Hacker News Reader

Comment by merpnderp | Hacker News Reader

I always wonder why people don't trust their offsite back-ups to cloud providers. I know they're trying to get away from getting locked out of their data, but what are the odds a burglar steals their computers on the exact same day their cloud provider locks them out because they violated the 'no making fun of ridiculous cloud provider lockout policies' policy?

As long as your house burning down and your cloud getting locked don't occur on the same day, you're golden and thus no messing with blue-rays and bank security boxes.

View on HN

I agree. I was especially surprised by:

> Every last weekend of the month, I will manually backup all the data to Blu-ray discs. Not once, but twice. One copy goes to a safe storage space at home and the other one ends up at a completely different location.

This is one paragraph after mentioning a 2TB+2TB NAS. Even assuming that's RAID1, a standard Blu-ray only stores 50 GB, so you need 40 of those. And then you need another 40 for the other location... every month?? Honestly it's probably cheaper to buy a new 4 TB hard drive every month.

If you're a cheapskate like me, backing up your encrypted (e.g. Borg) backups to a cloud provider like Google Drive isn't a bad option. My org provides me with unlimited cloud space, so I have hundreds of encrypted gigs on Google Drive. No reason to think it'll disappear overnight.

> it's probably cheaper to buy a new 4 TB hard drive every month

The reason for blurays might be that he's following rule 2 of the 3-2-1 Backup Strategy. 3 backups, 2 different types of storage media, 1 copy off-site.

If your house is hit by lightning it could wipe all your magnetic and solid state drives, but optical discs would probably be ok.

Most definitions of the 3-2-1 rule count the original data as one of the 3 copies [1][2][3] and don't go as far as to specify that you should be diversified against literal medium type. (Most recommend an external drive or NAS for your second local copy)

The "my house was hit by lightning" case is covered pretty well by your 1 offsite backup.

1. https://www.acronis.com/en-us/articles/backup-rule/ 2. https://www.carbonite.com/blog/article/2016/01/what-is-3-2-1... 3. https://www.backblaze.com/blog/the-3-2-1-backup-strategy/

> I always wonder why people don't trust their offsite back-ups to cloud providers.

Oh I trust them not to delete my encrypted data and that's all that I'd ask. But I still don't have backups on hardware that I don't own: it's super expensive. From the cost of hosted backups, I could buy a hard drive of the same storage space every three months or something. And hard drives live longer than three months.

Putting a raspberry pi with a big hard drive at a friend's place is rather power efficient, dead simple to setup if you have any technical knowledge at all, and off-site. Use Restic or something to avoid having to trust your friend or whoever will burglarize the place. They have an Internet connection anyway and where I live, there are no bandwidth caps.

I agree, the backup doesn't have to be trusted if you encrypt, and check if it's down.

If you have a friend with good internet, you could put a NAS in his house or even give it to him for him to use, just get a quota for some storage.

https://en.wikipedia.org/wiki/Third-party_doctrine

Use borg or other encrypted backup tool (Restic is also recommended by others in this thread). rsync.net is my offsite backup. Doesn't matter what anyone demands of them, all they ever see is an encrypted blob.

I have been using Duplicati, but

>Backup archives are mountable as userspace filesystems for easy interactive backup examination and restores (e.g. by using a regular file manager).

looks like a really nice feature of borg. Thanks.

sidenote: restic can do that too

You do then need to find somewhere to store an offsite backup of your encryption keys. That said, since those change far less often than your backups, options like a safety deposit box are a more realistic place to store keys than the backups themselves.

Yes, borg also has the option of storing them in the repo itself, protected by a passphrase (think encrypted ssh key files).

Anyway, my "home burned down rescue bundle" consists of a flash drive with a keepass export of my password vault and encrypted borg repo key / rsync.net ssh keys at the office.

Slightly less accessible in this pandemic world, but no safety deposit boxes needed.

Important to reiterate this, since it's an interesting feature - borg does, indeed, allow you to store the encryption key for your repository inside the repo itself and you just need to remember/safeguard the passphrase.

I can't say whether this is a good choice for any particular use-case but I appreciate that it is an option ...

For those that are curious, yes, you can later export the key from your repo so that you have a copy elsewhere ...

Yeah I tend to trust B2 for my offsite. I have redundant storage locally with snapshots. That covers up to two disks failing or even someone trying to wipe storage over SMB.

The offsite protects against catastrophic failure or theft. I would still like to add in another backup for critical data such as databases, I may use another cloud provider that has geo redundant storage for those.

Reply on news.ycombinator.com