Сначала для справки - Tarsnap это такой сервис для хранения бекапов в сети. Ориентирован на повышенную безопасность. Разрабатывается секьюрити-офицером FreeBSD - Colin Percival, также являющимся автором утилит portsnap и freebsd-update (обновлялка дерева портов и бинарный обновлятель ПО и системы целиком).
На днях пришло письмо следующего содержания. Думаю, его стоит опубликовать.
On Friday afternoon I was advised of a critical bug affecting Tarsnap versions 1.0.22 through 1.0.27. This bug will, in some cases, make it possible for me, Amazon, or US government agencies with access to Amazon's datacenters to decrypt data stored with the affected versions of Tarsnap. I'm really sorry about this.
I've released an updated version of Tarsnap which fixes this problem, and I've written a blog post providing extensive details about this; in the interest of putting the blog post online and sending out this email promptly, I'm going to point you at the blog post rather than repeating all the details in this email: http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-security-bug.html
Feel free to contact me with any questions or concerns you have about this and I'll do my best to answer them. I hope you'll give me a chance to re-earn your trust.
Sincerely, -- Colin Percival Security Officer, FreeBSD | freebsd.org | The power to serve Founder / author, Tarsnap | tarsnap.com | Online backups for the truly paranoid
