Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OwnCloud Server 8.0

owncloud.org

Post reply on HN
Print view View original

31–40 of 80 posts

Re: OwnCloud Server 8.0

#31

Post by edwintorok »

ukigumo wrote: post #13
wtbob wrote: post #3

OwnCloud looks pretty neat, but I do wish that it would support client-side encryption; I don't trust a machine I'm renting in a data centre any more than I do Facebook or Google. I'm aware that there (sadly) aren't standards for browser-uploaded encrypted files, sharing encrypted files efficiently and so forth, so it's hardly their fault.

If your worry is with data at rest, then owncloud already supports it ( http://doc.owncloud.org/server/7.0/user_manual/files/encrypt... ). I host my servers with AWS so I use Gluster encrypted bricks with backups to a S3 bucket as well as the built-in encryption capability from Owncloud.

SX has client-side encryption if you use the SX tools (sxcp) to upload/download your files to volumes that have encryption enabled: http://blog.skylable.com/2014/09/transparency-reports-server...

Disclaimer: I'm a co-founder of Skylable

Re: OwnCloud Server 8.0

#32

Post by raphman »

pestaa wrote: post #21
majormjr wrote: post #18

Are there any alternatives that have a better syncing mechanism? I really like ownClouds interface but I have encountered a few bugs with syncing files.

Seafile has been flawless for me.

Seconded - we have been running Seafile for the last few months with several shared folders. It works flawlessly and is quite fast.

Re: OwnCloud Server 8.0

#33

Post by ukigumo »

edwintorok wrote: post #31
ukigumo wrote: post #13

Earlier quoted context omitted.

If your worry is with data at rest, then owncloud already supports it ( http://doc.owncloud.org/server/7.0/user_manual/files/encrypt... ). I host my servers with AWS so I use Gluster encrypted bricks with backups to a S3 bucket as well as the built-in encryption capability from Owncloud.

SX has client-side encryption if you use the SX tools (sxcp) to upload/download your files to volumes that have encryption enabled: http://blog.skylable.com/2014/09/transparency-reports-server... Disclaimer: I'm a co-founder of Skylable

Looks very interesting, I'll have a better look at the product tonight.

Re: OwnCloud Server 8.0

#34

Post by cilantro1994 »

pbhjpbhj wrote: post #26
zimbatm wrote: post #5

Unfortunately OwnCloud is fundamentally broken because all "apps" share the same process and have to be written in PHP. The bigger the ecosystem gets, the harder it is going to be to deal with security issues. If OwnCloud wants to become a reference platform for other developers it really has to tackle sandboxing and permissions.

Is there a better alternative to OwnCloud that doesn't have similar flaws? I'm not being sarcastic, it's fine to say it's broken but that doesn't really make a difference if there are still no better alternatives!?

If you are a home user Tonido (http://www.tonido.com) is a good alternative.

Re: OwnCloud Server 8.0

#35

Post by frabcus »

iancarroll wrote: post #23
Spooky23 wrote: post #15

Earlier quoted context omitted.

> wordpress is in php That pretty much makes the point. 194 vulnerabilities in Wordpress with CVEs in 2014. http://www.cvedetails.com/vulnerability-list/vendor_id-2337/...

I would argue it is the developer writing the code, not the language it's written in.

Tools can help developers write safer code.

Yes, a good developer can write safe code in bad environment. But an average developer writes safer code in a good environment.

Re: OwnCloud Server 8.0

#37

Post by moe »

drzaiusapelord wrote: post #19
mariocesar wrote: post #11

Earlier quoted context omitted.

It's true and is the reason why so many PHP powered CMS are so insecure, how many times do you hear about a new wordpress exploit?

how many times do you hear about a new linux kernel exploit? Pretty much everything is insecure. Writing things in not-php isn't the magical fix you seem to think it is.

What an absurd comparison...

The linux kernel has 16 million lines of code, Wordpress has 300k.

Yet Wordpress[1] has had nearly as many security vulnerabilities as the kernel[2]; 194 vs 257 exploits.

Wordpress is one of the most exploited software packages ever created. It is the textbook example of bad programming.

Just mentioning the kernel when talking about Wordpress is pretty ridiculous.

[1] http://www.cvedetails.com/vulnerability-list/vendor_id-2337/...

[2] http://www.cvedetails.com/vulnerability-list/vendor_id-33/pr...

Re: OwnCloud Server 8.0

#38

Post by jrochkind1 »

vertex-four wrote: post #29
pbhjpbhj wrote: post #26

Earlier quoted context omitted.

Is there a better alternative to OwnCloud that doesn't have similar flaws? I'm not being sarcastic, it's fine to say it's broken but that doesn't really make a difference if there are still no better alternatives!?

Sandstorm, a platform which allows users to run arbitrary applications on a server in a secure sandbox. Of course, OwnCloud is at version 8 and Sandstorm is still working out its permissions UI.

I think they've got different goals.

My impression OwnCloud aims to be a replacement for "the google suite" (not search, but mail, docs, calendar, etc) -- it's really focused at the app layer. I think this is appropriate and there is a need for this.

There's also a need for "a platform which allows users to run arbitrary applications on a server in a secure sandbox", and certainly you can hypothetically build what OwnCloud is aiming at on such a platform. But it's going to take a lot more time and be harder to get right and be reliable and be easy to install and run.

I think OwnCloud is trying to be as easy to install and run as possible, to get a replacement for the google suite wwith apps that work as well as possible and are as easy to use as possible. I think this is a good goal, and they are making reasonable choices toward accomplishing that goal. I am not sure how well they've succeeded.

Re: OwnCloud Server 8.0

#39

Post by vertex-four »

jrochkind1 wrote: post #38
vertex-four wrote: post #29

Earlier quoted context omitted.

Sandstorm, a platform which allows users to run arbitrary applications on a server in a secure sandbox. Of course, OwnCloud is at version 8 and Sandstorm is still working out its permissions UI.

I think they've got different goals. My impression OwnCloud aims to be a replacement for "the google suite" (not search, but mail, docs, calendar, etc) -- it's really focused at the app layer. I think this is appropriate and there is a need for this. There's also a need for "a platform which allows users to run arbitrary applications on a server in a secure sandbox", and certainly you can hypothetically build what Ow…

I believe the point of Sandstorm is to allow people to install mail/docs/calendar apps as simply as possible. It already has multiple document editors ported.

To install apps into Sandstorm, you literally just click on a link - Sandstorm will manage grabbing the app and installing it for you. Sandstorm itself is a self-contained daemon that can run on any Linux server (and, at some point, there'll be an ISO to install an auto-updating Linux with Sandstorm on it).

Re: OwnCloud Server 8.0

#40

Post by pjc50 »

wtbob wrote: post #3

OwnCloud looks pretty neat, but I do wish that it would support client-side encryption; I don't trust a machine I'm renting in a data centre any more than I do Facebook or Google. I'm aware that there (sadly) aren't standards for browser-uploaded encrypted files, sharing encrypted files efficiently and so forth, so it's hardly their fault.

I think for this use case you'd keep the machine at home and reverse-proxy or VPN it to the outside world.
Post reply on HN