5 ms·

Btw. ownCloud 6.0.1 was released yesterday: http://owncloud.org/releases/Changelog http://owncloud.org/releases/Changelog

by SunboX 13y ago

est 13y ago
God I love the idea of ownCloud so much but secretly hope it's not written in PHP. I run a wordpress site for 3 years, and one day a hacker took my site over with a bug from a plugin.
- deleted 13y ago
  [deleted]
- rabino 13y ago
  Indeed, that's proof that PHP is bad. And that all other frameworks in other languages don't have bugs that can be exploited.
  - krapp 13y ago
    (cough yaml parser cough) ... indeed.
- SunboX 13y ago
  Something like this will happen with any bad written code. It's not PHP related. But you are right, PHP makes it easy to write bad code. There's no "security" layer build in. I hope ownCloud gets public enought to be secure. If more eyes look at the source they will hopfully do a good job.
- camus2 13y ago
  well, you had a problem with a badly written wordpress plugin ,not PHP. or are you saying PHP is insecure and no insecure code can be written in other plateforms ? for a project to be popular amongs developers and hobbyists , it has to be written in PHP, because PHP is easy to deploy even if you dont know PHP. By the way, most CMSes on other plateforms assume you know the language , PHP CMSes dont, so maybe there is some effort to be made on these plateform to make thing easier or write better docs. Wordpress would not be popular if it was in Python,Ruby or Java. Anyway the issue is with Wordpress plugin architecture , not PHP. A clean plugin architecture would require some kind of DSL instead of plain PHP.
  - est 13y ago
    > you had a problem with a badly written wordpress plugin The plugin is top 10 popular one > because PHP is easy to deploy even if you dont know PHP. Wordpress has clean URL, but under the hood many .php files are directly accessible via URL, so hacker found a exploit, crafted a parameter aginst one particular .php, and got in. The solution? Limit URL entry to only one .php file (like index.php), more rewrite configs and mod_security. So you lost the benefit of copy-to-update, it becomes just as hard like other language/frameworks. As ownCloud community grows, I think this problem will surf again and it will end up like many PHP forum/CMS today. You can put up a usable site very quickly, but once or few months you have to patch the system, and many plugins you need most are abandon-ware.
    - krapp 13y ago
      What plugin was it, and did you report the issue, and was this recent?
    - dspillett 13y ago
      * > > you had a problem with a badly written wordpress plugin > The plugin is top 10 popular one* Popular !== Good (where in this case good is in the context of being well written) > so hacker found a exploit, crafted a parameter aginst one particular .php, and got in That could happen with almost any laguage/framework though. While PHP makes it easy to write bad code (as do other options) it doesn't make it impossible to write secure code and you can't blame PHP and/or Wordpress for every bad plugin out there, even the massively popular ones.
- mverwijs 13y ago
  > hope it's not written in PHP. It is though.
- carsonreinke 13y ago
  What are you talking about? You have written off PHP because of a WordPress plugin issue.
- laumars 13y ago
  I hate PHP as a language, I really do, but bugs can happen in any language (eg C++ bugs are exploited all the time to gain machine access). Plus when you get a platform as popular as Wordpress, you'll find that it will constantly be under attack from 'hackers' who bank on people being slow to update their plugins. With regards to ownCloud, that is PHP by the way.
OGC 13y ago
It's written in PHP and had numerous showstopping bugs unfortunately (atleast when i tried it out, which was 2 months ago). Syncing didn't even work. I'm running Seafile at the moment, http://seafile.com/en/home/ http://seafile.com/en/home/ which seems to work OK.
laumars 13y ago
Personally I prefer 'Pydio' (formerly AjaXplorer): http://pyd.io/ http://pyd.io/ Though I do also run ownCloud for automatic photo uploads from my phone
- josephlord 13y ago
  Despite the name Pydio seems to be developed in PHP too.
  - laumars 13y ago
    Which changes nothing.
    - josephlord 13y ago
      It changes nothing but it is a fact. The original ancestor of this thread was put off Owncloud by the fact it was PHP and Pydia was offered as an alternative. The name suggest at least to me that it would be Python based. Now whether the PHP should put us off is a separate question. I have probably unfair doubts about the quality of things developed in PHP based worrying about the sort of people who would choose it when they have a free choice (see fractal of bad design post). However I personally don't want to learn PHP so I would prefer something in Python, Rails or possibly even Node (I've a feeling that I'm going to need to learn Javascript one day), Java, C or C+++ so that the barrier to me tinkering/fixing is lower.
      - laumars 13y ago
        You read too much into things: > The original ancestor of this thread was put off Owncloud by the fact it was PHP and Pydia was offered as an alternative. No, I said I preferred Pydio over ownCloud. You added the subtext to my post. > The name suggest at least to me that it would be Python based. Only if you place too much emphasis on naming conventions. Names are in fact just arbitrary labels, thus not everything that begins with "py" has to be written in Python. > Now whether the PHP should put us off is a separate question. I have probably unfair doubts about the quality of things developed in PHP based worrying about the sort of people who would choose it when they have a free choice (see fractal of bad design post). I'm aware of the Fractal Of Bad Design blog post and you're using that to justify your conclusion that 2+2=5. Just because a language might be -in our opinion- complete garbage to develop in, it doesn't mean all code developed in that language is garbage. And you're also making the assumption that all developers choose PHP because it's easy; where as many of these projects are actually written in PHP because it makes it easier for end users to deploy. > C or C+++ so that the barrier to me tinkering/fixing is lower. If you think writing a web application in C or C++ (two pluses) lowers the barrier of things that can go wrong or the amount of tinkering you'd need to do, then you clearly don't know what you're talking about. Sorry, but that last part just struck me as the stupidest thing I've read in a long time.
osxrand 13y ago
I haven't tried it since the previous version, but syncing a few directories with thousands of small files completely brought owncloud to its knees. The type of database used didn't matter, the syncing just started taking longer and longer, and because it hadn't started an auto sync in the last 10 (I think it's default time is) minutes, it would start another and essentially never be able to finish attempting to sync. Apart from that issue, I thought it was quite good, will have to give it another try.

Btw. ownCloud 6.0.1 was released yesterday: http://owncloud.org/releases/Changelog http://owncloud.org/releases/Changelog

by SunboX 13y ago

Btw. ownCloud 6.0.1 was released yesterday: http://owncloud.org/releases/Changelog http://owncloud.org/releases/Changelog

est 13y ago

God I love the idea of ownCloud so much but secretly hope it's not written in PHP. I run a wordpress site for 3 years, and one day a hacker took my site over with a bug from a plugin.

deleted 13y ago
[deleted]
rabino 13y ago
Indeed, that's proof that PHP is bad. And that all other frameworks in other languages don't have bugs that can be exploited.
- krapp 13y ago
  (cough yaml parser cough) ... indeed.
SunboX 13y ago
Something like this will happen with any bad written code. It's not PHP related. But you are right, PHP makes it easy to write bad code. There's no "security" layer build in. I hope ownCloud gets public enought to be secure. If more eyes look at the source they will hopfully do a good job.
camus2 13y ago
well, you had a problem with a badly written wordpress plugin ,not PHP. or are you saying PHP is insecure and no insecure code can be written in other plateforms ? for a project to be popular amongs developers and hobbyists , it has to be written in PHP, because PHP is easy to deploy even if you dont know PHP. By the way, most CMSes on other plateforms assume you know the language , PHP CMSes dont, so maybe there is some effort to be made on these plateform to make thing easier or write better docs. Wordpress would not be popular if it was in Python,Ruby or Java. Anyway the issue is with Wordpress plugin architecture , not PHP. A clean plugin architecture would require some kind of DSL instead of plain PHP.
- est 13y ago
  > you had a problem with a badly written wordpress plugin The plugin is top 10 popular one > because PHP is easy to deploy even if you dont know PHP. Wordpress has clean URL, but under the hood many .php files are directly accessible via URL, so hacker found a exploit, crafted a parameter aginst one particular .php, and got in. The solution? Limit URL entry to only one .php file (like index.php), more rewrite configs and mod_security. So you lost the benefit of copy-to-update, it becomes just as hard like other language/frameworks. As ownCloud community grows, I think this problem will surf again and it will end up like many PHP forum/CMS today. You can put up a usable site very quickly, but once or few months you have to patch the system, and many plugins you need most are abandon-ware.
  - krapp 13y ago
    What plugin was it, and did you report the issue, and was this recent?
  - dspillett 13y ago
    * > > you had a problem with a badly written wordpress plugin > The plugin is top 10 popular one* Popular !== Good (where in this case good is in the context of being well written) > so hacker found a exploit, crafted a parameter aginst one particular .php, and got in That could happen with almost any laguage/framework though. While PHP makes it easy to write bad code (as do other options) it doesn't make it impossible to write secure code and you can't blame PHP and/or Wordpress for every bad plugin out there, even the massively popular ones.
mverwijs 13y ago
> hope it's not written in PHP. It is though.
carsonreinke 13y ago
What are you talking about? You have written off PHP because of a WordPress plugin issue.
laumars 13y ago
I hate PHP as a language, I really do, but bugs can happen in any language (eg C++ bugs are exploited all the time to gain machine access). Plus when you get a platform as popular as Wordpress, you'll find that it will constantly be under attack from 'hackers' who bank on people being slow to update their plugins. With regards to ownCloud, that is PHP by the way.

OGC 13y ago

It's written in PHP and had numerous showstopping bugs unfortunately (atleast when i tried it out, which was 2 months ago). Syncing didn't even work. I'm running Seafile at the moment, http://seafile.com/en/home/ http://seafile.com/en/home/ which seems to work OK.

laumars 13y ago

Personally I prefer 'Pydio' (formerly AjaXplorer): http://pyd.io/ http://pyd.io/ Though I do also run ownCloud for automatic photo uploads from my phone

josephlord 13y ago
Despite the name Pydio seems to be developed in PHP too.
- laumars 13y ago
  Which changes nothing.
  - josephlord 13y ago
    It changes nothing but it is a fact. The original ancestor of this thread was put off Owncloud by the fact it was PHP and Pydia was offered as an alternative. The name suggest at least to me that it would be Python based. Now whether the PHP should put us off is a separate question. I have probably unfair doubts about the quality of things developed in PHP based worrying about the sort of people who would choose it when they have a free choice (see fractal of bad design post). However I personally don't want to learn PHP so I would prefer something in Python, Rails or possibly even Node (I've a feeling that I'm going to need to learn Javascript one day), Java, C or C+++ so that the barrier to me tinkering/fixing is lower.
    - laumars 13y ago
      You read too much into things: > The original ancestor of this thread was put off Owncloud by the fact it was PHP and Pydia was offered as an alternative. No, I said I preferred Pydio over ownCloud. You added the subtext to my post. > The name suggest at least to me that it would be Python based. Only if you place too much emphasis on naming conventions. Names are in fact just arbitrary labels, thus not everything that begins with "py" has to be written in Python. > Now whether the PHP should put us off is a separate question. I have probably unfair doubts about the quality of things developed in PHP based worrying about the sort of people who would choose it when they have a free choice (see fractal of bad design post). I'm aware of the Fractal Of Bad Design blog post and you're using that to justify your conclusion that 2+2=5. Just because a language might be -in our opinion- complete garbage to develop in, it doesn't mean all code developed in that language is garbage. And you're also making the assumption that all developers choose PHP because it's easy; where as many of these projects are actually written in PHP because it makes it easier for end users to deploy. > C or C+++ so that the barrier to me tinkering/fixing is lower. If you think writing a web application in C or C++ (two pluses) lowers the barrier of things that can go wrong or the amount of tinkering you'd need to do, then you clearly don't know what you're talking about. Sorry, but that last part just struck me as the stupidest thing I've read in a long time.

osxrand 13y ago

I haven't tried it since the previous version, but syncing a few directories with thousands of small files completely brought owncloud to its knees. The type of database used didn't matter, the syncing just started taking longer and longer, and because it hadn't started an auto sync in the last 10 (I think it's default time is) minutes, it would start another and essentially never be able to finish attempting to sync. Apart from that issue, I thought it was quite good, will have to give it another try.