Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Roundcube open-source webmail software merges with Nextcloud

phoronix.com

Post reply on HN
Print view View original

251–259 of 259 posts

Re: Roundcube open-source webmail software merges with Nextcloud

#251

Post by brazzy »

jerf wrote: post #247
brazzy wrote: post #244

Earlier quoted context omitted.

Hm so I guess your setup uses the default SQLite database? I switched to MariaDB because I kept having Nextcloud freeze after a few weeks.

No. Docker compose, if you want to get technical not just "docker", with MariaDB. When the cron job runs docker-compose down it backs all the subdirs up, including the full DB directory. (Probably not a cheap plan for a heavy-use site, but for my family it's a normal thing for day-to-day to have no changes.) Interesting that you comment about SQLite being a problem. I am not a heavy user of Nextcloud, but I haven't h…

That's an interesting idea - I guess when it's all shut down, simply copying everything can't really fail or break anything.

Since I'm using the same setup (docker compose for nextcloud, MariaDB, and some other stuff), maybe I should really look into that option, thank you!

Re: Roundcube open-source webmail software merges with Nextcloud

#252

Post by apitman »

teekert wrote: post #249
t-writescode wrote: post #232

Earlier quoted context omitted.

That is correct, yes.

It sounds a bit like using the same password for all your services... Hack a Nextcloud instance, gain root on any system through Docker,

I would assume (hope) that the AIO container itself is not exposed to the internet, only some of the containers it starts.

Re: Roundcube open-source webmail software merges with Nextcloud

#253

Post by hammyhavoc »

jchw wrote: post #126
microtonal wrote: post #84

Earlier quoted context omitted.

You still need a node somewhere that is always available, otherwise your device cannot sync when your other devices are offline. My wife and I had such a setup for years with Resilio Sync. But life is busy enough to maintain yet another thing, so we are happy to fork over the monthly fee for Dropbox Family. Ideally I'd switch over to some other sync solution, because Dropbox is somewhat overpriced. But we've had bad…

Well, you need an always-online node only if you actually need it to be syncing all of the time. Not everyone needs this; often times it's enough to just sync opportunistically. This is mainly necessary for things that are mutable and active; for me, I store my Keepass XC on a Syncthing shared folder, so this is relevant to me. And for that, I use my NAS, although obviously, not everyone has a NAS. But that's the thi…

If you run it on a Pi, do you run it on Portainer or anything like that?

Re: Roundcube open-source webmail software merges with Nextcloud

#254

Post by hammyhavoc »

b112 wrote: post #237
eurekin wrote: post #50

Earlier quoted context omitted.

I was thinking of trying out using something low level... Maybe that? Does it support lazy selective syncing? Updating only ranges of files? Does it handle broken connections gracefully and recovers without data loss?

davfs is a protcol, a standard. Read that standard uf you wonder, but many things used dav behind the scenes. And apache2 is a very well established implementation of it. Clients handle partial snags. I wouldn't rely upon anything that syncs like this, without backups. Any protocol at all. Of course, the same may be said for anything at all. Backups are king.

What are you using for backup?

Re: Roundcube open-source webmail software merges with Nextcloud

#255

Post by stracer »

SahAssar wrote: post #193
stracer wrote: post #149

Earlier quoted context omitted.

By this logic, you should recommend that people don't use computers. All software has vulnerabilities. The trick is to install it in a way which mitigates most of the typical ones: use VMs, SELINUX/APPARMOR, containers, chroots, user separations, etc.

None of what you mentioned protects against XSS which the parent mentioned. Things like having a proper CSP might but only if the application is built so it does not depend on insecure eval/inline and/or you can properly disallow fetch/connections to outside sources. Everything you mentioned is about protecting things the app should not have access to. Many vulnerabilities are about intent (did the admin user really…

Agreed, this is a nasty bug in the software, which makes it open to manipulation by anybody on the internet who can send you an email. It's a big failure of the RoundCube project, developers probably do not care about security of user data very much. The response to the bug report is "did something to fix this, closed", no comment on what is going to be done to prevent this stuff in the future. Which is disappointing for a flaw of such severity. I wouldn't be surprised if similar attacks on RoundCube are still possible.

Re: Roundcube open-source webmail software merges with Nextcloud

#256

Post by stracer »

velcrovan wrote: post #192
stracer wrote: post #149

Earlier quoted context omitted.

By this logic, you should recommend that people don't use computers. All software has vulnerabilities. The trick is to install it in a way which mitigates most of the typical ones: use VMs, SELINUX/APPARMOR, containers, chroots, user separations, etc.

Email is no longer in the class of "software you install" it is in the class of "services you outsource to reputable companies who won't fuck it up"

Many people don't see it that way, as they outsource to Microsoft, who can't do e-mail properly and eff it up all the time.

It's more of "outsource to someone else" than "who won't fuck it up".

Re: Roundcube open-source webmail software merges with Nextcloud

#257

Post by Saris »

manmal wrote: post #39
creshal wrote: post #36

Given Nextcloud's track record that doesn't bode well for Roundcube's future. We tried to make Nextcloud work for us for years, but it's just too terribly clunky, unstable, bug-ridden, and customer hostile. I hope none of that rubs off on roundcube.

Do you have recommendations for a self hosted webDAV server that could act as a Dropbox / GDrive replacement? I‘m using Nextcloud only for that use case because I haven’t found anything that seemed as stable.

sftpgo https://sftpgo.com/

Re: Roundcube open-source webmail software merges with Nextcloud

#258

Post by Saris »

haroldp wrote: post #163
jordemort wrote: post #65

I really want to like Nextcloud. I had it all set up perfectly earlier this year with their "AIO" setup. Then some upgrade came along and completely destroyed my install, couldn't get the containers to start after that, couldn't figure out how to debug it; seemed like the only way to get it back on its feet was to wipe and start over. I wiped; I haven't started over yet.

> couldn't get the containers to start after that, couldn't figure out how to debug it Docker monoculture and it's consequences.

No it's due to nextclouds crazy AIO container that creates other containers automatically, and hides the entire process from the user so there's no easy way to diagnose issues.

Re: Roundcube open-source webmail software merges with Nextcloud

#259

Post by haroldp »

Saris wrote: post #258
haroldp wrote: post #163

Earlier quoted context omitted.

> couldn't get the containers to start after that, couldn't figure out how to debug it Docker monoculture and it's consequences.

No it's due to nextclouds crazy AIO container that creates other containers automatically, and hides the entire process from the user so there's no easy way to diagnose issues.

We can't turn on web server logging? PHP logging? We don't take DB backups? We can't revert to the previous image version? The crazy AIO NextCloud Docker image doesn't store your documents as plain files in a data/{$USER}/ directory that one can always rescue?

"Use the Docker image. It just works!"

Until it doesn't.

I know this will sound very greybeard, but as sysadmins, we can slog through understanding the systems we are running when we set them up, or we can wait until they break to figure them out. You can tell which path a sysadmin chose when they things like, "I upgraded and my containers wouldn't start, so I gave up." Why wouldn't they start? What's in the error logs?

Post reply on HN