It's funny how even in their postmortem they don't seem to understand the obvious: live mirrors are not a backup strategy.
Git mirroring is great, and periodic checks for consistency would help, but snapshots taken and stored (offline) for reasonable periods of time are the only reasonable backup model. There are corruption issues, availability issues, etc. where offline backups are far more reasonable. Ideally you would separately cryptographically sign your backups (which is easier than just keeping track of hashes), too.
(and obviously a backup system is meaningless if you don't also check for restores periodically, and monitor the success of the whole process)
Git mirroring is great, and periodic checks for consistency would help, but snapshots taken and stored (offline) for reasonable periods of time are the only reasonable backup model. There are corruption issues, availability issues, etc. where offline backups are far more reasonable. Ideally you would separately cryptographically sign your backups (which is easier than just keeping track of hashes), too.
(and obviously a backup system is meaningless if you don't also check for restores periodically, and monitor the success of the whole process)