6 ms·

Show HN: arkOS - Securely self-hosting your data

156 points by jcook818 13y ago

jcook818 13y ago
I've been quietly working on this project for awhile now, but with all of the news about NSA in recent days, I thought it important to share a little about my project. I am working on a platform called arkOS. arkOS is an operating system that is initially designed to run on the Raspberry Pi, and will eventually be expanded to other architectures. It comes with a built-in graphical server management system called Genesis, which will allow users to easily and securely host websites, webapps (Wordpress/Drupal), email accounts, cloud services like ownCloud, Dropbox clones and anything else. The coolest part of Genesis is that it uses a plugin interface, so anyone who has a new project that they want to manage only needs to whip up a quick script in Python and it can be easily integrated into the rest of the application. Genesis was initially a fork of another server management app called Ajenti, but now extends its features and takes it in a more comprehensive direction. arkOS is similar to two other projects that have been in the spotlight lately - FreedomBox and Space Monkey. It differs from FreedomBox because it is not focused on redoing existing networking systems. It is simply dedicated to hosting your data and does not try to reinvent the wheel. It also puts a premium on user experience - it is designed to require as little command-line work as possible in order to maintain it (ideally zero). It differs from Space Monkey because it allows you to actually serve the content you put onto it, rather than just serving as a media storage system. While both of these tools are very exciting and important steps to "liberating" the cloud, I believe that arkOS fills an important niche in between the two. EDIT: Regarding how it can prevent against gov't/corporate spying like with PRISM: The idea is that it would provide an easy alternative to the services that are provided by these large companies, i.e. Google Talk (or whatever they call it nowadays) replaced with an XMPP server, Gmail replaced with self-hosted email, Dropbox replaced by your own self-hosted instance of ownCloud, etc. The only part of PRISM that it might not provide a defence against would be big social networks (Facebook et al), but you would still be able to host your own StatusNet instance or Tent server on your arkOS server and have alternatives that way. When services can be decentralized and brought back under individual user control, a "direct link" into major web company's servers is definitely made irrelevant. If anyone is interested in this project or would like to stay apprised on its status, I encourage you to check out the links below. I have many more things in the works for arkOS, including a system that helps people get around port blocking and dynamic DNS issues, something that prevents a large number of people from self-hosting their data. Thanks for reading :) -- Free The Cloud: https://ark-os.org/cloud https://ark-os.org/cloud Project Website: https://ark-os.org https://ark-os.org Github repo for Genesis, the server management GUI: https://github.com/cznweb/genesis https://github.com/cznweb/genesis
- ZenoArrow 13y ago
  jcook818, this is a really nice project, really nice, but I do wish you introduced it differently, as it doesn't have a huge amount to do with PRISM. With that said, I can definitely see me using this on my RasPi.
  - jcook818 13y ago
    Thanks! :) I'm updating my comment above to more clearly explain the connection with PRISM. If that still does not make sense, I'd welcome the input as to specifically how it isn't related.
- girvo 13y ago
  Hey, it's based on Ajenti, isn't it? :) I love Ajenti, I use it for my VPS.
  - jcook818 13y ago
    Yes it is! Based on the 0.6 branch.
- julianc 13y ago
  Looks nice and I like the whole privacy-focused ideology, however isn't this just an operating system with a control panel that easily allows you to install programs using a graphical interface vs. the command line? You know, like webmin/virtualmin, cpanel, etc.? I suppose it makes a lot more sense to install a os + control panel on a device such as the rpi than a webserver (like using XBMC on a HTPC), so your project may have a future :) Good luck!
  - jcook818 13y ago
    It is an operating system with a control panel, but the control panel is/will be a lot more comprehensive than Webmin or analogous server management apps. Whereas Webmin gives you a web interface with which to manage your server, if you don't understand how Apache/nginx/etc work then you still won't be able to add your own website, for example. If you have no idea about mail relays, virtual domains and so on, you probably will be way over your head if you try to host your own email. Genesis grinds the learning curve down as much as possible, by allowing websites (or other plugins like email/XMPP and so on) to be added with wizards and non-complicated language. Closer to Zentyal's web administration systems than that of Webmin. But it still represents a big improvement over how Zentyal works when we are just talking about personal use.
ceejayoz 13y ago
This defends against the Dropbox part of PRISM, but hardly the rest of it.
- jcook818 13y ago
  The idea is that it would provide an easy alternative to the services that are provided by these large companies, i.e. Google Talk (or whatever they call it nowadays) replaced with an XMPP server, Gmail replaced with self-hosted email, Dropbox replaced by your own self-hosted instance of ownCloud, etc. The only part of PRISM that it might not provide a defence against would be big social networks (Facebook et al), but you would still be able to host your own StatusNet instance or Tent server on your arkOS server and have alternatives that way. When services can be decentralized and brought back under individual user control, a "direct link" into major web company's servers is definitely made irrelevant.
  - muyuu 13y ago
    I don't see how does it provide any of that. This is a server administrator, isn't it? like old school Webmin for instance?
    - jcook818 13y ago
      It gives you the same abilities as Webmin, but it is/will be so much more. No need to fiddle around with config files (like Webmin) but at the same time it presents the configurations in ways that non-sysadmins might hope to understand. Installing and configuring webapps like Wordpress/Drupal/ownCloud and others with one click. Managing websites and emails in an intuitive and "easy" way. Webmin is great, but if you aren't a Linux sysadmin it doesn't really make hosting things any easier. Think of arkOS/Genesis as Webmin but with a better design, much easier to use and a more modular style of operation. It's kinda hard to explain because the plugins I am referring to are still works-in-progress. But as a longtime Webmin user, I can assure you that it goes above and beyond what Webmin does. It's actually a lot closer to Zentyal, but targeted for personal use, and bringing in many more improvements.
runako 13y ago
Your server's down.
- jcook818 13y ago
  Ugh, wonderful timing. Thanks for letting me know Edit: Fixed, for now
- mindcrime 13y ago
  That was probably just a temporary blip caused by the NSA installing their beam splitter and/or backdoor code.
captiva12 13y ago
Any of the personal cloud solutions like Tonido or your own NAS will help as well.
__voidcast__ 13y ago
Chrome is giving me a Invalid Server Certificate error on the site(I had to edit the https to http ). This would definitely be a good way to use my ownCloud :-)
- jcook818 13y ago
  Really? That's weird, it works just fine for me...
  - pseut 13y ago
    I'm getting the same thing with Konqueror edit: same thing = same problem
- ChrisAntaki 13y ago
  You could be experiencing a man in the middle attack. ;)
rohall 13y ago
Does anyone know of anything similar to arkOS that I could throw on a netbook? I'm thinking of installing Ubuntu and building it out myself, but if there's a pre-made distro that would be helpful.
- jcook818 13y ago
  Not that I'm aware of, sorry. Zentyal is an option, but I believe it is geared towards small business, and is probably closer to Webmin than arkOS/Genesis. I do have plans of making arkOS work on x86-based systems, but my first goal is armv6 and armv7 (RPI, Beagleboard Black, etc)
sciurus 13y ago
"arkOS is designed for use on the Raspberry Pi" What about this is specific to the Raspberry Pi, and why? Can Genesis run on any Arch Linux installation?
- jcook818 13y ago
  The operating system that Genesis runs on is packaged for installation on the Raspberry Pi, and its software packages are compiled for armv6 at this time. That being said, you can run Genesis on Arch Linux with little difficulty by just cloning the Github repo. arkOS is designed for use on the RPi at this time, because my goal is to create the best user experience possible at the lowest possible entry price. Lowering the barriers to self-host one's data and all that. Once Genesis is closer to its 1.0 release (and hopefully once I have more volunteers to help out), arkOS will be extended to more powerful platforms like the Beagleboard Black (armv7) and ultimately x64/64 systems. Since I'm only one person at the moment, I thought it prudent to start with a small focus then expand from there.
  - StavrosK 13y ago
    Plus, you can sell pre-installed microSD cards for $10, which should bring some revenue to help the project along.
so898 13y ago
I find my Raspberry Pi and install this OS, feel cool. But I think I will keep my ownCloud staffs, because I have two PCs and one Mac running three different systems... If arkOS could support Mac and Win, I will have a try again. BTW, the ownCloud really always delete my files when sync, which make me always want to go back to Dropbox...
mwcampbell 13y ago
Excellent project! We need to pull together and fund this so jcook818 can work on it full time. jcook818, how can we contribute? Have you thought about setting this up on Kickstarter or the like?
- jcook818 13y ago
  Hi there -- I do have plans for a Kickstarter, with some very interesting ideas on things that will be offered. Won't get into too much detail, but it will be awesome I can assure you :) I need to find a helper / partner before I can get to that stage though. Check my comment above for details. If you are interested in donating NOW which really helps server fees and other overhead, you are certainly welcome to do so and it is much appreciated. https://ark-os.org/donate https://ark-os.org/donate
pinaceae 13y ago
doesn't this just solve a piece of the mess? it is the communications channels being monitored, so email, chats, voip, whatever messages would still be easily tapped into. they control the pipes, the endpoints do not matter much.
- jcook818 13y ago
  Notwithstanding a MITM attack, the pipes are secure enough, provided you are properly using encryption. If an app stores any sort of data unencrypted on a centralized server, that data is potentially accessible to others who can compromise that server. This makes endpoints a piece of critical importance. When you self-host your data, you can patch that hole in the armour so to speak, because the endpoint falls under your control. Coupled with encryption, it's a massive deterrent to eavesdropping. In brief: it doesn't solve every Internet eavesdropping problem known to man, no. But it solves a very substantial one that hasn't really been tackled to date.
ippisl 13y ago
Jacob , It's great that you're working on this. But isn't the biggest problem with security/privacy is that people don't care about it and don't use privacy enhancing products? Because if that's the case, the starting point should be a viable marketing strategy - which will define the product. Snapchat is is a good example of this. They wrap a viable user need with a privacy preserving idea with great marketing. Have a look at their site.
- jcook818 13y ago
  Hi there! Yes, I agree that apathy is a big problem. My hypothesis is that apathy can be driven down once the investment in time/money/education required for self-hosting services is reduced. If it can't be, then more educational campaigns are needed. I'm not really a marketing-type of person, but I would love to have someone on the project that can do this sort of thing, and be more of a conduit for the community. I only have two hands on the project at this point, but hopefully in the future that will change :)
  - ippisl 13y ago
    There are secure services for IM/VOIP and maybe email(npt sure how secure) and of course TOR. Some are very easy to use like Redphone/textSecure which integrate transparently with android calls/meessaging. As far i can understand, they didn't grab much popularity. So i'm not sure ease of alone is enough. I'm not really a marketing person too, just interested in it, so i don't think i could help much. Anyway, best of luck with the project.
miaui 13y ago
what license is this released under?
- jcook818 13y ago
  The management interface (Genesis) is GPLv3.
jaakl 13y ago
It does not really resolve problem for the fully paranoid. Instead (and in addition to) of service providers the backdoors could be installed to your software, Raspberry Pi, or even to silicon. There is small number of providers of any of these, so they are quite easy to be controlled by interested parties. Solution: publish designs, so everyone will write your own software, build your own hardware.

156 points by jcook818 13y ago

I've been quietly working on this project for awhile now, but with all of the news about NSA in recent days, I thought it important to share a little about my project. I am working on a platform called arkOS. arkOS is an operating system that is initially designed to run on the Raspberry Pi, and will eventually be expanded to other architectures. It comes with a built-in graphical server management system called Genesis, which will allow users to easily and securely host websites, webapps (Wordpress/Drupal), email accounts, cloud services like ownCloud, Dropbox clones and anything else. The coolest part of Genesis is that it uses a plugin interface, so anyone who has a new project that they want to manage only needs to whip up a quick script in Python and it can be easily integrated into the rest of the application. Genesis was initially a fork of another server management app called Ajenti, but now extends its features and takes it in a more comprehensive direction. arkOS is similar to two other projects that have been in the spotlight lately - FreedomBox and Space Monkey. It differs from FreedomBox because it is not focused on redoing existing networking systems. It is simply dedicated to hosting your data and does not try to reinvent the wheel. It also puts a premium on user experience - it is designed to require as little command-line work as possible in order to maintain it (ideally zero). It differs from Space Monkey because it allows you to actually serve the content you put onto it, rather than just serving as a media storage system. While both of these tools are very exciting and important steps to "liberating" the cloud, I believe that arkOS fills an important niche in between the two. EDIT: Regarding how it can prevent against gov't/corporate spying like with PRISM: The idea is that it would provide an easy alternative to the services that are provided by these large companies, i.e. Google Talk (or whatever they call it nowadays) replaced with an XMPP server, Gmail replaced with self-hosted email, Dropbox replaced by your own self-hosted instance of ownCloud, etc. The only part of PRISM that it might not provide a defence against would be big social networks (Facebook et al), but you would still be able to host your own StatusNet instance or Tent server on your arkOS server and have alternatives that way. When services can be decentralized and brought back under individual user control, a "direct link" into major web company's servers is definitely made irrelevant. If anyone is interested in this project or would like to stay apprised on its status, I encourage you to check out the links below. I have many more things in the works for arkOS, including a system that helps people get around port blocking and dynamic DNS issues, something that prevents a large number of people from self-hosting their data. Thanks for reading :) -- Free The Cloud: https://ark-os.org/cloud https://ark-os.org/cloud Project Website: https://ark-os.org https://ark-os.org Github repo for Genesis, the server management GUI: https://github.com/cznweb/genesis https://github.com/cznweb/genesis

ZenoArrow 13y ago
jcook818, this is a really nice project, really nice, but I do wish you introduced it differently, as it doesn't have a huge amount to do with PRISM. With that said, I can definitely see me using this on my RasPi.
- jcook818 13y ago
  Thanks! :) I'm updating my comment above to more clearly explain the connection with PRISM. If that still does not make sense, I'd welcome the input as to specifically how it isn't related.
girvo 13y ago
Hey, it's based on Ajenti, isn't it? :) I love Ajenti, I use it for my VPS.
- jcook818 13y ago
  Yes it is! Based on the 0.6 branch.
julianc 13y ago
Looks nice and I like the whole privacy-focused ideology, however isn't this just an operating system with a control panel that easily allows you to install programs using a graphical interface vs. the command line? You know, like webmin/virtualmin, cpanel, etc.? I suppose it makes a lot more sense to install a os + control panel on a device such as the rpi than a webserver (like using XBMC on a HTPC), so your project may have a future :) Good luck!
- jcook818 13y ago
  It is an operating system with a control panel, but the control panel is/will be a lot more comprehensive than Webmin or analogous server management apps. Whereas Webmin gives you a web interface with which to manage your server, if you don't understand how Apache/nginx/etc work then you still won't be able to add your own website, for example. If you have no idea about mail relays, virtual domains and so on, you probably will be way over your head if you try to host your own email. Genesis grinds the learning curve down as much as possible, by allowing websites (or other plugins like email/XMPP and so on) to be added with wizards and non-complicated language. Closer to Zentyal's web administration systems than that of Webmin. But it still represents a big improvement over how Zentyal works when we are just talking about personal use.

ceejayoz 13y ago

This defends against the Dropbox part of PRISM, but hardly the rest of it.

jcook818 13y ago
The idea is that it would provide an easy alternative to the services that are provided by these large companies, i.e. Google Talk (or whatever they call it nowadays) replaced with an XMPP server, Gmail replaced with self-hosted email, Dropbox replaced by your own self-hosted instance of ownCloud, etc. The only part of PRISM that it might not provide a defence against would be big social networks (Facebook et al), but you would still be able to host your own StatusNet instance or Tent server on your arkOS server and have alternatives that way. When services can be decentralized and brought back under individual user control, a "direct link" into major web company's servers is definitely made irrelevant.
- muyuu 13y ago
  I don't see how does it provide any of that. This is a server administrator, isn't it? like old school Webmin for instance?
  - jcook818 13y ago
    It gives you the same abilities as Webmin, but it is/will be so much more. No need to fiddle around with config files (like Webmin) but at the same time it presents the configurations in ways that non-sysadmins might hope to understand. Installing and configuring webapps like Wordpress/Drupal/ownCloud and others with one click. Managing websites and emails in an intuitive and "easy" way. Webmin is great, but if you aren't a Linux sysadmin it doesn't really make hosting things any easier. Think of arkOS/Genesis as Webmin but with a better design, much easier to use and a more modular style of operation. It's kinda hard to explain because the plugins I am referring to are still works-in-progress. But as a longtime Webmin user, I can assure you that it goes above and beyond what Webmin does. It's actually a lot closer to Zentyal, but targeted for personal use, and bringing in many more improvements.

runako 13y ago

Your server's down.

jcook818 13y ago
Ugh, wonderful timing. Thanks for letting me know Edit: Fixed, for now
mindcrime 13y ago
That was probably just a temporary blip caused by the NSA installing their beam splitter and/or backdoor code.

captiva12 13y ago

Any of the personal cloud solutions like Tonido or your own NAS will help as well.

__voidcast__ 13y ago

Chrome is giving me a Invalid Server Certificate error on the site(I had to edit the https to http ). This would definitely be a good way to use my ownCloud :-)

jcook818 13y ago
Really? That's weird, it works just fine for me...
- pseut 13y ago
  I'm getting the same thing with Konqueror edit: same thing = same problem
ChrisAntaki 13y ago
You could be experiencing a man in the middle attack. ;)

rohall 13y ago

Does anyone know of anything similar to arkOS that I could throw on a netbook? I'm thinking of installing Ubuntu and building it out myself, but if there's a pre-made distro that would be helpful.

jcook818 13y ago
Not that I'm aware of, sorry. Zentyal is an option, but I believe it is geared towards small business, and is probably closer to Webmin than arkOS/Genesis. I do have plans of making arkOS work on x86-based systems, but my first goal is armv6 and armv7 (RPI, Beagleboard Black, etc)

sciurus 13y ago

"arkOS is designed for use on the Raspberry Pi" What about this is specific to the Raspberry Pi, and why? Can Genesis run on any Arch Linux installation?

jcook818 13y ago
The operating system that Genesis runs on is packaged for installation on the Raspberry Pi, and its software packages are compiled for armv6 at this time. That being said, you can run Genesis on Arch Linux with little difficulty by just cloning the Github repo. arkOS is designed for use on the RPi at this time, because my goal is to create the best user experience possible at the lowest possible entry price. Lowering the barriers to self-host one's data and all that. Once Genesis is closer to its 1.0 release (and hopefully once I have more volunteers to help out), arkOS will be extended to more powerful platforms like the Beagleboard Black (armv7) and ultimately x64/64 systems. Since I'm only one person at the moment, I thought it prudent to start with a small focus then expand from there.
- StavrosK 13y ago
  Plus, you can sell pre-installed microSD cards for $10, which should bring some revenue to help the project along.

so898 13y ago

I find my Raspberry Pi and install this OS, feel cool. But I think I will keep my ownCloud staffs, because I have two PCs and one Mac running three different systems... If arkOS could support Mac and Win, I will have a try again. BTW, the ownCloud really always delete my files when sync, which make me always want to go back to Dropbox...

mwcampbell 13y ago

Excellent project! We need to pull together and fund this so jcook818 can work on it full time. jcook818, how can we contribute? Have you thought about setting this up on Kickstarter or the like?

jcook818 13y ago
Hi there -- I do have plans for a Kickstarter, with some very interesting ideas on things that will be offered. Won't get into too much detail, but it will be awesome I can assure you :) I need to find a helper / partner before I can get to that stage though. Check my comment above for details. If you are interested in donating NOW which really helps server fees and other overhead, you are certainly welcome to do so and it is much appreciated. https://ark-os.org/donate https://ark-os.org/donate

pinaceae 13y ago

doesn't this just solve a piece of the mess? it is the communications channels being monitored, so email, chats, voip, whatever messages would still be easily tapped into. they control the pipes, the endpoints do not matter much.

jcook818 13y ago
Notwithstanding a MITM attack, the pipes are secure enough, provided you are properly using encryption. If an app stores any sort of data unencrypted on a centralized server, that data is potentially accessible to others who can compromise that server. This makes endpoints a piece of critical importance. When you self-host your data, you can patch that hole in the armour so to speak, because the endpoint falls under your control. Coupled with encryption, it's a massive deterrent to eavesdropping. In brief: it doesn't solve every Internet eavesdropping problem known to man, no. But it solves a very substantial one that hasn't really been tackled to date.

ippisl 13y ago

Jacob , It's great that you're working on this. But isn't the biggest problem with security/privacy is that people don't care about it and don't use privacy enhancing products? Because if that's the case, the starting point should be a viable marketing strategy - which will define the product. Snapchat is is a good example of this. They wrap a viable user need with a privacy preserving idea with great marketing. Have a look at their site.

jcook818 13y ago
Hi there! Yes, I agree that apathy is a big problem. My hypothesis is that apathy can be driven down once the investment in time/money/education required for self-hosting services is reduced. If it can't be, then more educational campaigns are needed. I'm not really a marketing-type of person, but I would love to have someone on the project that can do this sort of thing, and be more of a conduit for the community. I only have two hands on the project at this point, but hopefully in the future that will change :)
- ippisl 13y ago
  There are secure services for IM/VOIP and maybe email(npt sure how secure) and of course TOR. Some are very easy to use like Redphone/textSecure which integrate transparently with android calls/meessaging. As far i can understand, they didn't grab much popularity. So i'm not sure ease of alone is enough. I'm not really a marketing person too, just interested in it, so i don't think i could help much. Anyway, best of luck with the project.

miaui 13y ago

what license is this released under?

jcook818 13y ago
The management interface (Genesis) is GPLv3.

jaakl 13y ago

It does not really resolve problem for the fully paranoid. Instead (and in addition to) of service providers the backdoors could be installed to your software, Raspberry Pi, or even to silicon. There is small number of providers of any of these, so they are quite easy to be controlled by interested parties. Solution: publish designs, so everyone will write your own software, build your own hardware.