Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Self-hosted alternatives to popular cloud services

liminality.xyz

Post reply on HN
Print view View original

131–140 of 148 posts

Re: Self-hosted alternatives to popular cloud services

#131

Post by kentonv »

unethical_ban wrote: post #129
kentonv wrote: post #119

Earlier quoted context omitted.

You can log in to Sandstorm using any email address. Eventually, we plan to support logging in using a PGP key. We see "internal user stores" (e.g. basic username/password with no connected email address) as problematic because a major design goal of Sandstorm is the ability to move data between hosts easily. Say you and five friends have been using Rocket.Chat on Sandstorm Oasis, and then you decide to transfer it t…

It's not a bad option, and you make a decent case for that. However, the entire point of self-hosting for me is to be entirely self-reliant. Why would I use a github account to login to a Sandstorm Gitlab instance?

Well, it's entirely up to you what login mechanism you want to use, so if Github isn't what you want, then by all means don't use it. You can be completely self-reliant using email login, or eventually PGP login. But some people find Google and Github login convenient.

FWIW we're currently working on a change that will allow you to attach multiple such "identities" to a single account, after which we plan to open up the door to a lot more authentication providers, including other "open" federated options like OpenID or Shibboleth (as well as popular proprietary services like Twitter, Facebook, etc. -- again, it's up to each user to decide what's most convenient for them).

Probably at some point you'll be able to host your own IDP as a Sandstorm app, if that's what you want. Other Sandstorm servers would be able to rely on that IDP as well, so it meets the federated requirement.

Re: Self-hosted alternatives to popular cloud services

#132

Post by atriix »

jancborchardt wrote: post #62
atriix wrote: post #33

I keep a list of self-hosted application over at https://github.com/victorhaggqvist/selfhosted . Feel free to contribute if you think there is something missing.

Heya, I run a similar site since ages: http://libreprojects.net :) The focus is on highlighting one (the best) alternative in a given field, and limit the ones listed to those which are well-designed, open source of course, and also have a hosted instance so it’s ready to use for anyone without a server. I’m sure you already know of https://prism-break.org/ ?

Oddly enough, I have actually not seen any of these. Apparently my Google Fuu was not on top at the time when I started mine.

Anyhow, there is really lots of good stuff that turned up in this entire thread.

Re: Self-hosted alternatives to popular cloud services

#133

Post by StavrosK »

kentonv wrote: post #119
unethical_ban wrote: post #113

Earlier quoted context omitted.

The problem with sandstorm is the dependence on third-party auth. Until sandstorm has internal user stores, it's not a viable self-hosting solution.

You can log in to Sandstorm using any email address. Eventually, we plan to support logging in using a PGP key. We see "internal user stores" (e.g. basic username/password with no connected email address) as problematic because a major design goal of Sandstorm is the ability to move data between hosts easily. Say you and five friends have been using Rocket.Chat on Sandstorm Oasis, and then you decide to transfer it t…

Have you thought about adding Persona auth?

Re: Self-hosted alternatives to popular cloud services

#134

Post by kentonv »

StavrosK wrote: post #133
kentonv wrote: post #119

Earlier quoted context omitted.

You can log in to Sandstorm using any email address. Eventually, we plan to support logging in using a PGP key. We see "internal user stores" (e.g. basic username/password with no connected email address) as problematic because a major design goal of Sandstorm is the ability to move data between hosts easily. Say you and five friends have been using Rocket.Chat on Sandstorm Oasis, and then you decide to transfer it t…

Have you thought about adding Persona auth?

This seems like something we'd be interested in.

Of course, we have a lot on our plate, so I can't guarantee anything. Happy to accept pull requests. :)

Re: Self-hosted alternatives to popular cloud services

#135

Post by bartvk »

hiq wrote: post #31
pmlnr wrote: post #18

some other weapons of choice: WordPress - https://wordpress.org/ - because "WordPress is the Kalashnikov of the web." ( https://t.co/QgsYYUFTbo ) Syncthing - https://syncthing.net/ - for distributed file syncing Baikal - http://baikal-server.com/ - for contact & calendar syncing rss2email - https://pypi.python.org/pypi/rss2email - because email is stable, solid, and not going anywhere Tox - https://tox.chat/ - p2p, e…

Syncthing is awesome, I don't understand why some people still use bittorrent sync. If you use ownCloud only for file syncing you'd also be better off using Syncthing instead. The developer is also a super nice guy, answering all bug and performance reports on github. Regarding contact & calendar syncing, I just wish more apps could just use files instead of always setting a new server and reinventing the wheel to sy…

Both BitTorrent Sync and Syncthing need a particular port in the firewall to be open (or port forwarded). I'm a contractor that's almost always on the client site, and corporate firewalls are not opening up because I'd like it so. I've been using ownCloud for the past year and since it just uses the https/443 port, it works everywhere.

Re: Self-hosted alternatives to popular cloud services

#136

Post by bartvk »

Mooty wrote: post #25

Not open source but still very usefull and self hosted : http://plex.tv Ampache is cool but is really heavy for a simple hosting. Plex does movies and tv shows sort too. Place a Transmission / Deluge torrent client behind, you have a true media center, on a little server. Owncloud is cool but very buggy !

> Owncloud is cool but very buggy

That's not my experience at all. It's been running solid for a year now, on a lowly VPS and two MacBooks. It's got very nice Debian packages and an excellent iOS client.

I think it's rude to just say "very buggy" and leave it at that.

Re: Self-hosted alternatives to popular cloud services

#137

Post by gingerlime »

LukasReschke wrote: post #116
gingerlime wrote: post #109

Earlier quoted context omitted.

On mobile so please excuse me if I missed something subtle, but what's more insecure about this change? From what I know constant time compare protects against timing side channel attacks, so isn't it improving security here?

That was actually the part where they partially mitigated the vulnerability with. So before it was more insecure. The green one is the "fix" :) The constant time comparison is pretty irrelevant here. Check https://github.com/haiwen/seahub/commit/7cdb70368aa7acbf0546... , basically a valid password reset token in default Django requires an attacker to know: - Primary Key of the user (User ID) - Hashed version of the u…

Thanks for taking the time to explain... Sorry to nitpick, but I'm trying to get things clear.

your original comment pointing to the commit said

> And SeaFile has additionally modified the default Django components making it more insecure

So I was under the impression that this commit was making things worse, not better. Thanks for clarifying that this was already fixed in this commit, rather than introduce a vulnerability. It looks like they added the hashed password on the diff to mitigate this issue - unless I am missing something here? Can you explain why they "partially mitigated the vulnerability" here? is there still some gap that they've missed?

I'm not underestimating the vulnerability, or the fact that it was there in the first place. Just trying to get a full(er) picture.

I've had a read through this, and some other places where insecurity of Seafile is exposed/discussed/fixed. I agree that the overall impression I'm getting is that they're not security experts, and security could have definitely been better designed or taken into account in the first place.

I still think they're trying to do their best, and fix problems and improve. I hope for their and their users' sake that they can get some security-dedicated contributors (mostly to prevent bad things in the first place rather than fixing them later on). There's always more that can be done, but I'd like to give them the benefit of the doubt here and have faith that things will be better in the long run. Having a (robustly) secure, open-source dropbox replacement is a good thing. I think that's their aim, even if they are some times misguided.

disclaimed: I'm not even a user of Seafile, let alone know much about its codebase. It's the first time I hear about it. I was just curious about the security aspects of their product in light of some criticism here and on github etc.

Re: Self-hosted alternatives to popular cloud services

#138

Post by alpeb »

Anybody knows about an alternative for prismic.io? That's basically a CMS for devs, where you inject a site's content through API calls to prismic.io, while they provide a very nice UI for managing the content. It's a great service but I'd like to explore self-hosted alternatives.

Re: Self-hosted alternatives to popular cloud services

#139

Post by favadi »

sytse wrote: post #130
antsar wrote: post #112

Earlier quoted context omitted.

Just wanted to +1 the parent comment. I'm sure you're tired of hearing this, but it feels pretty backwards that we have to disable parts of the installation just to get it to work alongside other stuff (with a shared nginx instance, etc). Its understandable why you wanted to bundle everything, and I bet it makes installation much easier for beginners and/or lazy sysadmins. That said, it would be even better if the in…

"It seems like apt package dependencies would be more elegant than bundling everything together." totally agree, that why is why we're sponsoring Pirate Praveen who is working on a native Debian package.

That's great! Is there any ETA or discussion I can follow?

Re: Self-hosted alternatives to popular cloud services

#140

Post by ianlevesque »

thaumasiotes wrote: post #114
kentonv wrote: post #16

"N self-hosted alternatives to popular cloud services" is becoming a meme. Here's 43 self-hosted alternatives to popular cloud services, with one-click demos you can try yourself! https://apps.sandstorm.io/ Tiny Tiny RSS, Ghost, Gitlab, and Rocket.Chat are in there. ownCloud is missing, but you can try Davros, which is compatible with the ownCloud client apps. https://apps.sandstorm.io/app/8aspz4sfjnp8u89000mh2v1xrdy…

My first RSS reader was self-hosted. When I went away on vacation and came back to learn that my computer had shut down during that time, I switched to Google Reader.

The other replies are far more hilarious but you should consider a VPS for this reason rather than a computer at home or similar. They are extremely affordable and can be restarted/restored from backup remotely easier.
Post reply on HN