Ask HN: How should I back up data on devices if I'm not smart?
If someone is a less able, cognitively impaired, or perhaps very young - It would be good to see what advice HN would give them for protecting their data from ransomware, theft, or disaster.
135 comments
[ 4.8 ms ] story [ 198 ms ] threadBut I also set up Backblaze for most of my family members, and when my dad's iMac SSD died, even though I physically visited, and even though I had 48 hours there, there was no way to recover the (meager 1TB) contents.
I had to use the pretty-trash web UI and could only select something like 25GB at a time, from a super-slow and janky web UI, and then download those files in like dinosaur-time.
It did save the day; I could get the most important files (there were like, specific ones on the desktop that my dad was mostly really concerned about).
But in my only experience of using Backblaze in actual crisis, it disappointed.
I think (though I have never verified) that their option to FedEx a hard disk would have worked, if I had had more time, and that's cool. But I was only there for a couple days, and was trying to set him up with a new Mac Mini to replace the failed iMac.
So in the end, we said fuck it, and my dad lost a bunch of his shit.
OTOH, 5 or 8 years ago (?), my laptop corrupted my iPhoto library. (Yeah, back in iPhoto time.) I happened to be on a Japanese bullet train from Osaka to Tokyo at the time (editing a Printed Book composition for a gift, and that seemed to be what irrevocably corrupted the iPhoto library). I restored the backed-up iPhoto library (maybe 250GB back then, a tenth of what it is today) to my home Mac and it was restored by the time I got home from the 2.5 hour train ride.
But it also cost me something like $180, because I had Arq configured to use AWS Glacier storage, which (at least back then — does it even still exist?) was cheap to put data into and very expensive to get data out of quickly. (IIRC Arq even paused automatically, to avoid this, but I pressed the Continue button.)
something something pros and cons
While I wouldn't say my dad's "not smart" like the title of this thread, he is 70 or whatever, and not technical, and would probably not be able to convert a fedexed HDD from his old iMac to a working setup on his new Mac Mini.
It's easy to talk someone through physically plugging in a hard drive, and then you can do the copying yourself.
This of course relies on your dad not expecting his computer to be private from you, but I doubt there are many people who aren't technically engaged but expect the utmost in digital privacy.
So the remote option technically did exist, and if my dad was gonna die or something if we didn't recover those files, I could have done it. But there was like 20-30 second menu latency with remote access (partly Apple's fault, the Windows machine is 5x better with the same connection, but it seems macOS can't forego its stupid animations no matter what).
On the technical side, it's probably because RDP is well optimized. There has got to be something for Mac that works similarly well, but I can't give you any pointers. I was dealing with DSL as well (6M/384k), so ssh was an advantage.
Also, although I recently moved off of Mac to Linux for most desktop computing, I think I tried every single remote desktop solution for macOS over those years.
The best thing I ever found (in terms of being able to remote desktop into a 5K display and have usable latency and at least eventually show the screen at full resolution) was AnyDesk.
For my last year on the Mac, that is what I recommended for remote desktop. (It does work on Linux too, but on Linux I find xrdp works fine, just like on Windows.)
One tip: If you are connecting from macOS, using Microsoft Remote Desktop, that app crashes with 6K and 8K screen sizes. But there is an app called Royal TSX which can be an RDP client, and it handles those resolutions fine.
I still use Arq 7, and highly recommend it.
> When you request a data restore, we do what is known as a cloud restore. This simplifies the data restoration process. For example, let’s assume your hard drive crashes and you get a new hard drive or even a new computer. To restore your data you first log in to Backblaze using a web browser by providing your Backblaze account information (email address and password). Once you have logged in to the Backblaze secure web interface you can request a restore of your data. You do not have to install Backblaze to get your data back. To make this work, we decrypt your data on our secure restore servers and we then zip it and send it over an encrypted SSL connection to your computer. Once it arrives on your computer, you can unzip it and you have your data back.
That's if you are just using the default setup, which encrypts using a private key that Backblaze generates and manages.
You can optionally protect the private key with a passphrase. If you do that, restore changes:
> The data restoration process is a cloud restore, similar to the process previously described but with a few differences. To decrypt your data, you are required to enter your passphrase on our secure website. When you do so, it is passed over an encrypted connection to our datacenter where it is used to decrypt your private key, which in turn is used to decrypt your data. Your passphrase is never saved on disk and it is discarded once it is used. As before, once we decrypt your data on our secure restore servers we then zip it and send it over an encrypted SSL connection to your computer. Once it arrives on your computer, you can unzip it and you have your data back.
Instead, I decided to buy Arq and use a generic cloud storage service instead of a backup service. I was going to go with Backblaze's B2 for that but then realized that (1) I had 1 TB of OneDrive as part of my Office 365 subscription which had almost nothing on it, (2) OneDrive has an API allowing its use as a generic cloud storage service, and (3) Arq supports that API.
I've now got 3 years worth of backups of my 1 TB iMac on OneDrive, using about half of my 1 TB of OneDrive storage.
[1] https://www.backblaze.com/backup-encryption.html
So encrypt it yourself before they encrypt it for storage.
With the former you install some of their software on your computer. That software reads your files, encrypts them with the key Backblaze generated for you, and stores them on their servers.
The Backblaze software sees the same data that applications on your computer see. It is hard to see a reasonable way to impose your own encryption there in a way that would make Backblaze's software see the encrypted data.
If you are using a whole disk encryption system or whole partition encryption system, applications on your computer (including Backblaze's) see unencrypted data.
You could do file level encryption yourself with GPG or age or similar, but that would generally be in enormous pain in the ass because every time you wanted to use a file you'd need to decrypt it and if you modified it re-encrypt it. (And when you decrypt a file to use it you'd have to be careful that an incremental backup doesn't happen while you have the file decrypted).
I suppose you could get a drive specifically for local backup, use local backup software to maintain an encrypted backup on that drive, and use Backblaze's personal backup service to back up just your backup drive.
edit: leaving my original comment but I realise that the parent called for buying a new drive every year, not just backing up every year - my bad. That said, with this approach you still need to track where your backups are and when they were last backed up. That's definitely going to be more error prone than an automated system.
They said buy a new one every year. They didn't say only copy to it once a year.
Incidentally Google Cloud has lost some of my photos.
Can't speak for iCloud, but getting your data out of Google is pretty straightforward - it's well documented at [0]. How often do you want to do this though?
> I'm not sure what happens if you miss a few payments - do you lose your photos?
A quick google answers this question [1], if you stop paying and ignore the messages for 2 years your data _may_ be deleted.
> If you die can anyone else get access?
Again, a quick google says yes, if you set it up [2].
> Incidentally Google Cloud has lost some of my photos.
What do you mean by this? Google cloud or Google Photos? I would love to hear more about google photos losing data, I've _never_ heard of it (yet I have witnessed bit rot on physical media, or flash drives just getting lost).
[0] https://support.google.com/accounts/answer/3024190
[1] https://support.google.com/drive/answer/2736362
[2] https://support.google.com/accounts/troubleshooter/6357590
Google is a single point of failure. E.g. people get their accounts banned.
I completely reject this premise. I'm baffled why you think it's reasonable, honestly.
In backups, even for simple people, one is none and two is one. Online services are DEAD cheap, and can provide versioned backup that protects against creeping corruption and the like.
Single drive backup plans are malpractice.
If digital records aren't your long term secure storage, then what is? Paper printouts? With "really important" ones in a safe or safe deposit box? That is much harder to manage - for backups, organization, and retrieval - than having a digital source of truth and a few redundant backups.
And honestly once you're getting into someone "less able, cognitively impaired, or perhaps very young" to the point where they can't even manage productized cloud solutions, then they really need someone more capable that's involved in managing their (digital) life.
Please fail to realize the mental toll there is from keeping things you don't need.
- getting both devices on the same network
- scan the QR code on one device with another
After that, I've also found that it "just works" on the level of Dropbox or Google Drive. Honestly, I've had more problems trying to get iCloud or OneDrive to work as WebDAV.
I find Syncthing not very intuitive for anything beyond the default setup. Nonetheless, it's a great tool!
[0]: https://docs.syncthing.net/users/ignoring.html
> The .stignore file itself will never be synced to other devices, although it can #include files that are synchronized between devices.
So you might have a synced work folder, where some large but unimportant throwaway files will be created on Host A, you exclude them to avoid having them replicated when syncing to your Host B (and C, D, E, ...). But then, ignore rules don't sync so... surprise! those throwaway files when generated in the other Hosts will show up in A and everywhere else.
Am I being too unreasonable here? Yes, you can sync a common ignore file and #include that everywhere. But the idealistic way I see computing, that's a totally superfluous step that users should not even have to worry about doing. The kind of subtle technical detail that makes me agree with the phrase "too complex, unpolished and confusing".
Still, I use Syncthing every day. I think it's great. But I'm a developer and Git taught me ways about the logic and behavior of writing ignore files; it's not an apt solution for "less able, cognitively impaired, or perhaps very young" people.
The issue seems to be recognized [1]. But what can I say? the improvement proposal was outlined in 2015 and it's still unresolved 6 years later [2]. I wouldn't hope that it will get much more approachable for less technical people anytime soon.
[1]: https://github.com/syncthing/syncthing/issues/2353
[2]: https://github.com/syncthing/syncthing/issues/2491
Store your files in the dropbox folder and they will be safe (plus sync across devices and file history).
Backup and sync are two different things.
https://rclone.org/commands/rclone_sync/
Configure cron jobs to run automatically so they dont have to do anything on their end. Even if you're on a mobile device, you can install a terminal emulator and run rclone there.
[0] those things are undocumented, and the scanners have high rates of false positives
- Data is destroyed
- Data is abused (somebody uses it against you in some way)
Disaster destroys, theft & ransomware destroys and/or abuses your data
Security against "abusing your data" is afaik: encrypting your data, using different passwords, never trust a link in an email (allways use the links you commonly use). BUT: this is difficult and unlikely done even by a average user.
Security against losing data is: backup or sync : backup is done best to my knowledge in apple devices. it also features sync. othervise i'd recommend dropbox, it can also recover some of the data you accidentially delete.
printing things is also still a good backup of important data
We print the photos we really like and put them in albums. If our house burns down and we lose the albums and computer, we still have Google Photos and backblaze. If either Google or backblaze end their relationship with us, we still have our local copies and albums (and the other service).
We do pay for Google storage and for backblaze, but I think it comes out to around $12/month.
You just have to find some tools and services that are "fire and forget."
This is what I do:
1. All my working files are in my Dropbox account (or my corporate Dropbox account). I did this initially to support working off two machines interchangeably, but the fact of the matter is that this creates an easy versioned backup of your "live" files. Nowadays, my Dropbox is fully mirrored on TWO backup computers here in my office (ie, a spare machine and an old machine).
Setup Effort: Minimal. Ongoing Effort: Almost zero.
2. Because I use a Mac, I have Time Machine. It's glorious and can save your butt. It's the ONLY of these mechanisms I've ever had to use at scale (after a break-in and a stolen laptop). It worked flawlessly. Use it if you can. Every year or so, I get a new TM drive and archive the old one.
Setup Effort: VERY Minimal. Ongoing Effort: Zero.
3. I also use Backblaze for offsite backup security. I happen to live on the gulf coast, so major storms are a concern, but there's probably some house-eating danger wherever YOU live.
Setup Effort: Moderate. Ongoing Effort: Minimal.
4. Finally -- and this is the only part that needs actual action -- periodically I take a full image backup of my main machine's drive and archive it.
Setup Effort: Moderate. Ongoing Effort: Moderate.
I keep my newest image and my last TM drive in someone else's house, too, but that MAY be paranoia.
Since Time Machine is in addition to other backup methods, they don't need to make an effort to keep a Time Machine drive offsite.
For laptops I would aim for a setup where the drive is connected to whatever dock solution is in place. MacOS would backup automatically while the laptop was docked.
Edit /etc/netatalk/afp.conf:
And you're done. Don't lift a finger to do backups ever again.This happened to me at one point and the culprit ended up being that I had failed to exclude the folder holding my VMs.
In these COVID times, my laptop rarely leaves that desk, but even when it does there's only one cable to plug it all -- monitors, ethernet, various other peripherals, speakers, power -- into my laptop.
You just have to find some tools and services that are "fire and forget."
You just lost 99.99% of the population.
The problem, I think, is less in finding them and more simply knowing that keeping offsite backups is important (or any backups at all for that matter).
Edit: especially given the prompt of someone who is impared, very young or otherwise 'less able' whatever that might mean to you.
Please share.
I'm ok to pay for it but:
1 - I need the client to use encryption and be open source
2 - It needs to run on linux
3 - It needs to backup files in arbitrary locations, including spanning several partitions (one NTFS, one ext3)
4 - It needs good filtering / curation capabilities
5 - Restore should have great granularity, and I should be able to browser the archive without having to unpack it all
6 - it needs to be easy to setup. I don't want to setup my own instance or mess with config files.
I've never found a tools that could do all that. One of those always fail, and sometimes the tool promise all of them, but doesn't even manage to backup. Some backup only partially, missing a files. Some backup, and don't restore. Some can only restore the all archive. Some don't encrypt. Some are close source, or only available on Mac and Linux. Some will store wrong files, and you can't them out of the backup.
It's crazy that in 2021, the state of backup sucks so much.
So have 2 backups on 2 different hard drives for all my files. One with "way back machine", the other one with a simple cp. Then I take essential files, and I put them on a usb drive.
My only remote backup are githup repo and emails.
Any suggestion?
> It needs to run on linux
That right there is going to imply some level of knowledge from the user. Expecting a zero-config install for Linux is pushing it to begin with.
> It needs to backup files in arbitrary locations, including spanning several partitions (one NTFS, one ext3)
And
> It needs good filtering / curation capabilities
And
> it needs to be easy to setup. I don't want to setup my own instance or mess with config files.
Are pretty much mutually exclusive. If you want it to be powerful you'll need to do the work to configure it. If you don't want to do the work it's not going to meet your needs, period. No product exists that will meet all of these criteria, even for Windows. I don't think a product exists that would meet half of them, and certainly if it does it's not open source.
What you really want is rsync over SSH to a ZFS volume with encryption enabled, or some other CoW filesystem that lets you do snapshots and access them online.
If you want to get close, go buy a Synology NAS and set up a nightly rsync cron to it, then set it up to archive to AWS Glacier. That'll get you most of the way to your ideal, and it'll be done instead of perfect.
How so? Dropbox is zero config install for linux.
> Are pretty much mutually exclusive. If you want it to be powerful you'll need to do the work to configure it.
I never said zero config, I said easy to configure. Firefox has plenty of configuration nobs, but it's easy to configure it.
> What you really want is rsync over SSH to a ZFS volume with encryption enabled, or some other CoW filesystem that lets you do snapshots and access them online.
No because that's very complicated. I've done it in the past, and just the fact I have to manage a VPS to do so is more than what I want to do.
I've used rsync as well, it's again, too much scripting, meaning to much margin for errors.
Apple Time machine for linux is what I want, with remote capabilities.
You don't want to set up a VPS, even though I mentioned nothing about one. I said to buy an appliance, same as a Time Capsule or whatever that Apple thing used to be called.
You think rsync+SSH+snapshot is complicated, but you don't know that Time Machine is exactly that, just hidden from you so if anything goes wrong it's a black box that you can't recover from.
You think rsync is too much scripting - what are you trying to do that requires scripting beyond `rsync -aP src dest`?
You've DQ'd the majority of backup services with your first requirement. You want what you want, but realize you're doing it.
1. Set up a backup regime
2. Set up a password vault
It's a paid solution but simple enough for my mother.
If money isn't an issue, BackBlaze's options are interesting. Check out Arq backup too. Once you get either Backblaze or Arq backup, you can backup your backup drive of time machine images. Not terribly efficient, sure, but again, doesn't really require too much configuration. Minimizing friction for each step and trying to automate them are the best paths to success.
If this is a mobile device, iCloud for photos is a good enough options for most people. Yeah, apple's gonna scan, but so is Google Photos, or any other service that uploads images to the internet.
I really wish apple would do an E2EE time machine to the cloud one day! That would really unlock backups for a lot more less technical people.
If you're somewhat capable you could even set it up so the entirety of your OneDrive or equivalent is copied to another provider.
I remember that DB famously had to make special provision for Outlook files — is that kind of thing still the case?
As an analogy, you might be the greatest surgeon in the world but you may still want to ask a nutritionist to help you make sense of the varying, contradictory studies that come in.
The problem you have identified also effects the cognitively overwhelmed which is all of us.
New school: get a Macbook and an iPhone and use iCloud.
For programmers: Make an auto-backup script to an S3 bucket for very cheap storage, backing up only what you want (e.g. adding a flag to ignore node_modules when backing up your computer).
https://9to5mac.com/2019/10/23/recover-lost-icloud-documents...
I know many here will say thats being negligent or whatever, I don't really care too much, I'd rather just get on with my life than jump through a load of hoops for data that I'm not too fussed about losing.