Hacker News Reader

I've been very happy with it. I switched away from Tarsnap because it was far too slow on restores. BorgBackup has slightly different security semantics, but similarly supports the notion of append-only credentials.

And borgbase.com has been a good place to host my backups. Really nice onboarding flow.

View on HN

Borg has an append-only mode, but no append-only credentials as far as I could find (by necessity given the symmetric encryption I believe). That means the key still needs to be protected, which makes secure automated backups a bit of a pickle.

If you use a remote Borg server over SSH, you can set up your authorized_keys file to enforce append-only mode on the server by defining the command to be run at login, and reject Borg requests by that SSH key which try to purge or remove data.

I believe this is roughly what borgbase does to implement their own backup protection features.

Yeah I suppose that's a fair interpretation of the authorized_keys setup.

Ah, yes, my apologies -- it's done via a connection mode.

I've been using it with Rsync.net also very happy.

Reply on news.ycombinator.com