4 ms·

The only problem is that the server is written in PHP, which has had a history of bad RCE bugs (and an RCE bug in this context means all your personal data is a

by cyphar 7y ago

The only problem is that the server is written in PHP, which has had a history of bad RCE bugs (and an RCE bug in this context means all your personal data is accessible). In addition, NextCloud has had several pretty bad bugs related to authentication (such as bypassing 2FA, by pressing "cancel"). Don't get me wrong, I still use NextCloud, but you can only access my instance through a VPN (or by being on my home network where my server runs). I would suggest that everyone else does the same if you're hosting your own data.

kop316 7y ago
Do you recall which RCE bug and when? I have been using it for 4 years, and I recall one in the past year, but Nextcloud was loud and clear on making sure you had to upgrade. It was even nicer with auto updating on Debian, I didn't have to do anything to get my server patched (I just went in to confirm it was patched).
- cyphar 7y ago
  [1] shows 143 code execution CVEs in the past 20 years. Now, to be fair, this site has been known to misclassify bugs in the past and it's likely that most of those bugs don't apply to NextCloud or weren't even RCEs. However it's hardly unheard of for PHP to have RCEs. Usually the RCEs are in programs written in PHP, but PHP itself is hardly blameless. For comparison, Python has had 5-10 code execution CVEs in the past 10 years. And again, I'm not bashing PHP or NextCloud here. I would probably also firewall NextCloud if it was written in Python. The only thing protecting your data from being public is a single service that you are running and gated by a basic login form -- I personally feel much safer with it behind a WireGuard VPN. [1]: https://www.cvedetails.com/product/128/PHP-PHP.html?vendor_id=74 https://www.cvedetails.com/product/128/PHP-PHP.html?vendor_i...