61–70 of 94 posts
Earlier quoted context omitted.
I'm not too keen on the fact that AeroFS runs on Java as I would prefer to run Java free systems as much as possible (Go version would be nice =) but am willing to live with it if that's the only option.
We're working on it (a Java-free system, not a Go version, sorry ;) See my response here: https://news.ycombinator.com/item?id=5484566
The other problem is the pricing model. If I host everything and use my own bandwidth, what do I pay for ? Software development and upgrade ? This is very expensive for a user with a non profit activity who just want to stay in control with its own data.
For me Java is a no no because of all the update and security problems with it. Beside it isn't a lightweight and fast platform. I know many people that waisted a lot of time with Java software upgrading problems because of broken backward compatibility. The other problem is the pricing model. If I host everything and use my own bandwidth, what do I pay for ? Software development and upgrade ? This is very expensive…
Java seems to be a nice way to provide consistent experience across different platforms, I don't even want to think of installing OwnCloud on Windows. And with OwnCloud I'm even more concerned about security as it's written on PHP, but I may be biased here.
a) One of its goals is privacy, but it asks for my first and last name. Why is this needed? I could always lie, but I'd much prefer a single field (e.g. display name) that doesn't explicitly ask for this.
b) It tries to download a .deb file if I'm using Linux. I'd much rather click this myself, and I suspect it does this regardless of whether my system is Debian-based.
c) When signing up, I got no notifications at all. This may be due to NoScript, but I had no indication that my signup was completed. I thought perhaps my password wasn't valid or something along those lines, but I eventually tried to sign in-- it worked.
d) "Non-Ubuntu users can also download the tgz archive." .deb files are specific to all Debian-based systems, not just Ubuntu. Is it fine to install the .deb (which you've tried to download for me) on other Debian-based systems or just Ubuntu? It's unclear.
AeroFS is potentially great, but this isn't the first time I've reported concerns over a, b, and d.
Edit: added d, modified last sentence for clarity
This is awesome. AeroFS does everything I want in a file sharing system -- I can either run it entirely on my own machines on LAN and potentially VPN, or at a company on a network also not connected to the Internet, or I can use it as a direct Dropbox alternative (although it lacks some mobile clients and API support). I've been using it for ~a year or two in beta, as well as all the other alternatives. I still use D…
For me Java is a no no because of all the update and security problems with it. Beside it isn't a lightweight and fast platform. I know many people that waisted a lot of time with Java software upgrading problems because of broken backward compatibility. The other problem is the pricing model. If I host everything and use my own bandwidth, what do I pay for ? Software development and upgrade ? This is very expensive…
Pricing is for Teams only which makes sense, for everyone (teams of up to 3) its free, which is awesome!
Get dummy html in json request...
Earlier quoted context omitted.
Do you use certificate pinning on the clients? I.e. once a client sees peer's cert for the first time, it should remember it and warn if it ever changed afterwards.
Cert pinning only makes sense if you happen to trust multiple CAs, but want to stick to the cert issued by one particular one. We only trust one CA, and each issued cert is bound to a user and device id, so this is a non-issue. :)
It has nothing to do with that. Cert pinning is used to mitigate man-in-the-middle attacks whereby an attacker somehow obtains a valid certificate for peer's ID further down the road. If the certificate is not pinned, then the client will swallow a new cert without a peep, because it tracks back to a trusted CA.
Cert pinning is an equivalent of ~/.ssh/known_hosts. It allows me to pin specific public key to a peer and be notified if that key ever changes.
In your case, you might've gone with self-signed peer certs, but that would've obviously require manual verification of the peer's key on 1st contact. This is a bit of UX issue, because few people would bother to actually verify a string of hex numbers between two computers. So, naturally, you introduce a chaperon entity - your CA - that vouches for peer's credentials. I am willing to trust it, but consider it a "weak" trust that I put in place only for convenience purposes and to get stuff going quickly. Later on I may look and compare the key hashes (one provided by peer in an out of band fashion and the other I compute from my own copy of the key) and if they match only then I will know that I have a truly secure connection with the peer and that you didn't lie in your initial peer introduction. At this point I want to pin peer's key, so to be notified to repeat the manual verification process if/when the key changes.
tl;dr - Just add the cert pinning and display cert's public key hashes (mine and peers) somewhere in the UI.
This is awesome. AeroFS does everything I want in a file sharing system -- I can either run it entirely on my own machines on LAN and potentially VPN, or at a company on a network also not connected to the Internet, or I can use it as a direct Dropbox alternative (although it lacks some mobile clients and API support). I've been using it for ~a year or two in beta, as well as all the other alternatives. I still use D…