Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Owncloud has been forked into Nextcloud

nextcloud.com

Post reply on HN
Print view View original

31–40 of 134 posts

Re: Owncloud has been forked into Nextcloud

#31

Post by LukasReschke »

gstuartj wrote: post #28
LukasReschke wrote: post #26

Earlier quoted context omitted.

I'd like to point you to https://statuscode.ch/2015/09/ownCloud-security-development-... and make you aware of https://seacloud.cc/group/3/wiki/security-records.md and you should probably consider who reported the last critical vulnerability. Only because a project is serious about actually publishing vulnerability data does not make it necessarily more insecure (or secure).

I agree. Just pointing out that the specific problem the above poster mentioned as a reason to choose OwnCloud also is similarly true of OwnCloud. https://blog.hboeck.de/archives/880-Pwncloud-bad-crypto-in-t...

The impact is a different one though. In that scenario pointed by Hanno somebody needs to have access to the storage which already requires some kind of previous gained access. What could be done by an attacker then is to infect EXE files or so.

In the case of Seafile one could simply change passwords of any user etc.

But yes, crypto is hard and I agree that the way we did it at ownCloud is far away from the best way. :-)

Re: Owncloud has been forked into Nextcloud

#32

Post by antx »

alexggordon wrote: post #29

Let me tell you an anecdote about Owncloud. Once upon a time, I hosted an Owncloud instance for my family. I had a raid 5 system setup on an old Xserve with around 10 TB of usable space. I was really into learning about encryption at the time, so I figured it would be cool to encrypt all my families files on the server. I made sure that all my family members were properly educated about not forgetting their password,…

Well, sorry about your loss. Then again, please understand that NO, you didn't have a backup.

What you had was a single copy (probably a simple rsync, am I right?)... that is worth nothing in case of corruption or voluntary mischief.

Learn from your mistakes. Either use a solution that has a retention policy, or don't do backups at all.

Re: Owncloud has been forked into Nextcloud

#33

Post by mseebach »

alexggordon wrote: post #29

Let me tell you an anecdote about Owncloud. Once upon a time, I hosted an Owncloud instance for my family. I had a raid 5 system setup on an old Xserve with around 10 TB of usable space. I was really into learning about encryption at the time, so I figured it would be cool to encrypt all my families files on the server. I made sure that all my family members were properly educated about not forgetting their password,…

I don't mean to belittle the severity of the bug you encountered -- but the root-cause of your problem was a lack of a backup. A large number of issues, some of them software bugs, many of them not, could lead to data loss.

It that vein, too, your RAID-5 system is/was a disaster waiting to happen, especially when you don't have a backup: http://www.zdnet.com/article/raidfail-dont-use-raid-5-on-sma...

Re: Owncloud has been forked into Nextcloud

#34

Post by onli »

antx wrote: post #32
alexggordon wrote: post #29

Let me tell you an anecdote about Owncloud. Once upon a time, I hosted an Owncloud instance for my family. I had a raid 5 system setup on an old Xserve with around 10 TB of usable space. I was really into learning about encryption at the time, so I figured it would be cool to encrypt all my families files on the server. I made sure that all my family members were properly educated about not forgetting their password,…

Well, sorry about your loss. Then again, please understand that NO, you didn't have a backup. What you had was a single copy (probably a simple rsync, am I right?)... that is worth nothing in case of corruption or voluntary mischief. Learn from your mistakes. Either use a solution that has a retention policy, or don't do backups at all.

That is not the lesson here. It is that a backup should not backup the encrypted data, but the unencrypted data, and have its own encryption. A simple rsync based bashscript can be fine for that, though I'd use borg.

Re: Owncloud has been forked into Nextcloud

#35

Post by antx »

mseebach wrote: post #33
alexggordon wrote: post #29

Let me tell you an anecdote about Owncloud. Once upon a time, I hosted an Owncloud instance for my family. I had a raid 5 system setup on an old Xserve with around 10 TB of usable space. I was really into learning about encryption at the time, so I figured it would be cool to encrypt all my families files on the server. I made sure that all my family members were properly educated about not forgetting their password,…

I don't mean to belittle the severity of the bug you encountered -- but the root-cause of your problem was a lack of a backup. A large number of issues, some of them software bugs, many of them not, could lead to data loss. It that vein, too, your RAID-5 system is/was a disaster waiting to happen, especially when you don't have a backup: http://www.zdnet.com/article/raidfail-dont-use-raid-5-on-sma...

He probably thought he had a backup:

> "All my backups were the encrypted data, so those didn't really help either."

My guess is that the "bad encryption" simply was replicated over his "backup".

If you can't go back in time, a backup is worthless.

Ransomware are a thing, people, when will you learn?

Re: Owncloud has been forked into Nextcloud

#36

Post by jwildeboer »

alexggordon wrote: post #29

Let me tell you an anecdote about Owncloud. Once upon a time, I hosted an Owncloud instance for my family. I had a raid 5 system setup on an old Xserve with around 10 TB of usable space. I was really into learning about encryption at the time, so I figured it would be cool to encrypt all my families files on the server. I made sure that all my family members were properly educated about not forgetting their password,…

I think it is unfair to extend this specific experience to all personal fileservers. And TBH, I think that encrypting the storage shouldn't be done on this level. Setting up the OS that runs owncloud to have encrypted data volumes is the better way. If encryption is needed at all for taht.

Transport encryption between the various devices and the fileserver is a must, however. But going beyond that is not something I would consider to be a good thing.

Re: Owncloud has been forked into Nextcloud

#37

Post by jjnoakes »

onli wrote: post #34
antx wrote: post #32

Earlier quoted context omitted.

Well, sorry about your loss. Then again, please understand that NO, you didn't have a backup. What you had was a single copy (probably a simple rsync, am I right?)... that is worth nothing in case of corruption or voluntary mischief. Learn from your mistakes. Either use a solution that has a retention policy, or don't do backups at all.

That is not the lesson here. It is that a backup should not backup the encrypted data, but the unencrypted data, and have its own encryption. A simple rsync based bashscript can be fine for that, though I'd use borg.

How do you decrypt the data if it was encrypted client-side by multiple keys?

Re: Owncloud has been forked into Nextcloud

#38

Post by baldfat »

onli wrote: post #34
antx wrote: post #32

Earlier quoted context omitted.

Well, sorry about your loss. Then again, please understand that NO, you didn't have a backup. What you had was a single copy (probably a simple rsync, am I right?)... that is worth nothing in case of corruption or voluntary mischief. Learn from your mistakes. Either use a solution that has a retention policy, or don't do backups at all.

That is not the lesson here. It is that a backup should not backup the encrypted data, but the unencrypted data, and have its own encryption. A simple rsync based bashscript can be fine for that, though I'd use borg.

Having 2 local copies with local monthly backup for a year and an off site backup (CrashPlan) is the secret. CrashPlan can go back in time for issues like this.

As a Systems Librarian I did the daily (31 days worth), weekly (52 weeks worth), monthly (48 months worth) back ups with 131 tapes was a pain but it always paid off. I just had three machines and needed to go to my tapes once a day.

Re: Owncloud has been forked into Nextcloud

#39

Post by onli »

jjnoakes wrote: post #37
onli wrote: post #34

Earlier quoted context omitted.

That is not the lesson here. It is that a backup should not backup the encrypted data, but the unencrypted data, and have its own encryption. A simple rsync based bashscript can be fine for that, though I'd use borg.

How do you decrypt the data if it was encrypted client-side by multiple keys?

Every client would need to make its own backups, automatically. In such a situation it would be probably best to have two backups, those plus a backup of the encrypted data for the clients that fail to do the backups on their own. But you raise a good point: That's difficult to do.

Re: Owncloud has been forked into Nextcloud

#40

Post by [deleted] »

alexggordon wrote: post #29

Let me tell you an anecdote about Owncloud. Once upon a time, I hosted an Owncloud instance for my family. I had a raid 5 system setup on an old Xserve with around 10 TB of usable space. I was really into learning about encryption at the time, so I figured it would be cool to encrypt all my families files on the server. I made sure that all my family members were properly educated about not forgetting their password,…

[deleted]
Post reply on HN