There are many existing distributed file systems. Each file system provides a different degree of performance and safety. In this context, performance is the time required to satisfy individual requests, and safety is the set of guarantees that the file system provides to users. In this thesis, we characterize many of the trade-offs between performance and safety. We include numerical relationships whenever possible. As a corollary, it is shown that a flexible file system - one that provides a wide range of possible safety properties - can also have very good performance. This thesis uses two main approaches, practical and theoretical. The practical approach centers around the Deceit File System. Deceit supports file replication, file migration and a sophisticated update control protocol. Deceit can behave like a plain Sun Network File System (NFS) server and can be used by any NFS client without modifying any client software. Deceit servers are interchangeable and collectively provide the illusion of a single large server machine to its clients. The theoretical approach presents several results that are applicable to all distributed file systems. A careful analysis of many systems yielded insights into the behavior of successful file systems. We formalize the relationships between safety conditions exposed by this analysis. We also determine the cost of reading and writing a file given different sets of safety conditions. In conclusion, we find that Deceit does not totally meet the goal of being efficient under all possible sets of requirements. Deceit is highly efficient for cases that require a high degree of replication and safety, but it is inefficient in cases where very specific optimizations are possible. However, the flexibility that Deceit provides is still very useful. For example, we show that writing to a file with three replicas costs a factor of 5 more messages more than writing to a file with one replica. Allowing asynchronous disk writes instead of synchronous writes can decrease latency by a factor of more than 30. Since Deceit allows the user to choose among these possibilities, dramatic performance gains can be achieved in many cases.