5 ms·

"""Do you plan to open the source code? Currently not. Opening the source code of Wuala would consume quite some time and effort, and commitment to maintain it

"""Do you plan to open the source code? Currently not. Opening the source code of Wuala would consume quite some time and effort, and commitment to maintain it. If you are a software engineer and would like to see how Wuala works, feel free to apply for a job at Wuala.""" ಠ_ಠ So.. an alternative, but not the solution we need.

venomsnake 13y ago
Don't open source it. Just give read and build for personal use permission. That should be enough. I don't think that I will be able to trust secure trough obscurity solution.
- pgeorgi 13y ago
  Or open up the protocol, for independent client implementations. With client-side crypto, the server doesn't matter much.
Toshio 13y ago
> "If you are a software engineer and would like to see how Wuala works, feel free to apply for a job at Wuala." A non-answer if I've ever seen one. What about someone who applies for a job at Wuala, gets rejected, but still wants to look at the source code?
- pablasso 13y ago
  And that's the only use case that bothers you?
  - stcredzero 13y ago
    You only need one counter example to poke a hole in a position.
shin_lao 13y ago
And what would having the source code change? Unless you host the data yourself, if you don't trust Wuala there is no guarantee the binaries you use are built from the source code you have.
- fmavituna 13y ago
  You can see the client code and confirm that it actually encrypts all of the data and use your own copy rather than their binaries. Technically if the client is not sending not encrypted data and encrypts without a foul, then nothing they can do on the server-side can cause leaking your data.
  - shin_lao 13y ago
    Just two ideas on top of my head: Through auto updates you can make sure that you get the backdoored version or you can have an exploit within the software to allow "silent" remote updates (good luck finding that). So well... Either you do it end to end, or you trust the third party.
    - claudius 13y ago
      Nobody sane wants software to auto-update, especially not security-relevant software. This is in particular true if you reviewed the source code of the software at one point in time. Furthermore, for the software to be able to even auto-update, it would have to be able to change its own binary. I don’t know how this particular piece of software works, but it is possible to run FUSE ‘drivers’ as a user on Linux, with the binary safely sitting in /usr/bin, hence removing any possibility to auto-update (if you don’t do shady tricks like placing an ‘updated’ binary somewhere and changing the user’s PATH – and even that could – in theory – be avoided by mounting all user-writeable things noexec).
      - drdaeman 13y ago
        From http://www.wuala.com/en/download/linux http://www.wuala.com/en/download/linux: > The package installs Wuala and registers our repository for further updates. This is even more harmful that it sounds, as someone who has repo access (be it some evil staff member or, more possibly, inturder) may push not only malicious Wuala build, but any package with higher version number than in other repos (say, a linux-image-999.999 with a bundled rootkit) and if user was incautious it will be installed on system update.
sigil 13y ago
So.. an alternative, but not the solution we need. Completely agree. We need 100% opensource client-side encryption tools. And at least in this space (cloud backup), we already have it, thanks to HN's own cperciva: http://www.tarsnap.com/ http://www.tarsnap.com/

venomsnake 13y ago

Don't open source it. Just give read and build for personal use permission. That should be enough. I don't think that I will be able to trust secure trough obscurity solution.

pgeorgi 13y ago
Or open up the protocol, for independent client implementations. With client-side crypto, the server doesn't matter much.

Toshio 13y ago

> "If you are a software engineer and would like to see how Wuala works, feel free to apply for a job at Wuala." A non-answer if I've ever seen one. What about someone who applies for a job at Wuala, gets rejected, but still wants to look at the source code?

pablasso 13y ago
And that's the only use case that bothers you?
- stcredzero 13y ago
  You only need one counter example to poke a hole in a position.

shin_lao 13y ago

And what would having the source code change? Unless you host the data yourself, if you don't trust Wuala there is no guarantee the binaries you use are built from the source code you have.

fmavituna 13y ago
You can see the client code and confirm that it actually encrypts all of the data and use your own copy rather than their binaries. Technically if the client is not sending not encrypted data and encrypts without a foul, then nothing they can do on the server-side can cause leaking your data.
- shin_lao 13y ago
  Just two ideas on top of my head: Through auto updates you can make sure that you get the backdoored version or you can have an exploit within the software to allow "silent" remote updates (good luck finding that). So well... Either you do it end to end, or you trust the third party.
  - claudius 13y ago
    Nobody sane wants software to auto-update, especially not security-relevant software. This is in particular true if you reviewed the source code of the software at one point in time. Furthermore, for the software to be able to even auto-update, it would have to be able to change its own binary. I don’t know how this particular piece of software works, but it is possible to run FUSE ‘drivers’ as a user on Linux, with the binary safely sitting in /usr/bin, hence removing any possibility to auto-update (if you don’t do shady tricks like placing an ‘updated’ binary somewhere and changing the user’s PATH – and even that could – in theory – be avoided by mounting all user-writeable things noexec).
    - drdaeman 13y ago
      From http://www.wuala.com/en/download/linux http://www.wuala.com/en/download/linux: > The package installs Wuala and registers our repository for further updates. This is even more harmful that it sounds, as someone who has repo access (be it some evil staff member or, more possibly, inturder) may push not only malicious Wuala build, but any package with higher version number than in other repos (say, a linux-image-999.999 with a bundled rootkit) and if user was incautious it will be installed on system update.

sigil 13y ago

So.. an alternative, but not the solution we need. Completely agree. We need 100% opensource client-side encryption tools. And at least in this space (cloud backup), we already have it, thanks to HN's own cperciva: http://www.tarsnap.com/ http://www.tarsnap.com/