Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OwnCloud Server 8.0

owncloud.org

Post reply on HN
Print view View original

41–50 of 80 posts

Re: OwnCloud Server 8.0

#41

Post by hbbio »

zimbatm wrote: post #5

Unfortunately OwnCloud is fundamentally broken because all "apps" share the same process and have to be written in PHP. The bigger the ecosystem gets, the harder it is going to be to deal with security issues. If OwnCloud wants to become a reference platform for other developers it really has to tackle sandboxing and permissions.

It's still a bit ahead of launch, but we are preparing an open source alternative to OwnCloud (that also includes messaging platform) that acts as an OAuth server for apps/plugins and an API and does not impose all apps to be implemented in the same language. We are using a NodeJS runtime, but the code is generated using a strongly statically typed language, Opa.

Source code is not yet published, will be AGPL.

Docker containers: https://github.com/MLstate/PEPS

Re: OwnCloud Server 8.0

#42

Post by WA »

Note: I just tried to upgrade the version following the docs. I didn't notice that I read the 7.0 docs for upgrading and there, it says you should download "owncloud-latest.tar.bz2". This will download an old version of ownCloud. Use this link to get it:

https://download.owncloud.org/community/owncloud-8.0.0.tar.b...

Re: OwnCloud Server 8.0

#43

Post by daddykotex »

majormjr wrote: post #18

Are there any alternatives that have a better syncing mechanism? I really like ownClouds interface but I have encountered a few bugs with syncing files.

I use BitTorrent sync on a box and installed ownCloud as the UI to access those files from a browser. It works well.

Re: OwnCloud Server 8.0

#44

Post by jordanlev »

moe wrote: post #37
drzaiusapelord wrote: post #19

Earlier quoted context omitted.

how many times do you hear about a new linux kernel exploit? Pretty much everything is insecure. Writing things in not-php isn't the magical fix you seem to think it is.

What an absurd comparison... The linux kernel has 16 million lines of code, Wordpress has 300k. Yet Wordpress[1] has had nearly as many security vulnerabilities as the kernel[2]; 194 vs 257 exploits. Wordpress is one of the most exploited software packages ever created. It is the textbook example of bad programming. Just mentioning the kernel when talking about Wordpress is pretty ridiculous. [1] http://www.cvedetail…

I am no fan of wordpress, and I agree that it is a textbook example of bad programming... but it is also a textbook example of good community management and success at empowering non-programmers to have their own web presence. And I believe that the amount of exploits has as much to do (if not moreso) with its sheer popularity as it does with the code.

Re: OwnCloud Server 8.0

#45

Post by maratd »

moe wrote: post #37
drzaiusapelord wrote: post #19

Earlier quoted context omitted.

how many times do you hear about a new linux kernel exploit? Pretty much everything is insecure. Writing things in not-php isn't the magical fix you seem to think it is.

What an absurd comparison... The linux kernel has 16 million lines of code, Wordpress has 300k. Yet Wordpress[1] has had nearly as many security vulnerabilities as the kernel[2]; 194 vs 257 exploits. Wordpress is one of the most exploited software packages ever created. It is the textbook example of bad programming. Just mentioning the kernel when talking about Wordpress is pretty ridiculous. [1] http://www.cvedetail…

> Wordpress is one of the most exploited software packages ever created.

Hyperbole much?

It's one of the most popular software packages installed on the web. It's not surprising it has a lot of eyes on it.

Re: OwnCloud Server 8.0

#46

Post by benbristow »

finalight wrote: post #14
zimbatm wrote: post #5

Unfortunately OwnCloud is fundamentally broken because all "apps" share the same process and have to be written in PHP. The bigger the ecosystem gets, the harder it is going to be to deal with security issues. If OwnCloud wants to become a reference platform for other developers it really has to tackle sandboxing and permissions.

wordpress is in php wikipedia is in php facebook is in php flickr is in php photobucket is in php need i say more?

I thought Facebook made their own PHP fork type of language.

Re: OwnCloud Server 8.0

#47

Post by moe »

maratd wrote: post #45
moe wrote: post #37

Earlier quoted context omitted.

What an absurd comparison... The linux kernel has 16 million lines of code, Wordpress has 300k. Yet Wordpress[1] has had nearly as many security vulnerabilities as the kernel[2]; 194 vs 257 exploits. Wordpress is one of the most exploited software packages ever created. It is the textbook example of bad programming. Just mentioning the kernel when talking about Wordpress is pretty ridiculous. [1] http://www.cvedetail…

> Wordpress is one of the most exploited software packages ever created. Hyperbole much? It's one of the most popular software packages installed on the web. It's not surprising it has a lot of eyes on it.

This has nothing to do with eyes.

Dozens of other packages have a much larger install base than Wordpress.

Wordpress has 32(!) CVE's tagged with "Exec Code" (remote code execution) alone. The last one a mere 6 months old.

If you know another project that comes even remotely close to that then I'd be genuinely curious which one that would be?

Re: OwnCloud Server 8.0

#48

Post by orblivion »

vertex-four wrote: post #29
pbhjpbhj wrote: post #26

Earlier quoted context omitted.

Is there a better alternative to OwnCloud that doesn't have similar flaws? I'm not being sarcastic, it's fine to say it's broken but that doesn't really make a difference if there are still no better alternatives!?

Sandstorm, a platform which allows users to run arbitrary applications on a server in a secure sandbox. Of course, OwnCloud is at version 8 and Sandstorm is still working out its permissions UI.

I think Sandstorm in principle is the sort of thing that would run and deploy Owncloud. It doesn't happen to have it in its list of apps at the moment. Similarly there's indieboxproject.org, which has a lot fewer apps, but it does support Owncloud.

Re: OwnCloud Server 8.0

#49

Post by orblivion »

pbhjpbhj wrote: post #26
zimbatm wrote: post #5

Unfortunately OwnCloud is fundamentally broken because all "apps" share the same process and have to be written in PHP. The bigger the ecosystem gets, the harder it is going to be to deal with security issues. If OwnCloud wants to become a reference platform for other developers it really has to tackle sandboxing and permissions.

Is there a better alternative to OwnCloud that doesn't have similar flaws? I'm not being sarcastic, it's fine to say it's broken but that doesn't really make a difference if there are still no better alternatives!?

For file syncing, this came up on hacker news once upon a time: http://syncthing.net/

Re: OwnCloud Server 8.0

#50

Post by orblivion »

drzaiusapelord wrote: post #10
zimbatm wrote: post #5

Unfortunately OwnCloud is fundamentally broken because all "apps" share the same process and have to be written in PHP. The bigger the ecosystem gets, the harder it is going to be to deal with security issues. If OwnCloud wants to become a reference platform for other developers it really has to tackle sandboxing and permissions.

>and have to be written in PHP. How is this different than other HN beloved products like Drupal or pretty much any CMS? I can't think of any single one that has proper sandboxing. OwnCloud is just a type of CMS really, but instead of managing HTML, it manages all sorts of filetypes.

I would argue that the security of what one would put in Owncloud is more important, as an individual, than what one would put into Drupal. But you can correct me on that, I haven't really used a CMS.
Post reply on HN