8 ms·

Japan to add millions of new nodes to federated Nextcloud network

237 points by r3bl 8y ago

JChase2 8y ago
Set up nextcloud on my home network and share stuff with friends and family that way, never got into federation but that's pretty awesome! Especially since it supports encryption and privacy in a pretty easy to use way.
- ekianjo 8y ago
  Is encryption ready to use safely or is it still experimental?
  - r3bl 8y ago
    It is stable since v13 hit stable.
hazelnut 8y ago
Meaning they’re installing PHP on all routers to support Nextcloud? Not the expert here but that doesn’t sound too secure to me.
- tomcooks 8y ago
  PHP can be secure
  - EvangelicalPig 8y ago
    Most people's "PHP is inherently insecure" perception comes from projects like phpBB 2.x circa a decade ago and the shared hosts (still?) running an ancient version of PHP.
    - paulie_a 8y ago
      And WordPress, drupal and honestly every other php project custom or open source. PHP needs to go away.
      - washadjeffmad 8y ago
        Careful, there are a lot of WP, Drupal, and PHP devs here, and they make up a much bigger chunk of the front end developer pool than you'd expect post-2000s. And from sitting in on a lot of leadership meetings, they're one of the few groups that perpetually seems to be concerned with something they depend on sunsetting. As long as they're passing with ISO, I just stay out of it.
        paulie_a 8y ago
        That's fine if they are upset. Php is a scourge on the internet. If php on the server and Java on the desktop were wiped out. The internet would be a better place.
      - tomcooks 8y ago
        As opposed to? Le JS framework-du-jour? /s
        c487bd62 8y ago
        I'll take PHP spaghetti over JS any day
      - gmemstr 8y ago
        PHP is fine, no software is bug free, especially when it accepts external input. Drupal, WordPress etc are huge so there's definitely a lot of chances for things to sneak in, but PHP itself can't be 100% to blame.
        paulie_a 8y ago
        They are low hanging fruit to exploit. Considering drupal specifically, and the massive history of WordPress (oh I can grab root passwords because of a massively deployed image slider) An attacker is thinking it's Christmas morning. And yes it is because they are PHP. It's unsafe under any circumstances. Php is a go-to route of getting a shell.
  - zaphar 8y ago
    Sure, anything an be secure. PHP just makes is comically easy to be insecure.
- prophesi 8y ago
  Here's a good start: https://paragonie.com/blog/2017/12/2018-guide-building-secure-php-software https://paragonie.com/blog/2017/12/2018-guide-building-secur... The big issue with PHP's security is that there are a lottt of old guides and stackoverflow answers out there with terrible, unsafe practices.
  - hazelnut 8y ago
    I see, thanks for the explanation
- Walkman 8y ago
  They are actually know what they are doing. I think they have a full time security guys and also have a bug bounty as others have mentioned.
cs702 8y ago
Sounds impressive. If Nextcloud continues to add features and get more traction, perhaps it can become a viable alternative to Google drive/mail/calendar? Does anyone here have experience deploying Nextcloud in a business setting?
- deleted 8y ago
  [deleted]
- 713233eb 8y ago
  We are using NC with ~250 employees, works fine and runs smooth as butter, syncs to desktop well but many prefer to use the web interface. We are using LDAP auth, it powers our whole stack (Zimbra, OTRS, Debian/Ubuntu servers, Wifi, remote desktops, custom ERP, etc). Honestly, we have more problems with custom built software ($$$) than open source that is free for all. Sometimes I wish we could alter our internal workflows in a blink of an eye to leave out the greedy companies with whom we have software development agreements as legacy.
  - cs702 8y ago
    How well does calendar/contacts/email/docs syncing work with mobile devices?
    - codethief 8y ago
      Synchronizing calendar & contacts works great in my experience! I'm using DAVDroid for that.
- Pistos2 8y ago
  In my experience, Nextcloud's file sharing features are great, working as expected. We use it mainly to share large files with business contacts, both directions. I haven't tried the desktop apps. We use the web interface and the mobile apps.
philamonster 8y ago
Not to derail but I've been running ownCloud at home since 2013 and have considered switching since the fork but wanted to see Nextcloud mature a bit more. Any long-time ownCloud users have experience with switching and can offer advice or info on some of the pitfalls, if any? What are upgrades going forward really like with incremental updates and major version releases etc? I often end up holding ownCloud updates back in apt as there's always this sense of dread that I'll have trouble getting the app out of maintenance mode. Versions 9+ have been better but upgrades sucked in the beginning even as a home user not using disk encryption.
- kardos 8y ago
  Nextcloud user since v11 or so (small installation, <10 users). Updates have been painless, the web interface for updating has worked fine each time with nothing to clean up by hand. Its given me remarkably little problems after running it for ~18 months.
  - Semaphor 8y ago
    It's the same for me. With ownCloud I, too, dreaded updates. But since I switched to nextcloud, updates have become simple and easy
- moonfern 8y ago
  We have about 600 users, most of them use webdav. We just did a painless upgrade.
- alistproducer2 8y ago
  I set up owncloud in an rpi3 a couple months ago but really wasn't satisfied with the lack of apps - the lack of video conferencing to be specific among other things. Switching over to nextcloud was a couple hour affair because I had to rename tables and other nit picks. I like nextcloud a lot more and it's performance is great, especially since I started using redis (that was a huge pain to install on the rpi though). I only use Google Drive as an encrypted backup. I've replaced everything it did with nextcloud + collabra + talk.
justinclift 8y ago
Hopefully this get implemented extremely well. Anything else could make for some really terrible data breach possibilities. At scale. :/
- justinclift 8y ago
  Hmmm, NextCloud has a bug bounty program: https://hackerone.com/nextcloud https://hackerone.com/nextcloud The maximum's seem pretty low though (to me), considering it's used for housing peoples personal data.
  - kardos 8y ago
    Is nextcloud known to have deep pockets?
    - justinclift 8y ago
      No idea personally. :)
  - lima 8y ago
    A bug bounty only helps with a very narrow set of security issues. For instance, the deployment and updating process (which Nextcloud has no control over) is just as important.
    - justinclift 8y ago
      Good point. :)
  - tinus_hn 8y ago
    I think if you provide the money they’d be happy to raise the bounties!
indigodaddy 8y ago
Are all the component of NextCloud, including NextCoud Talk, open source, or are some features/components paid/enterprise/subscription only?
- Walkman 8y ago
  I don't know about any paid only plugin. Nextcloud is forked from ownCloud because the original founders of ownCloud didn't like the direction where ownCloud was heading (paid only features for enterprises) and they wanted to open source every part of it. They are unrealistically good people, making an unlikely good product :) See their reasoning of forking here: - https://www.youtube.com/watch?v=UTKvLSnFL6I https://www.youtube.com/watch?v=UTKvLSnFL6I - http://karlitschek.de/2016/06/nextcloud/ http://karlitschek.de/2016/06/nextcloud/ - https://news.ycombinator.com/item?id=12919330 https://news.ycombinator.com/item?id=12919330
thekyle 8y ago
If these Nextcloud instances are being installed on routers then they likely won't have access to very much storage space.
- abricot 8y ago
  Most routers support attaching a USB hard- or flash drive. This might become more convenient when they add Nexcloud to the router.
codethief 8y ago
> Nextcloud servers are not alone. The Nextcloud Federation feature enables users from one Nextcloud server to share with users on another server, creating a globally spanning network of private, self-hosted clouds. A federated cloud id, comparable to an email address, enables users to identify one another […] I wonder what domain they'll be using for these self-hosted Nextcloud instances. Are they going to allow for custom domains?
mxuribe 8y ago
This effort is to be applauded. Kudos to NEC and especially NextCloud; I wish them both luck!
jernst 8y ago
In the meantime, if you don't want to wait or don't live in Japan, there is the UBOSBox Nextcloud server appliance we announced yesterday: https://indiecomputing.com/ https://indiecomputing.com/ (disclaimer: yes, my company)

237 points by r3bl 8y ago

Set up nextcloud on my home network and share stuff with friends and family that way, never got into federation but that's pretty awesome! Especially since it supports encryption and privacy in a pretty easy to use way.

ekianjo 8y ago
Is encryption ready to use safely or is it still experimental?
- r3bl 8y ago
  It is stable since v13 hit stable.

hazelnut 8y ago

Meaning they’re installing PHP on all routers to support Nextcloud? Not the expert here but that doesn’t sound too secure to me.

tomcooks 8y ago
PHP can be secure
- EvangelicalPig 8y ago
  Most people's "PHP is inherently insecure" perception comes from projects like phpBB 2.x circa a decade ago and the shared hosts (still?) running an ancient version of PHP.
  - paulie_a 8y ago
    And WordPress, drupal and honestly every other php project custom or open source. PHP needs to go away.
    - washadjeffmad 8y ago
      Careful, there are a lot of WP, Drupal, and PHP devs here, and they make up a much bigger chunk of the front end developer pool than you'd expect post-2000s. And from sitting in on a lot of leadership meetings, they're one of the few groups that perpetually seems to be concerned with something they depend on sunsetting. As long as they're passing with ISO, I just stay out of it.
      - paulie_a 8y ago
        That's fine if they are upset. Php is a scourge on the internet. If php on the server and Java on the desktop were wiped out. The internet would be a better place.
    - tomcooks 8y ago
      As opposed to? Le JS framework-du-jour? /s
      - c487bd62 8y ago
        I'll take PHP spaghetti over JS any day
    - gmemstr 8y ago
      PHP is fine, no software is bug free, especially when it accepts external input. Drupal, WordPress etc are huge so there's definitely a lot of chances for things to sneak in, but PHP itself can't be 100% to blame.
      - paulie_a 8y ago
        They are low hanging fruit to exploit. Considering drupal specifically, and the massive history of WordPress (oh I can grab root passwords because of a massively deployed image slider) An attacker is thinking it's Christmas morning. And yes it is because they are PHP. It's unsafe under any circumstances. Php is a go-to route of getting a shell.
- zaphar 8y ago
  Sure, anything an be secure. PHP just makes is comically easy to be insecure.
prophesi 8y ago
Here's a good start: https://paragonie.com/blog/2017/12/2018-guide-building-secure-php-software https://paragonie.com/blog/2017/12/2018-guide-building-secur... The big issue with PHP's security is that there are a lottt of old guides and stackoverflow answers out there with terrible, unsafe practices.
- hazelnut 8y ago
  I see, thanks for the explanation
Walkman 8y ago
They are actually know what they are doing. I think they have a full time security guys and also have a bug bounty as others have mentioned.

cs702 8y ago

Sounds impressive. If Nextcloud continues to add features and get more traction, perhaps it can become a viable alternative to Google drive/mail/calendar? Does anyone here have experience deploying Nextcloud in a business setting?

deleted 8y ago
[deleted]
713233eb 8y ago
We are using NC with ~250 employees, works fine and runs smooth as butter, syncs to desktop well but many prefer to use the web interface. We are using LDAP auth, it powers our whole stack (Zimbra, OTRS, Debian/Ubuntu servers, Wifi, remote desktops, custom ERP, etc). Honestly, we have more problems with custom built software ($$$) than open source that is free for all. Sometimes I wish we could alter our internal workflows in a blink of an eye to leave out the greedy companies with whom we have software development agreements as legacy.
- cs702 8y ago
  How well does calendar/contacts/email/docs syncing work with mobile devices?
  - codethief 8y ago
    Synchronizing calendar & contacts works great in my experience! I'm using DAVDroid for that.
Pistos2 8y ago
In my experience, Nextcloud's file sharing features are great, working as expected. We use it mainly to share large files with business contacts, both directions. I haven't tried the desktop apps. We use the web interface and the mobile apps.

philamonster 8y ago

Not to derail but I've been running ownCloud at home since 2013 and have considered switching since the fork but wanted to see Nextcloud mature a bit more. Any long-time ownCloud users have experience with switching and can offer advice or info on some of the pitfalls, if any? What are upgrades going forward really like with incremental updates and major version releases etc? I often end up holding ownCloud updates back in apt as there's always this sense of dread that I'll have trouble getting the app out of maintenance mode. Versions 9+ have been better but upgrades sucked in the beginning even as a home user not using disk encryption.

kardos 8y ago
Nextcloud user since v11 or so (small installation, <10 users). Updates have been painless, the web interface for updating has worked fine each time with nothing to clean up by hand. Its given me remarkably little problems after running it for ~18 months.
- Semaphor 8y ago
  It's the same for me. With ownCloud I, too, dreaded updates. But since I switched to nextcloud, updates have become simple and easy
moonfern 8y ago
We have about 600 users, most of them use webdav. We just did a painless upgrade.
alistproducer2 8y ago
I set up owncloud in an rpi3 a couple months ago but really wasn't satisfied with the lack of apps - the lack of video conferencing to be specific among other things. Switching over to nextcloud was a couple hour affair because I had to rename tables and other nit picks. I like nextcloud a lot more and it's performance is great, especially since I started using redis (that was a huge pain to install on the rpi though). I only use Google Drive as an encrypted backup. I've replaced everything it did with nextcloud + collabra + talk.

justinclift 8y ago

Hopefully this get implemented extremely well. Anything else could make for some really terrible data breach possibilities. At scale. :/

justinclift 8y ago
Hmmm, NextCloud has a bug bounty program: https://hackerone.com/nextcloud https://hackerone.com/nextcloud The maximum's seem pretty low though (to me), considering it's used for housing peoples personal data.
- kardos 8y ago
  Is nextcloud known to have deep pockets?
  - justinclift 8y ago
    No idea personally. :)
- lima 8y ago
  A bug bounty only helps with a very narrow set of security issues. For instance, the deployment and updating process (which Nextcloud has no control over) is just as important.
  - justinclift 8y ago
    Good point. :)
- tinus_hn 8y ago
  I think if you provide the money they’d be happy to raise the bounties!

indigodaddy 8y ago

Are all the component of NextCloud, including NextCoud Talk, open source, or are some features/components paid/enterprise/subscription only?

Walkman 8y ago
I don't know about any paid only plugin. Nextcloud is forked from ownCloud because the original founders of ownCloud didn't like the direction where ownCloud was heading (paid only features for enterprises) and they wanted to open source every part of it. They are unrealistically good people, making an unlikely good product :) See their reasoning of forking here: - https://www.youtube.com/watch?v=UTKvLSnFL6I https://www.youtube.com/watch?v=UTKvLSnFL6I - http://karlitschek.de/2016/06/nextcloud/ http://karlitschek.de/2016/06/nextcloud/ - https://news.ycombinator.com/item?id=12919330 https://news.ycombinator.com/item?id=12919330

thekyle 8y ago

If these Nextcloud instances are being installed on routers then they likely won't have access to very much storage space.

abricot 8y ago
Most routers support attaching a USB hard- or flash drive. This might become more convenient when they add Nexcloud to the router.

codethief 8y ago

> Nextcloud servers are not alone. The Nextcloud Federation feature enables users from one Nextcloud server to share with users on another server, creating a globally spanning network of private, self-hosted clouds. A federated cloud id, comparable to an email address, enables users to identify one another […] I wonder what domain they'll be using for these self-hosted Nextcloud instances. Are they going to allow for custom domains?

mxuribe 8y ago

This effort is to be applauded. Kudos to NEC and especially NextCloud; I wish them both luck!

jernst 8y ago

In the meantime, if you don't want to wait or don't live in Japan, there is the UBOSBox Nextcloud server appliance we announced yesterday: https://indiecomputing.com/ https://indiecomputing.com/ (disclaimer: yes, my company)