Live data from Hacker News

Roundcube open-source webmail software merges with Nextcloud

phoronix.com

121–130 of 259 posts

Re: Roundcube open-source webmail software merges with Nextcloud

#121
post #118
post #76

I've been running Nextcloud for family collaboration purposes since before the fork from Owncloud. I've been pretty happy with it overall. My biggest gripe with it is the increasing schizophrenia of the UX devs. One thing I _loved_ about Nextcloud was that they paid a lot of attention to making it easy to navigate and use. The newer UX "enhancements" seem to be all about maximizing (useless) whitespace and making eve…

> I also use round cube > [ their useless UX designers ruined it ] Why do you have to wait for someone to fork it? Can’t you just not update to the bad version? I thought that was a major appeal of hosting your own email client like this. And given the email protocols won’t ever change, I would assume it’ll continue working the same for a decade or more. (My only guess is a security worry, but this seems like a rathe…

A self-hosted personal server very much needs to be kept up to date. This isn't a "state-level actor" issue; any vulnerabilities in software like this, especially in software that someone might not update in a timely fashion, will get scanned for automatically and exploited when found.

In theory, the portions that are only accessible with authentication are less security sensitive if you have only a small set of trusted users, but that's still reducing the security of your server to the security of your least security-aware user.

Re: Roundcube open-source webmail software merges with Nextcloud

#122
Since we're talking about email, contacts, calendars and files, thought it might be useful to summarize what I tried and landed on. Note that I'm only using it for my own personal setup, not shared with a company: - SyncThing - current solution for some of the filesync I'm doing (mainly personal projects). I have a small server at home that works well as an "always on" client that I can access. - OwnCloud - used to use it for files, cal and contacts. It's much lighter than NextCloud, pretty easy to setup. I've had corruption issues with the files, which arguably might have been my configuration - and made me leave it behind - Radicale + infCloud - Used it for a while for contacts and calendar. It's working well, and the API being carddav+caldav, you can use anything you want to sync. The main issue I had was that you can't sent and invite, which is a hassle. - NextCloud - current solution for calendar and contacts. I'm using it mainly because my shared hosting is providing an instance with my contract, and they handle backups. I don't like the UI much, it's slow and a bit clunky, I mainly use it when I want to invite someone. I don't use files. I tried using their mail solution but never made it work. I'm using Davx5 to sync on my phone, and the carddav/caldav sync on mac. I may be moving at some point. - Rainloop - very good alternative to roundcube. My only grief with it is that I never figured how to search across folders. - Roundcube - pretty good, and lots of plugins you can use to make it do what you want. - Also used a simple SSH + SCP client to do file sync'ing. I'm just hesitant with that, since someone getting access would mean full access to the server.

Re: Roundcube open-source webmail software merges with Nextcloud

#123
post #76

I've been running Nextcloud for family collaboration purposes since before the fork from Owncloud. I've been pretty happy with it overall. My biggest gripe with it is the increasing schizophrenia of the UX devs. One thing I _loved_ about Nextcloud was that they paid a lot of attention to making it easy to navigate and use. The newer UX "enhancements" seem to be all about maximizing (useless) whitespace and making eve…

> docker image, upgrades are a breeze.

Maybe this has been improved, but I remember thinking that and then it biting me because updating to the latest image (linuxserver/nextcloud) wasn't actually updating nextcloud itself, just the environment (php, etc.)

When I realized this, I had to go through several major nextcloud upgrades, incrementally going from one major version to the next.

Then it bit me again a few months later where nextcloud updated their maximum supported php version, and the docker image I was on quickly bumped the bundled php version to the new maximum, so the older version of nextcloud suddenly refused to start - even to run the updater. I ended up finding the max version check in nextcloud's php code and commenting it out, after that I was able to run the nextcloud update manually.

After being bit twice, I finally automated the full process so that the nextcloud software is updated in addition to the environment.

Re: Roundcube open-source webmail software merges with Nextcloud

#124

Earlier quoted context omitted.

> And finally it's a PHP app with a tons of legacy code Finally? That's a security nightmare right there.

I think legacy code in any language is a security nightmare; not just PHP. Imagine a half-a-decade-old NodeJS project...

5 years old? Really?

Or do you just mean because of the crazy dependencies in a typical node project?

Re: Roundcube open-source webmail software merges with Nextcloud

#125
post #52

Earlier quoted context omitted.

Have fun paying a fortune if you need to get those files again.

If you need all of them, and can wait 5-12 hours, that appears to be free to request and transfer? Or am I misreading[0]? [0] https://aws.amazon.com/s3/glacier/pricing/#Retrieval_request... <- under "Bulk"

This does not include data transfer pricing: https://aws.amazon.com/de/s3/glacier/pricing/#Data_transfer_...

Re: Roundcube open-source webmail software merges with Nextcloud

#126
post #31

Earlier quoted context omitted.

Not only that, you don't even need to "host" Syncthing. Being P2P in nature, it can just run on whatever computers you want to sync to, directly. That's pretty cool. The only thing I'd really want for Syncthing is some kind of simple interface for my desktops (all running SwayWM.) There's a GTK app that I use on my Pinephone, but it's a little janky. I mainly just want to be able to know that I'll get notifications w…

You still need a node somewhere that is always available, otherwise your device cannot sync when your other devices are offline. My wife and I had such a setup for years with Resilio Sync. But life is busy enough to maintain yet another thing, so we are happy to fork over the monthly fee for Dropbox Family. Ideally I'd switch over to some other sync solution, because Dropbox is somewhat overpriced. But we've had bad…

Well, you need an always-online node only if you actually need it to be syncing all of the time. Not everyone needs this; often times it's enough to just sync opportunistically. This is mainly necessary for things that are mutable and active; for me, I store my Keepass XC on a Syncthing shared folder, so this is relevant to me. And for that, I use my NAS, although obviously, not everyone has a NAS.

But that's the thing. Especially notable compared to NextCloud, Syncthing is not like most "self-hosted" software. Because a node is a node is a node, and because it's relatively lightweight, it literally doesn't matter what you use. You can use a Raspberry Pi, an old phone or laptop, anything you can connect sufficient disk and a network to can be a Syncthing node. And if it catches on fire, it doesn't really matter since every node is equal. You can just add another node at any time.

So a lot of people think Syncthing is another thing you'll have to worry about and maintain, but it's not. It's one of the few pieces of software that I expected to have to deal with a lot of extra work to use, but then it wound up being dramatically easier and more flexible than I expected. I worry about robustness when it comes to something as complex as cross filesystem syncing, but Syncthing has never lost my data. I have backups turned on on most nodes for the important folders, but I've never consulted them before, because I've never needed to.

Surely it is possible to lose data with Syncthing, or otherwise create a headache. However, from my point of view, it certainly seems to be among the most reliable and lowest effort ways to sync stuff across devices. I haven't had to spend almost any time maintaining Syncthing, and I don't have to worry about limits. I just need one device with a big enough disk, then I can create however many shared folders are needed to get the granularity I want.

Syncthing also has a pretty cool encryption feature. It is considered "beta" still, so I only use it in "trusted" scenarios, but it works great.

When I started using Syncthing, I only intended to share some document files between my desktop and my laptop. Now I use it to sync my Keepass database, files between some servers (think seedbox etc.,) multiple different documents folders including some for collaborative projects, and even a couple of other things. So it really wound up over-delivering for me.

I'd strongly recommend people, even people who already feel like Resilio Sync wasn't a good fit, to just try to set up Syncthing before resigning to Dropbox. Comparatively, I think Syncthing is simpler to use and more robust than basically any other solution that isn't Dropbox.

Re: Roundcube open-source webmail software merges with Nextcloud

#127
post #6

I'm glad the post states that Roundcube will stay an independent product. Roundcube is on a whole other level in terms of stability and robustness compared to Nextcloud. I'm also glad that the current Nextcloud client will be replaced, because it's not very good right now.

The first and only time I had a server hacked was due to a RoundCube vulnerability in 2006. Just a month ago there was news of a RoundCube XSS zero-day that was widely exploited ( https://cyberpedia.medium.com/state-sponsored-cyberattacks-l... ). Don’t use RoundCube!

Can you recommend a webmail client which hasn't had 2 vulnerabilities in the last 15 years?

Re: Roundcube open-source webmail software merges with Nextcloud

#128

I sure hope there are no changes to standalone roundcube, because I'm just starting to think nextcloud is too heavy. I see people on selfhosting forums asking for alternatives. It would be sad if they swallowed roundcube, which I remember as a decent web email client.

Rainloop is a good alternative IMO

I hear SnappyMail is a fork of Rainloop with lots of improvements.
Post reply on HN