problem. The problem was never where your files live. The problem was that anything connected can be found — and the only things that are truly safe from being found are the things that aren't connected at all.