Conversation

Notices

1. Embed this notice
   Royce Williams (tychotithonus@infosec.exchange)'s status on Thursday, 14-May-2026 02:11:02 JST Royce Williams

   Non-offline backups aren't.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Thursday, 14-May-2026 02:11:01 JST Rich Felker

     in reply to

     @tychotithonus How do you define "offline"? I would consider the key distinguishing characteristic of a real backup is that it's not mutable online. It can accept append or readback online, just not overwrite/deletion.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Thursday, 14-May-2026 05:21:34 JST Rich Felker

     in reply to

     @tychotithonus Access control to read should be cryptographic (read whatever you like but without the keys it might as well be random bits).

   • Embed this notice
     Royce Williams (tychotithonus@infosec.exchange)'s status on Thursday, 14-May-2026 05:21:35 JST Royce Williams

     in reply to

     • Rich Felker

     @dalias Very fair! (though there are also security properties for not being able to read a backup, that's kinda a different animal.) Though I'd also argue that there's a fuzzy demarc of immutability for which "disconnected and in a drawer" buys additional insurance. YTMMV as always!

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Thursday, 14-May-2026 06:29:14 JST Rich Felker

     in reply to

     @tychotithonus No. It's serving the role of a backup even if it's compromising secrecy of your data. And non-encrypted isn't necessarily compromising the secrecy; like you said, there can be non-cryptographic means of preventing it from being read back, like having it fully offline/disconnected. It's just that encryption (with proper key handling) is best, and lets you avoid this constraint of needing to have it fully offline rather than just append-only.

   • Embed this notice
     Royce Williams (tychotithonus@infosec.exchange)'s status on Thursday, 14-May-2026 06:29:15 JST Royce Williams

     in reply to

     • Rich Felker

     @dalias So ... are you saying only encrypted backups are backups? 😉

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Thursday, 14-May-2026 08:27:45 JST Rich Felker

     in reply to

     • fraggLe!

     @fwaggle @tychotithonus My bakelite does incremental backups with support for pruning old snapshots with this kind of blinding.

   • Embed this notice
     fraggLe! (fwaggle@moodoo.org)'s status on Thursday, 14-May-2026 08:27:47 JST fraggLe!

     in reply to

     • Rich Felker

     @dalias @tychotithonus I used to use Tarsnap wrong for this purpose - I had a set of write-only keys on each machine, to push the new snapshots up on a schedule.

     This did mean that automatically pruning became problematic/impossible, and I'm not sure if Colin ever figured out a reasonable solution, but it meant that any compromised machine couldn't nuke the backups it had already made - the worst an attacker could do is upload garbage to run me out of credit.