7 ms·

The one thing that has put me off Tarsnap until now is, and not to be intentionally morbid, the bus factor [1] of 1. As far as I know its just Colin that runs i

The one thing that has put me off Tarsnap until now is, and not to be intentionally morbid, the bus factor [1] of 1. As far as I know its just Colin that runs it. In the unlikely event we need to access our backups, tarsnap is down and Colin is no longer available to maintain it we could be stuffed. Colin, do you have a contingency plan in place if you are not available? 1: http://en.wikipedia.org/wiki/Bus_factor http://en.wikipedia.org/wiki/Bus_factor

read 13y ago
What has put me off Tarsnap was not realizing that the price per GB is for compressed storage. So while it looks high compared to Amazon's per GB pricing, it's a lot cheaper. I don't recall if this was on Tarsnap's website when I had first checked, but it might be worth reporting the average compression rate to make more visible to prospective customers what the Amazon S3 storage portion of the pricing is.
- pedrocr 13y ago
  I'd assume the average compression rate to be very low, no? Don't modern cryptosystems have to encrypt then compress to avoid some forms of attack, thus making the compression not very effective?
  - deleted 13y ago
    [deleted]
  - amalcon 13y ago
    Those attacks only work when the attacker has some control over the plaintext. Backup services don't have that problem.
    - pedrocr 13y ago
      So tarsnap compresses then encrypts?
      - amalcon 13y ago
        I haven't actually checked that; all I mean to say is that it would be relatively safe to do so.
      - JW_00000 13y ago
        Yes. And it de-duplicates as well.
      - mpyne 13y ago
        Guys, don't confuse the crypto issues here. The whole point to tarsnap is to be able to safely encrypt any and all of your data, including compressed data. We wouldn't expect that a .tar.gz being backed up is somehow "less secure" than the .tar file, we'd demand the same security for both. Compression becomes a problem when it can be used as an "oracle" into the key used for a given stream of ciphertext. The reason TLS is susceptible is because the attacker can MITM and control at least some aspects of the plaintext or shared client-server state, and iterate repeatedly to refine their guesses. These issues simply don't apply in the same way to backing up files. I sure there are still theoretical issues that would need to be worked through in deciding how you'd do something like this, issues which could be better explained by any of the many crypto types who hang out here. But don't cargo cult your treatment of crypto.
      - deleted 13y ago
        [deleted]
    - solarexplorer 13y ago
      Well, if you backup your entire disk, then there is probably a fair amount of known plain text...
      - nitrogen 13y ago
        In the recent web attack instances, it's not just known plaintext, it's using compression to discover unknown plaintext by repeatedly guessing across multiple requests and watching for the request size to change. So an attacker would need the ability to alter your filesystem and make backup requests, repeatedly, for that attack to matter to Tarsnap.
  - anton_gogolev 13y ago
    I'd wager that the output from "modern cryptosystems" is, for all practical purposes, not compressible at all.
  - midas007 13y ago
    A strong construction should be impossible to compress because encryption maximizes bit entropy, which should make the cyphertext indistinguishable from a PRF (ie a random noise source). MAC, decrypt, decompress.... always^9 in that order.
    - pedrocr 13y ago
      Right, encrypt then compress is useless. And compress then encrypt is unsafe in some cases[1]. Apparently backup isn't one of them, you need to be able to choose the plaintext. https://en.wikipedia.org/wiki/CRIME_(security_exploit) https://en.wikipedia.org/wiki/CRIME_(security_exploit)
- mnutt 13y ago
  What if tarsnap released a command-line tool that could be run on a directory to estimate its storage cost, pre-signup?
  - hamburglar 13y ago
    Yeah, I almost wrote to them suggesting exactly this, but then I figured what the heck, I'll just sign up. The tool would definitely be helpful, though.
- late2part 13y ago
  Not really. If you compressed your data on Amazon, you'd get a lower per-GB price too. I think tarsnap is good, and you're paying him for the service of interfacing to Amazon for you. It's not accurate to say his price of compressed storage is comparable to uncompressed storage.
jacquesm 13y ago
You could mitigate the bus factor of 1 yourself by using more than one backup service, which is good practice anyway.
- samwillis 13y ago
  Very true, and infact that is what I do. I use my VPS providers backup system for snapshotting my servers and an offsite file store for additional backups. However if my choice for the latter is between a sole trader and an organisation with 20-30 employees and multiple directors that obviously is the more sensible choice. No matter how much more you like the tools or respect the owner with something as important as backups you need to go with the most reliable option. Sure, I could use tarsnap and another file store for three backup locations (which may be something I should do) but then the argument is why not go with two companies that have a bus factor of more than 1?
RoboTeddy 13y ago
If you're using Tarsnap, and you hear it fails, then quickly make a new backup somewhere else. The chance of your primary storage failing during that unlikely and limited window seems low.
- samwillis 13y ago
  Yes, that could work however you have now lost your historical backups and still exposed yourself to an unnecessary risk. Again sorry Colin for this but there is a 1/500,000 chance he will be struck by lightning this year [1]. Amazon 3s (the backend of tarsnap) has a durability of 99.999999999% [2] and so you are 200 thousand times more likely to lose your backup because of a lightning strike than due to a corruption on s3. [1]:http://en.wikipedia.org/wiki/Lightning_strike http://en.wikipedia.org/wiki/Lightning_strike [2]: http://aws.amazon.com/s3/faqs/ http://aws.amazon.com/s3/faqs/
  - throwaway7767 13y ago
    I think the fact that Colin handles everything himself increases my trust in tarsnap, because he clearly knows what he is doing. I trust it in a way that I would not trust a faceless corporation like crashplan, even though they also advertise client-side encryption. I have a secondary emergency backup in a bank vault, so even in the unlikely event that tarsnap were to crash and burn at the same time my disk fails, I still have another backup, it's just 1-2 months old. Honestly, I'm not sure I would be a tarsnap customer if it were a larger operation where I could not gauge the trustworthiness and skill of all the involved parties.
  - oskarth 13y ago
    Why do you need Colin alive in order use tarsnap? (God, that's a strange sentence to write. Sorry about that, Colin.)
    - iancarroll 13y ago
      Assuming the S3 bill is the next day...
    - 13y ago
sgt 13y ago
Remember when Colin Percival announced his Tarsnap logo competition on HN? There'd be a cash price and everything. I am sure several people worked on logos - some excellent, some less so. I'm frankly surprised to see that this is the result: http://www.tarsnap.com/header.png http://www.tarsnap.com/header.png Really? Did some of us just waste our time so that Colin could have his 8 year old nephew whip up a blurry logo? It's ofcourse his right to do so, but it does make me wonder.
- diydsp 13y ago
  eh... Without having any skin in the game, I would say this logo design adequately conveys the meaning: disks, a lock, "authoritative"-looking font, succint tagline. I agree the blurriness could be improved, though. As for people entering a contest... they can't all be winners.
  - cperciva 13y ago
    The blurriness is the result of antialiasing. I start with an EPS; can you tell me how to convert this without running into that problem? I'm afraid I'm not very good at anything graphical.
    - Kerrick 13y ago
      Often it requires a bit of manual hinting. For example, [1] was just resizing the vector and allowing antialiasing to do its thing, and [2] is the result of resizing it and then dragging vertices to pixel or half-pixels. [1]: http://i.imgur.com/Urs6S3r.png http://i.imgur.com/Urs6S3r.png [2]: http://i.imgur.com/5EMBxaV.png http://i.imgur.com/5EMBxaV.png
      - cperciva 13y ago
        Ugh. I was hoping there was some automatic way of doing this.
    - mwcampbell 13y ago
      If you can first convert the logo to PDF, then you could grab xpdf or poppler, then try: pdftoppm -png -aa no -r <dpi> logo.pdf logo You'll have to experiment with the dpi until the logo comes out the right size. The dpi doesn't have to be an integer.
mjschultz 13y ago
Here is his response to that question on the mailing list: http://mail.tarsnap.com/tarsnap-users/msg00846.html http://mail.tarsnap.com/tarsnap-users/msg00846.html
JoshTriplett 13y ago
For my part, it's a closely related reason: I'd sign up for the service today if the client were Open Source, rather than "look but don't touch" source.

read 13y ago

What has put me off Tarsnap was not realizing that the price per GB is for compressed storage. So while it looks high compared to Amazon's per GB pricing, it's a lot cheaper. I don't recall if this was on Tarsnap's website when I had first checked, but it might be worth reporting the average compression rate to make more visible to prospective customers what the Amazon S3 storage portion of the pricing is.

pedrocr 13y ago
I'd assume the average compression rate to be very low, no? Don't modern cryptosystems have to encrypt then compress to avoid some forms of attack, thus making the compression not very effective?
- deleted 13y ago
  [deleted]
- amalcon 13y ago
  Those attacks only work when the attacker has some control over the plaintext. Backup services don't have that problem.
  - pedrocr 13y ago
    So tarsnap compresses then encrypts?
    - amalcon 13y ago
      I haven't actually checked that; all I mean to say is that it would be relatively safe to do so.
    - JW_00000 13y ago
      Yes. And it de-duplicates as well.
    - mpyne 13y ago
      Guys, don't confuse the crypto issues here. The whole point to tarsnap is to be able to safely encrypt any and all of your data, including compressed data. We wouldn't expect that a .tar.gz being backed up is somehow "less secure" than the .tar file, we'd demand the same security for both. Compression becomes a problem when it can be used as an "oracle" into the key used for a given stream of ciphertext. The reason TLS is susceptible is because the attacker can MITM and control at least some aspects of the plaintext or shared client-server state, and iterate repeatedly to refine their guesses. These issues simply don't apply in the same way to backing up files. I sure there are still theoretical issues that would need to be worked through in deciding how you'd do something like this, issues which could be better explained by any of the many crypto types who hang out here. But don't cargo cult your treatment of crypto.
    - deleted 13y ago
      [deleted]
  - solarexplorer 13y ago
    Well, if you backup your entire disk, then there is probably a fair amount of known plain text...
    - nitrogen 13y ago
      In the recent web attack instances, it's not just known plaintext, it's using compression to discover unknown plaintext by repeatedly guessing across multiple requests and watching for the request size to change. So an attacker would need the ability to alter your filesystem and make backup requests, repeatedly, for that attack to matter to Tarsnap.
- anton_gogolev 13y ago
  I'd wager that the output from "modern cryptosystems" is, for all practical purposes, not compressible at all.
- midas007 13y ago
  A strong construction should be impossible to compress because encryption maximizes bit entropy, which should make the cyphertext indistinguishable from a PRF (ie a random noise source). MAC, decrypt, decompress.... always^9 in that order.
  - pedrocr 13y ago
    Right, encrypt then compress is useless. And compress then encrypt is unsafe in some cases[1]. Apparently backup isn't one of them, you need to be able to choose the plaintext. https://en.wikipedia.org/wiki/CRIME_(security_exploit) https://en.wikipedia.org/wiki/CRIME_(security_exploit)
mnutt 13y ago
What if tarsnap released a command-line tool that could be run on a directory to estimate its storage cost, pre-signup?
- hamburglar 13y ago
  Yeah, I almost wrote to them suggesting exactly this, but then I figured what the heck, I'll just sign up. The tool would definitely be helpful, though.
late2part 13y ago
Not really. If you compressed your data on Amazon, you'd get a lower per-GB price too. I think tarsnap is good, and you're paying him for the service of interfacing to Amazon for you. It's not accurate to say his price of compressed storage is comparable to uncompressed storage.

jacquesm 13y ago

You could mitigate the bus factor of 1 yourself by using more than one backup service, which is good practice anyway.

samwillis 13y ago
Very true, and infact that is what I do. I use my VPS providers backup system for snapshotting my servers and an offsite file store for additional backups. However if my choice for the latter is between a sole trader and an organisation with 20-30 employees and multiple directors that obviously is the more sensible choice. No matter how much more you like the tools or respect the owner with something as important as backups you need to go with the most reliable option. Sure, I could use tarsnap and another file store for three backup locations (which may be something I should do) but then the argument is why not go with two companies that have a bus factor of more than 1?

RoboTeddy 13y ago

If you're using Tarsnap, and you hear it fails, then quickly make a new backup somewhere else. The chance of your primary storage failing during that unlikely and limited window seems low.

samwillis 13y ago
Yes, that could work however you have now lost your historical backups and still exposed yourself to an unnecessary risk. Again sorry Colin for this but there is a 1/500,000 chance he will be struck by lightning this year [1]. Amazon 3s (the backend of tarsnap) has a durability of 99.999999999% [2] and so you are 200 thousand times more likely to lose your backup because of a lightning strike than due to a corruption on s3. [1]:http://en.wikipedia.org/wiki/Lightning_strike http://en.wikipedia.org/wiki/Lightning_strike [2]: http://aws.amazon.com/s3/faqs/ http://aws.amazon.com/s3/faqs/
- throwaway7767 13y ago
  I think the fact that Colin handles everything himself increases my trust in tarsnap, because he clearly knows what he is doing. I trust it in a way that I would not trust a faceless corporation like crashplan, even though they also advertise client-side encryption. I have a secondary emergency backup in a bank vault, so even in the unlikely event that tarsnap were to crash and burn at the same time my disk fails, I still have another backup, it's just 1-2 months old. Honestly, I'm not sure I would be a tarsnap customer if it were a larger operation where I could not gauge the trustworthiness and skill of all the involved parties.
- oskarth 13y ago
  Why do you need Colin alive in order use tarsnap? (God, that's a strange sentence to write. Sorry about that, Colin.)
  - iancarroll 13y ago
    Assuming the S3 bill is the next day...
  - 13y ago

sgt 13y ago

Remember when Colin Percival announced his Tarsnap logo competition on HN? There'd be a cash price and everything. I am sure several people worked on logos - some excellent, some less so. I'm frankly surprised to see that this is the result: http://www.tarsnap.com/header.png http://www.tarsnap.com/header.png Really? Did some of us just waste our time so that Colin could have his 8 year old nephew whip up a blurry logo? It's ofcourse his right to do so, but it does make me wonder.

diydsp 13y ago
eh... Without having any skin in the game, I would say this logo design adequately conveys the meaning: disks, a lock, "authoritative"-looking font, succint tagline. I agree the blurriness could be improved, though. As for people entering a contest... they can't all be winners.
- cperciva 13y ago
  The blurriness is the result of antialiasing. I start with an EPS; can you tell me how to convert this without running into that problem? I'm afraid I'm not very good at anything graphical.
  - Kerrick 13y ago
    Often it requires a bit of manual hinting. For example, [1] was just resizing the vector and allowing antialiasing to do its thing, and [2] is the result of resizing it and then dragging vertices to pixel or half-pixels. [1]: http://i.imgur.com/Urs6S3r.png http://i.imgur.com/Urs6S3r.png [2]: http://i.imgur.com/5EMBxaV.png http://i.imgur.com/5EMBxaV.png
    - cperciva 13y ago
      Ugh. I was hoping there was some automatic way of doing this.
  - mwcampbell 13y ago
    If you can first convert the logo to PDF, then you could grab xpdf or poppler, then try: pdftoppm -png -aa no -r <dpi> logo.pdf logo You'll have to experiment with the dpi until the logo comes out the right size. The dpi doesn't have to be an integer.

mjschultz 13y ago

Here is his response to that question on the mailing list: http://mail.tarsnap.com/tarsnap-users/msg00846.html http://mail.tarsnap.com/tarsnap-users/msg00846.html

JoshTriplett 13y ago

For my part, it's a closely related reason: I'd sign up for the service today if the client were Open Source, rather than "look but don't touch" source.