9 ms·

At Backblaze, we've done a lot of our own analyses on our hard drives to look at which ones are most reliable, whether temperature affects reliability, etc. How

by budmang 12y ago

At Backblaze, we've done a lot of our own analyses on our hard drives to look at which ones are most reliable, whether temperature affects reliability, etc. However, we kept being asked for the raw data so people could run their own analyses. This data set releases 500 million data points on 41,000 drives. I imagine you guys here at YCombinator/Hacker News are the ones who'd find this data amongst the most useful. Enjoy and let us know what you find!

crackulator 12y ago
Your website uses a terrible HTTPS config. https://www.ssllabs.com/ssltest/analyze.html?d=www.backblaze.com https://www.ssllabs.com/ssltest/analyze.html?d=www.backblaze... No PFS, weak RC4, TLS 1.0 only, and SHA1. It's not much effort to fix these, really. It makes me question the security of your product.
- CatDevURandom 12y ago
  > Which brings us to the most important principle on HN: civility. Since long before the web, the anonymity of online conversation has lured people into being much ruder than they'd dare to be in person. So the principle here is: don't say anything you wouldn't say face to face. This doesn't mean you can't disagree. But disagree without calling the other person names. If you're right, your argument will be more convincing without them.
- atYevP 12y ago
  We got a B! That's above average! Totally not "terrible". Truth is the website and the service itself are fairly different, but I can tell you that we have a lot of folks using, lets say..."older", browsers that access our site, and so we try to make sure that they can still access their accounts - though we're constantly monitoring for ways to make it better. A lot of folks that use us have older operating systems and that hampers us a bit.
  - rasz_pl 12y ago
    This is a pretty weak excuse, are you claiming adding modern crypto support would make old browsers not work on your site?
    - taneliv 12y ago
      If you look at the ssllabs analysis, they already fail in IE 6 handshake simulation. Offhand I can't say if support for older browser is incompatible with more modern ciphers and protocols.
      - edwintorok 12y ago
        The mozilla wikipage on TLS configuration has good information on ciphersuites and supported browser: https://news.ycombinator.com/item?id=9000235 https://news.ycombinator.com/item?id=9000235 The intermediate suite (default) says: "Firefox 1, Chrome 1, IE 7, Opera 5 and Safari 1. " The "Old backward compatibility" has IE6, but it also has SSL3, which is really not recommended.
      - brianwski 12y ago
        Brian from Backblaze here. Why do we get a bad grade for not talking with IE6? I'm honestly curious... I thought anybody who supported IE6 should be downgraded, because IE6 was end of lifed, inherently using it is a bad bad bad thing. It is literally safer to not use it than use it, right? I don't think it's even possible to run IE6 on Windows Vista or Windows 7 or Windows 8, but I'm not entirely sure of that.
        yuhong 12y ago
        Yea, that is a false claim and not what OP means.
      - yuhong 12y ago
        It should not be incompatible. Servers will just select 3DES or RC4 suites for older browsers that only have these listed.
- deftnerd 12y ago
  Their website doesn't have a lot to protect, in all honesty. Their backup product uses different security mechanisms. If it was a site that had critical user information, like email or document storage, then they could solve this by making their website open to all protocols and then test the browser type and redirect the user to a specific subdomain with the appropriate security. For instance, https://sitename.com https://sitename.com could be backwards compatible. Upon login, it redirects the user to lowsecurity.sitename.com or highsecurity.sitename.com depending on their browser type.
  - harshreality 12y ago
    The login password is the primary backup password isn't it? That's what would enable them to offer downloads of backed-up files. While they have a zero-knowledge option (encrypt using secret key only known to the client), it can't realistically be enabled by default in a backup service that's intended to be easy to use. Same with crashplan and every other service that isn't zero-knowledge-mode only. The fact that the actual backups may (don't know) be transferred over a channel with higher security is irrelevant if the passphrase for decrypting the backup (or decrypting the decryption key, depending on how it works) is transmitted over SSL to the website in question. You don't need lowsecurity.site.com and highsecurity.site.com. You can support any even marginally secure and up-to-date client with one website ssl configuration. The big websites do it just fine. The other problem is that clients that don't support TLS 1.2 and good ciphersuites are pretty much by definition no longer maintained very well.
    - NeutronBoy 12y ago
      If the password for your Backblaze backups is the account password to the website, then there are bigger issues than having RC4 enabled.
- nodata 12y ago
  Your tact could be better. Here they come with their raw data that we asked for, and you reward them by whinging about their SSL cert.
deanclatworthy 12y ago
I've asked before but as you're now moving in this direction I'll try again. Do you have any plans to release this data more frewuently, maybe once a month?
- atYevP 12y ago
  Yev from Backblaze here -> Not monthly, but we're hoping to do it quarterly though that may change. That's the plan for now though!

by budmang 12y ago

crackulator 12y ago

Your website uses a terrible HTTPS config. https://www.ssllabs.com/ssltest/analyze.html?d=www.backblaze.com https://www.ssllabs.com/ssltest/analyze.html?d=www.backblaze... No PFS, weak RC4, TLS 1.0 only, and SHA1. It's not much effort to fix these, really. It makes me question the security of your product.

CatDevURandom 12y ago
> Which brings us to the most important principle on HN: civility. Since long before the web, the anonymity of online conversation has lured people into being much ruder than they'd dare to be in person. So the principle here is: don't say anything you wouldn't say face to face. This doesn't mean you can't disagree. But disagree without calling the other person names. If you're right, your argument will be more convincing without them.
atYevP 12y ago
We got a B! That's above average! Totally not "terrible". Truth is the website and the service itself are fairly different, but I can tell you that we have a lot of folks using, lets say..."older", browsers that access our site, and so we try to make sure that they can still access their accounts - though we're constantly monitoring for ways to make it better. A lot of folks that use us have older operating systems and that hampers us a bit.
- rasz_pl 12y ago
  This is a pretty weak excuse, are you claiming adding modern crypto support would make old browsers not work on your site?
  - taneliv 12y ago
    If you look at the ssllabs analysis, they already fail in IE 6 handshake simulation. Offhand I can't say if support for older browser is incompatible with more modern ciphers and protocols.
    - edwintorok 12y ago
      The mozilla wikipage on TLS configuration has good information on ciphersuites and supported browser: https://news.ycombinator.com/item?id=9000235 https://news.ycombinator.com/item?id=9000235 The intermediate suite (default) says: "Firefox 1, Chrome 1, IE 7, Opera 5 and Safari 1. " The "Old backward compatibility" has IE6, but it also has SSL3, which is really not recommended.
    - brianwski 12y ago
      Brian from Backblaze here. Why do we get a bad grade for not talking with IE6? I'm honestly curious... I thought anybody who supported IE6 should be downgraded, because IE6 was end of lifed, inherently using it is a bad bad bad thing. It is literally safer to not use it than use it, right? I don't think it's even possible to run IE6 on Windows Vista or Windows 7 or Windows 8, but I'm not entirely sure of that.
      - yuhong 12y ago
        Yea, that is a false claim and not what OP means.
    - yuhong 12y ago
      It should not be incompatible. Servers will just select 3DES or RC4 suites for older browsers that only have these listed.
deftnerd 12y ago
Their website doesn't have a lot to protect, in all honesty. Their backup product uses different security mechanisms. If it was a site that had critical user information, like email or document storage, then they could solve this by making their website open to all protocols and then test the browser type and redirect the user to a specific subdomain with the appropriate security. For instance, https://sitename.com https://sitename.com could be backwards compatible. Upon login, it redirects the user to lowsecurity.sitename.com or highsecurity.sitename.com depending on their browser type.
- harshreality 12y ago
  The login password is the primary backup password isn't it? That's what would enable them to offer downloads of backed-up files. While they have a zero-knowledge option (encrypt using secret key only known to the client), it can't realistically be enabled by default in a backup service that's intended to be easy to use. Same with crashplan and every other service that isn't zero-knowledge-mode only. The fact that the actual backups may (don't know) be transferred over a channel with higher security is irrelevant if the passphrase for decrypting the backup (or decrypting the decryption key, depending on how it works) is transmitted over SSL to the website in question. You don't need lowsecurity.site.com and highsecurity.site.com. You can support any even marginally secure and up-to-date client with one website ssl configuration. The big websites do it just fine. The other problem is that clients that don't support TLS 1.2 and good ciphersuites are pretty much by definition no longer maintained very well.
  - NeutronBoy 12y ago
    If the password for your Backblaze backups is the account password to the website, then there are bigger issues than having RC4 enabled.
nodata 12y ago
Your tact could be better. Here they come with their raw data that we asked for, and you reward them by whinging about their SSL cert.

deanclatworthy 12y ago

I've asked before but as you're now moving in this direction I'll try again. Do you have any plans to release this data more frewuently, maybe once a month?

atYevP 12y ago
Yev from Backblaze here -> Not monthly, but we're hoping to do it quarterly though that may change. That's the plan for now though!