Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nextcloud: Open-Source Cloud Apps

nextcloud.com

Post reply on HN
Print view View original

111–120 of 250 posts

Re: Nextcloud: Open-Source Cloud Apps

#111

Post by komali2 »

BrandoElFollito wrote: post #93

Nextcloud is a nightmare. First if all, it wants to do everything and does none well (or better than specialized apps) Its internals are a shitshow - a question about getting the real IP of the calling client raised a 10 pages discussion where people said "it works" and other days "it does not". The "solution" required you to change a volatile setting within the docker container (and do it again when the container ch…

This might be true but I finally deployed nextcloud for our co-op because I couldn't find any other solution to easily have a shared calendar with granular permissions to accounts I assign for write privileges, but also a dynamic ICS file download endpoint I can publicly expose. I tried a couple other caldav servers and none had this. So it does at least one thing better than specialized apps, which I typically prefer to use.

Re: Nextcloud: Open-Source Cloud Apps

#112

Post by obnauticus »

Timber-6539 wrote: post #34
obnauticus wrote: post #20

I originally wanted to do this but the CVE history is a bit too colorful for something I’d want to trust as a “cloud replacement”: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=nextcloud A common misconception IMO is that running and owning your own infrastructure is somehow more secure. To that I lol, and I’m confident that the thousands of AWS/GCP/Azure/iCloud security engineers are all doing a more thorough job…

> thousands of AWS/GCP/Azure/iCloud security engineers are all doing a more thorough job than you All these cloud services are just attack surfaces with a huge target on their backs. And the security engineers slip up too [0], in the case of Microsoft it's become more of a meme now. The North Korean hackers basically own them. [0] https://www.techspot.com/news/102573-microsoft-left-server-c...

Somewhat depends on your threat model. The relative value of an iCloud/aws/gDrive 0day is going to be higher than Nextcloud. If you’re in the category of people concerned about this type of breach, self-hosting a PHP web app and claiming it’s somehow safer wont save you either. For this risky population, neither solution works since attackers are willing to throw expensive exploits at your data in either scenario.

If you aren’t being specifically targeted, then you would care about low hanging fruits discovered by something like automated scanning. Not exposing your service to the internet does solve this assuming you’re confident in the stack which provides this isolation. But managing this stack and performing risk calculus here is actually where the security horse trading happens. I think most people aren’t safer managing this themselves — arguably they’re actually worse off.

I have high standards for the confidentiality of my data. I care about things like lateral movement and the massive attack surface that isolation tech to prevent such movement has. I also won’t design monitoring and alerting, ensure a patch state, or perform code audits on Nextcloud and all the isolation tech required to secure it to a comporable level of security. Because of this, I instead reason around the cost of exploitation. I want it to be higher than what I believe Nextcloud provides and I’d rather require an attacker to use an expensive 0day to extract my data off a cloud provider like Google versus a potentially cheap one against my own infra.

Re: Nextcloud: Open-Source Cloud Apps

#113

Post by littlestymaar »

uselpa wrote: post #78
bravetraveler wrote: post #43

Earlier quoted context omitted.

One doesn't have to expose it to malicious actors. It is most-useful that way, sure. Mine is at 10.27.0.68 . Have fun, hackers! Also, I lol at most CVEs. Butterfly farted outside, oh uh. Take the top one: In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable. This is fixed in 3.13.4. You mean to tell me a few minor po…

I find that one concerning in an enterprise setup (which they target). Or the fact that the desktop client has 999 open issues. Or that the last version silently takes you off the stable channel. I could go on … Nextcloud desktop has severe quality control issues.

An number of github issues is even a worse metric than CVEs, many people just post wishlist issues there.

Re: Nextcloud: Open-Source Cloud Apps

#114

Post by saagarjha »

laymansterms wrote: post #95
bravetraveler wrote: post #43

Earlier quoted context omitted.

One doesn't have to expose it to malicious actors. It is most-useful that way, sure. Mine is at 10.27.0.68 . Have fun, hackers! Also, I lol at most CVEs. Butterfly farted outside, oh uh. Take the top one: In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable. This is fixed in 3.13.4. You mean to tell me a few minor po…

Yeah, one CVE is literally "You can use the MacOS variant of LD_PRELOAD on the client to hook libc calls! Oh no!!" This is a bogus CVE; any application can perform arbitrary actions when its system calls are hooked, but it requires such a strong threat model that the adversary realistically gains no ground by doing so. ("A code injection in Nextcloud Desktop Client for macOS allowed to load arbitrary code when starti…

You will note that the PR strengthens that model regardless.

Re: Nextcloud: Open-Source Cloud Apps

#115

Post by bonsai_vendetta »

MaxBarraclough wrote: post #49
obnauticus wrote: post #20

I originally wanted to do this but the CVE history is a bit too colorful for something I’d want to trust as a “cloud replacement”: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=nextcloud A common misconception IMO is that running and owning your own infrastructure is somehow more secure. To that I lol, and I’m confident that the thousands of AWS/GCP/Azure/iCloud security engineers are all doing a more thorough job…

I'm not a security specialist, but it seems to me that while managed services typically have better security and sysadmin resourcing, they also have the downside that their security can fail at a massive scale. If someone defeated the security of, say, GitHub, they could leak all the private repos stored there. Managed services also have to accept connections from the public Internet, which on-premises solutions do n…

[dead]

Re: Nextcloud: Open-Source Cloud Apps

#116

Post by TheChaplain »

BrandoElFollito wrote: post #93

Nextcloud is a nightmare. First if all, it wants to do everything and does none well (or better than specialized apps) Its internals are a shitshow - a question about getting the real IP of the calling client raised a 10 pages discussion where people said "it works" and other days "it does not". The "solution" required you to change a volatile setting within the docker container (and do it again when the container ch…

I've run Nextcloud for almost 3 years now via docker on a vps , it hosts my contacts, calendars and files. There is a apache reverse proxy in front of it, and a postgresql-database in the back.

Not once had I any serious issues updating when pulling new updated images.

Occasionally it whines about missing indices, but that is easily fixed using the occ command line tool. The clients real IP is forwarded by the proxy.

What I want to say is just that Nextcloud works fine.

Re: Nextcloud: Open-Source Cloud Apps

#117

Post by homebrewer »

boramalper wrote: post #110
sneak wrote: post #99

Earlier quoted context omitted.

The desktop clients are anything but “mature”, and the whole point of GDocs is collaborative editing. If you don’t want to collaborate, syncthing works fine and doesn’t need a server.

> the whole point of GDocs is collaborative editing Strong disagree. Collaborative editing is one of the major points but not the only one. For me and I believe many others, being able to view and edit my documents in a web browser is a huge convenience. (Speaking of collaborative editing, OnlyOffice too supports it. [0] However, you might need to setup a standalone “document server” [1] if you’ve a lot of collaborat…

I supported a NextCloud + OnlyOffice server for 4 years for a 100-person company, and have since moved to Collabora Code (which has been running for ~2 years now). IME Code has better performance, is easier to upgrade, provides better compatibility with MS Office (since it's basically LibreOffice with a web UI), and is easier to integrate with (I wrote some integrations for a couple of internal systems and it's been a breeze).

It's fully FOSS. https://www.collaboraonline.com/code

Re: Nextcloud: Open-Source Cloud Apps

#118

Post by _cenw »

kiney wrote: post #76
mort96 wrote: post #17

Earlier quoted context omitted.

I have looked into Seafile, but the thing is that I like some of the extra Nextcloud things, especially the calendar. I just wish that file sync was the main focus and not an afterthought. But honestly, I should probably just use Seafile and get another, more lightweight CalDAV server.

I use syncthing for files and radicale for calendar and contacts. Very lightweight and stable for years. Radicale sits behind a proxy with basic auth, so dont have to worry about patching vulns to much.

Syncthing is also a very solid choice and I'd use it if I didn't need the ability to create links for people - either to download or upload.

Re: Nextcloud: Open-Source Cloud Apps

#119

Post by klabb3 »

lolinder wrote: post #101
BrandoElFollito wrote: post #93

Nextcloud is a nightmare. First if all, it wants to do everything and does none well (or better than specialized apps) Its internals are a shitshow - a question about getting the real IP of the calling client raised a 10 pages discussion where people said "it works" and other days "it does not". The "solution" required you to change a volatile setting within the docker container (and do it again when the container ch…

> it wants to do everything and does none well I can't speak to the other points you made because this has always stopped me from investing in it. What I need in my stack is a focused Google Docs alternative, but every time I've installed it (3-4 times at this point) I'm quickly overwhelmed by the quantity of stuff it includes and by how complicated actually setting up the Docs replacement was (at the time the recomm…

> it wants to do everything and does none well

On that topic, it’s amusing to see when the “are we a product or a platform?” confusion jumps from its native host (publicly listed tech corps) to FOSS projects – different species altogether.

The idea of owning your own server just like any other device like laptops, smartphones and tablets, is just wonderful. But that means Linux! And Linux is absolutely infamous for poor application distribution (well technically the Linux distros). So now people make their own half-assed “app stores”, which is infinitely worse.

We would need a platform spec so that application developers can publish, users can discover and deploy, and platform providers can implement against a shared spec. That would be such a major step away from the surveillance economy and towards data sovereignty.

Re: Nextcloud: Open-Source Cloud Apps

#120

Post by vid »

I've been looking into NextCloud to recommend to a government agency. The world desperately need competition or at least something compatible with the m365 stack, because it's eating the world and taking a lot of choice away and killing a lot of innovation outside the Microsoft funnel, since Microsoft is not interested in a lot of tech (for example, network schemas, useful for "tell us once" type applications, since they'd rather you just use their tech for everything, and the messier it is behind the scenes, the better for them).

Anyway, I have mixed feelings. I admire the community and the support it has by many governments, its staunch Open Source basis so it's useful for an individual or a large organization. But it is building on a lot of crufty PHP, their collection of apps is very uneven and it's hard to know what works well without a lot of research, and it's going in a few directions to upgrade. AppApi in particular is on one hand very innovative, on the other going in some odd directions. I know it is successfully used by very large organizations, but without spending a lot of time with it, it's hard to get a sense of the commitment and considerations required.

Post reply on HN