Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OwnCloud Server 8.0

owncloud.org

Post reply on HN
Print view View original

11–20 of 80 posts

Re: OwnCloud Server 8.0

#11

Post by mariocesar »

UnoriginalGuy wrote: post #8
zimbatm wrote: post #5

Unfortunately OwnCloud is fundamentally broken because all "apps" share the same process and have to be written in PHP. The bigger the ecosystem gets, the harder it is going to be to deal with security issues. If OwnCloud wants to become a reference platform for other developers it really has to tackle sandboxing and permissions.

Just playing devil's advocate, but isn't this true with many CMSs? Most implement "users" (and or groups) either in-house or using the underlying OS, and when it is the underlying OS the CMS needs access to all of the user's files anyway to make cooperation and interoperability work, essentially placing a big bullseye on the CMS system itself.

It's true and is the reason why so many PHP powered CMS are so insecure, how many times do you hear about a new wordpress exploit?

Re: OwnCloud Server 8.0

#13

Post by ukigumo »

wtbob wrote: post #3

OwnCloud looks pretty neat, but I do wish that it would support client-side encryption; I don't trust a machine I'm renting in a data centre any more than I do Facebook or Google. I'm aware that there (sadly) aren't standards for browser-uploaded encrypted files, sharing encrypted files efficiently and so forth, so it's hardly their fault.

If your worry is with data at rest, then owncloud already supports it (http://doc.owncloud.org/server/7.0/user_manual/files/encrypt...).

I host my servers with AWS so I use Gluster encrypted bricks with backups to a S3 bucket as well as the built-in encryption capability from Owncloud.

Re: OwnCloud Server 8.0

#14

Post by finalight »

zimbatm wrote: post #5

Unfortunately OwnCloud is fundamentally broken because all "apps" share the same process and have to be written in PHP. The bigger the ecosystem gets, the harder it is going to be to deal with security issues. If OwnCloud wants to become a reference platform for other developers it really has to tackle sandboxing and permissions.

wordpress is in php

wikipedia is in php

facebook is in php

flickr is in php

photobucket is in php

need i say more?

Re: OwnCloud Server 8.0

#15

Post by Spooky23 »

finalight wrote: post #14
zimbatm wrote: post #5

Unfortunately OwnCloud is fundamentally broken because all "apps" share the same process and have to be written in PHP. The bigger the ecosystem gets, the harder it is going to be to deal with security issues. If OwnCloud wants to become a reference platform for other developers it really has to tackle sandboxing and permissions.

wordpress is in php wikipedia is in php facebook is in php flickr is in php photobucket is in php need i say more?

> wordpress is in php

That pretty much makes the point. 194 vulnerabilities in Wordpress with CVEs in 2014.

http://www.cvedetails.com/vulnerability-list/vendor_id-2337/...

Re: OwnCloud Server 8.0

#16

Post by regularfry »

finalight wrote: post #14
zimbatm wrote: post #5

Unfortunately OwnCloud is fundamentally broken because all "apps" share the same process and have to be written in PHP. The bigger the ecosystem gets, the harder it is going to be to deal with security issues. If OwnCloud wants to become a reference platform for other developers it really has to tackle sandboxing and permissions.

wordpress is in php wikipedia is in php facebook is in php flickr is in php photobucket is in php need i say more?

Yes.

Re: OwnCloud Server 8.0

#17

Post by UnoriginalGuy »

mariocesar wrote: post #11
UnoriginalGuy wrote: post #8

Earlier quoted context omitted.

Just playing devil's advocate, but isn't this true with many CMSs? Most implement "users" (and or groups) either in-house or using the underlying OS, and when it is the underlying OS the CMS needs access to all of the user's files anyway to make cooperation and interoperability work, essentially placing a big bullseye on the CMS system itself.

It's true and is the reason why so many PHP powered CMS are so insecure, how many times do you hear about a new wordpress exploit?

It really has nothing to do with PHP. Changing the language or framework wouldn't inherently change the design.

e.g. http://www.cvedetails.com/vulnerability-list/vendor_id-26/pr...

Re: OwnCloud Server 8.0

#19

Post by drzaiusapelord »

mariocesar wrote: post #11
UnoriginalGuy wrote: post #8

Earlier quoted context omitted.

Just playing devil's advocate, but isn't this true with many CMSs? Most implement "users" (and or groups) either in-house or using the underlying OS, and when it is the underlying OS the CMS needs access to all of the user's files anyway to make cooperation and interoperability work, essentially placing a big bullseye on the CMS system itself.

It's true and is the reason why so many PHP powered CMS are so insecure, how many times do you hear about a new wordpress exploit?

how many times do you hear about a new linux kernel exploit?

Pretty much everything is insecure. Writing things in not-php isn't the magical fix you seem to think it is.

Re: OwnCloud Server 8.0

#20

Post by jepper »

majormjr wrote: post #18

Are there any alternatives that have a better syncing mechanism? I really like ownClouds interface but I have encountered a few bugs with syncing files.

Bittorent sync? Discoverability and multiple folder syncing has been a problem for me. I would be very interested in a perfect method to track and sync multiple folders on multiple computers
Post reply on HN