Hacker News Reader

Comment by tptacek | Hacker News Reader

Start figuring out how you're going to talk about this now, and use the blog to practice. This killed our first product too.

I'm not saying talk up serverside security; I'm saying, after allllllll that content about crypto algorithms, I'm still left wondering whether I can trust my data to your app. Most everyone else who talks about secure backup is going to leave it at "SSL, plus we encrypt the data on our servers". Your #1 feature is that you do the opposite, but all I see is RSA OAEP.

Also, I'm not saying downplay the crypto; I'm saying, reverse pyramid style, find a way to come up with a brand-y feature-y way to summarize (a) custom crypto, (b) open, auditable design, (c) freely available source code. Then use the crypto details to back that up (on a seperate page).

Dynamic updates: how do you update the tarsnap clientside software?

Consider a name other than tarsnap, too.

View on HN

k, even more thoughts:

* STOP using the word "paranoid". You're not paranoid, you're right (or I'm not paying). Paranoid + merit badge sash of algorithm parameters = vanity project. You don't have a vanity project; stop being self-effacing.

* Consider taking a few minutes to write a positioning statement, then bucket your feature/function accordingly. A no-brainer template for positioning: For {companies,nonprofits,summer camps} that need {puppies,secure backup,surface mount soldering}, Colin Percival offers tarsnap. Unlike {mozy,carbonite,idrive}, tarsnap provides {block level security,puppy mincing} that allows users to {save the world,make better tacos}.

* Along similar lines, "my dream backup system" probably not the best positioning ever. Maybe kill those words. =)

* One feature you're probably unwilling to play up is that you're actually (probably ;) qualified to design a custom cryptosystem. Get some cryptofriends to vouch for you!

Dynamic updates: how do you update the tarsnap clientside software?

I don't. Users do (by downloading the latest version, extracting the tarball, compiling, and installing).

Actually, you're right that I depend on SSL for this at the moment -- but I will be adding GPG signatures for the tarballs soon.

Consider a name other than tarsnap, too.

What's wrong with that name? In all seriousness, the people who would be turned off by that name are also people who would be turned off by the command-line interface.

What's wrong with that name? In all seriousness, the people who would be turned off by that name are also people who would be turned off by the command-line interface.

Yeah, and, about that...

I think you make some VERY good points, but I'm unsure if you and the creator of tarsnap are on the same page regarding the audience / customer base for this service. I like the name because it makes sense to me and it's easy to understand. Of course the management at Big Co. probably have no idea what "tarsnap" means just by looking at it. That could matter, or not, depending on the author's target audience.

Also, from your example, I've crafted the perfect position statement: For summer camps that need surface mount soldering, Colin Percival offers tarsnap. Unlike carbonite, tarsnap provides puppy mincing that allows users to make better tacos

After reading that, I'm buying tomorrow.

There's a pretty well recognized trap in the security software space; call it the "IDA Pro Effect". IDA is the industry standard disassembler, easily the most popular commercial reverse engineering tool, certainly licensed by every major security research team. It costs ~$500.

This is a problem: successfully cornering the market for disassemblers and selling to ever security research team wins Hex-Rays literally thousands of dollars!

If you're going to craft a product pitch that appeals to the very high end of the market --- those comfortable with per-host command-line backup who care very intensely about security --- you may need to price way higher than where Colin is today. Of course, then he'll find himself in competition with homebrew PGP+S3 scripts, just like IDA would quickly be replaced by a web UI on "objdump" if Ilfak jacked the price up to $20,000 (which is kind of where it belongs, value-wise).

I'm also wary of the history of "premium" command-line backup tools; remember Bru?

I don't disagree one bit. I'm not entirely convinced it will be successful, considering it is a pretty niche product as far as backup products go and the security value-add isn't really priced according to what very security-conscious people/organizations would spend on the solution. All I was really pointing out is that Colin and you may have different ideas of who the audience here is, in which case some of your advice isn't relevant (yet, anyway); if it's going to be marketed to people who <3 cli then tarsnap is a perfectly good name. Otherwise, something awesome like "Fort Knox Backup Vault 2008" may be more appropriate ;)

For the record: I'm very bullish on Colin's idea; I just don't think he has the positioning and packaging worked out.

Unless he's not out to make money. Some people aren't. He's a FreeBSD dev, after all. Sucker. :P

Don't worry, I'm in this to make money. :-)

I started with *nix and a command-line interface for two reasons: 1. This is what I know, and 2. a CLI can be far more easily used as a component of a larger system.

I'm following a fairly standard startup course here: Build something people want, then build something more people want. I expect a GUI to happen in the future (probably using Qt). I expect a Windows version to happen in the future. I expect tarsnap to be included in web server management interfaces in the future. The name might change in the future, or "tarsnap" might just end up being one of the names like "google" which start out looking dumb but end up sounding normal.

But that's all "easy" stuff -- the place to start is with a solid and secure foundation, which is what I'm doing.

Reply on news.ycombinator.com