Comment by tombrossman | Hacker News Reader

Comment by tombrossman | Hacker News Reader

Parent Full thread

Isn't switching from one closed source backup system to another closed source system overlooking the elephant in the room? These companies are legally required to rat you out when the government comes knocking (some even doing so without demanding a valid warrant, and profiting from LEO requests).

SpiderOak has been saying they "expect to make the SpiderOak client code open source in the not-distant future" [1] for years now, and their code still is not fully open-source. I completely understand their situation and know it's not always possible to fully open up the code, but I'm not able to overlook this deal breaker either.

Encrypt locally using only open source tools, then sync with whichever online backup/sync provider you like. It's the storage version of a 'dumb pipe', maybe we call it 'dumb containers'. Everything else is marketing bullshit which will evaporate once that first official demand for your data arrives.

[1]https://spideroak.com/faq/questions/35/why_isnt_spideroak_op...

Hey, SpiderOaker here!

While open-sourcing the desktop client isn't going as fast as we'd like, I'd like to point out that practically all current and future projects are open source on our GitHub (https://github.com/SpiderOak/), including our next-gen encryption system Crypton (which will eventually replace the data structures in the desktop client ANYWAY)

This is cool. Have you guys considered offering encryption as a service and let users pick their own data provider?

It's technically possible with Crypton. Note that the server-side components are under AGPL or commercial license; it's either pay fair or play fair.

I recently created a "petition" for SpiderOak to open source the client (and allow people to build it themselves from source) so that people can let SpiderOak know their thoughts. The petition signatures are sent to SpiderOak.

It's still available at the link below if any SpiderOak user (or potential customer) wants to use it to "show the numbers" on a single site (as opposed to scattered comments): http://www.change.org/petitions/spideroak-http-www-spideroak...

There's an online backup service called Cyphertite (cyphertite.com) that provides the sources for its client programs on all the platforms it supports. So I don't really see why SpiderOak, with its prominent proclamations of "zero knowledge", cannot walk the talk.

Of course, I understand that certain competitive advantages may take longer to provide in the open (until factors other than the client source code and backend architecture become competitive advantages). But I have to admit that SpiderOak has been dragging on opening up the source.

Edit: Let me also admit that I do like SpiderOak and the emphasis it places on privacy and in educating users about privacy. We need more services that strongly support what ought to be basic rights.

Thanks for your support and your efforts are much appreciated. We also agree that SpiderOak needs to be entirely open, and hope to have that completed within the next year. Everything new we've started in the last several years (including https://crypton.io/ and https://nimbus.io/ and a variety of other things on our GitHub) is GPL'd. Stay tuned!

You already have what you want. The source is here:

http://duplicity.nongnu.org/

Actively in development, stable, ready for enterprise use.

Yeah, buggy and unstable and just hangs when you throw large quantities of small files at it.

"It's the storage version of a 'dumb pipe', maybe we call it 'dumb containers'. Everything else is marketing bullshit..."

Ding!

If only there was such a provider that gave you the dumb pipe version of an offsite filesystem ... it's on the tip of my tongue ...

Reply on news.ycombinator.com