6 ms·

I'm with you on this one. This must be a very hard hurdle for hosting based startups. Perhaps on of the github guys could comment?

by j2d2 18y ago

tptacek 18y ago
My sense is that most of the traffic on github is open source, which isn't scary; also, my product source code is less scary than my financials.
budmang 18y ago
I'm the CEO of Backblaze and certainly understand your concern about hosting your data with a startup. We do encrypt your data using AES encryption, your data is stored in the 365 Main datacenters (where Cnet, Sun, etc.) are located, and you can put your own private key on the data. This is also not our first company - Excite@Home, SonicWALL, and Thomson Financial purchased the last ones...and they obviously cared a lot about security of the data. Hope we can help you backup your code and computers.
- tptacek 18y ago
  I realize you're the CEO, and that the marketing language you're using is probably effective for your normal customers, but: "Encrypted using AES" doesn't mean anything. Plenty of full-disk encryption products failed because of key management problems. More importantly, your literature doesn't document how you actually use AES --- for instance, is it ECB mode, which allows for random access but also for plaintext blocks to be copied and shuffled? How do you authenticate the data? If someone breaks into your servers and flips the right bit in my ciphertext, can she make binary integers decrypt to wildly large numbers that can break my software? More importantly, how does your backup agent software work? What messages does it send back and forth to your servers? Do I need to worry that a program you've installed on my machine with access to all my files has bugs where an attacker who can corrupt the DNS can run code on my machine, or access my files? How do you update your software? Nobody gets any of this stuff right anywhere in any setting, and backup is the most sensitive IT task you can perform.

I'm with you on this one. This must be a very hard hurdle for hosting based startups. Perhaps on of the github guys could comment?

by j2d2 18y ago

I'm with you on this one. This must be a very hard hurdle for hosting based startups. Perhaps on of the github guys could comment?

tptacek 18y ago

My sense is that most of the traffic on github is open source, which isn't scary; also, my product source code is less scary than my financials.

budmang 18y ago

I'm the CEO of Backblaze and certainly understand your concern about hosting your data with a startup. We do encrypt your data using AES encryption, your data is stored in the 365 Main datacenters (where Cnet, Sun, etc.) are located, and you can put your own private key on the data. This is also not our first company - Excite@Home, SonicWALL, and Thomson Financial purchased the last ones...and they obviously cared a lot about security of the data. Hope we can help you backup your code and computers.

tptacek 18y ago
I realize you're the CEO, and that the marketing language you're using is probably effective for your normal customers, but: "Encrypted using AES" doesn't mean anything. Plenty of full-disk encryption products failed because of key management problems. More importantly, your literature doesn't document how you actually use AES --- for instance, is it ECB mode, which allows for random access but also for plaintext blocks to be copied and shuffled? How do you authenticate the data? If someone breaks into your servers and flips the right bit in my ciphertext, can she make binary integers decrypt to wildly large numbers that can break my software? More importantly, how does your backup agent software work? What messages does it send back and forth to your servers? Do I need to worry that a program you've installed on my machine with access to all my files has bugs where an attacker who can corrupt the DNS can run code on my machine, or access my files? How do you update your software? Nobody gets any of this stuff right anywhere in any setting, and backup is the most sensitive IT task you can perform.