4 ms·

I don't understand how you could possibly claim the Google Drive is in any way more secure than OwnCloud. Proprietary software hosted in the cloud is inherentl

I don't understand how you could possibly claim the Google Drive is in any way more secure than OwnCloud. Proprietary software hosted in the cloud is inherently unsafe, insecure, and not private. OwnCloud may not be the best piece of software, but it can be audited by anyone and hosted on computers that you trust. You have no idea if Google Drive is secure because it is impossible for you audit it.

jqm 11y ago
I use OwnCloud but I'm hopeful a better version in something like Python emerges soon. Have to agree with OP (who did audit the code as you suggest). PHP OwnCloud feels a bit like a janky duck taped mess. I'm always a bit surprised it works and it doesn't make me feel a whole lot more secure than using a provider like MS, Dropbox or Google. I just like running my own stuff which is why I use it.
- bildung 11y ago
  > I use OwnCloud but I'm hopeful a better version in something like Python emerges soon. The web interface of Seafile (https://github.com/haiwen/seafile https://github.com/haiwen/seafile) is written in Python/Django. The server is C, though.
dredmorbius 11y ago
Implication is that OP has audited source and found it wanting. Threat models and risks vary. SAAS offers aggregated data and appealing targets, though they may be well hardened. Much as I criticise Google, I find their claims of protecting data reasonably credible (not enough to be comfortable with it). A distributed system with many known and unknown vulnerabilities and a readily determined network signature (nmap or similar) remains a bulk source. A determined adversary could scan all possible network space quite quickly and access data. With known targets -- monitoring your network traffic, knowing URLs or MXs -- they could target you directly. NB: I haven't audited OwnClowd, nor am I particularly qualified to do so.
- davexunit 11y ago
  But you can't audit Google Drive. If it's not free software, then it cannot be trusted.
  - dredmorbius 11y ago
    Fair point, though not strictly true. It's possible to conduct both audits and black-box testing of proprietary systems, and some of these provide source fairly liberally. Microsoft provides examples of both. Samba's Andrew Tridgell has commented that the team knows many ways to crash or compromise Windows systems. Microsoft's academic code licensing provided pretty liberal access to OS source code. Similarly corporate partner licensing for contractors. Though security didn't exactly thrive under that regime... PGP is another company that provided core crypto code for public review, though it wasn't Free Software.
runjake 11y ago
You didn't even read my comment before commenting, did you? > I don't understand how you could possibly claim the Google Drive is in any way more secure than OwnCloud. It depends on your threat model. Against the US? It's wise to assume it's game over, no matter what you do, here. Foreign state actors? ownCloud is seriously pwnable. not quite so with Google services (unless that foreign gov't has an intelligence sharing agreement with Google) Criminals? Again, ownCloud is seriously pwnable. I'm a US citizen, so I'm primarily concerned with foreign and criminal actors (knowing that it's game over versus US intelligence), therefore ownCloud does not fit my threat model.
jlarocco 11y ago
I've been trying to stop using Google products, but I have to admit most of their web services are probably about as secure as you're going to get. Google has some of the smartest tech people in the world working for them, and everything I've seen tells me they take security seriously. If they're doing it wrong, I'm scared to think about other companies. As far as I know, most people who quit Google do it because they dislike Google mining their data, not because they don't think Google is secure.

jqm 11y ago

I use OwnCloud but I'm hopeful a better version in something like Python emerges soon. Have to agree with OP (who did audit the code as you suggest). PHP OwnCloud feels a bit like a janky duck taped mess. I'm always a bit surprised it works and it doesn't make me feel a whole lot more secure than using a provider like MS, Dropbox or Google. I just like running my own stuff which is why I use it.

bildung 11y ago
> I use OwnCloud but I'm hopeful a better version in something like Python emerges soon. The web interface of Seafile (https://github.com/haiwen/seafile https://github.com/haiwen/seafile) is written in Python/Django. The server is C, though.

dredmorbius 11y ago

Implication is that OP has audited source and found it wanting. Threat models and risks vary. SAAS offers aggregated data and appealing targets, though they may be well hardened. Much as I criticise Google, I find their claims of protecting data reasonably credible (not enough to be comfortable with it). A distributed system with many known and unknown vulnerabilities and a readily determined network signature (nmap or similar) remains a bulk source. A determined adversary could scan all possible network space quite quickly and access data. With known targets -- monitoring your network traffic, knowing URLs or MXs -- they could target you directly. NB: I haven't audited OwnClowd, nor am I particularly qualified to do so.

davexunit 11y ago
But you can't audit Google Drive. If it's not free software, then it cannot be trusted.
- dredmorbius 11y ago
  Fair point, though not strictly true. It's possible to conduct both audits and black-box testing of proprietary systems, and some of these provide source fairly liberally. Microsoft provides examples of both. Samba's Andrew Tridgell has commented that the team knows many ways to crash or compromise Windows systems. Microsoft's academic code licensing provided pretty liberal access to OS source code. Similarly corporate partner licensing for contractors. Though security didn't exactly thrive under that regime... PGP is another company that provided core crypto code for public review, though it wasn't Free Software.

runjake 11y ago

You didn't even read my comment before commenting, did you? > I don't understand how you could possibly claim the Google Drive is in any way more secure than OwnCloud. It depends on your threat model. Against the US? It's wise to assume it's game over, no matter what you do, here. Foreign state actors? ownCloud is seriously pwnable. not quite so with Google services (unless that foreign gov't has an intelligence sharing agreement with Google) Criminals? Again, ownCloud is seriously pwnable. I'm a US citizen, so I'm primarily concerned with foreign and criminal actors (knowing that it's game over versus US intelligence), therefore ownCloud does not fit my threat model.

jlarocco 11y ago

I've been trying to stop using Google products, but I have to admit most of their web services are probably about as secure as you're going to get. Google has some of the smartest tech people in the world working for them, and everything I've seen tells me they take security seriously. If they're doing it wrong, I'm scared to think about other companies. As far as I know, most people who quit Google do it because they dislike Google mining their data, not because they don't think Google is secure.