Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OwnCloud Server 8.0

owncloud.org

Post reply on HN
Print view View original

61–70 of 80 posts

Re: OwnCloud Server 8.0

#61

Post by IshKebab »

pbhjpbhj wrote: post #24
Spooky23 wrote: post #15

Earlier quoted context omitted.

> wordpress is in php That pretty much makes the point. 194 vulnerabilities in Wordpress with CVEs in 2014. http://www.cvedetails.com/vulnerability-list/vendor_id-2337/...

That list appears to include CVE going back to 2006 at least. I count 17 in 2014, the highest rated of which is an arbitrary code exectution (CVE-2014-5203) rated 7.5. Not sure number of disclosed flaws is a good metric to look at, whether it's high or low.

Arbitrary code execution is pretty damn bad. Anyway he wasn't just counting vulnerabilities. Wordpress is renowned for its terrible security (or plugins with terrible security often).

Re: OwnCloud Server 8.0

#62

Post by moe »

maratd wrote: post #60
moe wrote: post #47

Earlier quoted context omitted.

This has nothing to do with eyes. Dozens of other packages have a much larger install base than Wordpress. Wordpress has 32(!) CVE's tagged with "Exec Code" (remote code execution) alone. The last one a mere 6 months old. If you know another project that comes even remotely close to that then I'd be genuinely curious which one that would be?

> This has nothing to do with eyes. Yeah, it does. You can write a crappy piece of software that nobody uses and because nobody has interest in it, it has no known security issues! Big deal. I'm not saying that Wordpress has a great code-base or that there's no correlation, but that popularity is a substantial variable in that equation. > Dozens of other packages have a much larger install base than Wordpress. Name o…

Name one web based software suite that's installed more often.

What does "web based" have to do with anything?

Do you think SSH, Postfix, nginx, Apache & Co don't get the same amount of scrutiny? Each of them has a significantly larger install base than Wordpress.

Re: OwnCloud Server 8.0

#63

Post by maratd »

moe wrote: post #62
maratd wrote: post #60

Earlier quoted context omitted.

> This has nothing to do with eyes. Yeah, it does. You can write a crappy piece of software that nobody uses and because nobody has interest in it, it has no known security issues! Big deal. I'm not saying that Wordpress has a great code-base or that there's no correlation, but that popularity is a substantial variable in that equation. > Dozens of other packages have a much larger install base than Wordpress. Name o…

Name one web based software suite that's installed more often. What does "web based" have to do with anything? Do you think SSH, Postfix, nginx, Apache & Co don't get the same amount of scrutiny? Each of them has a significantly larger install base than Wordpress.

> Do you think SSH, Postfix, nginx, Apache & Co don't get the same amount of scrutiny?

NO! Because they're behind a firewall AND each operates on a very restricted protocol! It has nothing to do with quality of codebase. If Wordpress was behind a firewall and only restricted to text-based input per spec, you wouldn't find many vulnerabilities either.

> What does "web based" have to do with anything?

Because "web based" is the client. It has to be flexible and with flexibility, comes complexity, and with complexity come exploits.

Try getting a CRM going on Postfix or all the myriad other things Wordpress is being used for.

Re: OwnCloud Server 8.0

#64

Post by ocdtrekkie »

jrochkind1 wrote: post #38
vertex-four wrote: post #29

Earlier quoted context omitted.

Sandstorm, a platform which allows users to run arbitrary applications on a server in a secure sandbox. Of course, OwnCloud is at version 8 and Sandstorm is still working out its permissions UI.

I think they've got different goals. My impression OwnCloud aims to be a replacement for "the google suite" (not search, but mail, docs, calendar, etc) -- it's really focused at the app layer. I think this is appropriate and there is a need for this. There's also a need for "a platform which allows users to run arbitrary applications on a server in a secure sandbox", and certainly you can hypothetically build what Ow…

I've been moving my Drive sheets over to EtherCalc on Sandstorm and all of my new documents I write on Etherpad for Sandstorm. Draw.io also just released for Sandstorm, which is one of Google Drive's original third party apps.

Re: OwnCloud Server 8.0

#65

Post by ocdtrekkie »

orblivion wrote: post #48
vertex-four wrote: post #29

Earlier quoted context omitted.

Sandstorm, a platform which allows users to run arbitrary applications on a server in a secure sandbox. Of course, OwnCloud is at version 8 and Sandstorm is still working out its permissions UI.

I think Sandstorm in principle is the sort of thing that would run and deploy Owncloud. It doesn't happen to have it in its list of apps at the moment. Similarly there's indieboxproject.org, which has a lot fewer apps, but it does support Owncloud.

The issue there is that ownCloud and Sandstorm share a lot of goals and functionality. Both are meant to be app platforms in a respect. And both are meant to organize your personal data. Since Sandstorm wants every file to be a granular document, putting the entirely of ownCloud in a file would be kinda odd. It'll likely happen sooner or later though.

Re: OwnCloud Server 8.0

#66

Post by moe »

maratd wrote: post #63
moe wrote: post #62

Earlier quoted context omitted.

Name one web based software suite that's installed more often. What does "web based" have to do with anything? Do you think SSH, Postfix, nginx, Apache & Co don't get the same amount of scrutiny? Each of them has a significantly larger install base than Wordpress.

> Do you think SSH, Postfix, nginx, Apache & Co don't get the same amount of scrutiny? NO! Because they're behind a firewall AND each operates on a very restricted protocol! It has nothing to do with quality of codebase. If Wordpress was behind a firewall and only restricted to text-based input per spec, you wouldn't find many vulnerabilities either. > What does "web based" have to do with anything? Because "web base…

NO! Because they're behind a firewall

Huh? SSH, Postfix and nginx are usually not firewalled.

Because "web based" is the client. It has to be flexible and with flexibility...

If "flexibility and complexity equal vulnerability" then why does the linux kernel, 53x the size of Wordpress and a tad more complex than a CMS, not have about 53x more exploits?

And why does no other CMS system or framework come even close to the number of critical vulnerabilities in Wordpress?

Re: OwnCloud Server 8.0

#67

Post by xorcist »

maratd wrote: post #63
moe wrote: post #62

Earlier quoted context omitted.

Name one web based software suite that's installed more often. What does "web based" have to do with anything? Do you think SSH, Postfix, nginx, Apache & Co don't get the same amount of scrutiny? Each of them has a significantly larger install base than Wordpress.

> Do you think SSH, Postfix, nginx, Apache & Co don't get the same amount of scrutiny? NO! Because they're behind a firewall AND each operates on a very restricted protocol! It has nothing to do with quality of codebase. If Wordpress was behind a firewall and only restricted to text-based input per spec, you wouldn't find many vulnerabilities either. > What does "web based" have to do with anything? Because "web base…

If you think that sshd gets restricted to "text-based input per spec", you should get out more. Or at least check your logs more.

Re: OwnCloud Server 8.0

#68

Post by tankenmate »

UnoriginalGuy wrote: post #17
mariocesar wrote: post #11

Earlier quoted context omitted.

It's true and is the reason why so many PHP powered CMS are so insecure, how many times do you hear about a new wordpress exploit?

It really has nothing to do with PHP. Changing the language or framework wouldn't inherently change the design. e.g. http://www.cvedetails.com/vulnerability-list/vendor_id-26/pr...

Having said that PHP does make it very hard to run each interpreter process as the user it is doing work on behalf of. Some of the best systems out there run each user's process under it's own uid:gid (or equivalent), and each user has their own filespace and/or database. Obviously this pushes the separation issues down to the OS kernel rather than in the app, but most widely used OS kernels get at least an order of magnitude more, most of the time several orders more, testing for these user separation security features. NIH, re-inventing the wheel and all that.

Re: OwnCloud Server 8.0

#69

Post by state »

Are there any active OwnCloud users out there? I'm curious about your experience.

How do you feel about it? What do you use it for primarily?

Re: OwnCloud Server 8.0

#70

Post by maratd »

moe wrote: post #66
maratd wrote: post #63

Earlier quoted context omitted.

> Do you think SSH, Postfix, nginx, Apache & Co don't get the same amount of scrutiny? NO! Because they're behind a firewall AND each operates on a very restricted protocol! It has nothing to do with quality of codebase. If Wordpress was behind a firewall and only restricted to text-based input per spec, you wouldn't find many vulnerabilities either. > What does "web based" have to do with anything? Because "web base…

NO! Because they're behind a firewall Huh? SSH, Postfix and nginx are usually not firewalled. Because "web based" is the client. It has to be flexible and with flexibility... If "flexibility and complexity equal vulnerability" then why does the linux kernel, 53x the size of Wordpress and a tad more complex than a CMS, not have about 53x more exploits? And why does no other CMS system or framework come even close to t…

> And why does no other CMS system or framework come even close to the number of critical vulnerabilities in Wordpress?

Because no other CMS or framework has as many deployments. Not even close.

> If "flexibility and complexity equal vulnerability" then why does the linux kernel, 53x the size of Wordpress and a tad more complex than a CMS, not have about 53x more exploits?

Because it's behind a firewall. Do I really need to keep repeating myself?

If I could send remote commands to your kernel, don't you think there would be a few more exploits kicking around?

> Huh? SSH, Postfix and nginx are usually not firewalled.

If you're not restricting access to SSH using a firewall, then you're a bigger idiot than I thought you were.

Post reply on HN