4 ms·
I've always felt a little nervous about encrypting backups. The point of the backup is something has gone wrong and you want to get the data back. You don't rea
by JonChesterfield 2y ago
I've always felt a little nervous about encrypting backups. The point of the backup is something has gone wrong and you want to get the data back. You don't really want stray bit errors to cascade across vast swathes of the data. Encrypt in transit sure, but maybe not when laying down the bit pattern on the medium at the other end.
- lazide 2y agoIt Depends(tm). Some encryption schemes will cascade bit errors (aka a flipped bit somewhere early on will fail everything and you’ll potentially lose access to the entire archive). Those also are terrible for random access. But usually extremely secure. Most sane ones for backups use a variant of block level encryption where you’ll lose at most a block worth of data from a bit flip. Which hopefully whatever archiving format you’re using can recover from, since long term storage already has that issue. Way back, I had issues like this (unstable hardware) and piped tar through encryption (I forget what library - it might have been gpg haha) then rsbep2 to avoid problems. It recovered from corrupted blocks at least twice.
- kkfx 2y agoTo avoid bitrot the rule is simply having more replicas on different iron. The chance to get ALL broken is obviously low. The big issue is backing up keys or people who memorize passphrases, because for that there is no pure-tech solution.
- lazide 2y agoReed Solomon encoding helps with both. But yes, is not a 100% solution.
- amano-kenji 2y agoRestic can detect and fix bitrots in encrypted backups. Restic stores small chunks of files, so only small chunks are affected by bitrots.
- aborsy 2y agoIt can detect, but cannot fix. It doesn’t have Reed Solomon coding. Very few have, Kopia is the only one that I know of. ZFS can fix errors too with Raid or copies=2.
- amano-kenji 2y agohttps://restic.readthedocs.io/en/stable/077_troubleshooting.html#repair-the-index https://restic.readthedocs.io/en/stable/077_troubleshooting....
- aborsy 2y agoThis is just repairing the index file, automating what used to be done manually: salvaging the rest of the data that has not been lost hopefully (not restoring lost data).
- amano-kenji 2y agoDoes restic not try to fetch the pristine data chunks from the source? Technically, there are two copies of data. One is on the source. The other is on the destination. Thus, restic can be like raid1. Restic has checksums for chunks. RAID1 with checksum can repair errors.