OwnCloud Server 8.0

by trampi • 11 years ago

102 78 11 years ago

scottlinux• 11 years ago

wtbob2• 11 years ago

OwnCloud looks pretty neat, but I do wish that it would support client-side encryption; I don't trust a machine I'm renting in a data centre any more than I do Facebook or Google. I'm aware that there (sadly) aren't standards for browser-uploaded encrypted files, sharing encrypted files efficiently and so forth, so it's hardly their fault.

neoeldex• 11 years ago

Can you even trust a machine you built yourself, running at home?

Not saying you're not right being wary, but who can you trust?

Can you trust yourself?

lukifer• 11 years ago

Like so many things, security is a spectrum. Just because an intruder can break your window, doesn't mean you shouldn't lock your front door.

BetaMechazawa• 11 years ago

There is an encryption plugin that gets bundled with owncloud that allows you to encrypt the data stored on the server

ukigumo2• 11 years ago

If your worry is with data at rest, then owncloud already supports it (http://doc.owncloud.org/server/7.0/user_manual/files/encrypt...).

I host my servers with AWS so I use Gluster encrypted bricks with backups to a S3 bucket as well as the built-in encryption capability from Owncloud.

edwintorok• 11 years ago

SX has client-side encryption if you use the SX tools (sxcp) to upload/download your files to volumes that have encryption enabled: http://blog.skylable.com/2014/09/transparency-reports-server...

Disclaimer: I'm a co-founder of Skylable

wtbob2• 11 years ago

Yeah, but:

You don’t have to do anything special, as it uses your ownCloud login as the password for your unique private encryption key.

So the server can decrypt my files at will, since it has access to my plaintext password.

pjc50• 11 years ago

I think for this use case you'd keep the machine at home and reverse-proxy or VPN it to the outside world.

toggle• 11 years ago

They've said that they don't intend to support this because the web interface has features like previewing images and editing ODF docs. So, in order for that to work, the server has to be able to read the actual file. As others have pointed out, there's a plugin for encryption at rest, but that can be decrypted by the server. Sounds like client side encryption is a no-go for the time being.

naiyt• 11 years ago

Have you tried Seafile? It supports client side encryption.

zimbatm2• 11 years ago

Unfortunately OwnCloud is fundamentally broken because all "apps" share the same process and have to be written in PHP. The bigger the ecosystem gets, the harder it is going to be to deal with security issues. If OwnCloud wants to become a reference platform for other developers it really has to tackle sandboxing and permissions.

UnoriginalGuy2• 11 years ago

Just playing devil's advocate, but isn't this true with many CMSs? Most implement "users" (and or groups) either in-house or using the underlying OS, and when it is the underlying OS the CMS needs access to all of the user's files anyway to make cooperation and interoperability work, essentially placing a big bullseye on the CMS system itself.

mariocesar• 11 years ago

It's true and is the reason why so many PHP powered CMS are so insecure, how many times do you hear about a new wordpress exploit?

zimbatm2• 11 years ago

The difference is that OwnCloud is marketed as an operating system and is aimed at holding all the user's personal information. Users who aren't necessarily knowledgeable enough to distinguish trusted and untrusted "applications".

A CMS is usually used by a company and has different threat scenarios. Usually only sysadmins configure and install extensions.

drzaiusapelord3• 11 years ago

and have to be written in PHP.

How is this different than other HN beloved products like Drupal or pretty much any CMS? I can't think of any single one that has proper sandboxing. OwnCloud is just a type of CMS really, but instead of managing HTML, it manages all sorts of filetypes.

orblivion3• 11 years ago

I would argue that the security of what one would put in Owncloud is more important, as an individual, than what one would put into Drupal. But you can correct me on that, I haven't really used a CMS.

finalight• 11 years ago

wordpress is in php

wikipedia is in php

facebook is in php

flickr is in php

photobucket is in php

need i say more?

Spooky23• 11 years ago

wordpress is in php

That pretty much makes the point. 194 vulnerabilities in Wordpress with CVEs in 2014.

http://www.cvedetails.com/vulnerability-list/vendor_id-2337/...

regularfry• 11 years ago

Yes.

benbristow• 11 years ago

I thought Facebook made their own PHP fork type of language.

amirmc• 11 years ago

If we want to do this in a way where everyone can run their own infrastructure then we've got to tackle some of the distributed systems problems. Specifically, life-cycle management of software/apps, how things sync/backup, and issues of identity and connectivity. One method is to take a clean-slate approach and build up a new stack (with its own trade-offs) e.g. Using unikernels as a base http://amirchaudhry.com/brewing-miso-to-serve-nymote/

pbhjpbhj3• 11 years ago

Is there a better alternative to OwnCloud that doesn't have similar flaws?

I'm not being sarcastic, it's fine to say it's broken but that doesn't really make a difference if there are still no better alternatives!?

vertex-four2• 11 years ago

Sandstorm, a platform which allows users to run arbitrary applications on a server in a secure sandbox. Of course, OwnCloud is at version 8 and Sandstorm is still working out its permissions UI.

orblivion3• 11 years ago

For file syncing, this came up on hacker news once upon a time: http://syncthing.net/

biokoda2• 11 years ago

An easy to use and powerful alternative is: http://www.emitcloud.com

davidb_• 11 years ago

The only feature it has is file sharing, but I quite like Seafile: http://seafile.com/en/home/

hbbio3• 11 years ago

Shameless plug, but we use strong static typing to implement PEPS:

https://github.com/MLstate/PEPS

(will be open source AGPLv3, release this month)

hbbio3• 11 years ago

It's still a bit ahead of launch, but we are preparing an open source alternative to OwnCloud (that also includes messaging platform) that acts as an OAuth server for apps/plugins and an API and does not impose all apps to be implemented in the same language. We are using a NodeJS runtime, but the code is generated using a strongly statically typed language, Opa.

Source code is not yet published, will be AGPL.

Docker containers: https://github.com/MLstate/PEPS

atoponce• 11 years ago

It's still a bit ahead of launch, but we are preparing an open source alternative to OwnCloud

OwnCloud is licensed under the AGPLv3. Curious why you think it's not Open Source Software.

drzaiusapelord3• 11 years ago

This is great news. I've been looking for an excuse to move away from my bug-ridden Pydio install. I tried upgrading to the newest version of Pydio only to have the upgrade process completely break the site. OwnCloud just looks better managed and more stable for production.

pgl• 11 years ago

The site seems to be down right now. Here's the text-only Google cache for anyone else who just wants to see what's new:

http://webcache.googleusercontent.com/search?q=cache:ownclou...

majormjr• 11 years ago

Are there any alternatives that have a better syncing mechanism? I really like ownClouds interface but I have encountered a few bugs with syncing files.

jepper• 11 years ago

Bittorent sync? Discoverability and multiple folder syncing has been a problem for me. I would be very interested in a perfect method to track and sync multiple folders on multiple computers

shmerl2• 11 years ago

Too bad it's closed.

pestaa• 11 years ago

Seafile has been flawless for me.

raphman• 11 years ago

Seconded - we have been running Seafile for the last few months with several shared folders. It works flawlessly and is quite fast.

biokoda2• 11 years ago

There is: http://www.emitcloud.com

SilverEdition• 11 years ago

nice solution

ef42• 11 years ago

I highly recommend Syncthing.

c0wb0yc0d3r• 11 years ago

Is forwarding ports required to get syncthing working?

daddykotex• 11 years ago

I use BitTorrent sync on a box and installed ownCloud as the UI to access those files from a browser. It works well.

shmerl2• 11 years ago

Just use any WebDAV share and sync with anything you want like rsync.

stp-ip• 11 years ago

An up to date demo is available at https://demo.owncloud.org.

frabcus2• 11 years ago

I'd love to see a review of this from someone who has tried using it for a while - also compared to Sandstorm which is similar (newer, more sandboxed) https://sandstorm.io/

WA• 11 years ago

Note: I just tried to upgrade the version following the docs. I didn't notice that I read the 7.0 docs for upgrading and there, it says you should download "owncloud-latest.tar.bz2". This will download an old version of ownCloud. Use this link to get it:

https://download.owncloud.org/community/owncloud-8.0.0.tar.b...

state• 11 years ago

Are there any active OwnCloud users out there? I'm curious about your experience.

How do you feel about it? What do you use it for primarily?

dantheta• 11 years ago

I'm running one for calendar syncing (cyanogenmod and iOS clients), personal file storage and as a limited photo gallery. The automatic file sync from my phone is good too. It's running at home on my server. Setup was straightforward, and although I had the odd couple of glitches after setup, it was nothing too major. It's worked out pretty well.

OwnCloud Server 8.0

Related Stories