6 ms·

I've installed and abandoned ownCloud several times, mostly because it is far too heavy for what I need and I had concerns about its security. I also had to set

I've installed and abandoned ownCloud several times, mostly because it is far too heavy for what I need and I had concerns about its security. I also had to set up EncFS on my local machines for client-side encryption of sensitive files because there was no way I was trusting that to ownCloud server-side. It took more work to set up but I have Seafile self-hosted on the smallest DigitalOcean VPS and it works beautifully. $5/month, plenty of space for the amount of files I need to sync across machines, and my data is in Germany which is great (I'm in Europe). Native client-side encryption is built-in to the client so I have an easier configuration on local machines, and it does most of what I need. I'm still looking for a good self-hosted CalDAV/CardDAV option that doesn't require PHP or MySQL, but as this data is less sensitive I'm happy to trust it to FastMail for now.

vincentkriek 11y ago
> I also had to set up EncFS on my local machines for client-side encryption of sensitive files because there was no way I was trusting that to ownCloud server-side. Did you host OwnCloud yourself? But you didn't trust the software with your files? In what way is the SeaFile solution you are running now more trustworthy? > I'm still looking for a good self-hosted CalDAV/CardDAV option that doesn't require PHP or MySQL, but as this data is less sensitive I'm happy to trust it to FastMail for now. http://radicale.org/ http://radicale.org/ is exactly what you are looking for.
- deleted 11y ago
  [deleted]
- tombrossman 11y ago
  > Did you host OwnCloud yourself? Yes, I prefer to self-host anything I can. I'm lucky to have a gigabit FTTH connection and moving lots of data around is no problem. I still prefer to use a remote VPS because some things are best left to the pros. > But you didn't trust the software with your files? In what way is the SeaFile solution you are running now more trustworthy? Seafile has a much smaller attack surface (no PHP, MySQL not required, etc) and handles the client-side encryption itself. We are discussing degrees of trust here, so while I was happy to trust ownCloud and the VPS to be there for a request, and to not corrupt my data, I didn't trust that my sensitive data was safe if the server was compromised. EncFS was a workaround, but it cluttered up Nautilus with extra drives since every encrypted directory had to be mounted as a drive. Now I'm comfortable trusting Seafile to do all that because an attacker would need to compromise both my VPS and my local machine to gain access to sensitive data. This is orders of magnitude less likely and for me is an acceptable risk, especially considering the simpler software stack. And I'm definitely checking out radicale, thanks for the tip. If it does contact photo sync (annoyingly not currently supported my FastMail CardDAV) I'll give it a try.
  - pjc50 11y ago
    When I was reviewing alternatives, syncany's web page claimed that seafile has a poor security record: https://github.com/syncany/syncany/wiki/Comparison:-Syncany-vs.-X https://github.com/syncany/syncany/wiki/Comparison:-Syncany-... I'm not sure how seriously to take this.
    - tombrossman 11y ago
      I nearly went with Syncany, they were a very close second but they are still in alpha, plus they have no mobile apps (yet). I really like being able to take a photo with my phone and have it sync to my computer. Development on Seafile is very active and they are transparent about security issues. I don't think it is poorly written but maybe a third-party audit like Truecrypt did is a good idea. Here's their 'Records of security issues' page: https://seacloud.cc/group/3/wiki/security-records/ https://seacloud.cc/group/3/wiki/security-records/
      - LukasReschke 11y ago
        > Here's their 'Records of security issues' page: https://seacloud.cc/group/3/wiki/security-records/ https://seacloud.cc/group/3/wiki/security-records/ Just take a look who reported their recent issue allowing a lot of attack vectors. (more than they mentioned though) :) Actually if somebody had a local user account themselves they could bruteforce the secret key in seconds. And SeaFile has additionally modified the default Django components making it more insecure: https://github.com/haiwen/seahub/commit/7cdb70368aa7acbf05461e22e83278b00c2036c8 https://github.com/haiwen/seahub/commit/7cdb70368aa7acbf0546... By the way, ownCloud does run a Bug Bounty: https://hackerone.com/owncloud https://hackerone.com/owncloud
        gingerlime 11y ago
        On mobile so please excuse me if I missed something subtle, but what's more insecure about this change? From what I know constant time compare protects against timing side channel attacks, so isn't it improving security here?
- deleted 11y ago
  [deleted]
- StavrosK 11y ago
  Thanks for radicale! I switched to it from Google Calendar and Contacts. The git integration is amazing.
zaggynl 11y ago
How do you update Seafile? I've found the manual update process to be somewhat unwieldy. (I'm spoiled by package managers)
- tombrossman 11y ago
  You update manually via SSH. It's a bit more tedious than a package manager but not too bad. It took me a while to wrap my head around their file layout and how they do things, but I have it figured out now and updating takes a couple minutes. I can have two SSH terminals open on the same machine and by the time the first one completes `apt-get update && apt-get -y upgrade` I'm nearly done with the Seafile update. I really don't like adding third-party PPAs so I'll probably stick with this method for a while even if someone manages to package it up.
NoGravitas 11y ago
I run ownCloud, despite some reservations about its security. I'm not too concerned about the data in ownCloud itself (if it's private, then I encrypt it client-side, but most things I put in ownCloud are not very private). I'm more concerned about it being used as a launching point for an attack on my home server. As a kind of compromise, I'm running it in a VM.
- LukasReschke 11y ago
  > I run ownCloud, despite some reservations about its security. I'm not too concerned about the data in ownCloud itself (if it's private, then I encrypt it client-side, but most things I put in ownCloud are not very private). I'm more concerned about it being used as a launching point for an attack on my home server. As a kind of compromise, I'm running it in a VM. ownCloud does run a bug bounty program (https://hackerone.com/owncloud https://hackerone.com/owncloud) and the company supporting the project also employs internal security experts. You might also want to read https://statuscode.ch/2015/09/ownCloud-security-development-over-the-years/ https://statuscode.ch/2015/09/ownCloud-security-development-... which covers why comparing CVEs is not a reliably way to compare the security of products.
tdkl 11y ago
> I'm still looking for a good self-hosted CalDAV/CardDAV option that doesn't require PHP or MySQL Baikal is PHP, but can run on sqlite instead of MySQL : http://baikal-server.com/ http://baikal-server.com/
dualboot 11y ago
I feel the same way about owncloud and most of the currently available webdav/filesync self-hosted options. My compromise for the most part is having all of those services walled off behind vpn.

vincentkriek 11y ago

> I also had to set up EncFS on my local machines for client-side encryption of sensitive files because there was no way I was trusting that to ownCloud server-side. Did you host OwnCloud yourself? But you didn't trust the software with your files? In what way is the SeaFile solution you are running now more trustworthy? > I'm still looking for a good self-hosted CalDAV/CardDAV option that doesn't require PHP or MySQL, but as this data is less sensitive I'm happy to trust it to FastMail for now. http://radicale.org/ http://radicale.org/ is exactly what you are looking for.

deleted 11y ago
[deleted]
tombrossman 11y ago
> Did you host OwnCloud yourself? Yes, I prefer to self-host anything I can. I'm lucky to have a gigabit FTTH connection and moving lots of data around is no problem. I still prefer to use a remote VPS because some things are best left to the pros. > But you didn't trust the software with your files? In what way is the SeaFile solution you are running now more trustworthy? Seafile has a much smaller attack surface (no PHP, MySQL not required, etc) and handles the client-side encryption itself. We are discussing degrees of trust here, so while I was happy to trust ownCloud and the VPS to be there for a request, and to not corrupt my data, I didn't trust that my sensitive data was safe if the server was compromised. EncFS was a workaround, but it cluttered up Nautilus with extra drives since every encrypted directory had to be mounted as a drive. Now I'm comfortable trusting Seafile to do all that because an attacker would need to compromise both my VPS and my local machine to gain access to sensitive data. This is orders of magnitude less likely and for me is an acceptable risk, especially considering the simpler software stack. And I'm definitely checking out radicale, thanks for the tip. If it does contact photo sync (annoyingly not currently supported my FastMail CardDAV) I'll give it a try.
- pjc50 11y ago
  When I was reviewing alternatives, syncany's web page claimed that seafile has a poor security record: https://github.com/syncany/syncany/wiki/Comparison:-Syncany-vs.-X https://github.com/syncany/syncany/wiki/Comparison:-Syncany-... I'm not sure how seriously to take this.
  - tombrossman 11y ago
    I nearly went with Syncany, they were a very close second but they are still in alpha, plus they have no mobile apps (yet). I really like being able to take a photo with my phone and have it sync to my computer. Development on Seafile is very active and they are transparent about security issues. I don't think it is poorly written but maybe a third-party audit like Truecrypt did is a good idea. Here's their 'Records of security issues' page: https://seacloud.cc/group/3/wiki/security-records/ https://seacloud.cc/group/3/wiki/security-records/
    - LukasReschke 11y ago
      > Here's their 'Records of security issues' page: https://seacloud.cc/group/3/wiki/security-records/ https://seacloud.cc/group/3/wiki/security-records/ Just take a look who reported their recent issue allowing a lot of attack vectors. (more than they mentioned though) :) Actually if somebody had a local user account themselves they could bruteforce the secret key in seconds. And SeaFile has additionally modified the default Django components making it more insecure: https://github.com/haiwen/seahub/commit/7cdb70368aa7acbf05461e22e83278b00c2036c8 https://github.com/haiwen/seahub/commit/7cdb70368aa7acbf0546... By the way, ownCloud does run a Bug Bounty: https://hackerone.com/owncloud https://hackerone.com/owncloud
      - gingerlime 11y ago
        On mobile so please excuse me if I missed something subtle, but what's more insecure about this change? From what I know constant time compare protects against timing side channel attacks, so isn't it improving security here?
deleted 11y ago
[deleted]
StavrosK 11y ago
Thanks for radicale! I switched to it from Google Calendar and Contacts. The git integration is amazing.

zaggynl 11y ago

How do you update Seafile? I've found the manual update process to be somewhat unwieldy. (I'm spoiled by package managers)

tombrossman 11y ago
You update manually via SSH. It's a bit more tedious than a package manager but not too bad. It took me a while to wrap my head around their file layout and how they do things, but I have it figured out now and updating takes a couple minutes. I can have two SSH terminals open on the same machine and by the time the first one completes `apt-get update && apt-get -y upgrade` I'm nearly done with the Seafile update. I really don't like adding third-party PPAs so I'll probably stick with this method for a while even if someone manages to package it up.

NoGravitas 11y ago

I run ownCloud, despite some reservations about its security. I'm not too concerned about the data in ownCloud itself (if it's private, then I encrypt it client-side, but most things I put in ownCloud are not very private). I'm more concerned about it being used as a launching point for an attack on my home server. As a kind of compromise, I'm running it in a VM.

LukasReschke 11y ago
> I run ownCloud, despite some reservations about its security. I'm not too concerned about the data in ownCloud itself (if it's private, then I encrypt it client-side, but most things I put in ownCloud are not very private). I'm more concerned about it being used as a launching point for an attack on my home server. As a kind of compromise, I'm running it in a VM. ownCloud does run a bug bounty program (https://hackerone.com/owncloud https://hackerone.com/owncloud) and the company supporting the project also employs internal security experts. You might also want to read https://statuscode.ch/2015/09/ownCloud-security-development-over-the-years/ https://statuscode.ch/2015/09/ownCloud-security-development-... which covers why comparing CVEs is not a reliably way to compare the security of products.

tdkl 11y ago

> I'm still looking for a good self-hosted CalDAV/CardDAV option that doesn't require PHP or MySQL Baikal is PHP, but can run on sqlite instead of MySQL : http://baikal-server.com/ http://baikal-server.com/

dualboot 11y ago

I feel the same way about owncloud and most of the currently available webdav/filesync self-hosted options. My compromise for the most part is having all of those services walled off behind vpn.