They look amazing. Bug bounties for everything, completely transparent architecture, data duplication and compression on the fly, they will be up even if two of Amazon's data centers die, one pays per byte and they are pretty cheap.
Tarsnap works really, really well. Just make a consistent snapshot of your data (I'm using UFS snapshots), point Tarsnap at it, and you're good to go.<p>The documentation is thorough, and Colin (the owner/operator/author) responds quickly to emails.<p>Finally, compression and deduplication is amazing:<p><pre><code> [nick@home ~]$ sudo tarsnap --print-stats
Total size Compressed size
All archives 348 GB 76 GB
(unique data) 34 GB 6.3 GB
</code></pre>
Yep, I've backed up 350GB of data, but since most of it is duplicated, I pay for storing 6.3GB. Win.<p>One word of caution though - this isn't a mainstream consumer backup service. If you lose your keys you lose your data. No chance of recovery. So make sure you back those up properly too, ideally in a different geography.
<i>why Tarsnap pricing is defined in terms of picodollars per byte rather than dollars per gigabyte: Tarsnap's author is a geek. Applying SI prefixes to non-SI units is a geeky thing to do.</i><p>I find that so amazingly annoying. To me it says "yeah, I know many people might find it hard to get their head around the units I defined, but I don't really care about that because I find it cool." We have standard units for a reason, because people can immediately get the scale of something in their mind. With this, you can't. I went to their site open to what they were selling, but I'm very turned off by this.
As an alternative, I use Arq continuously on all my computers and I highly recommend it (Sorry I'm on my iPhone and won't be able to give a link). It lets you use your own AWS credentials for backup and you can encrypt the data before it is sent to AWS.<p>The issue I have with Tarsnap is that the data is still at the hands of a small operation, as far as I can tell, and honestly I'm afraid we won't get our data if something happens to the guy. This is fine of course for many services, but data backup is inherently as mission critical as it gets. The whole reason for it is reliability, assurance and redundancy. It is not a nice to have, it is for many people the only place they fully trust to keep their data forever.<p>I wish Tarsnap had an innovation that made it possible to use it with one's (or an organization's) own AWS credentials. An on-site mode, if you will. Otherwise it has always seemed to me like a great piece of software.
All the data is encrypted before it ever leaves your machine. Not even cperciva should be able to read it.<p>You can also create a write-only key. If you run tarsnap from a server which gets pwned, the attackers can't touch the existing backups. Don't be the next Astalavista[1].<p>[1] <a href="http://joncraton.org/blog/49/analyzing-the-astalavista-hack" rel="nofollow">http://joncraton.org/blog/49/analyzing-the-astalavista-hack</a>
OP here. I found them looking for a good backup solution.<p>They look amazing. Bug bounties for everything (including cosmetic stuff), completely transparent architecture, data deduplication and compression on the fly, they will be up even if two of Amazon's data centers fail, one pays per byte (traffic/store) and for all that they are pretty cheap.
Interesting. Tarsnap and rsync.net seem to alternate coverage on HN, and for the longest time I kept forgetting they were different, even though I had vague sense of confusion.<p>This one is Colin Percival's project.
I understand data is encrypted before it ever leaves your machine, but I certainly wouldn't want encrypted data at-rest being exposed. Which gives me concern about Tarnap's terms: "I may provide information concerning your account and your use of the service to 3rd parties, at my sole discretion, if ... It is requested by law enforcement authorities ..." note - no requirement for a court order or subpoena.<p><a href="https://www.tarsnap.com/legal-why.html#PRIVACYLAW" rel="nofollow">https://www.tarsnap.com/legal-why.html#PRIVACYLAW</a>
I'm thinking of using Tarsnap. Can I absolutely, positively, definitely trust that everything on Tarsnap's end is encrypted to best practice standards and that there is no reasonable way to get to my data (outside of the usual contract provided by encryption I mean)?<p>I don't have the option to know for sure by analyzing the source code myself so I'll have to trust the popular opionion of Very Smart People here on HN (well, I suppose I <i>could</i> if I spent a non-trivial chunk of the coming year reading up on crypto stuff).
Cyphertite may also be of interest: <a href="https://www.cyphertite.com/" rel="nofollow">https://www.cyphertite.com/</a><p>Client-side encryption and deduplication, with source code. 8GB free, $10/mo for personal unlimited use, 10c/GB/month for business/enterprise. My main reservations are they seem to be based in one datacenter, and don't seem to have support for multiple keyfiles with separate read/write/delete/machine restrictions. Also not in FreeBSD ports :P
Tarsnap has been working really well for us, but one huge downside that we've noticed is how slow it is to restore data from say a 1TB archive.<p>Sometimes it takes more than 3 hours to restore a customer's 40MB directory.<p>If we were to have a full HD failure and had to restore the whole 1TB, that would probably take days. Days of downtime for us.<p>So depending on your situation, this might not be ideal.<p>I contacted Colin about this a few months ago and he mentioned that he is working on a faster version.
The "legal" section of the site is confusing.<p>"1. You may only access the service using unmodified Tarsnap client code which I have distributed" -- really? no API and no custom clients?
One of the things I love about Tarsnap is the bug bounties, which range from $2000 for being able to decrypt user data right down to $1 for cosmetic issues.
quick question here: is there a delay in Recent Activity?<p>I just signed up and used it on two servers like 30 minutes ago, but I don't see anything in the account activity except the payment info.
I'm quite sure my servers sent stuff because I monitored b/w usage
Colin - I dig what you're doing, but every time I go to the Tarsnap website, I'm turned off from using it for all of the reasons that have been discussed here ad nauseum since 2009. I'd love to see you succeed more; I think you deserve it, and I wish you'd just <i>grab</i> it.<p>see <a href="https://news.ycombinator.com/item?id=820705" rel="nofollow">https://news.ycombinator.com/item?id=820705</a> and <a href="https://news.ycombinator.com/item?id=1639277" rel="nofollow">https://news.ycombinator.com/item?id=1639277</a>, e.g.
I'm still not sure whether I can trust somebody else with my data, but I'm growing more and more concerned of hardware failure of my own backups. Might try Tarsnap one of these days.
I would love to have something like the Backblaze client but working with Tarsnap as a backend: you install it and you forget about it. The sensible default configuration is good enough for average joe but you can tweak it if you want.
This is absurdly expensive. If you have a 400GB laptop, fully backed-up and with negligible deltas, you are paying $1440 a year.<p>(400GB is not an absurd amount, either. I personally would ideally have about that much in my off-site backup.)
I've been using <a href="http://labs.bittorrent.com/experiments/sync.html" rel="nofollow">http://labs.bittorrent.com/experiments/sync.html</a> for a while and it is as reliable as you need.
i've been poking round the site and i couldn't see an answer to this question - why do you need to encrypt the communication if the data themselves are encrypted? maybe i am misunderstanding, but it seems like each block is encrypted <i>and</i> the pipe between client and server is encrypted. is it because there are additional interesting metadata (if so, what)? or have i misunderstood?
Truly paranoids are/will/should use Bitcoin or Litecoin. I don't get why pricing is USD$ only, it just seems that cryptocurrencies are perfect for this kind of service.
<a href="http://www.tarsnap.com/legal-why.html#BCPSTISSTUPID" rel="nofollow">http://www.tarsnap.com/legal-why.html#BCPSTISSTUPID</a> I see what you did there :)