6 ms·

After https://news.ycombinator.com/item?id=26536019 https://news.ycombinator.com/item?id=26536019 I pulled off all my files from backblaze. Is there a good alte

After https://news.ycombinator.com/item?id=26536019 https://news.ycombinator.com/item?id=26536019 I pulled off all my files from backblaze. Is there a good alternative for long term storage other than amazon glacier? For about ~6tb-8tb of data.

fX0rObfoMN4 6y ago
You could use rsync.net or tarsnap but it wouldn't be cheap.
woliveirajr 6y ago
OVH, Wasabi.
aikinai 6y ago
I’m using Arq Backup with Wasabi for the storage. I think it’s a great combo.
tsujp 6y ago
Hetzner has storage boxes and storage services. Not as cheap as Glacier of course. Otherwise there is Acronis, IDrive (nothing to do with Apple), and Carbonite. I've never dealt with the latter three only heard of them.
- foepys 6y ago
  If you need the data, it could very well be cheaper. AWS Glacier request costs are no joke.
  - andrewzah 6y ago
    Well, the idea with Backblaze/Glacier is cheap long term storage in exchange for high request costs, no? For me anyways, this is a tertiary backup of data that is duplicated in a zfs raid 10 pool and in external drives at a different house. A high request cost isn't much to get back my family photos, documents, etc, in a situation where neither of the first two backups are available.
- pnutjam 6y ago
  Time4vps had the best storage server prices last I checked. I've been using them for afew years.
exhilaration 6y ago
Did Backblaze ever issue an explanation for that?
- kbaker 6y ago
  Write up here. Accidentally added the Facebook pixel to all pages instead of the marketing pages. https://www.backblaze.com/blog/privacy-update-third-party-tracking/ https://www.backblaze.com/blog/privacy-update-third-party-tr...
  - ethbr0 6y ago
    If you want to nail a company to the cross for being in bed with Facebook... Backblaze probably shouldn't be at the top of your naughty list. IMHO, over-ado about a small something. "A new campaign was launched beginning on March 8, 2021 on the marketing web pages using Google Tag Manager which included the Facebook pixel. That new campaign resulted in the Facebook advertising pixel being accidentally configured in Google Tag Manager to run on all platform pages instead of just the marketing web pages." "We’ve confirmed that there was only a single page (b2_browse_files2.htm) where the Facebook advertising pixel had the ability to access certain metadata. We tested this on Chrome, Safari, Firefox, and Edge. Our investigation determined that 9,245 users visited that page during the window when the Facebook campaign was active (March 8 at 12:39 p.m. Pacific time, through March 21st at 11:19 p.m. Pacific time when we removed the offending code)." "If users were browsing their B2 Cloud Storage files on b2_browse_files2.htm during that period, AND clicked to preview file information, then the Facebook pixel pulled the following metadata: folder/file name, folder/file size, and the date the folder/file was uploaded. The folder/file metadata was limited to file information that was currently loaded in the browser. No actual files or file contents were shared at any time. The data that was pulled did not include any user account information."
    - AnonC 6y ago
      In previous threads about this leak, commenters gave examples of how exposing filenames could be harmful to certain classes of paying customers. It is not a small thing by any stretch of imagination.
alberth 6y ago
Isn’t this a bit hasty. Backblaze fixed thr issue immediately, wrote a detailed blog posted and it was also found to have only been in a single webpage of theirs. https://www.backblaze.com/blog/privacy-update-third-party-tracking/ https://www.backblaze.com/blog/privacy-update-third-party-tr... Now while I certainly agree that I don’t like this info leaked, there was no mal-intent and they quickly took action once notified. I feel like their action is what makes me like them so much.
- dannyw 6y ago
  Yes and no. This issue was perhaps X lines of code away from accidentally transferring the contents of your files (or login email and password!) to Facebook, or a malicious attacker. For one, this highlights they don't have automated tests detecting arbitrary/malicious JS injection on their web app. This is a serious security risk: we are talking about your cloud filesystem here, and "spear phish / bribe your marketing intern to adding malicious.js" is a real attack vector. Alarms should be going off internally whenever a new external JS file gets included in your webapp, either ststically or dynamically. Facebook pixel today, a malicious hacker tomorrow. I'd expect a private cloud to have better security procedures than "wait till someone on Twitter discovers a bug". (Personally, I will continue to use Backblaze, but just highlighting why it's a serious security concern.)
  - jscheel 6y ago
    You should not be backing up plaintext passwords to offsite storage anywhere. Or do you mean malicious JS capturing your form entry at login?
    - dannyw 6y ago
      That's what I mean. But the specific issue I see is that a piece of external JS got inserted into their web app, and their security team didn't realise it. The fact that its from GTM is no excuse: give me Google tag manager, I'll exfil your users data in an hour ;)
deleted 6y ago
[deleted]
purplecats 6y ago
I just spent the last 12 hours migrating everything to B2. BB seems to be somewhat immature relative to the competitors, and the product certainly feels that way, but as long as they try and the data integrity is there, then I think I am okay with it. The rest of my stuff is in S3 with Glacier auto archives.
poidos 6y ago
maybe rsync.net? I don’t use them (yet) but they seem cool.
- andrewzah 6y ago
  I looked at rsync.net, but they are 2.5 cents/gb versus backblaze's $0.005/gb or glacier's $0.004/gb per month. I see rsync.net for active use, while b2/glacier are for set-and-forget backups.
icedchai 6y ago
I use Wasabi with restic. Wasabi has an S3 compatible API, I believe.
devwastaken 6y ago
That's a good example of the paraphrased quote "don't make software for privacy people, they'll never be happy". They fixed it, yet every other service is doing far worse behavior. Dont hold backblaze on a higher pedestal than amazon unless you only want amazon to exist. Backblaze is the most affordable and available remote storage/cdn service available, by miles. Go look at a calculator between amazon and backblaze. The actually give half a care and even partner with various providers so your outgoing bandwidth is free to them.
- tzs 6y ago
  For a large number of Windows and Mac users who have less than 1 TB to backup (or less than 6 TB if they are willing to put up with a fair amount of hassle) there is a far less expensive option. I speak of Windows and Mac users who got a Microsoft 365 subscription for the Microsoft Office apps. That comes with 1 TB of OneDrive, or 6 TB if you get the family subscription. OneDrive has API access which is supported by a fair number of commercial and open source backup programs. You can get a family subscription without being a family. All you actually need is the ability to control 5 extra email addresses, one for each fake family member. Your 6 TB would end up partitioned into 6 1 TB buckets so as I said, would be somewhat of a hassle to use. But if you only need 1 TB, and want or need Office anyway, and don't really have a lot of non-backup cloud needs, then OneDrive is a good, often overlooked option.
- andrewzah 6y ago
  What bothers me is using facebook tracking scripts in the first page, particularly for internal customer pages. Of course I'm not happy with them working with facebook at all. Other services doing worse things is not an excuse. I don't want to go with amazon either, hence my question here.
  - risyachka 6y ago
    Vast majority of websites integrate facebook or google or both their SDKs. But they don't work with them. They have to it in order to run ads and as result to survive.
- 6y ago
sandworm101 6y ago
Considering that Backblaze was totally open and correcte this mistake immediately, what you are asking for is a backup company that never makes mistakes. They dont exist. Buy a synology NAS. Slap some ironwolfs in it and do your own backups.
- dylan604 6y ago
  How many years at $60/year of Backblaze service will it take to equal that NAS setup? Also, will that NAS survive a disaster? These are the types of questions that make the Backblaze services so hard to walk away.
ideaoverload 6y ago
Google archive option looks pretty good with 1.2$/TB/month and real time API: https://cloud.google.com/storage/archival https://cloud.google.com/storage/archival
- red0point 6y ago
  Yes, until you actually want to download your data and pay 85 USD for downloading it once.
  - domq 6y ago
    Can you please substantiate that point?
- charrondev 6y ago
  We’re so pissed at Google Tag Manager being included in a page of a website in error, that we’ll move our backups to a google service (that with certainty will track analytics at google indefinitely).
- risyachka 6y ago
  If you are concerned about tracking this should be your last choice.
notyourday 6y ago
Why would you use any cloud storage company without encrypting your files? I use Backblaze and Wasabi.
amelius 6y ago
I wonder, isn't tape backup ripe for disruption? The drives are crazy expensive, while tapes are very affordable.
- mcdevilkiller 6y ago
  Tape is also incredibly slow and difficult to scale. Also, the equipment needed to operate a cluster of tape archivers costs a lot, while they are using their own designs dor servers, with coXmmodity hardware in them.
  - cm2187 6y ago
    And to backup a NAS, it requires to regularly change the tapes. Any backup that requires manual steps is likely to be delayed and to be too infrequent to be useful.
  - adrian_b 6y ago
    Tape is slow only when you need frequently to read some random part of it, because you might need a couple of minutes to go till the other end of the tape. The reading/writing speed of tapes is excellent, better than that of hard drives, so writing a backup takes less time. For archives that are accessed only infrequently, tape is more reliable and also faster. If you want to have access in less than a minute to any part of your backups, then yes, tape is inappropriate and you must use HDDs.
  - amelius 6y ago
    > Tape is also incredibly slow and difficult to scale Tape is still the best backup medium for many small and large companies. And by the way, how fast do you think a service like Backblaze is?
varispeed 6y ago
I initially wanted to pull all my data, but then realised that I in fact encrypt everything locally so what they see is just garbage, so in my case if the provider is unsafe and leaks all my data, that would be of no use to anyone.
wnevets 6y ago
Tim Apple could stand in the middle of 5th Avenue and shoot someone but HN would still use their products. Backblaze accidentally deploys a facebook pixel to its pages and HN cast it off to the tech shadow realm.
yosito 6y ago
Tardigrade.io

fX0rObfoMN4 6y ago

You could use rsync.net or tarsnap but it wouldn't be cheap.

woliveirajr 6y ago

OVH, Wasabi.

aikinai 6y ago

I’m using Arq Backup with Wasabi for the storage. I think it’s a great combo.

tsujp 6y ago

Hetzner has storage boxes and storage services. Not as cheap as Glacier of course. Otherwise there is Acronis, IDrive (nothing to do with Apple), and Carbonite. I've never dealt with the latter three only heard of them.

foepys 6y ago
If you need the data, it could very well be cheaper. AWS Glacier request costs are no joke.
- andrewzah 6y ago
  Well, the idea with Backblaze/Glacier is cheap long term storage in exchange for high request costs, no? For me anyways, this is a tertiary backup of data that is duplicated in a zfs raid 10 pool and in external drives at a different house. A high request cost isn't much to get back my family photos, documents, etc, in a situation where neither of the first two backups are available.
pnutjam 6y ago
Time4vps had the best storage server prices last I checked. I've been using them for afew years.

exhilaration 6y ago

Did Backblaze ever issue an explanation for that?

kbaker 6y ago
Write up here. Accidentally added the Facebook pixel to all pages instead of the marketing pages. https://www.backblaze.com/blog/privacy-update-third-party-tracking/ https://www.backblaze.com/blog/privacy-update-third-party-tr...
- ethbr0 6y ago
  If you want to nail a company to the cross for being in bed with Facebook... Backblaze probably shouldn't be at the top of your naughty list. IMHO, over-ado about a small something. "A new campaign was launched beginning on March 8, 2021 on the marketing web pages using Google Tag Manager which included the Facebook pixel. That new campaign resulted in the Facebook advertising pixel being accidentally configured in Google Tag Manager to run on all platform pages instead of just the marketing web pages." "We’ve confirmed that there was only a single page (b2_browse_files2.htm) where the Facebook advertising pixel had the ability to access certain metadata. We tested this on Chrome, Safari, Firefox, and Edge. Our investigation determined that 9,245 users visited that page during the window when the Facebook campaign was active (March 8 at 12:39 p.m. Pacific time, through March 21st at 11:19 p.m. Pacific time when we removed the offending code)." "If users were browsing their B2 Cloud Storage files on b2_browse_files2.htm during that period, AND clicked to preview file information, then the Facebook pixel pulled the following metadata: folder/file name, folder/file size, and the date the folder/file was uploaded. The folder/file metadata was limited to file information that was currently loaded in the browser. No actual files or file contents were shared at any time. The data that was pulled did not include any user account information."
  - AnonC 6y ago
    In previous threads about this leak, commenters gave examples of how exposing filenames could be harmful to certain classes of paying customers. It is not a small thing by any stretch of imagination.

alberth 6y ago

Isn’t this a bit hasty. Backblaze fixed thr issue immediately, wrote a detailed blog posted and it was also found to have only been in a single webpage of theirs. https://www.backblaze.com/blog/privacy-update-third-party-tracking/ https://www.backblaze.com/blog/privacy-update-third-party-tr... Now while I certainly agree that I don’t like this info leaked, there was no mal-intent and they quickly took action once notified. I feel like their action is what makes me like them so much.

dannyw 6y ago
Yes and no. This issue was perhaps X lines of code away from accidentally transferring the contents of your files (or login email and password!) to Facebook, or a malicious attacker. For one, this highlights they don't have automated tests detecting arbitrary/malicious JS injection on their web app. This is a serious security risk: we are talking about your cloud filesystem here, and "spear phish / bribe your marketing intern to adding malicious.js" is a real attack vector. Alarms should be going off internally whenever a new external JS file gets included in your webapp, either ststically or dynamically. Facebook pixel today, a malicious hacker tomorrow. I'd expect a private cloud to have better security procedures than "wait till someone on Twitter discovers a bug". (Personally, I will continue to use Backblaze, but just highlighting why it's a serious security concern.)
- jscheel 6y ago
  You should not be backing up plaintext passwords to offsite storage anywhere. Or do you mean malicious JS capturing your form entry at login?
  - dannyw 6y ago
    That's what I mean. But the specific issue I see is that a piece of external JS got inserted into their web app, and their security team didn't realise it. The fact that its from GTM is no excuse: give me Google tag manager, I'll exfil your users data in an hour ;)

deleted 6y ago

[deleted]

purplecats 6y ago

I just spent the last 12 hours migrating everything to B2. BB seems to be somewhat immature relative to the competitors, and the product certainly feels that way, but as long as they try and the data integrity is there, then I think I am okay with it. The rest of my stuff is in S3 with Glacier auto archives.

poidos 6y ago

maybe rsync.net? I don’t use them (yet) but they seem cool.

andrewzah 6y ago
I looked at rsync.net, but they are 2.5 cents/gb versus backblaze's $0.005/gb or glacier's $0.004/gb per month. I see rsync.net for active use, while b2/glacier are for set-and-forget backups.

icedchai 6y ago

I use Wasabi with restic. Wasabi has an S3 compatible API, I believe.

devwastaken 6y ago

That's a good example of the paraphrased quote "don't make software for privacy people, they'll never be happy". They fixed it, yet every other service is doing far worse behavior. Dont hold backblaze on a higher pedestal than amazon unless you only want amazon to exist. Backblaze is the most affordable and available remote storage/cdn service available, by miles. Go look at a calculator between amazon and backblaze. The actually give half a care and even partner with various providers so your outgoing bandwidth is free to them.

tzs 6y ago
For a large number of Windows and Mac users who have less than 1 TB to backup (or less than 6 TB if they are willing to put up with a fair amount of hassle) there is a far less expensive option. I speak of Windows and Mac users who got a Microsoft 365 subscription for the Microsoft Office apps. That comes with 1 TB of OneDrive, or 6 TB if you get the family subscription. OneDrive has API access which is supported by a fair number of commercial and open source backup programs. You can get a family subscription without being a family. All you actually need is the ability to control 5 extra email addresses, one for each fake family member. Your 6 TB would end up partitioned into 6 1 TB buckets so as I said, would be somewhat of a hassle to use. But if you only need 1 TB, and want or need Office anyway, and don't really have a lot of non-backup cloud needs, then OneDrive is a good, often overlooked option.
andrewzah 6y ago
What bothers me is using facebook tracking scripts in the first page, particularly for internal customer pages. Of course I'm not happy with them working with facebook at all. Other services doing worse things is not an excuse. I don't want to go with amazon either, hence my question here.
- risyachka 6y ago
  Vast majority of websites integrate facebook or google or both their SDKs. But they don't work with them. They have to it in order to run ads and as result to survive.
6y ago

sandworm101 6y ago

Considering that Backblaze was totally open and correcte this mistake immediately, what you are asking for is a backup company that never makes mistakes. They dont exist. Buy a synology NAS. Slap some ironwolfs in it and do your own backups.

dylan604 6y ago
How many years at $60/year of Backblaze service will it take to equal that NAS setup? Also, will that NAS survive a disaster? These are the types of questions that make the Backblaze services so hard to walk away.

ideaoverload 6y ago

Google archive option looks pretty good with 1.2$/TB/month and real time API: https://cloud.google.com/storage/archival https://cloud.google.com/storage/archival

red0point 6y ago
Yes, until you actually want to download your data and pay 85 USD for downloading it once.
- domq 6y ago
  Can you please substantiate that point?
charrondev 6y ago
We’re so pissed at Google Tag Manager being included in a page of a website in error, that we’ll move our backups to a google service (that with certainty will track analytics at google indefinitely).
risyachka 6y ago
If you are concerned about tracking this should be your last choice.

notyourday 6y ago

Why would you use any cloud storage company without encrypting your files? I use Backblaze and Wasabi.

amelius 6y ago

I wonder, isn't tape backup ripe for disruption? The drives are crazy expensive, while tapes are very affordable.

mcdevilkiller 6y ago
Tape is also incredibly slow and difficult to scale. Also, the equipment needed to operate a cluster of tape archivers costs a lot, while they are using their own designs dor servers, with coXmmodity hardware in them.
- cm2187 6y ago
  And to backup a NAS, it requires to regularly change the tapes. Any backup that requires manual steps is likely to be delayed and to be too infrequent to be useful.
- adrian_b 6y ago
  Tape is slow only when you need frequently to read some random part of it, because you might need a couple of minutes to go till the other end of the tape. The reading/writing speed of tapes is excellent, better than that of hard drives, so writing a backup takes less time. For archives that are accessed only infrequently, tape is more reliable and also faster. If you want to have access in less than a minute to any part of your backups, then yes, tape is inappropriate and you must use HDDs.
- amelius 6y ago
  > Tape is also incredibly slow and difficult to scale Tape is still the best backup medium for many small and large companies. And by the way, how fast do you think a service like Backblaze is?

varispeed 6y ago

I initially wanted to pull all my data, but then realised that I in fact encrypt everything locally so what they see is just garbage, so in my case if the provider is unsafe and leaks all my data, that would be of no use to anyone.

wnevets 6y ago

Tim Apple could stand in the middle of 5th Avenue and shoot someone but HN would still use their products. Backblaze accidentally deploys a facebook pixel to its pages and HN cast it off to the tech shadow realm.

yosito 6y ago

Tardigrade.io