15 ms·

I'm a long time user of backblaze, and I'm a big fan of the product - it does a great job of always making sure my working documents are backed up, particularly

I'm a long time user of backblaze, and I'm a big fan of the product - it does a great job of always making sure my working documents are backed up, particularly when I'm traveling overseas, and my laptop is more vulnerable to theft or damage. With that said - Backblaze is optimized for working documents - and the default "exclusion" list makes it clear they don't want to be backing up your "wab~,vmc,vhd,vo1,vo2,vsv,vud,vmdk,vmsn,vmsd,hdd,vdi,vmwarevm,nvram,vmx,vmem,iso,dmg,sparseimage,sys,cab,exe,msi,dll,dl_,wim,ost,o,log,m4v" files. They also don't want to backup your /applications, /library, /etc, and so on locations. They also make it clear that backing up a NAS is not the target case for their service. I can live with that - because, honestly, it's $4/month, and my goal is to keep my working files backed up. System Image backups, I've been using Super Duper to a $50 external hard drive. Glacier + a product like http://www.haystacksoftware.com/arq/ http://www.haystacksoftware.com/arq/ means I get the benefit of both worlds - Amazon will be fine with me dropping my entire 256 Gigabyte Drive onto Glacier (total cost - $2.56/month) and I get the benefit of off site backup. The world is about to get a whole lot simpler (and inexpensive) for backups.

jwr 14y ago
What's even more important, you will be able to encrypt your backups without having to disclose the encryption key in case you ever need to restore (client-side encryption and decryption). This is not the case with Backblaze, which is why I switched to CrashPlan — but I'm still looking for other solutions.
- chmars 14y ago
  CrashPlan shows your encryption key in plain text. Doesn't that worry you?
  - jwr 14y ago
    Where does it show that? And are you sure we are talking about the encryption key, not the account password?
    - chmars 14y ago
      Settings / Security / Archive Encryption / 448-bit encryption with custom 448-bit key
      - jwr 14y ago
        Then no, it does not worry me. Obscuring password entry in an application that I almost never run is not a problem. Plus, if I do actually run the app and want to enter the password, I don't do it with a bunch of people peering over my shoulder.
  - leejoramo 14y ago
    CrashPlan defaults to using the account password as the encryption password. However, you can also secure the encryption with a password not associated with the account. Or even provide your own 448-bit key. If you do either of these options, CrashPlan support will not be able to help you This setup allows CrashPlan to easily help non-technical home users, while allowing technically savvy users to securely hang themselves with their own encryption.
    - chmars 14y ago
      My question is not about the setup, that's OK. I am wondering why CrashPlan shows the encryption key in the clear and does not store it in the user or system keychain.
      - leejoramo 14y ago
        I see what you mean. I have up voted your original comment.
      - res0nat0r 14y ago
        I'm assuming this because their desktop client is a java app and it it's been made to run on linux, mac and Windows. Is there such a thing as a keychain on Windows? I've only used it on linux and mac.
        voltagex_ 14y ago
        Yes, there's the CredWrite API - http://msdn.microsoft.com/en-us/library/windows/desktop/aa375187(v=vs.85).aspx http://msdn.microsoft.com/en-us/library/windows/desktop/aa37..., although I must admit I like the OS X keychain a lot better.
      - varikin 14y ago
        As others have noted, it is partially because Crashplan is a Java based app. Partially, it is also because Crashplan runs as System, not as the user. That way, I can have Crashplan backup my wife's user account and my user account. Furthermore, you can use the encryption key + a custom password, or your own encryption key with a passphrase. In this case, it is encyrpted locally and the key is not sent to Crashplan[1]. [1] http://support.crashplan.com/doku.php/recipe/change_security_settings http://support.crashplan.com/doku.php/recipe/change_security...
  - acdha 14y ago
    You'd prefer that they lie to you and pretend it's not stored in the clear? If you don't have to type it in every time a backup runs, it's in the clear - everything else is just window dressing.
    - chmars 14y ago
      Standard practice is IMHO to use the user or system keychain.
      - acdha 14y ago
        Right, which is a largely meaningless distinction: if the process runs as you, any successful attacker can simply read it out of the CrashPlan process in memory. Again, if you're not typing the password in every time, a local compromise is almost certainly game-over. Apple's keychain helps reduce the damage if the data's not actively used but for something like CrashPlan which is always running the attacker is probably going to be lucky.
        chmars 14y ago
        I agree that showing the encryption key in the clear is not a serious security flaw but it's IMHO against best practice. Passwords and key are usually shown in an obscured form, usually with asterisks, and stored in the user or system keychain. You are absolutely right that the security value of these standard practices should not be overvalued but still … what else within the security framework of CrashPlan is not done in accordance with best practice? (I assume, BTW, that CrashPlan does not use the system or user keychain on the Mac because it is not a real Mac citizen but a Java-based app. Firefox and Wuala – the latter Java-based too – don't use the user or system keychain either.)
        greedo 14y ago
        There have been sound arguments made against obscuring password entry.
- driverdan 14y ago
  The other feature that's great about CrashPlan is that it will allow you to backup to other systems running their software. I backup my laptop to both their service and one of my dedicated servers. That way if anything ever happens to their online service I have a second remote copy that I control.
- deleted 14y ago
  [deleted]
- Auguste 14y ago
  Backblaze does support the optional use of a separate encryption key which they claim to never store, but there's no information about whether it is ever disclosed to them or not. There's little information on their website, but it can be set in Settings > Security in the Backblaze client.
  - jwr 14y ago
    You have to provide your encryption key to their website if you want to recover files. That's a show-stopper for me.
kondro 14y ago
Home-use is probably the only situation Glacier is good for backup though. A home user is fine with a 3.5-4 hour window before their backup becomes available for download (as it will probably take them days to download it anyway). In a corporate environment, I don't want to wait around for 3.5-4 hours before my data even becomes available for restore in a disaster recovery situation. Seems good for archive-only in a corporate environment (as the name implies).
- webreac 14y ago
  Here, we are producing logs of simulation runs that may be needed in the next couple of years. Most of the logs will be destroyed unused. This is a perfect use case for glacier. We do not care about 5 hours recovery time.
  - kondro 14y ago
    Absolutely, it's an archive product, not a backup product.
- culturestate 14y ago
  In a corporate environment, I wouldn't want to depend on the cloud as my primary backup solution in the first place. I'd be much more comfortable using it as the offsite mirror of an onsite backup. If you're at a point in disaster recovery where you have to restore from your offsite, you (likely) have bigger problems than a 4-hour wait time.
  - tomp 14y ago
    I personally believe that data should never be deleted (or overwritten), but only appended to. Kinda like what redis/datomic does. So, keep live data onsite, along with an onsite (small) backup, and all the old data in Glacier.
    - rossjudson 14y ago
      You can believe that, but legal realities dictate otherwise. There are certain classes of information that you are not permitted to keep beyond a defined horizon, either temporal or event-based. Legal compliance with records management processes means having the ability to delete or destroy information such that it cannot be recovered. Note that if the information is encrypted, you can just delete the decryption key and it is effectively deleted.
kalininalex 14y ago
With large volumes the real issue is not the storage but the upload speed. I've done some experiments and with the Comcast link (20Mbps down/whatever up), I got 1 Gb/hour upload rate. So, it'll take 11 full days to upload 256 Gb. Or, more realistically, if you do it overnight (8 hours) - the entire month.
- cstuder 14y ago
  If you don't mind the additional cost, you can physically send Amazon a harddrive: http://aws.amazon.com/importexport/ http://aws.amazon.com/importexport/
  - alttab 14y ago
    nothing says "cloud" like sending a physical hard drive through the mail.
    - jerf 14y ago
      "Never underestimate the bandwidth of a station wagon full of tapes hurtling down the highway. —Tanenbaum, Andrew S." - http://en.wikipedia.org/wiki/Sneakernet http://en.wikipedia.org/wiki/Sneakernet
- Tichy 14y ago
  But then you can do incremental backups which should be faster. Although I admit I am not sure how to do it with encryption (impossible?).
  - mkl 14y ago
    That's what duplicity is for: http://duplicity.nongnu.org/ http://duplicity.nongnu.org/ It uses rsync's algorithm to figure out what has changed, and everything is encrypted locally. (The site says it's in beta, but it's said that for years.)
- jefffoster 14y ago
  There's also Amazon Direct Connection (http://aws.amazon.com/directconnect/ http://aws.amazon.com/directconnect/) if you happen to be on the same backbone / data center.
sreitshamer 14y ago
I'm looking into supporting Glacier in Arq. It sure is cheap -- $10/month for a terabyte.
- ianlevesque 14y ago
  That would be fantastic.
- sbarre 14y ago
  As a happy customer, I'm glad to hear this as well!
- leejoramo 14y ago
  Arq is great backup software. I would view inclusion of Glacier support as a worthy paid upgrade. Arq is the pinnacle of my rather large backup pyramid which also includes: Dropbox, Superduper, Crashplan, rsync, SVN/GIT and more.
  - chmars 14y ago
    In an earlier version of Arq, there was no possibility to see which data was actually selected for backup (and which not). Has Arq become more user-friendly?
    - ghshephard 14y ago
      I'm a current user of ARQ, and it has, in my opinion (compared to Backblaze) a phenomenally user friendly description of exactly what is being backed up, and when, and when something was added, or modified.
- backwardm 14y ago
  Just FYI, I too would view Glacier support as something worth a normal upgrade fee. I am using Arq more as a long-term back-it-up-and-forget-about-it storage solution anyway, so it seems like a natural direction to go for a user like me (same strategy, but even lower cost). That said, I am reminded that I should not forget about the Arq backups and do a few test restores sometime. :)
g-garron 14y ago
I use s3cmd sync to keep my files backed up. But for my pictures, tunes, I use a Linux server and rsync. Now glacier is perfect for my tunes and family pictures.
cpeterso 14y ago
Here are Arq developer Stefan Reitshamer's initial comments on Amazon Glacier: http://www.haystacksoftware.com/support/arqforum/topic.php?id=2412#post-3689 http://www.haystacksoftware.com/support/arqforum/topic.php?i...
rektide 14y ago
A possible alternative to Glacier+product X (you mention Arq) could perhaps be Git-Annex, recently mentioned as it's Kickstarting a friendly UI component: http://news.ycombinator.com/item?id=4385886 http://news.ycombinator.com/item?id=4385886 http://www.kickstarter.com/projects/joeyh/git-annex-assistant-like-dropbox-but-with-your-own http://www.kickstarter.com/projects/joeyh/git-annex-assistan... Already has Amazon support: http://git-annex.branchable.com/tips/using_Amazon_S3/ http://git-annex.branchable.com/tips/using_Amazon_S3/ Very friendly with very large files!

jwr 14y ago

What's even more important, you will be able to encrypt your backups without having to disclose the encryption key in case you ever need to restore (client-side encryption and decryption). This is not the case with Backblaze, which is why I switched to CrashPlan — but I'm still looking for other solutions.

chmars 14y ago
CrashPlan shows your encryption key in plain text. Doesn't that worry you?
- jwr 14y ago
  Where does it show that? And are you sure we are talking about the encryption key, not the account password?
  - chmars 14y ago
    Settings / Security / Archive Encryption / 448-bit encryption with custom 448-bit key
    - jwr 14y ago
      Then no, it does not worry me. Obscuring password entry in an application that I almost never run is not a problem. Plus, if I do actually run the app and want to enter the password, I don't do it with a bunch of people peering over my shoulder.
- leejoramo 14y ago
  CrashPlan defaults to using the account password as the encryption password. However, you can also secure the encryption with a password not associated with the account. Or even provide your own 448-bit key. If you do either of these options, CrashPlan support will not be able to help you This setup allows CrashPlan to easily help non-technical home users, while allowing technically savvy users to securely hang themselves with their own encryption.
  - chmars 14y ago
    My question is not about the setup, that's OK. I am wondering why CrashPlan shows the encryption key in the clear and does not store it in the user or system keychain.
    - leejoramo 14y ago
      I see what you mean. I have up voted your original comment.
    - res0nat0r 14y ago
      I'm assuming this because their desktop client is a java app and it it's been made to run on linux, mac and Windows. Is there such a thing as a keychain on Windows? I've only used it on linux and mac.
      - voltagex_ 14y ago
        Yes, there's the CredWrite API - http://msdn.microsoft.com/en-us/library/windows/desktop/aa375187(v=vs.85).aspx http://msdn.microsoft.com/en-us/library/windows/desktop/aa37..., although I must admit I like the OS X keychain a lot better.
    - varikin 14y ago
      As others have noted, it is partially because Crashplan is a Java based app. Partially, it is also because Crashplan runs as System, not as the user. That way, I can have Crashplan backup my wife's user account and my user account. Furthermore, you can use the encryption key + a custom password, or your own encryption key with a passphrase. In this case, it is encyrpted locally and the key is not sent to Crashplan[1]. [1] http://support.crashplan.com/doku.php/recipe/change_security_settings http://support.crashplan.com/doku.php/recipe/change_security...
- acdha 14y ago
  You'd prefer that they lie to you and pretend it's not stored in the clear? If you don't have to type it in every time a backup runs, it's in the clear - everything else is just window dressing.
  - chmars 14y ago
    Standard practice is IMHO to use the user or system keychain.
    - acdha 14y ago
      Right, which is a largely meaningless distinction: if the process runs as you, any successful attacker can simply read it out of the CrashPlan process in memory. Again, if you're not typing the password in every time, a local compromise is almost certainly game-over. Apple's keychain helps reduce the damage if the data's not actively used but for something like CrashPlan which is always running the attacker is probably going to be lucky.
      - chmars 14y ago
        I agree that showing the encryption key in the clear is not a serious security flaw but it's IMHO against best practice. Passwords and key are usually shown in an obscured form, usually with asterisks, and stored in the user or system keychain. You are absolutely right that the security value of these standard practices should not be overvalued but still … what else within the security framework of CrashPlan is not done in accordance with best practice? (I assume, BTW, that CrashPlan does not use the system or user keychain on the Mac because it is not a real Mac citizen but a Java-based app. Firefox and Wuala – the latter Java-based too – don't use the user or system keychain either.)
        greedo 14y ago
        There have been sound arguments made against obscuring password entry.
driverdan 14y ago
The other feature that's great about CrashPlan is that it will allow you to backup to other systems running their software. I backup my laptop to both their service and one of my dedicated servers. That way if anything ever happens to their online service I have a second remote copy that I control.
deleted 14y ago
[deleted]
Auguste 14y ago
Backblaze does support the optional use of a separate encryption key which they claim to never store, but there's no information about whether it is ever disclosed to them or not. There's little information on their website, but it can be set in Settings > Security in the Backblaze client.
- jwr 14y ago
  You have to provide your encryption key to their website if you want to recover files. That's a show-stopper for me.

kondro 14y ago

Home-use is probably the only situation Glacier is good for backup though. A home user is fine with a 3.5-4 hour window before their backup becomes available for download (as it will probably take them days to download it anyway). In a corporate environment, I don't want to wait around for 3.5-4 hours before my data even becomes available for restore in a disaster recovery situation. Seems good for archive-only in a corporate environment (as the name implies).

webreac 14y ago
Here, we are producing logs of simulation runs that may be needed in the next couple of years. Most of the logs will be destroyed unused. This is a perfect use case for glacier. We do not care about 5 hours recovery time.
- kondro 14y ago
  Absolutely, it's an archive product, not a backup product.
culturestate 14y ago
In a corporate environment, I wouldn't want to depend on the cloud as my primary backup solution in the first place. I'd be much more comfortable using it as the offsite mirror of an onsite backup. If you're at a point in disaster recovery where you have to restore from your offsite, you (likely) have bigger problems than a 4-hour wait time.
- tomp 14y ago
  I personally believe that data should never be deleted (or overwritten), but only appended to. Kinda like what redis/datomic does. So, keep live data onsite, along with an onsite (small) backup, and all the old data in Glacier.
  - rossjudson 14y ago
    You can believe that, but legal realities dictate otherwise. There are certain classes of information that you are not permitted to keep beyond a defined horizon, either temporal or event-based. Legal compliance with records management processes means having the ability to delete or destroy information such that it cannot be recovered. Note that if the information is encrypted, you can just delete the decryption key and it is effectively deleted.

kalininalex 14y ago

With large volumes the real issue is not the storage but the upload speed. I've done some experiments and with the Comcast link (20Mbps down/whatever up), I got 1 Gb/hour upload rate. So, it'll take 11 full days to upload 256 Gb. Or, more realistically, if you do it overnight (8 hours) - the entire month.

cstuder 14y ago
If you don't mind the additional cost, you can physically send Amazon a harddrive: http://aws.amazon.com/importexport/ http://aws.amazon.com/importexport/
- alttab 14y ago
  nothing says "cloud" like sending a physical hard drive through the mail.
  - jerf 14y ago
    "Never underestimate the bandwidth of a station wagon full of tapes hurtling down the highway. —Tanenbaum, Andrew S." - http://en.wikipedia.org/wiki/Sneakernet http://en.wikipedia.org/wiki/Sneakernet
Tichy 14y ago
But then you can do incremental backups which should be faster. Although I admit I am not sure how to do it with encryption (impossible?).
- mkl 14y ago
  That's what duplicity is for: http://duplicity.nongnu.org/ http://duplicity.nongnu.org/ It uses rsync's algorithm to figure out what has changed, and everything is encrypted locally. (The site says it's in beta, but it's said that for years.)
jefffoster 14y ago
There's also Amazon Direct Connection (http://aws.amazon.com/directconnect/ http://aws.amazon.com/directconnect/) if you happen to be on the same backbone / data center.

sreitshamer 14y ago

I'm looking into supporting Glacier in Arq. It sure is cheap -- $10/month for a terabyte.

ianlevesque 14y ago
That would be fantastic.
sbarre 14y ago
As a happy customer, I'm glad to hear this as well!
leejoramo 14y ago
Arq is great backup software. I would view inclusion of Glacier support as a worthy paid upgrade. Arq is the pinnacle of my rather large backup pyramid which also includes: Dropbox, Superduper, Crashplan, rsync, SVN/GIT and more.
- chmars 14y ago
  In an earlier version of Arq, there was no possibility to see which data was actually selected for backup (and which not). Has Arq become more user-friendly?
  - ghshephard 14y ago
    I'm a current user of ARQ, and it has, in my opinion (compared to Backblaze) a phenomenally user friendly description of exactly what is being backed up, and when, and when something was added, or modified.
backwardm 14y ago
Just FYI, I too would view Glacier support as something worth a normal upgrade fee. I am using Arq more as a long-term back-it-up-and-forget-about-it storage solution anyway, so it seems like a natural direction to go for a user like me (same strategy, but even lower cost). That said, I am reminded that I should not forget about the Arq backups and do a few test restores sometime. :)

g-garron 14y ago

I use s3cmd sync to keep my files backed up. But for my pictures, tunes, I use a Linux server and rsync. Now glacier is perfect for my tunes and family pictures.

cpeterso 14y ago

Here are Arq developer Stefan Reitshamer's initial comments on Amazon Glacier: http://www.haystacksoftware.com/support/arqforum/topic.php?id=2412#post-3689 http://www.haystacksoftware.com/support/arqforum/topic.php?i...

rektide 14y ago

A possible alternative to Glacier+product X (you mention Arq) could perhaps be Git-Annex, recently mentioned as it's Kickstarting a friendly UI component: http://news.ycombinator.com/item?id=4385886 http://news.ycombinator.com/item?id=4385886 http://www.kickstarter.com/projects/joeyh/git-annex-assistant-like-dropbox-but-with-your-own http://www.kickstarter.com/projects/joeyh/git-annex-assistan... Already has Amazon support: http://git-annex.branchable.com/tips/using_Amazon_S3/ http://git-annex.branchable.com/tips/using_Amazon_S3/ Very friendly with very large files!