3 ms·

> but there just isn't a viable alternative. Why can't the state build a data center and host some Matrix, Nextcloud and Moodle instances? To me that would see

by ls15 4y ago

> but there just isn't a viable alternative. Why can't the state build a data center and host some Matrix, Nextcloud and Moodle instances? To me that would seem like tax money being used as intended by the taxpayer.

jeffbee 4y ago
This kind of response always baffles me. Choose any of the common questions people have about cloud data privacy and ask the same question about Nextcloud. For example: when I delete a file does the cloud really delete it? Now read the Nextcloud source code. All it does is unlink files, and it doesn't even do that properly because it doesn't handle errors and races. Also, it poops your private data all over the filesystem while creating thumbnails and previews. So the answer is no, absolutely not even a single iota of effort has been expended making sure deleted data is really deleted, and inside administrators will have complete and total, unaudited access to it. Switching from a cloud run by professionals to a self-hosted Nextcloud would be a massive downgrade in information privacy.
- cmroanirgo 4y ago
  The thing is, there's no gaurantee that google nor microsoft nor apple do anything more. With products like nextcloud, at least you can see exactly what's going on. We already know google, microsoft and apple have unfettered access to your data too. With self hosting, at least I have a chance of knowing when my data's being monitored & I can choose increasingly severe security around that system. The big players can only offer promises with little to no way for us to verify the truth of any one of their statements. So, unless the big players offer e2ee as a default, it's best to assume the worst from them. With nextcloud it's far less necessary if you're rolling your own (but it supports a form of encryption anyhow)
  - jeffbee 4y ago
    > at least I have a chance of knowing when my data's being monitored C'mon really. The whole central point of this euro scaremongering is that Google will turn over your data to intelligence agencies when U.S. court orders it to do so. Now imagine that for whatever fanciful and obviously highly unlikely reason the C.I.A. wants your PDFs. You are claiming this will be visible to you, that you will be able to defend yourself against hardware supply chain attacks, attacks on the media you downloaded to install CrapNux on your servers, attacks against your NextCloud auto-updates, attacks against the whole rest of your software supply chain, social engineering attacks against your sysadmins, attacks against your hard disk drive waste stream, and all the rest of it? And you will be able to achieve this on the budget on a Dutch primary school? Look, I think it would be cool if nation-sized bureaucracies had the doctrines and practices that allowed them to be actually safer than the cloud, but as it stands they do not.
    - ls15 4y ago
      > The whole central point of this euro scaremongering is that Google will turn over your data to intelligence agencies when U.S. court orders it to do so. I am sure, Google has ways to abuse data that do not include any courts.
    - freeflight 4y ago
      > The whole central point of this euro scaremongering is that Google will turn over your data to intelligence agencies when U.S. court orders it to do so. Euro scaremongering? [0] [1] Particularly that court mention is weird, considering how the FISA court is very much just a rubberstamp formality. > Now imagine that for whatever fanciful and obviously highly unlikely reason the C.I.A. wants your PDFs. That "fanciful reason" could be that my company developed a breakthrough technology/medication/chemical. Which is exactly the kind of stuff the NSA is very interested in, so it can "patent subsidize" US industries with them [2] [0] https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data https://www.theguardian.com/world/2013/jun/06/us-tech-giants... [1] https://qz.com/1145669/googles-true-origin-partly-lies-in-cia-and-nsa-research-grants-for-mass-surveillance/ https://qz.com/1145669/googles-true-origin-partly-lies-in-ci... [2] https://en.wikipedia.org/wiki/ECHELON#Examples_of_industrial_espionage https://en.wikipedia.org/wiki/ECHELON#Examples_of_industrial...
      - cyberpunk 4y ago
        Sssh! The official line is that only China does this.
    - 6510 4y ago
      You make this entire IT thing sound like a bad idea. The mess we've made of it... > U.S. court order If only it worked like that.
- nisa 4y ago
  ...and yet they win big government contracts and nextcloud is the official cloud storage solution for a lot of german universities. Same for matrix - good idea on paper but implementation is not there at the moment - still they won some pretty big government contracts for Bundeswehr (military) chat and health chat. IMHO Europe should just do something like create an https://www.inria.fr/en https://www.inria.fr/en for writing sane software that acknowledges and handles the complexities of governance. Can't image that paying tons of grad students good money to design and hack something in Ocaml/Haskell that actually works is more expensive than the status quo.
- pessimizer 4y ago
  This kind of response always baffles me. This is not you setting up an owncloud instance, this is a country setting up infrastructure, on which it can spend millions (and on which it currently spends millions without ownership.) They can afford professionals.
  - deleted 4y ago
    [deleted]
  - ls15 4y ago
    Exactly, where there is a will, there is a way.
- kitkat_new 4y ago
  obviously the state can let the cloud run by professionals as well, see the German state NRW: > Dataport setzt dafür die Softwarelösungen Open-Xchange für E-Mail, Nextcloud für den Dokumentenaustausch, Matrix und Jitsi für Videokonferenzen sowie virtuelle Zusammenarbeit und die Software Collabora für Office-Anwendungen ein. https://www.dataport.de/pressemitteilung/dataport-stellt-open-source-arbeitsplatz-phoenix-in-vollem-umfang-bereit/ https://www.dataport.de/pressemitteilung/dataport-stellt-ope...
- ls15 4y ago
  > Also, it poops your private data all over the filesystem while creating thumbnails and previews. So the answer is no, absolutely not even a single iota of effort has been expended making sure deleted data is really deleted, and inside administrators will have complete and total, unaudited access to it. That all seems solveable to me with enough money and time. What if a billion Euro gets invested into infrastructure and hardening of these tools? I think everything that you describe is a result of underinvestment. Extorting our kids data to Google cannot be better. We aren't also outsourcing the military to Blackwater and the secret service to Facebook, just because they can run it more efficiently.
gidorah 4y ago
I mean the state could. But we keep voting in centre-right parties that believe in small government and big business.

by ls15 4y ago

jeffbee 4y ago

This kind of response always baffles me. Choose any of the common questions people have about cloud data privacy and ask the same question about Nextcloud. For example: when I delete a file does the cloud really delete it? Now read the Nextcloud source code. All it does is unlink files, and it doesn't even do that properly because it doesn't handle errors and races. Also, it poops your private data all over the filesystem while creating thumbnails and previews. So the answer is no, absolutely not even a single iota of effort has been expended making sure deleted data is really deleted, and inside administrators will have complete and total, unaudited access to it. Switching from a cloud run by professionals to a self-hosted Nextcloud would be a massive downgrade in information privacy.

cmroanirgo 4y ago
The thing is, there's no gaurantee that google nor microsoft nor apple do anything more. With products like nextcloud, at least you can see exactly what's going on. We already know google, microsoft and apple have unfettered access to your data too. With self hosting, at least I have a chance of knowing when my data's being monitored & I can choose increasingly severe security around that system. The big players can only offer promises with little to no way for us to verify the truth of any one of their statements. So, unless the big players offer e2ee as a default, it's best to assume the worst from them. With nextcloud it's far less necessary if you're rolling your own (but it supports a form of encryption anyhow)
- jeffbee 4y ago
  > at least I have a chance of knowing when my data's being monitored C'mon really. The whole central point of this euro scaremongering is that Google will turn over your data to intelligence agencies when U.S. court orders it to do so. Now imagine that for whatever fanciful and obviously highly unlikely reason the C.I.A. wants your PDFs. You are claiming this will be visible to you, that you will be able to defend yourself against hardware supply chain attacks, attacks on the media you downloaded to install CrapNux on your servers, attacks against your NextCloud auto-updates, attacks against the whole rest of your software supply chain, social engineering attacks against your sysadmins, attacks against your hard disk drive waste stream, and all the rest of it? And you will be able to achieve this on the budget on a Dutch primary school? Look, I think it would be cool if nation-sized bureaucracies had the doctrines and practices that allowed them to be actually safer than the cloud, but as it stands they do not.
  - ls15 4y ago
    > The whole central point of this euro scaremongering is that Google will turn over your data to intelligence agencies when U.S. court orders it to do so. I am sure, Google has ways to abuse data that do not include any courts.
  - freeflight 4y ago
    > The whole central point of this euro scaremongering is that Google will turn over your data to intelligence agencies when U.S. court orders it to do so. Euro scaremongering? [0] [1] Particularly that court mention is weird, considering how the FISA court is very much just a rubberstamp formality. > Now imagine that for whatever fanciful and obviously highly unlikely reason the C.I.A. wants your PDFs. That "fanciful reason" could be that my company developed a breakthrough technology/medication/chemical. Which is exactly the kind of stuff the NSA is very interested in, so it can "patent subsidize" US industries with them [2] [0] https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data https://www.theguardian.com/world/2013/jun/06/us-tech-giants... [1] https://qz.com/1145669/googles-true-origin-partly-lies-in-cia-and-nsa-research-grants-for-mass-surveillance/ https://qz.com/1145669/googles-true-origin-partly-lies-in-ci... [2] https://en.wikipedia.org/wiki/ECHELON#Examples_of_industrial_espionage https://en.wikipedia.org/wiki/ECHELON#Examples_of_industrial...
    - cyberpunk 4y ago
      Sssh! The official line is that only China does this.
  - 6510 4y ago
    You make this entire IT thing sound like a bad idea. The mess we've made of it... > U.S. court order If only it worked like that.
nisa 4y ago
...and yet they win big government contracts and nextcloud is the official cloud storage solution for a lot of german universities. Same for matrix - good idea on paper but implementation is not there at the moment - still they won some pretty big government contracts for Bundeswehr (military) chat and health chat. IMHO Europe should just do something like create an https://www.inria.fr/en https://www.inria.fr/en for writing sane software that acknowledges and handles the complexities of governance. Can't image that paying tons of grad students good money to design and hack something in Ocaml/Haskell that actually works is more expensive than the status quo.
pessimizer 4y ago
This kind of response always baffles me. This is not you setting up an owncloud instance, this is a country setting up infrastructure, on which it can spend millions (and on which it currently spends millions without ownership.) They can afford professionals.
- deleted 4y ago
  [deleted]
- ls15 4y ago
  Exactly, where there is a will, there is a way.
kitkat_new 4y ago
obviously the state can let the cloud run by professionals as well, see the German state NRW: > Dataport setzt dafür die Softwarelösungen Open-Xchange für E-Mail, Nextcloud für den Dokumentenaustausch, Matrix und Jitsi für Videokonferenzen sowie virtuelle Zusammenarbeit und die Software Collabora für Office-Anwendungen ein. https://www.dataport.de/pressemitteilung/dataport-stellt-open-source-arbeitsplatz-phoenix-in-vollem-umfang-bereit/ https://www.dataport.de/pressemitteilung/dataport-stellt-ope...
ls15 4y ago
> Also, it poops your private data all over the filesystem while creating thumbnails and previews. So the answer is no, absolutely not even a single iota of effort has been expended making sure deleted data is really deleted, and inside administrators will have complete and total, unaudited access to it. That all seems solveable to me with enough money and time. What if a billion Euro gets invested into infrastructure and hardening of these tools? I think everything that you describe is a result of underinvestment. Extorting our kids data to Google cannot be better. We aren't also outsourcing the military to Blackwater and the secret service to Facebook, just because they can run it more efficiently.

gidorah 4y ago

I mean the state could. But we keep voting in centre-right parties that believe in small government and big business.