Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OwnCloud Server 8.0

owncloud.org

Post reply on HN
Print view View original

71–80 of 80 posts

Re: OwnCloud Server 8.0

#71

Post by maratd »

xorcist wrote: post #67
maratd wrote: post #63

Earlier quoted context omitted.

> Do you think SSH, Postfix, nginx, Apache & Co don't get the same amount of scrutiny? NO! Because they're behind a firewall AND each operates on a very restricted protocol! It has nothing to do with quality of codebase. If Wordpress was behind a firewall and only restricted to text-based input per spec, you wouldn't find many vulnerabilities either. > What does "web based" have to do with anything? Because "web base…

If you think that sshd gets restricted to "text-based input per spec", you should get out more. Or at least check your logs more.

My logs are clean. Because sshd is restricted to specific ip ranges. Ever hear of a firewall? Apparently the other guy on this thread hasn't either.

Re: OwnCloud Server 8.0

#72

Post by adrusi »

benbristow wrote: post #46
finalight wrote: post #14

Earlier quoted context omitted.

wordpress is in php wikipedia is in php facebook is in php flickr is in php photobucket is in php need i say more?

I thought Facebook made their own PHP fork type of language.

yeah, to say Facebook is written in PHP is misleading. Facebook was originally written in PHP. Now it runs on the HHVM, which foregoes supporting the dangerous parts of the PHP stdlib, and offers better performance (fixing the two biggest problems with PHP). As I understand, much of their new code is written in Hack which interoperates with their legacy PHP code but supports gradual typing and other safety features (and some niceties).

Facebook is written in PHP, but they have invested a lot into making their PHP not be PHP.

Re: OwnCloud Server 8.0

#73

Post by bestham »

atoponce wrote: post #57
hbbio wrote: post #41

Earlier quoted context omitted.

It's still a bit ahead of launch, but we are preparing an open source alternative to OwnCloud (that also includes messaging platform) that acts as an OAuth server for apps/plugins and an API and does not impose all apps to be implemented in the same language. We are using a NodeJS runtime, but the code is generated using a strongly statically typed language, Opa. Source code is not yet published, will be AGPL. Docker…

> It's still a bit ahead of launch, but we are preparing an open source alternative to OwnCloud OwnCloud is licensed under the AGPLv3. Curious why you think it's not Open Source Software.

FreeBSD is an open source alternative to Linux. Not saying that Linux is closed source.

Re: OwnCloud Server 8.0

#74

Post by cthalupa »

maratd wrote: post #70
moe wrote: post #66

Earlier quoted context omitted.

NO! Because they're behind a firewall Huh? SSH, Postfix and nginx are usually not firewalled. Because "web based" is the client. It has to be flexible and with flexibility... If "flexibility and complexity equal vulnerability" then why does the linux kernel, 53x the size of Wordpress and a tad more complex than a CMS, not have about 53x more exploits? And why does no other CMS system or framework come even close to t…

> And why does no other CMS system or framework come even close to the number of critical vulnerabilities in Wordpress? Because no other CMS or framework has as many deployments. Not even close. > If "flexibility and complexity equal vulnerability" then why does the linux kernel, 53x the size of Wordpress and a tad more complex than a CMS, not have about 53x more exploits? Because it's behind a firewall. Do I really…

>If you're not restricting access to SSH using a firewall, then you're a bigger idiot than I thought you were.

I'm not sure name calling is really appropriate here. Yes, firewalling stuff is certainly appropriate, particularly administrative things, but key based auth is pretty secure, firewall or no.

You're also nitpicking on a single point when he mentions other things that are definitely not usually firewalled. Your mail and web servers are generally open to the world, regardless of whether or not SSH is.

Re: OwnCloud Server 8.0

#76

Post by dantheta »

state wrote: post #69

Are there any active OwnCloud users out there? I'm curious about your experience. How do you feel about it? What do you use it for primarily?

I'm running one for calendar syncing (cyanogenmod and iOS clients), personal file storage and as a limited photo gallery. The automatic file sync from my phone is good too. It's running at home on my server. Setup was straightforward, and although I had the odd couple of glitches after setup, it was nothing too major. It's worked out pretty well.

Re: OwnCloud Server 8.0

#77

Post by pbhjpbhj »

IshKebab wrote: post #61
pbhjpbhj wrote: post #24

Earlier quoted context omitted.

That list appears to include CVE going back to 2006 at least. I count 17 in 2014, the highest rated of which is an arbitrary code exectution (CVE-2014-5203) rated 7.5. Not sure number of disclosed flaws is a good metric to look at, whether it's high or low.

Arbitrary code execution is pretty damn bad. Anyway he wasn't just counting vulnerabilities. Wordpress is renowned for its terrible security (or plugins with terrible security often).

I avoided making any value judgement on purpose - you can't really do that off-the-cuff. Looking at the reports (linked here, [0]) it concerns hash checks on serialised widgets. The apparent vulnerability was reported by the Wordpress security team and reported as being hard to actually make work - I can't find a PoC or any actual exploit reports. It seems based on [1] that a fix was submitted 2 months before the report and made available to automatic updaters a few days prior (? I'm not sure how the reporting dates and such work here really, on a superficial view that's right though the bug is 2014-08-13 and the fix 2014-06-08 with the report of the update [2] coming 2014-08-06). So, whilst yes an arbitrary code execution is severe one that is fixed before it's made public and without any clear way to exploit it is perhaps less of an issue than it first appears. But then of course the number of installs mean you can very likely find vulnerable installs in the wild even today.

TL;DR simple statistics don't really seem to work well in providing a proper view of comparative levels of security of web apps.

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5203

[1] https://core.trac.wordpress.org/changeset/29389

[2] https://wordpress.org/news/2014/08/wordpress-3-9-2/

Re: OwnCloud Server 8.0

#78

Post by ef4 »

c0wb0yc0d3r wrote: post #75
ef4 wrote: post #28

Earlier quoted context omitted.

I highly recommend Syncthing.

Is forwarding ports required to get syncthing working?

Often not. It can do UPnP automatically. But in my case I don't even need that, because I just run a dedicated server node with a public IP, and everybody else can sync via that.

Re: OwnCloud Server 8.0

#80

Post by wtbob »

ukigumo wrote: post #13
wtbob wrote: post #3

OwnCloud looks pretty neat, but I do wish that it would support client-side encryption; I don't trust a machine I'm renting in a data centre any more than I do Facebook or Google. I'm aware that there (sadly) aren't standards for browser-uploaded encrypted files, sharing encrypted files efficiently and so forth, so it's hardly their fault.

If your worry is with data at rest, then owncloud already supports it ( http://doc.owncloud.org/server/7.0/user_manual/files/encrypt... ). I host my servers with AWS so I use Gluster encrypted bricks with backups to a S3 bucket as well as the built-in encryption capability from Owncloud.

Yeah, but:

> You don’t have to do anything special, as it uses your ownCloud login as the password for your unique private encryption key.

So the server can decrypt my files at will, since it has access to my plaintext password.

Post reply on HN