Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Roundcube open-source webmail software merges with Nextcloud

phoronix.com

Post reply on HN
Print view View original

191–200 of 259 posts

Re: Roundcube open-source webmail software merges with Nextcloud

#191

Post by radlad »

jjeaff wrote: post #181
dzikimarian wrote: post #155

Earlier quoted context omitted.

Don't use linuxserver images. My feeling is they were done by someone who doesn't understand docker very well. Frequent use of supervisor, lack of logs on stdout, weird automagic config approach. It may feel convenient if someone did homelab without docker, but will bite you in the long run.

hmm, are you sure about that? the whole reason I use the linuxserver offerings is that they all follow the same pattern of not using root privileges in the container and also factoring the uid and group id out as compose variables so you can match them to other containers if needed.

I think both are true - LinuxServer images are usually well maintained, and they all use a common format, so once you know how to configure one, it's easy to configure the rest.

But they make a lot of decisions that are not "best practices" in Docker - such as running multiple processes per container, under a supervisor.

IMO, they are great for single-machine home deployments.

Re: Roundcube open-source webmail software merges with Nextcloud

#192

Post by velcrovan »

stracer wrote: post #149
velcrovan wrote: post #67

Earlier quoted context omitted.

The first and only time I had a server hacked was due to a RoundCube vulnerability in 2006. Just a month ago there was news of a RoundCube XSS zero-day that was widely exploited ( https://cyberpedia.medium.com/state-sponsored-cyberattacks-l... ). Don’t use RoundCube!

By this logic, you should recommend that people don't use computers. All software has vulnerabilities. The trick is to install it in a way which mitigates most of the typical ones: use VMs, SELINUX/APPARMOR, containers, chroots, user separations, etc.

Email is no longer in the class of "software you install" it is in the class of "services you outsource to reputable companies who won't fuck it up"

Re: Roundcube open-source webmail software merges with Nextcloud

#193

Post by SahAssar »

stracer wrote: post #149
velcrovan wrote: post #67

Earlier quoted context omitted.

The first and only time I had a server hacked was due to a RoundCube vulnerability in 2006. Just a month ago there was news of a RoundCube XSS zero-day that was widely exploited ( https://cyberpedia.medium.com/state-sponsored-cyberattacks-l... ). Don’t use RoundCube!

By this logic, you should recommend that people don't use computers. All software has vulnerabilities. The trick is to install it in a way which mitigates most of the typical ones: use VMs, SELINUX/APPARMOR, containers, chroots, user separations, etc.

None of what you mentioned protects against XSS which the parent mentioned. Things like having a proper CSP might but only if the application is built so it does not depend on insecure eval/inline and/or you can properly disallow fetch/connections to outside sources.

Everything you mentioned is about protecting things the app should not have access to. Many vulnerabilities are about intent (did the admin user really mean to truncate the db they have permission to truncate) or target (did the user really mean to export all my emails in an archive to h4x0r@yahoo.com).

If you at all store any sensitive data within the application either serverside or clientside you need to consider the security of the application itself, not just the sandboxing/isolation.

Re: Roundcube open-source webmail software merges with Nextcloud

#194

Post by dzikimarian »

jjeaff wrote: post #181
dzikimarian wrote: post #155

Earlier quoted context omitted.

Don't use linuxserver images. My feeling is they were done by someone who doesn't understand docker very well. Frequent use of supervisor, lack of logs on stdout, weird automagic config approach. It may feel convenient if someone did homelab without docker, but will bite you in the long run.

hmm, are you sure about that? the whole reason I use the linuxserver offerings is that they all follow the same pattern of not using root privileges in the container and also factoring the uid and group id out as compose variables so you can match them to other containers if needed.

Yes their images are standardized, which helps if you want "linuxserver experience" and don't care about actual image.

Try to understand what actually happens on container startup and you're stuck in three layers of base images that they use as framework, with hooks on each layer.

Wanna inherit some image and eg. copy something into config dir? Nope. Config dir is overwritten by symlink, by script on some layer. Actual config dir is moved somewhere to fit their internal convention.

Their framework allows them to quickly add new applications and keep them updated. But it's pain to work with.

I guess if you're willing to learn it and you're 100% sure, you're not going to modify image or configure application beyond of what they exposed - you might be okay using it. Otherwise just get official image.

Re: Roundcube open-source webmail software merges with Nextcloud

#196

Post by arcza »

jospoortvliet wrote: post #178
Zetobal wrote: post #168

Earlier quoted context omitted.

They are advertising a enterprise ready solution and it's clearly not. No matter how much hardware you throw at it.

I beg to differ and so would our over 1000 customers, none of them with less than 100 seats (we don't sell below that). Most have 1000 users or more. The largest has several tens of millions of users and they are using Global Scale. One customer runs nearly 4 million users on a single cluster. Nextcloud is a complicated beast, and scaling to tens of thousands of users isn't trivial, but then that is what Nextcloud En…

"tens of millions"? you must specify what. hosting mail with 20GiB average mailboxes? Or a publicly accessible file share with a million monthly hits? Big difference. I would not productionise Nextcloud for a large organisation.

Finally there are very few orgs worldwide even with a few hundred k employees and any firm would get huge Microsoft discounts at that scale for products like SharePoint (on prem), Exchange (on prem) and Office Server (on prem also)... and oodles of support over a very mature product which Nextcloud is simply not.

Re: Roundcube open-source webmail software merges with Nextcloud

#197

Post by mekster »

Zetobal wrote: post #47

I hate nextcloud with a passion and I just hope they can govern a project like roundcube... used it for 20 years even through the whole roundcube next debacle. That said roundcube itself is not an oss project with a clean track record. Nextcloud is the OSS equivalent of IBM and ticking boxes so it's easy for management to pull the trigger but every feature is just a half-assed buggy implementation. Gobbling up OSS fu…

True but it does have the features that look attractive.

Too bad "beta quality everywhere" attitude never gets fixed. Basic stuff like weird upload indicator on the web, desktop app freezing when synching some 10GB or so and I don't even want to touch most of the third party plugins which are at alpha quality.

It's like a selfish girl that you need to treat carefully or it starts crying real fast.

Re: Roundcube open-source webmail software merges with Nextcloud

#198

Post by johnsea »

jospoortvliet wrote: post #187
stracer wrote: post #152

Earlier quoted context omitted.

By that logic, it should be good for Nextcloud investors.

The good news is that neither has investors... With regards to security, nothing is perfect but I'm absolutely positive that Nextcloud is ahead of the vast majority of open source projects. And if you know of a security hole, go and collect your USD 10K at HackerOne.

True. I don't know of any other "holistic" project that we could have choosen instead of Nextcloud. One very very important point is the AIO installation method. So easy and no fear to have forgotten something important. -- You saved us from Google (no way) and Microsoft365 (a possibility), thank you!

Re: Roundcube open-source webmail software merges with Nextcloud

#199

Post by brazzy »

bityard wrote: post #76

I've been running Nextcloud for family collaboration purposes since before the fork from Owncloud. I've been pretty happy with it overall. My biggest gripe with it is the increasing schizophrenia of the UX devs. One thing I _loved_ about Nextcloud was that they paid a lot of attention to making it easy to navigate and use. The newer UX "enhancements" seem to be all about maximizing (useless) whitespace and making eve…

>On the plus side, if you're using the docker image, upgrades are a breeze.

I've had problems that required fiddly manual interventions twice after updating to a new major version.

And what keeps me from using it for anything other than File synching is the lack of a functioning integrated backup mechanism. There is a plugin, but it's unusable shite (tries to keep the entire data in memory, big has been open for years), and I really don't want to depend on a self-made combination of Filesystem and DB backup.

Re: Roundcube open-source webmail software merges with Nextcloud

#200

Post by mekster »

manmal wrote: post #39
creshal wrote: post #36

Given Nextcloud's track record that doesn't bode well for Roundcube's future. We tried to make Nextcloud work for us for years, but it's just too terribly clunky, unstable, bug-ridden, and customer hostile. I hope none of that rubs off on roundcube.

Do you have recommendations for a self hosted webDAV server that could act as a Dropbox / GDrive replacement? I‘m using Nextcloud only for that use case because I haven’t found anything that seemed as stable.

Not sure if it's based on WebDAV but Seafile is probably one of the only few that works for self hosted file synchronizer.
Post reply on HN