Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Code Spaces data and backups deleted by hackers

codespaces.com

Post reply on HN
Print view View original

41–50 of 85 posts

Re: Code Spaces data and backups deleted by hackers

#41

Post by [deleted] »

toomuchtodo wrote: post #32
bagosm wrote: post #9

All I can say is this: If you can delete it with a single control panel, it doesn't count as an offsite back. Fire the devops

DevOps here. There are some things you aren't going to expect (compromise of your AWS console). This could have been solved by having MFA enabled, as well as having the app push backups in realtime, versioned with delete protection, to S3 buckets under the control of another account (write access, but no delete access). Show of hands how many people here are doing it this way.

[deleted]

Re: Code Spaces data and backups deleted by hackers

#42

Post by rcthompson »

jacquesm wrote: post #34
lugg wrote: post #31

Earlier quoted context omitted.

Thanks for the cache just getting to this. Edited because someone didn't like my original tone. Was a bit rushed to be honest. Few things seem off about this: - Offsite backups were also deleted, I don't think they had offsite backups, or at least backups you could legitimately say were "off site." - EC2 has two factor auth, why you wouldn't use this for your business I don't know. [1] - Corresponding with extortioni…

There is something about this whole story that feels weird, I can't name it but it is as if this isn't the whole story.

Probably because of the part where they say this isn't the whole story: "This took place over a 12 hour period which I have condensed into this very brief explanation, which I will elaborate on more once we have managed our customers needs."

Re: Code Spaces data and backups deleted by hackers

#43

Post by jacquesm »

rcthompson wrote: post #42
jacquesm wrote: post #34

Earlier quoted context omitted.

There is something about this whole story that feels weird, I can't name it but it is as if this isn't the whole story.

Probably because of the part where they say this isn't the whole story: "This took place over a 12 hour period which I have condensed into this very brief explanation, which I will elaborate on more once we have managed our customers needs."

That could be it. But there is a certain dissonance about this whole thing, I try to imagine myself in the same situation and the whole thing weirds me out. How could this mysterious hacker have known they had no other backups? Have they talked to LE at all at this point? Why not string the guy along, buy time, immediately alert amazon to lock the account completely?

So many questions. Anyway, they'll be updating this sooner or later, I just can't help but feel a bit weirded out by some of the things in there (and things that should be in there that are not).

This is most likely just my professional paranoia acting up. And of course it is easy enough to be back-seat driver here, I'd hate to be in their shoes, no matter how they got there.

Re: Code Spaces data and backups deleted by hackers

#45

Post by eterm »

wasamasa wrote: post #13

Does anyone know of noteworthy projects that were hosted there?

Without naming names I know of at least one company who were using it for their main svn repo. I am hoping they have come out of this relatively unscathed. I am not with them anymore and last I heard they were switching to git so perhaps they have managed to dodge this bullet.

Re: Code Spaces data and backups deleted by hackers

#46

Post by eli »

EwanToo wrote: post #40
toomuchtodo wrote: post #36

Earlier quoted context omitted.

Okay then. Where would these backups go? S3 is easy to backup to. Tarsnap is nice. Rsync.net works as well. But these are all online backup options. If you're advocating offloading to physical media, you need someone who is going to religiously do it (execute code, pull to removable flash drive/SATA dock), and the more up to date you want your backups to be, the more tedious it becomes. How much are you willing to sp…

At its simplest, you should be able to backup to another Amazon S3 setup, that's completely isolated, belonging to a separate account. Backups should be initiated from a production account access key where "Create" access has been granted, but all the storage and maintenance by another AWS account with it's own access key. However, I'm not sure that's technically feasible at the moment, without quite a lot of manual…

Tarsnap makes that approach easy. Well, easy if you're comfortable with command line tools.

Re: Code Spaces data and backups deleted by hackers

#48

Post by taspeotis »

Another point for distributed version control systems. If the server hosting my repository exploded I'd have the entire repo on my computer.

Why hosted subversion is a thing, I don't know. It's a horrendous experience once you introduce any latency between the client and server.

Re: Code Spaces data and backups deleted by hackers

#50

Post by imperialdrive »

Taken from a snapshot of their website:

See why over 200 companies a week choose Code Spaces

Real-time Backups Backing up your code has never been so easy

"Real Time We have invested a great deal of time and effort in developing a real-time backup solution that allows us to keep off-site, fully functional backups of your data - at high performance. We literally backup everything you do, as soon as you do it.

Backups are only as good as your recovery plan Backing up data is one thing, but it is meaningless without a recovery plan, not only that a recovery plan - and one that is well-practiced and proven to work time and time again.

Code Spaces has a full recovery plan that has been proven to work and is, in fact, practiced.

Your Backups We provide full access to the latest backup for you to download at anytime. If you choose to keep a copy of backups for your own piece of mind, its all there in the Code Spaces backups section"

heh they said off-site backups, well-practiced and proven... heh

https://web.archive.org/web/20140328015048/http://www.codesp...

Post reply on HN