After https://news.ycombinator.com/item?id=26536019 I pulled off all my files from backblaze. Is there a good alternative for long term storage other than amazon glacier? For about ~6tb-8tb of data.
https://www.backblaze.com/blog/privacy-update-third-party-tr...
Now while I certainly agree that I don’t like this info leaked, there was no mal-intent and they quickly took action once notified. I feel like their action is what makes me like them so much.
For one, this highlights they don't have automated tests detecting arbitrary/malicious JS injection on their web app. This is a serious security risk: we are talking about your cloud filesystem here, and "spear phish / bribe your marketing intern to adding malicious.js" is a real attack vector.
Alarms should be going off internally whenever a new external JS file gets included in your webapp, either ststically or dynamically. Facebook pixel today, a malicious hacker tomorrow.
I'd expect a private cloud to have better security procedures than "wait till someone on Twitter discovers a bug".
(Personally, I will continue to use Backblaze, but just highlighting why it's a serious security concern.)
But the specific issue I see is that a piece of external JS got inserted into their web app, and their security team didn't realise it.
The fact that its from GTM is no excuse: give me Google tag manager, I'll exfil your users data in an hour ;)
Injecting third-party content then requires editing both your site and the server setup. Of course, you can make the policies more or less strict depending on how much you want to tighten this kind of attack vector.
This is a weird metric.
edit: and enabling facebook tracking on customer pages...
When a company provides full disclosure people are shocked and abandon the platform.
Every company has bugs. Everyone eventually gets breached. If a company is honest with what happened, follows up with their users, and fixes it, what more can you ask for?
Should it have happened? No. Did they find the issue? Yes. Did they fix it? Yes. Did they disclose it? Yes. Perfect, thanks.
I mean, worst of all, many of them are Web Developer means there is a very high probability they have make mistakes /bugs in the pass, big or small. Which put them in the category of hypocrite.
Backblaze is the most affordable and available remote storage/cdn service available, by miles. Go look at a calculator between amazon and backblaze.
The actually give half a care and even partner with various providers so your outgoing bandwidth is free to them.
I speak of Windows and Mac users who got a Microsoft 365 subscription for the Microsoft Office apps. That comes with 1 TB of OneDrive, or 6 TB if you get the family subscription.
OneDrive has API access which is supported by a fair number of commercial and open source backup programs.
You can get a family subscription without being a family. All you actually need is the ability to control 5 extra email addresses, one for each fake family member. Your 6 TB would end up partitioned into 6 1 TB buckets so as I said, would be somewhat of a hassle to use.
But if you only need 1 TB, and want or need Office anyway, and don't really have a lot of non-backup cloud needs, then OneDrive is a good, often overlooked option.
Other services doing worse things is not an excuse. I don't want to go with amazon either, hence my question here.
But they don't work with them. They have to it in order to run ads and as result to survive.
Please provide specific sources of AWS, GCP, or Azure leaking file names and sizes to a third party.
For me anyways, this is a tertiary backup of data that is duplicated in a zfs raid 10 pool and in external drives at a different house. A high request cost isn't much to get back my family photos, documents, etc, in a situation where neither of the first two backups are available.
https://www.backblaze.com/blog/privacy-update-third-party-tr...
IMHO, over-ado about a small something.
"A new campaign was launched beginning on March 8, 2021 on the marketing web pages using Google Tag Manager which included the Facebook pixel. That new campaign resulted in the Facebook advertising pixel being accidentally configured in Google Tag Manager to run on all platform pages instead of just the marketing web pages."
"We’ve confirmed that there was only a single page (b2_browse_files2.htm) where the Facebook advertising pixel had the ability to access certain metadata. We tested this on Chrome, Safari, Firefox, and Edge. Our investigation determined that 9,245 users visited that page during the window when the Facebook campaign was active (March 8 at 12:39 p.m. Pacific time, through March 21st at 11:19 p.m. Pacific time when we removed the offending code)."
"If users were browsing their B2 Cloud Storage files on b2_browse_files2.htm during that period, AND clicked to preview file information, then the Facebook pixel pulled the following metadata: folder/file name, folder/file size, and the date the folder/file was uploaded. The folder/file metadata was limited to file information that was currently loaded in the browser.
No actual files or file contents were shared at any time. The data that was pulled did not include any user account information."
> We use Google Tag Manager to help deploy key third-party code in a streamlined fashion. The Google Tag Manager implementation includes a Facebook trigger. On March 8, 2021 at 12:39 p.m. Pacific time, a new Facebook campaign was created that started firing a Facebook advertising pixel, intended to only run on marketing web pages. However, it was inadvertently configured to run on signed-in pages.
[0] https://www.backblaze.com/blog/privacy-update-third-party-tr...
It looks like it does but the permissions are so frustrating to use that it just becomes overly permissive as a side effect.
The rest of my stuff is in S3 with Glacier auto archives.
The reading/writing speed of tapes is excellent, better than that of hard drives, so writing a backup takes less time.
For archives that are accessed only infrequently, tape is more reliable and also faster.
If you want to have access in less than a minute to any part of your backups, then yes, tape is inappropriate and you must use HDDs.
Tape is still the best backup medium for many small and large companies.
And by the way, how fast do you think a service like Backblaze is?
I use Backblaze and Wasabi.