Hacker News Reader

Many people’s backup routines aren’t good enough.

Some of these guys encrypt over a period of time which is long enough to exceed the backup rotation. Their code decrypts on request, until the trigger day, when it posts the banners and deletes itself.

View on HN

That's why you have a combination of rotating backups, say 7, one a day, and non-rotating permanent backups, say once a week.

Also, one should use "append only" backups (such as tape), or a disk drive designed to be append only with hardware write enables.

With a de-duplicating backup system like Borg, you can keep more backups in the same space. borgbase.com provides append-only and 2FA, which keeps your backups secure.

Maybe corporations should make it standard practice to have cold storage backups that are physically disconnected from the network (by humans) in a rotated fashion. Backup A is physically disconnected on B days and backup B is physically disconnected on A days.

Or stored an a cloud storage provider that supports S3-style object lock.

Reply on news.ycombinator.com