Re: The NGbackup
Heitor Faria <[email protected]> Tue, 7 Jul 2026 08:19:02 -0400
| Newsgroups | gmane.comp.bacula.user |
|---|---|
| Message-ID | <CAK6z+ADyd+v-MaKpnotCGFnfs+4z43hDCg=CqLZxKPrKN0KG_g@mail.gmail.com> |
--===============3929623289649176856== Content-Type: multipart/alternative; boundary="000000000000336ebf06560466f6" --000000000000336ebf06560466f6 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable "faaleoleo.io =E2=80=94 who is behind the "[email protected]" attacks An anonymous sender using the identity "Dev Team" [email protected] has been posting hostile attacks on NGBackup, both directly and to the public bacula-users mailing list. The domain and email headers tie this identity to the Bacula / BareOS circle in Germany, specifically to Reiner Jung (M:Tier). SPF evidence. The SPF record for faaleoleo.io (which authorizes who may send email on its behalf) lists: 178.63.245.123 =E2=86=92 www.mtier.org (M:Tier, Reiner Jung's company) So faaleoleo.io explicitly authorizes M:Tier's server to send mail for it. The domain also shares the same host and SPF IP block as its mail server mail.sec4share.me. All infrastructure is Hetzner, Germany. Header evidence (stronger than SPF). The hostile email of 7 Jul 2026 ("Re: [Bacula-users] The NGbackup"), From [email protected], was addressed To: Heitor Faria and Reiner Jung [email protected]. An earlier attack (4 Jul) was addressed to Heitor and Arno Lehmann [email protected], another long-time Bacula figure. All messages sent via mail.sec4share.me using the "Canary" client, with DKIM failing for @faaleoleo (consistent with a throwaway/impersonation domain). Conclusion. The anonymous [email protected] identity is operated from, and SPF-linked to, M:Tier's infrastructure, and Reiner Jung is a named party on the attack thread. This is the German Bacula/BareOS circle using a non-attributable identity to attack a competitor. What is not provable is the exact person who typed each message (the WHOIS registration is privacy-masked); the records prove the infrastructure and the circle, not signed authorship." Is this true, Reiner? On Tue, Jul 7, 2026 at 8:00=E2=80=AFAM Dev Team <[email protected]> wro= te: > Heitor, > > NOBODY can/will run a backup on SAP which is not certified! You will loos= e > your support same moment. I think I know SAP and requirements well. SAP > have very hard requirements even how your setup for testing - staging and > production must look like. > > Your is based on what? active active, stand by, bow failover work. how yo= u > get a quorum? > > I really would like to talk to a customer of you which is experience of > your new development. Which if your customer use a Mainframe? Government = i > know the responsible people in Brazil and I could ask them they know > anything about NG backup. 0r maybe SERPO? All my contacts dont know > anything about NGbackup > > > > On Dienstag, Juli 07, 2026 at 2:11 PM, Heitor Faria <[email protected]= m> > wrote: > Hello Reiner, > > Thanks for the detailed note. It's clear you read the material closely, s= o > let me answer point by point. > > PodHeitor vs NGBackup. You're conflating two different products (thanks > for being my fan). PodHeitor was built on Community Bacula and deprecated > for the better stuff. NGBackup is a from-scratch engine: 1,000+ Rust sour= ce > files, zero C, memory-safe by construction. That's not a marketing > adjective. It's why the whole class of memory-corruption CVEs that legacy > engines keep publishing cannot occur here. So "nothing has changed since > PodHeitor" is simply wrong. Everything under the hood changed. > > "Just repackaged community plugins." Every NGBackup plugin is written in > one standard language, Rust, compiled and memory-safe. That is materially > more performant and more serious than the open-ended > PowerShell/Python/shell scripts that other suites rely on for their > plugins. Uniform tooling, no interpreter sprawl, no per-plugin runtime > surprises. That is original engineering, not copy-paste. > > High availability. This is real HA, not file copying. NGBackup runs an > active/standby Director pair with product-managed catalog and configurati= on > replication. It supports automatic failover with witness quorum and a > split-brain guard, plus planned, unplanned, maintenance and test failover > modes, and failback with reverse sync. Calling that "SCP/SFTP somewhere" = is > not accurate. It is a designed control-plane HA architecture, and it is > exactly what enterprise backup HA is supposed to mean. > > Deduplication. There's nothing to misunderstand here. Any backup > specialist knows dedup ratios improve as more repetitive, retained backup= s > accumulate. We state the industry-standard 20x, with some environments > exceeding 60x at higher retention and redundancy. That's a range tied to > retention, reported exactly the way every dedup vendor reports one. Not a > lab trick. Arithmetic. > > Where else we are ahead of Bacula Enterprise: > > A single control plane. Every daemon (Director, SD, FD) is remotely > reconfigurable, reloadable and restartable from one place, including remo= te > SD/FD config edits with validation, atomic apply and rollback. Bacula has > none of this. > Config-as-data. Director configuration lives in the database as immutable= , > versioned revisions. No config-file sprawl across daemons and plugins. > No clear-text passwords in files. Enrollment is token-based. Secrets are > sealed, never written in plaintext to a .conf. > Modern and vastly more complete Web and console interfaces. > Mainframe / SAP HANA. We have real customers running both in Brazil. The > ADABAS plugin ships today. z/OS binaries are being built. On SAP HANA > specifically, the absence of a formal certification badge doesn't mean th= e > capability can't be delivered. Certification is a commercial and > partnership step, not a technical ceiling. We have customers on it. > Bloom filters and segment locality in Dedup for better performance. > > Pricing. Enterprise backup is quote-based across this market. Bacula > Enterprise and the other vendors don't publish price lists either. Ours i= s > the same model, with a concrete migration discount for teams leaving Veea= m, > Commvault or NetBackup. > > On the "copy-paste" thesis generally. A single Rust control plane, > active/standby HA with automatic failover, config-as-data in the catalog, > tokenized enrollment with no plaintext secrets, and Rust-native plugins a= re > not things the community project offers. That is original design, and it'= s > shipping. > > I'll note, since it's relevant to the tone here, that you have a > commercial relationship with Bacula Systems, and this critique arrives > alongside messages on LinkedIn that I'd characterize as threats. I'm glad > to have a technical debate on the merits. I'd rather keep it there. > > Best regards, > Heitor Faria > NGBackup / NGStructures, LSG Global Group > > On Tue, Jul 7, 2026 at 6:41=E2=80=AFAM Reiner Jung <[email protected]> wro= te: > >> Heitor, >> >> It looks as if the only real selling point of your solution is that it i= s >> written in Rust. Apart from that, if you take a closer look at what you = are >> trying to sell here, it is just marketing fluff. >> >> Let=E2=80=99s take ransomware detection as an example. It is more than d= oubtful >> that what you are selling now is any different from what you already tri= ed >> to market some time ago as PodHeitor. It was ineffective and pointless >> then, and nothing here suggests that has changed. >> >> Your claim of deduplication with a 60x factor is highly questionable. I >> have no idea how you arrive at such numbers =E2=80=93 presumably under i= dealized >> lab conditions with a carefully selected configuration that has little t= o >> do with reality. >> >> You also write: >> >> =E2=80=9CFrom the mainframe to Microsoft 365 in one place =E2=80=94 21 d= atabase, >> virtualization and cloud plugins.=E2=80=9D >> >> I assume you do not have a mainframe at home, and it does not appear on >> your actual plugin list either. This makes your marketing statement >> misleading at best. As PodHeitor there was ever SAP HANA. You never can >> provide this as you must be a partner and you are not. >> >> Your so=E2=80=91called =E2=80=9Chigh availability=E2=80=9D is no such th= ing; at most it is a >> simple failover where you copy files somewhere else using SCP/SFTP. >> Architecturally, this is just wrong and falls far short of what real HA >> means in enterprise backup. Is this really automatic failure? Ask you AI= , >> it is not. >> >> Your entire solution looks just as fragile as your previous offerings >> that you kept promoting with bpipe and similar tools. >> >> There is also no transparent price list, just a vague promise to be 50% >> cheaper than Veeam. Where are your actual prices? On your own site, you >> instead advertise discounts of =E2=80=9C=E2=89=A5 50% off your current V= eeam / Commvault / >> NetBackup contract,=E2=80=9D which raises even more questions about how = realistic >> and sustainable your pricing is. >> >> Based on the documents you have published in the past, it is doubtful >> that you even fully understood what your AI-generated material is saying= . >> >> Most of the features you list here are not innovations at all but a chea= p >> copy of what you have simply recompiled or repackaged from Bacula >> Community, which already offers many plugins and advanced backup functio= ns >> in open source form. >> >> The more interesting question is how you and your development team inten= d >> to further develop Bacula Core itself, or whether you are once again jus= t >> waiting for the next community release so you can copy new features into >> your product. >> >> Innovation does not come from copy and paste. It comes from original >> design, real-world testing, and delivering value beyond what the communi= ty >> has already built. >> >> >> > > -- > Atenciosamente, > > Heitor faria (Miami) > https://ngbackup.com > WhatsApp: +1 786-726-1749 | +55 61 98268-4220 > _______________________________________________ > Bacula-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/bacula-users > > --=20 Atenciosamente, Heitor faria (Miami) https://ngbackup.com WhatsApp: +1 786-726-1749 | +55 61 98268-4220 --000000000000336ebf06560466f6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr">"<a href=3D"http://= faaleoleo.io">faaleoleo.io</a> =E2=80=94 who is behind the "<a href=3D= "mailto:[email protected]">[email protected]</a>" attacks<br>A= n anonymous sender using the identity "Dev Team" <a href=3D"mailt= o:[email protected]">[email protected]</a> has been posting hostile= attacks on NGBackup, both directly and to the public bacula-users mailing = list. The domain and email headers tie this identity to the Bacula / BareOS= circle in Germany, specifically to Reiner Jung (M:Tier).<br><br>SPF eviden= ce. The SPF record for <a href=3D"http://faaleoleo.io">faaleoleo.io</a> (wh= ich authorizes who may send email on its behalf) lists:<br><br>178.63.245.1= 23 =E2=86=92 <a href=3D"http://www.mtier.org">www.mtier.org</a> (M:Tier, Re= iner Jung's company)<br>So <a href=3D"http://faaleoleo.io">faaleoleo.io= </a> explicitly authorizes M:Tier's server to send mail for it. The dom= ain also shares the same host and SPF IP block as its mail server <a href= =3D"http://mail.sec4share.me">mail.sec4share.me</a>. All infrastructure is = Hetzner, Germany.<br><br>Header evidence (stronger than SPF). The hostile e= mail of 7 Jul 2026 ("Re: [Bacula-users] The NGbackup"), From <a h= ref=3D"mailto:[email protected]">[email protected]</a>, was address= ed To: Heitor Faria and Reiner Jung <a href=3D"mailto:[email protected]">r.j= [email protected]</a>. An earlier attack (4 Jul) was addressed to Heitor and Ar= no Lehmann <a href=3D"mailto:[email protected]">[email protected]</a>, anot= her long-time Bacula figure. All messages sent via <a href=3D"http://mail.s= ec4share.me">mail.sec4share.me</a> using the "Canary" client, wit= h DKIM failing for @faaleoleo (consistent with a throwaway/impersonation do= main).<br><br>Conclusion. The anonymous <a href=3D"mailto:dev-team@faaleole= o.io">[email protected]</a> identity is operated from, and SPF-linked t= o, M:Tier's infrastructure, and Reiner Jung is a named party on the att= ack thread. This is the German Bacula/BareOS circle using a non-attributabl= e identity to attack a competitor. What is not provable is the exact person= who typed each message (the WHOIS registration is privacy-masked); the rec= ords prove the infrastructure and the circle, not signed authorship."<= br><br>Is this true, Reiner?</div><br><div class=3D"gmail_quote gmail_quote= _container"><div dir=3D"ltr" class=3D"gmail_attr">On Tue, Jul 7, 2026 at 8:= 00=E2=80=AFAM Dev Team <<a href=3D"mailto:[email protected]">dev-tea= [email protected]</a>> wrote:<br></div><blockquote class=3D"gmail_quote" st= yle=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padd= ing-left:1ex"><div style=3D"font-family:Helvetica;color:rgb(0,0,0);font-siz= e:13px"><div id=3D"m_-7289606999999779334CanaryBody" dir=3D"auto"><div>Heit= or,</div><div><br></div><div>NOBODY can/will run a backup on SAP which is n= ot certified! You will loose your support same moment. I think I know SAP a= nd requirements well. SAP have very hard requirements even how your setup f= or testing - staging and production must look like.=C2=A0</div><div><br></d= iv><div>Your is based on what? active active, stand by, bow failover work. = how you get a quorum?=C2=A0</div><div><br></div><div>I really would like to= talk to a customer of you which is experience of your new development. Whi= ch if your customer use a Mainframe? Government i know the responsible peop= le in Brazil and I could ask them they know anything about NG backup. 0r ma= ybe SERPO? All my contacts dont know anything about NGbackup=C2=A0</div><di= v><br></div></div><div id=3D"m_-7289606999999779334CanarySig"><div><div><br= ></div><div><br></div></div></div><div id=3D"m_-7289606999999779334CanaryDr= opbox"></div><blockquote id=3D"m_-7289606999999779334CanaryBlockquote"><div= ><div>On Dienstag, Juli 07, 2026 at 2:11 PM, Heitor Faria <<a href=3D"ma= ilto:[email protected]" target=3D"_blank">[email protected]</a>>= wrote:<br></div><div><div dir=3D"ltr">Hello Reiner,<br><br>Thanks for the = detailed note. It's clear you read the material closely, so let me answ= er point by point.<br><br>PodHeitor vs NGBackup. You're conflating two = different products (thanks for being my fan). PodHeitor was built on Commun= ity Bacula and deprecated for the better stuff. NGBackup is a from-scratch = engine: 1,000+ Rust source files, zero C, memory-safe by construction. That= 's not a marketing adjective. It's why the whole class of memory-co= rruption CVEs that legacy engines keep publishing cannot occur here. So &qu= ot;nothing has changed since PodHeitor" is simply wrong. Everything un= der the hood changed.<br><br>"Just repackaged community plugins."= Every NGBackup plugin is written in one standard language, Rust, compiled = and memory-safe. That is materially more performant and more serious than t= he open-ended PowerShell/Python/shell scripts that other suites rely on for= their plugins. Uniform tooling, no interpreter sprawl, no per-plugin runti= me surprises. That is original engineering, not copy-paste.<br><br>High ava= ilability. This is real HA, not file copying. NGBackup runs an active/stand= by Director pair with product-managed catalog and configuration replication= . It supports automatic failover with witness quorum and a split-brain guar= d, plus planned, unplanned, maintenance and test failover modes, and failba= ck with reverse sync. Calling that "SCP/SFTP somewhere" is not ac= curate. It is a designed control-plane HA architecture, and it is exactly w= hat enterprise backup HA is supposed to mean.<br><br>Deduplication. There&#= 39;s nothing to misunderstand here. Any backup specialist knows dedup ratio= s improve as more repetitive, retained backups accumulate. We state the ind= ustry-standard 20x, with some environments exceeding 60x at higher retentio= n and redundancy. That's a range tied to retention, reported exactly th= e way every dedup vendor reports one. Not a lab trick. Arithmetic.<br><br>W= here else we are ahead of Bacula Enterprise:<br><br>A single control plane.= Every daemon (Director, SD, FD) is remotely reconfigurable, reloadable and= restartable from one place, including remote SD/FD config edits with valid= ation, atomic apply and rollback. Bacula has none of this.<br>Config-as-dat= a. Director configuration lives in the database as immutable, versioned rev= isions. No config-file sprawl across daemons and plugins.<br>No clear-text = passwords in files. Enrollment is token-based. Secrets are sealed, never wr= itten in plaintext to a .conf.<br>Modern and vastly more complete Web and c= onsole interfaces.<br>Mainframe / SAP HANA. We have real customers running = both in Brazil. The ADABAS plugin ships today. z/OS binaries are being buil= t. On SAP HANA specifically, the absence of a formal certification badge do= esn't mean the capability can't be delivered. Certification is a co= mmercial and partnership step, not a technical ceiling. We have customers o= n it.<br>Bloom filters and segment locality in Dedup for better performance= .<br><br>Pricing. Enterprise backup is quote-based across this market. Bacu= la Enterprise and the other vendors don't publish price lists either. O= urs is the same model, with a concrete migration discount for teams leaving= Veeam, Commvault or NetBackup.<br><br>On the "copy-paste" thesis= generally. A single Rust control plane, active/standby HA with automatic f= ailover, config-as-data in the catalog, tokenized enrollment with no plaint= ext secrets, and Rust-native plugins are not things the community project o= ffers. That is original design, and it's shipping.<br><br>I'll note= , since it's relevant to the tone here, that you have a commercial rela= tionship with Bacula Systems, and this critique arrives alongside messages = on LinkedIn that I'd characterize as threats. I'm glad to have a te= chnical debate on the merits. I'd rather keep it there.<br><br>Best reg= ards,<br>Heitor Faria<br>NGBackup / NGStructures, LSG Global Group</div><br= ><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Tue, J= ul 7, 2026 at 6:41=E2=80=AFAM Reiner Jung <<a href=3D"mailto:r.jung@mtie= r.org" target=3D"_blank">[email protected]</a>> wrote:<br></div><blockquo= te class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px = solid rgb(204,204,204);padding-left:1ex"><div><div id=3D"m_-728960699999977= 9334m_3514217287192629826" dir=3D"auto"><div>Heitor,<br><div><br></div><div= >It looks as if the only real selling point of your solution is that it is = written in Rust. Apart from that, if you take a closer look at what you are= trying to sell here, it is just marketing fluff.</div><div><br></div><div>= Let=E2=80=99s take ransomware detection as an example. It is more than doub= tful that what you are selling now is any different from what you already t= ried to market some time ago as PodHeitor. It was ineffective and pointless= then, and nothing here suggests that has changed.</div><div><br></div><div= >Your claim of deduplication with a 60x factor is highly questionable. I ha= ve no idea how you arrive at such numbers =E2=80=93 presumably under ideali= zed lab conditions with a carefully selected configuration that has little = to do with reality.</div><div><br></div><div>You also write:</div><div><br>= </div><div>=E2=80=9CFrom the mainframe to Microsoft 365 in one place =E2=80= =94 21 database, virtualization and cloud plugins.=E2=80=9D</div><div><br><= /div><div>I assume you do not have a mainframe at home, and it does not app= ear on your actual plugin list either. This makes your marketing statement = misleading at best. As PodHeitor there was ever SAP HANA. You never can pro= vide this as you must be a partner and you are not.=C2=A0</div><div><br></d= iv><div>Your so=E2=80=91called =E2=80=9Chigh availability=E2=80=9D is no su= ch thing; at most it is a simple failover where you copy files somewhere el= se using SCP/SFTP. Architecturally, this is just wrong and falls far short = of what real HA means in enterprise backup. Is this really automatic failur= e? Ask you AI, it is not.=C2=A0</div><div><br></div><div>Your entire soluti= on looks just as fragile as your previous offerings that you kept promoting= with bpipe and similar tools.</div><div><br></div><div>There is also no tr= ansparent price list, just a vague promise to be 50% cheaper than Veeam. Wh= ere are your actual prices? On your own site, you instead advertise discoun= ts of =E2=80=9C=E2=89=A5 50% off your current Veeam / Commvault / NetBackup= contract,=E2=80=9D which raises even more questions about how realistic an= d sustainable your pricing is.</div><div><br></div><div>Based on the docume= nts you have published in the past, it is doubtful that you even fully unde= rstood what your AI-generated material is saying.</div><div><br></div><div>= Most of the features you list here are not innovations at all but a cheap c= opy of what you have simply recompiled or repackaged from Bacula Community,= which already offers many plugins and advanced backup functions in open so= urce form.</div><div><br></div><div>The more interesting question is how yo= u and your development team intend to further develop Bacula Core itself, o= r whether you are once again just waiting for the next community release so= you can copy new features into your product.</div><div><br></div><div>Inno= vation does not come from copy and paste. It comes from original design, re= al-world testing, and delivering value beyond what the community has alread= y built.</div><div><br></div><div><br></div></div></div><div id=3D"m_-72896= 06999999779334m_3514217287192629826CanaryDropbox"></div></div></blockquote>= </div><div><br clear=3D"all"></div><div><br></div><span class=3D"gmail_sign= ature_prefix">--<span class=3D"gmail-Apple-converted-space">=C2=A0</span></= span><br><div dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"ltr">Atenci= osamente,<br><br>Heitor faria (Miami)<br><a href=3D"https://ngbackup.com/" = target=3D"_blank">https://ngbackup.com</a><div>WhatsApp: +1 786-726-1749 |= =C2=A0+55 61 98268-4220<br></div></div></div>______________________________= _________________<span class=3D"gmail-Apple-converted-space">=C2=A0</span><= br>Bacula-users mailing list<span class=3D"gmail-Apple-converted-space">=C2= =A0</span><br><a href=3D"mailto:[email protected]" target= =3D"_blank">[email protected]</a><span class=3D"gmail-Appl= e-converted-space">=C2=A0</span><br><a href=3D"https://lists.sourceforge.ne= t/lists/listinfo/bacula-users" target=3D"_blank">https://lists.sourceforge.= net/lists/listinfo/bacula-users</a><br></div></div></blockquote></div></blo= ckquote></div><div><br clear=3D"all"></div><div><br></div><span class=3D"gm= ail_signature_prefix">--<span class=3D"gmail-Apple-converted-space">=C2=A0<= /span></span><br><div dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"ltr= ">Atenciosamente,<br><br>Heitor faria (Miami)<br><a href=3D"https://ngbacku= p.com/" target=3D"_blank">https://ngbackup.com</a><div>WhatsApp: +1 786-726= -1749 |=C2=A0+55 61 98268-4220</div></div></div></div></div> --000000000000336ebf06560466f6-- --===============3929623289649176856== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============3929623289649176856== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Bacula-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/bacula-users --===============3929623289649176856==--