3 ms·

Do EU Governments care about security? Has a proper audit of this monstrosity been done? Or is this just another ploy to get better pricing?

cafxx 7y ago
Sounds like someone didn't bother reading the linked page...
- nominated1 7y ago
  Those quotes read like typical PR statements made by politicians. I was hoping for a bit more. I can’t find it now but it wasn’t long ago that the NextCloud (or was it OwnCloud) FAQ had a note about security that read something like “we’re busy adding features we’ll get to security later”. It left me feeling uneasy. I would have hoped security would have been part of the design. Maybe I’m just getting old...
  - jospoortvliet 7y ago
    Things have changed a fair bit since the early ownCloud days - you'll be hard pressed to find a large PHP app with so few security issues, and that's not me saying that but quoting a pentest firm hired by the Swiss city of Geneva which audited Nextcloud recently. See https://nextcloud.com/secure https://nextcloud.com/secure - thoughts are, of course, always welcome.
    - jospoortvliet 7y ago
      Actually, we already quoted them in an earlier blog: https://nextcloud.com/blog/a-wave-of-cities-all-over-europe-moving-to-nextcloud/ https://nextcloud.com/blog/a-wave-of-cities-all-over-europe-... ;-)
codedokode 7y ago
Where is information stored securely? On a private server not accessible from outside and protected by law or on foreign publicly accessible servers not protected by local laws?
- jospoortvliet 7y ago
  So both the German and French governments host Nextcloud firewalled off from the internet. Others use things like a reverse proxy (City of Geneva). Most customers just run Nextcloud internet-facing, as that is the easiest if you want to collaborate and work remotely. We trust Nextcloud to be perfectly safe for that, at least as safe as any complex piece of software can every be, of course. We have a very active security team, the latest security measures and a bug bounty program where you get up to $5K for reporting issues to us.

cafxx 7y ago

Sounds like someone didn't bother reading the linked page...

nominated1 7y ago
Those quotes read like typical PR statements made by politicians. I was hoping for a bit more. I can’t find it now but it wasn’t long ago that the NextCloud (or was it OwnCloud) FAQ had a note about security that read something like “we’re busy adding features we’ll get to security later”. It left me feeling uneasy. I would have hoped security would have been part of the design. Maybe I’m just getting old...
- jospoortvliet 7y ago
  Things have changed a fair bit since the early ownCloud days - you'll be hard pressed to find a large PHP app with so few security issues, and that's not me saying that but quoting a pentest firm hired by the Swiss city of Geneva which audited Nextcloud recently. See https://nextcloud.com/secure https://nextcloud.com/secure - thoughts are, of course, always welcome.
  - jospoortvliet 7y ago
    Actually, we already quoted them in an earlier blog: https://nextcloud.com/blog/a-wave-of-cities-all-over-europe-moving-to-nextcloud/ https://nextcloud.com/blog/a-wave-of-cities-all-over-europe-... ;-)

codedokode 7y ago

Where is information stored securely? On a private server not accessible from outside and protected by law or on foreign publicly accessible servers not protected by local laws?

jospoortvliet 7y ago
So both the German and French governments host Nextcloud firewalled off from the internet. Others use things like a reverse proxy (City of Geneva). Most customers just run Nextcloud internet-facing, as that is the easiest if you want to collaborate and work remotely. We trust Nextcloud to be perfectly safe for that, at least as safe as any complex piece of software can every be, of course. We have a very active security team, the latest security measures and a bug bounty program where you get up to $5K for reporting issues to us.