Owncloud has been forked into Nextcloud • Hacker News Board

Re: Owncloud has been forked into Nextcloud

#41

Post by antx » Thu, Jun 02, 2016, 1:09 PM UTC

jwildeboer wrote: post #36

alexggordon wrote: post #29

Let me tell you an anecdote about Owncloud. Once upon a time, I hosted an Owncloud instance for my family. I had a raid 5 system setup on an old Xserve with around 10 TB of usable space. I was really into learning about encryption at the time, so I figured it would be cool to encrypt all my families files on the server. I made sure that all my family members were properly educated about not forgetting their password,…

I think it is unfair to extend this specific experience to all personal fileservers. And TBH, I think that encrypting the storage shouldn't be done on this level. Setting up the OS that runs owncloud to have encrypted data volumes is the better way. If encryption is needed at all for taht. Transport encryption between the various devices and the fileserver is a must, however. But going beyond that is not something I…

In-transit encryption is a no-brainer.

The most secure (from a trust point of view, at least) method of encrypting file is obviously at rest, client-side.

Seafile uses that method, but fails on the implementation on some aspects.

"In-place" encryption versus "volume/disk" encryption both have major drawbacks and are hard to implement correctly.

In case of "in-place", the private key is a possible vulnerability (like leaving the key under the doormat).

In case of disk encryption, while it's mounted, it's worth nothing if (when) you are compromised.

Re: Owncloud has been forked into Nextcloud

#42

Post by JustSomeNobody » Thu, Jun 02, 2016, 1:12 PM UTC

phreeza wrote: post #12

I have been using Seafile for 2 years now and I'm very happy with it.

The reason I prefer Owncloud to Seafile is that my files are stored as my files. I have a script that copies the photos I upload to Owncloud over to my NAS automatically.

Yes, there's FUSE, but I still prefer the way Owncloud handles my files.

Re: Owncloud has been forked into Nextcloud

#43

Post by mkesper » Thu, Jun 02, 2016, 1:15 PM UTC

gstuartj wrote: post #25

embik wrote: post #17

Earlier quoted context omitted.

While Seafile seems to work, the developers have been kinda sloppy both with licensing[1] and security[2]. The answers on both issues really make me question their integrity and ability to deliver a secure piece of software. [1] https://github.com/haiwen/seafile/issues/666 [2] https://github.com/haiwen/seafile/issues/350

OwnCloud actually has security issues similar to what you cited in the second link. Their security track record isn't spectacular either. https://blog.hboeck.de/archives/880-Pwncloud-bad-crypto-in-t...

I hope there can be an updateable packet in Debian again with this fork.

Re: Owncloud has been forked into Nextcloud

#44

Post by benmcnelly » Thu, Jun 02, 2016, 1:27 PM UTC

antx wrote: post #35

mseebach wrote: post #33

Earlier quoted context omitted.

I don't mean to belittle the severity of the bug you encountered -- but the root-cause of your problem was a lack of a backup. A large number of issues, some of them software bugs, many of them not, could lead to data loss. It that vein, too, your RAID-5 system is/was a disaster waiting to happen, especially when you don't have a backup: http://www.zdnet.com/article/raidfail-dont-use-raid-5-on-sma...

He probably thought he had a backup: > "All my backups were the encrypted data, so those didn't really help either." My guess is that the "bad encryption" simply was replicated over his "backup". If you can't go back in time, a backup is worthless. Ransomware are a thing, people, when will you learn?

Yep, if your backup software doesn't have historical snapshots where you can jump back to a certain day, you are just going to write bad data as your backup and only have bad data to restore.

Re: Owncloud has been forked into Nextcloud

#45

Post by onli » Thu, Jun 02, 2016, 1:33 PM UTC

baldfat wrote: post #38

onli wrote: post #34

Earlier quoted context omitted.

That is not the lesson here. It is that a backup should not backup the encrypted data, but the unencrypted data, and have its own encryption. A simple rsync based bashscript can be fine for that, though I'd use borg.

Having 2 local copies with local monthly backup for a year and an off site backup (CrashPlan) is the secret. CrashPlan can go back in time for issues like this. As a Systems Librarian I did the daily (31 days worth), weekly (52 weeks worth), monthly (48 months worth) back ups with 131 tapes was a pain but it always paid off. I just had three machines and needed to go to my tapes once a day.

That sounds like a lot. Simple because it sounds also interesting: Why did you have to use your tapes each day? Unreliable filesystem?

Re: Owncloud has been forked into Nextcloud

#46

Post by mhurron » Thu, Jun 02, 2016, 1:36 PM UTC

stp-ip wrote: post #7

9 of the top 10 contributors in addition to the project founder and the lead security engineer are pushing this effort. Good foundation to fork and support users. Let's hope this brings the transparency, openness and community awareness owncloud/nextcloud always needed.

Why would they when they were (apparently) 90% of OwnCloud in the first place. What stopped them being open in the first place?

Re: Owncloud has been forked into Nextcloud

#47

Post by ausjke » Thu, Jun 02, 2016, 1:38 PM UTC

After read the announcement I still can not figure out the reason to fork? I tried owncloud and found it uses a lot memory and then gave up on that.

Re: Owncloud has been forked into Nextcloud

#48

Post by the-dude » Thu, Jun 02, 2016, 1:54 PM UTC

onli wrote: post #45

baldfat wrote: post #38

Earlier quoted context omitted.

Having 2 local copies with local monthly backup for a year and an off site backup (CrashPlan) is the secret. CrashPlan can go back in time for issues like this. As a Systems Librarian I did the daily (31 days worth), weekly (52 weeks worth), monthly (48 months worth) back ups with 131 tapes was a pain but it always paid off. I just had three machines and needed to go to my tapes once a day.

That sounds like a lot. Simple because it sounds also interesting: Why did you have to use your tapes each day? Unreliable filesystem?

To move them offsite presumably.

Re: Owncloud has been forked into Nextcloud

#49

Post by stp-ip » Thu, Jun 02, 2016, 2:06 PM UTC

mhurron wrote: post #46

stp-ip wrote: post #7

9 of the top 10 contributors in addition to the project founder and the lead security engineer are pushing this effort. Good foundation to fork and support users. Let's hope this brings the transparency, openness and community awareness owncloud/nextcloud always needed.

Why would they when they were (apparently) 90% of OwnCloud in the first place. What stopped them being open in the first place?

They were 90% of the top contributors. The company had a lot more sales people. The devs don't control decisions of the company. Only the code and that's why I assume there was this fork.

Re: Owncloud has been forked into Nextcloud

#50

Post by majewsky » Thu, Jun 02, 2016, 2:13 PM UTC

evook wrote: post #13

NetStrikeForce wrote: post #10

Earlier quoted context omitted.

It sounds like they didn't have a viable business model, so they're starting a new company to get rid of any ties the old had. Maybe there's VC money coming in and this is a requirement to be able to be sold later... Who knows? :)

Based on what I heared from someone involved, it's actually the opposite. They don't want VC money to come in and loose theirs influence in the decision making.

I'd guess the same. The new company is a GmbH (German version of a "Ltd." AFAIK), not a stock corporation. See also https://en.wikipedia.org/wiki/Gesellschaft_mit_beschränkter_...