Hacker News Reader

To be fair, this is not data on your own PC or laptop where you know that the disk dies, the data is gone. You'd expect a IT setup by a professional university to have redundant backups for you, so that nothing could go wrong even if something breaks or gets deleted. But depends on the university of course, and it must be hard for students to know how qualified the IT department of their university is.

> You'd expect a IT setup by a professional university to have redundant backups for you

They very likely do. On the M: and Z: drive.

As far as I can see this is just IT saying “if you stored your data somewhere you shouldn’t have, it’s now gone”.

But of course they can’t say that, so instead they have to help people recover from their mistake.

Or maybe the mistake was thinking people would actually do what you told them instead of whatever was more convenient.

> As far as I can see this is just IT saying “if you stored your data somewhere you shouldn’t have, it’s now gone”.

You're assuming people are aware of where they — or their niche specialty software packages — store their data. I'm not even sure I'd know where e.g. some biotech-DNA-analysis-package stores its data.

And this is why computer literacy is important. I can't fathom not knowing where the stuff I put tens and hundreds of hours into is saved. And this is despite the fact I never really lost any critical data in my life - backups offline and offline, on site and off site.

Recently I've been given incredible abuse by my ex who accused me I took her external HDD when I moved out. I actually considered I did and scoured all my boxes and belongings and even invited her over to search herself. Meanwhile, I asked her if she had any backups.

Needless to say the abuse tripled. I never found the drive.

You're right, but not even VUW's professional IT department is computer-literate, so how cna the students and faculty been held to a higher standard?

Slightly off-topic, but I'm sorry you were subjected to that abuse. It's not ok.

I don’t know, if I were writing my thesis on a machine, I’d very much want to know where it’s stored, and not just trust the awesomeness.

Not "it's gone", but "we wrote and ran software that invaded your computer and destroyed it".

Why didn't IT use their powers to deploy a backup program before they deployed a deletion program?

Thought expermiment: what wuodt happen if a student accidently deleted school's files, instead of the reverse? Criminal penalties? Civil penalties?

we wrote and ran software that invaded your computer and destroyed it

Were these personal laptops, or university provided? The fact they have H: and M: drives mounted suggests the latter.

Any shared network drives can protect critical documents, but I would expect that many people in the university have critical data for which those drives are simply unusable - can they put a 20gb experimental dataset they have gathered for analysis on that drive due to quotas, and if they can, would it have reasonable performance?

20GB? That's $20/yr Google Drive / Dropbox / whatever, synced from local disk. And a $7 USB key cold storage.

> "And a $7 USB key cold storage."

Which is actually not safe for cold storage in any way, shape, or form. Cheap flash storage devices are optimized for minimum cost per bit stored, not long-term data retention.

I agree that there are solutions available at a reasonable cost, but the question is why this organization appararently did not implement any of these solutions, and will they do it after this incident.

I've never seen that. The only moment I needed a university backup was when a university unit specialized in IT (making websites, databases...) lost 3 months of work on a system they were managing and that we needed to migrate from (to get rid of them and their incompetence). The deal was for them to give us the data on that day, theu just nuked the db, and recycled the hard drives. There were supposedly backups University wide, so I just asked the service handling it (another one) to send me the backups. Thats when they discovered that no backup worked for the last few months for the whole university... Don't ever trust your university with data. Make yourself multiple backups, encrypt them and keep a copy of the key/password in a safe place. I have horror stories linked to each of these reasons. One fun one was the single backup that was plugged when a user opened a "fedex" email and got a cryptolocker that locked all the network drives and the backup. Thankfully the person managing the networked drives had off site backups (and archiving).

> Don't ever trust your university with data. Make yourself multiple backups

More generally: make sure you DR plan, even the simple "I have a backup" one that most people use, involves a second provider (which in some circumstances is your own local resources).

Even if the people keeping your data safe on a daily basis are entirely competent, bad things can happen and with centralised control they can happen to many people at once. Even if all the data can be restored you may not be a priority so if you need urgent access to the data having on off-provider copy you can take it from is a godsend.

Of course in a commercial setting or some university/research settings, maintaining an off-provider copy of any data may be a _massive_ policy breach. Or even a legal problem is it involves personal or other sensitive data.

> it must be hard for students to know how qualified the IT department of their university is.

The trick is to look at the most productive research groups, in terms of funding and output, and see if they use the resources from the IT department or not.

You can't expect that,I'm afraid. We have tens of millions of people using all sorts of 'in the cloud' thinking it's as safe, as it can possibly be. Same principle in this case. I do agree on the quality of the uni staff thought.

TFA also talks about data stored in locally installed software; lots of scientific software I've seen puts data in a default location and you have to go out of your way to know where it is on disk.

Not if your USB ports were disabled by Group Policy you can’t.

I can't imagine students use computers with USB disabled but somebody with some experience may correct.

You're assuming they: (1) have/had a choice of schools (2) policy didn't change while they were there (3) the students can afford alternatives outside a computer/research lab

I remember it was done by some folks as an idiotic solution to keeping malware off your computers. It would not surprise me if someone did just that. Although, that would basically force students to use network or cloud drives.

Many use specially authorized locked tablets or chrome laptops that are "safe for exam". highly depends on the place. In some universities students struggle, in other the CS students come with their monsters AlienWare machines to learn how to python...

> Many use specially authorized locked tablets or chrome laptops that are "safe for exam". highly depends on the place.

That's a huge red flag when looking at the institution.

For you maybe, but that institution is still ranked high in national and international piss contests so I guess it doesnt matter for most people. I know many devs that work without having an admin or root access on their machines and stalking software on their phones, thats a red flag for me, but not for them apparently.

Depending on what research you are doing (if it includes confidential information about people participating in your experiment for example), taking your own off-site backup is a quick way to get fired / thrown out of your PhD.

In this case the University should still provide a good way of you backing everything up of course, and you can still back up anything which isn't confidential.

They said they have shared drives and these are unaffected. Shared drives are typically backed up by IT. It looks like a perfect place to store backups for most people that don't have a lot of data.

One would hope so, but those backups are maintained by the same crew who did this...

> Seriously, I can't imaging doing something like research or writing PhD thesis and not having at least one off-site backup.

And yet people do this. Last year I read a newspaper article of a guy who worked 2 years on his PhD thesis but then forgot his laptop in a bus and now those 2 years of work are gone forever.

The real problem here is not just backups, though. It's a severe ignorance of technology and its limitations that leads to such carelessness. The old saying about advanced tech seeming like magic should be a warning. No sane person goes out into the rain without an umbrella thinking they just won't get wet because yesterday they didn't, as it's painfully obvious that water is wet. Yet when someone stores everything on a single point of failure they don't lose a second of sleep of what could go wrong, it's simply not in their perceived range of possibilities that e.g. a hard drive could fail.

People are very, very bad when it comes to proactively mitigating low probability disasters. It is not that it is complicated, although you might underestimate the challenge of having a decent and updated backup that can be restored to the layman inundated with a deluge of commercial offerings trying to outdo each other on interface obtuseness.

We seem to instinctively err on the side of avoiding any short term cost, no matter how potentially grave the consequences in the future if the probability of those becomes low or obfuscated.

You can see this not just in backups, but in lifestyle choices, business decisions, construction, natural resources, financial speculation ...

Any situation where you can say "it does not happen often, but if it does the results will be catastrophic", you can bet that the risks will be unhedged.

Heck, my kids are theoretically engineers (at least their degree says so!), but even buying BackBlaze for them, I can't even get them to hit Ctrl-S from time-to-time. I think their mom must have fucked the milkman, because she is smarter than this herself...

Very simple 'backup' is to email it to yourself. Ofc it's not a legit backup, but a Word file, even if it's 500 pages, won't take so much space.

Pendrive/USB ports may be locked. But you can always zip & email the very critical doc/xls files. This was you can also have 'versioning'.

Something that I assume people do, is journaling. So even if you DID lose 1-2-3 months worth of work (in academia) you can read your (handwritten) notes and will save a lot of time from remembering the key points, key resources, etc.

Either way, whoever wanted to wipe a couple of computers and managed to push the script to the full AD group.. I got no words. Article doesn't mention what OS they were sitting on, but I will go ahead and assume it's Windows, on an Active Directory, and the admin pushed the new 'think' to the wrong OU.

How does this scheme protect against ransomware?

The cycle typically takes couple of weeks which should be enough for me to notice the problem and use one of the drives to restore the files.

I don't believe I am susceptible to a ransomware attack, though. All my machines including laptop are Linux and most of the software that contacts outside world (including browser, zoom, etc.) are running within dedicated containers or VMs.

Now, this does not make it safe against targeted attacks, but I did not plan it to stand a chance against really determined attacker. I just think no generic ransomware will expect to break out of container or VM.

Sounds like it has an RTO of “transit to and from mom/dad’s house” and a RPO of “however often I went to mom/dad’s house”

Those are above and beyond what I would personally need to avoid the threat of ransomware. If you need improvements, visit your family more often - win win :)