Live data from Hacker News

OwnCloud Server 8.0

owncloud.org

21–30 of 80 posts

Re: OwnCloud Server 8.0

#23

Earlier quoted context omitted.

wordpress is in php wikipedia is in php facebook is in php flickr is in php photobucket is in php need i say more?

> wordpress is in php That pretty much makes the point. 194 vulnerabilities in Wordpress with CVEs in 2014. http://www.cvedetails.com/vulnerability-list/vendor_id-2337/...

I would argue it is the developer writing the code, not the language it's written in.

Re: OwnCloud Server 8.0

#24

Earlier quoted context omitted.

wordpress is in php wikipedia is in php facebook is in php flickr is in php photobucket is in php need i say more?

> wordpress is in php That pretty much makes the point. 194 vulnerabilities in Wordpress with CVEs in 2014. http://www.cvedetails.com/vulnerability-list/vendor_id-2337/...

That list appears to include CVE going back to 2006 at least. I count 17 in 2014, the highest rated of which is an arbitrary code exectution (CVE-2014-5203) rated 7.5.

Not sure number of disclosed flaws is a good metric to look at, whether it's high or low.

Re: OwnCloud Server 8.0

#25
post #5

Unfortunately OwnCloud is fundamentally broken because all "apps" share the same process and have to be written in PHP. The bigger the ecosystem gets, the harder it is going to be to deal with security issues. If OwnCloud wants to become a reference platform for other developers it really has to tackle sandboxing and permissions.

If we want to do this in a way where everyone can run their own infrastructure then we've got to tackle some of the distributed systems problems. Specifically, life-cycle management of software/apps, how things sync/backup, and issues of identity and connectivity. One method is to take a clean-slate approach and build up a new stack (with its own trade-offs) e.g. Using unikernels as a base http://amirchaudhry.com/brewing-miso-to-serve-nymote/

Re: OwnCloud Server 8.0

#26
post #5

Unfortunately OwnCloud is fundamentally broken because all "apps" share the same process and have to be written in PHP. The bigger the ecosystem gets, the harder it is going to be to deal with security issues. If OwnCloud wants to become a reference platform for other developers it really has to tackle sandboxing and permissions.

Is there a better alternative to OwnCloud that doesn't have similar flaws?

I'm not being sarcastic, it's fine to say it's broken but that doesn't really make a difference if there are still no better alternatives!?

Re: OwnCloud Server 8.0

#28

Are there any alternatives that have a better syncing mechanism? I really like ownClouds interface but I have encountered a few bugs with syncing files.

I highly recommend Syncthing.

Re: OwnCloud Server 8.0

#29
post #5

Unfortunately OwnCloud is fundamentally broken because all "apps" share the same process and have to be written in PHP. The bigger the ecosystem gets, the harder it is going to be to deal with security issues. If OwnCloud wants to become a reference platform for other developers it really has to tackle sandboxing and permissions.

Is there a better alternative to OwnCloud that doesn't have similar flaws? I'm not being sarcastic, it's fine to say it's broken but that doesn't really make a difference if there are still no better alternatives!?

Sandstorm, a platform which allows users to run arbitrary applications on a server in a secure sandbox. Of course, OwnCloud is at version 8 and Sandstorm is still working out its permissions UI.

Re: OwnCloud Server 8.0

#30
post #5

Unfortunately OwnCloud is fundamentally broken because all "apps" share the same process and have to be written in PHP. The bigger the ecosystem gets, the harder it is going to be to deal with security issues. If OwnCloud wants to become a reference platform for other developers it really has to tackle sandboxing and permissions.

Just playing devil's advocate, but isn't this true with many CMSs? Most implement "users" (and or groups) either in-house or using the underlying OS, and when it is the underlying OS the CMS needs access to all of the user's files anyway to make cooperation and interoperability work, essentially placing a big bullseye on the CMS system itself.

The difference is that OwnCloud is marketed as an operating system and is aimed at holding all the user's personal information. Users who aren't necessarily knowledgeable enough to distinguish trusted and untrusted "applications".

A CMS is usually used by a company and has different threat scenarios. Usually only sysadmins configure and install extensions.

Post reply on HN