7 ms·

Unfortunately OwnCloud is fundamentally broken because all "apps" share the same process and have to be written in PHP. The bigger the ecosystem gets, the harde

by zimbatm 12y ago

Unfortunately OwnCloud is fundamentally broken because all "apps" share the same process and have to be written in PHP. The bigger the ecosystem gets, the harder it is going to be to deal with security issues. If OwnCloud wants to become a reference platform for other developers it really has to tackle sandboxing and permissions.

UnoriginalGuy 12y ago
Just playing devil's advocate, but isn't this true with many CMSs? Most implement "users" (and or groups) either in-house or using the underlying OS, and when it is the underlying OS the CMS needs access to all of the user's files anyway to make cooperation and interoperability work, essentially placing a big bullseye on the CMS system itself.
- mariocesar 12y ago
  It's true and is the reason why so many PHP powered CMS are so insecure, how many times do you hear about a new wordpress exploit?
  - UnoriginalGuy 12y ago
    It really has nothing to do with PHP. Changing the language or framework wouldn't inherently change the design. e.g. http://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-11116/Microsoft-Sharepoint-Server.html http://www.cvedetails.com/vulnerability-list/vendor_id-26/pr...
    - tankenmate 12y ago
      Having said that PHP does make it very hard to run each interpreter process as the user it is doing work on behalf of. Some of the best systems out there run each user's process under it's own uid:gid (or equivalent), and each user has their own filespace and/or database. Obviously this pushes the separation issues down to the OS kernel rather than in the app, but most widely used OS kernels get at least an order of magnitude more, most of the time several orders more, testing for these user separation security features. NIH, re-inventing the wheel and all that.
  - drzaiusapelord 12y ago
    how many times do you hear about a new linux kernel exploit? Pretty much everything is insecure. Writing things in not-php isn't the magical fix you seem to think it is.
    - moe 12y ago
      What an absurd comparison... The linux kernel has 16 million lines of code, Wordpress has 300k. Yet Wordpress[1] has had nearly as many security vulnerabilities as the kernel[2]; 194 vs 257 exploits. Wordpress is one of the most exploited software packages ever created. It is the textbook example of bad programming. Just mentioning the kernel when talking about Wordpress is pretty ridiculous. [1] http://www.cvedetails.com/vulnerability-list/vendor_id-2337/product_id-4096/Wordpress-Wordpress.html http://www.cvedetails.com/vulnerability-list/vendor_id-2337/... [2] http://www.cvedetails.com/vulnerability-list/vendor_id-33/product_id-47/cvssscoremin-7/cvssscoremax-7.99/Linux-Linux-Kernel.html http://www.cvedetails.com/vulnerability-list/vendor_id-33/pr...
      - jordanlev 12y ago
        I am no fan of wordpress, and I agree that it is a textbook example of bad programming... but it is also a textbook example of good community management and success at empowering non-programmers to have their own web presence. And I believe that the amount of exploits has as much to do (if not moreso) with its sheer popularity as it does with the code.
      - maratd 12y ago
        > Wordpress is one of the most exploited software packages ever created. Hyperbole much? It's one of the most popular software packages installed on the web. It's not surprising it has a lot of eyes on it.
        moe 12y ago
        This has nothing to do with eyes. Dozens of other packages have a much larger install base than Wordpress. Wordpress has 32(!) CVE's tagged with "Exec Code" (remote code execution) alone. The last one a mere 6 months old. If you know another project that comes even remotely close to that then I'd be genuinely curious which one that would be?
- zimbatm 12y ago
  The difference is that OwnCloud is marketed as an operating system and is aimed at holding all the user's personal information. Users who aren't necessarily knowledgeable enough to distinguish trusted and untrusted "applications". A CMS is usually used by a company and has different threat scenarios. Usually only sysadmins configure and install extensions.
drzaiusapelord 12y ago
>and have to be written in PHP. How is this different than other HN beloved products like Drupal or pretty much any CMS? I can't think of any single one that has proper sandboxing. OwnCloud is just a type of CMS really, but instead of managing HTML, it manages all sorts of filetypes.
- orblivion 12y ago
  I would argue that the security of what one would put in Owncloud is more important, as an individual, than what one would put into Drupal. But you can correct me on that, I haven't really used a CMS.
finalight 12y ago
wordpress is in php wikipedia is in php facebook is in php flickr is in php photobucket is in php need i say more?
- Spooky23 12y ago
  > wordpress is in php That pretty much makes the point. 194 vulnerabilities in Wordpress with CVEs in 2014. http://www.cvedetails.com/vulnerability-list/vendor_id-2337/product_id-4096/Wordpress-Wordpress.html http://www.cvedetails.com/vulnerability-list/vendor_id-2337/...
  - iancarroll 12y ago
    I would argue it is the developer writing the code, not the language it's written in.
    - frabcus 12y ago
      Tools can help developers write safer code. Yes, a good developer can write safe code in bad environment. But an average developer writes safer code in a good environment.
  - pbhjpbhj 12y ago
    That list appears to include CVE going back to 2006 at least. I count 17 in 2014, the highest rated of which is an arbitrary code exectution (CVE-2014-5203) rated 7.5. Not sure number of disclosed flaws is a good metric to look at, whether it's high or low.
    - IshKebab 12y ago
      Arbitrary code execution is pretty damn bad. Anyway he wasn't just counting vulnerabilities. Wordpress is renowned for its terrible security (or plugins with terrible security often).
      - pbhjpbhj 12y ago
hbbio 12y ago
It's still a bit ahead of launch, but we are preparing an open source alternative to OwnCloud (that also includes messaging platform) that acts as an OAuth server for apps/plugins and an API and does not impose all apps to be implemented in the same language. We are using a NodeJS runtime, but the code is generated using a strongly statically typed language, Opa. Source code is not yet published, will be AGPL. Docker containers: https://github.com/MLstate/PEPS https://github.com/MLstate/PEPS
- atoponce 12y ago
  > It's still a bit ahead of launch, but we are preparing an open source alternative to OwnCloud OwnCloud is licensed under the AGPLv3. Curious why you think it's not Open Source Software.
  - hbbio 12y ago
    Was not speaking about OwnCloud, but PEPS which is going to be AGPLv3 in a few days.
  - bestham 12y ago
    FreeBSD is an open source alternative to Linux. Not saying that Linux is closed source.
amirmc 12y ago
If we want to do this in a way where everyone can run their own infrastructure then we've got to tackle some of the distributed systems problems. Specifically, life-cycle management of software/apps, how things sync/backup, and issues of identity and connectivity. One method is to take a clean-slate approach and build up a new stack (with its own trade-offs) e.g. Using unikernels as a base http://amirchaudhry.com/brewing-miso-to-serve-nymote/ http://amirchaudhry.com/brewing-miso-to-serve-nymote/
pbhjpbhj 12y ago
Is there a better alternative to OwnCloud that doesn't have similar flaws? I'm not being sarcastic, it's fine to say it's broken but that doesn't really make a difference if there are still no better alternatives!?
- vertex-four 12y ago
  Sandstorm, a platform which allows users to run arbitrary applications on a server in a secure sandbox. Of course, OwnCloud is at version 8 and Sandstorm is still working out its permissions UI.
  - jrochkind1 12y ago
    I think they've got different goals. My impression OwnCloud aims to be a replacement for "the google suite" (not search, but mail, docs, calendar, etc) -- it's really focused at the app layer. I think this is appropriate and there is a need for this. There's also a need for "a platform which allows users to run arbitrary applications on a server in a secure sandbox", and certainly you can hypothetically build what OwnCloud is aiming at on such a platform. But it's going to take a lot more time and be harder to get right and be reliable and be easy to install and run. I think OwnCloud is trying to be as easy to install and run as possible, to get a replacement for the google suite wwith apps that work as well as possible and are as easy to use as possible. I think this is a good goal, and they are making reasonable choices toward accomplishing that goal. I am not sure how well they've succeeded.
    - vertex-four 12y ago
      I believe the point of Sandstorm is to allow people to install mail/docs/calendar apps as simply as possible. It already has multiple document editors ported. To install apps into Sandstorm, you literally just click on a link - Sandstorm will manage grabbing the app and installing it for you. Sandstorm itself is a self-contained daemon that can run on any Linux server (and, at some point, there'll be an ISO to install an auto-updating Linux with Sandstorm on it).
    - 12y ago

by zimbatm 12y ago

UnoriginalGuy 12y ago

Just playing devil's advocate, but isn't this true with many CMSs? Most implement "users" (and or groups) either in-house or using the underlying OS, and when it is the underlying OS the CMS needs access to all of the user's files anyway to make cooperation and interoperability work, essentially placing a big bullseye on the CMS system itself.

mariocesar 12y ago
It's true and is the reason why so many PHP powered CMS are so insecure, how many times do you hear about a new wordpress exploit?
- UnoriginalGuy 12y ago
  It really has nothing to do with PHP. Changing the language or framework wouldn't inherently change the design. e.g. http://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-11116/Microsoft-Sharepoint-Server.html http://www.cvedetails.com/vulnerability-list/vendor_id-26/pr...
  - tankenmate 12y ago
    Having said that PHP does make it very hard to run each interpreter process as the user it is doing work on behalf of. Some of the best systems out there run each user's process under it's own uid:gid (or equivalent), and each user has their own filespace and/or database. Obviously this pushes the separation issues down to the OS kernel rather than in the app, but most widely used OS kernels get at least an order of magnitude more, most of the time several orders more, testing for these user separation security features. NIH, re-inventing the wheel and all that.
- drzaiusapelord 12y ago
  how many times do you hear about a new linux kernel exploit? Pretty much everything is insecure. Writing things in not-php isn't the magical fix you seem to think it is.
  - moe 12y ago
    What an absurd comparison... The linux kernel has 16 million lines of code, Wordpress has 300k. Yet Wordpress[1] has had nearly as many security vulnerabilities as the kernel[2]; 194 vs 257 exploits. Wordpress is one of the most exploited software packages ever created. It is the textbook example of bad programming. Just mentioning the kernel when talking about Wordpress is pretty ridiculous. [1] http://www.cvedetails.com/vulnerability-list/vendor_id-2337/product_id-4096/Wordpress-Wordpress.html http://www.cvedetails.com/vulnerability-list/vendor_id-2337/... [2] http://www.cvedetails.com/vulnerability-list/vendor_id-33/product_id-47/cvssscoremin-7/cvssscoremax-7.99/Linux-Linux-Kernel.html http://www.cvedetails.com/vulnerability-list/vendor_id-33/pr...
    - jordanlev 12y ago
      I am no fan of wordpress, and I agree that it is a textbook example of bad programming... but it is also a textbook example of good community management and success at empowering non-programmers to have their own web presence. And I believe that the amount of exploits has as much to do (if not moreso) with its sheer popularity as it does with the code.
    - maratd 12y ago
      > Wordpress is one of the most exploited software packages ever created. Hyperbole much? It's one of the most popular software packages installed on the web. It's not surprising it has a lot of eyes on it.
      - moe 12y ago
        This has nothing to do with eyes. Dozens of other packages have a much larger install base than Wordpress. Wordpress has 32(!) CVE's tagged with "Exec Code" (remote code execution) alone. The last one a mere 6 months old. If you know another project that comes even remotely close to that then I'd be genuinely curious which one that would be?
zimbatm 12y ago
The difference is that OwnCloud is marketed as an operating system and is aimed at holding all the user's personal information. Users who aren't necessarily knowledgeable enough to distinguish trusted and untrusted "applications". A CMS is usually used by a company and has different threat scenarios. Usually only sysadmins configure and install extensions.

drzaiusapelord 12y ago

>and have to be written in PHP. How is this different than other HN beloved products like Drupal or pretty much any CMS? I can't think of any single one that has proper sandboxing. OwnCloud is just a type of CMS really, but instead of managing HTML, it manages all sorts of filetypes.

orblivion 12y ago
I would argue that the security of what one would put in Owncloud is more important, as an individual, than what one would put into Drupal. But you can correct me on that, I haven't really used a CMS.

finalight 12y ago

wordpress is in php wikipedia is in php facebook is in php flickr is in php photobucket is in php need i say more?

Spooky23 12y ago
> wordpress is in php That pretty much makes the point. 194 vulnerabilities in Wordpress with CVEs in 2014. http://www.cvedetails.com/vulnerability-list/vendor_id-2337/product_id-4096/Wordpress-Wordpress.html http://www.cvedetails.com/vulnerability-list/vendor_id-2337/...
- iancarroll 12y ago
  I would argue it is the developer writing the code, not the language it's written in.
  - frabcus 12y ago
    Tools can help developers write safer code. Yes, a good developer can write safe code in bad environment. But an average developer writes safer code in a good environment.
- pbhjpbhj 12y ago
  That list appears to include CVE going back to 2006 at least. I count 17 in 2014, the highest rated of which is an arbitrary code exectution (CVE-2014-5203) rated 7.5. Not sure number of disclosed flaws is a good metric to look at, whether it's high or low.
  - IshKebab 12y ago
    Arbitrary code execution is pretty damn bad. Anyway he wasn't just counting vulnerabilities. Wordpress is renowned for its terrible security (or plugins with terrible security often).
    - pbhjpbhj 12y ago

hbbio 12y ago

It's still a bit ahead of launch, but we are preparing an open source alternative to OwnCloud (that also includes messaging platform) that acts as an OAuth server for apps/plugins and an API and does not impose all apps to be implemented in the same language. We are using a NodeJS runtime, but the code is generated using a strongly statically typed language, Opa. Source code is not yet published, will be AGPL. Docker containers: https://github.com/MLstate/PEPS https://github.com/MLstate/PEPS

atoponce 12y ago
> It's still a bit ahead of launch, but we are preparing an open source alternative to OwnCloud OwnCloud is licensed under the AGPLv3. Curious why you think it's not Open Source Software.
- hbbio 12y ago
  Was not speaking about OwnCloud, but PEPS which is going to be AGPLv3 in a few days.
- bestham 12y ago
  FreeBSD is an open source alternative to Linux. Not saying that Linux is closed source.

amirmc 12y ago

If we want to do this in a way where everyone can run their own infrastructure then we've got to tackle some of the distributed systems problems. Specifically, life-cycle management of software/apps, how things sync/backup, and issues of identity and connectivity. One method is to take a clean-slate approach and build up a new stack (with its own trade-offs) e.g. Using unikernels as a base http://amirchaudhry.com/brewing-miso-to-serve-nymote/ http://amirchaudhry.com/brewing-miso-to-serve-nymote/

pbhjpbhj 12y ago

Is there a better alternative to OwnCloud that doesn't have similar flaws? I'm not being sarcastic, it's fine to say it's broken but that doesn't really make a difference if there are still no better alternatives!?

vertex-four 12y ago
Sandstorm, a platform which allows users to run arbitrary applications on a server in a secure sandbox. Of course, OwnCloud is at version 8 and Sandstorm is still working out its permissions UI.
- jrochkind1 12y ago
  I think they've got different goals. My impression OwnCloud aims to be a replacement for "the google suite" (not search, but mail, docs, calendar, etc) -- it's really focused at the app layer. I think this is appropriate and there is a need for this. There's also a need for "a platform which allows users to run arbitrary applications on a server in a secure sandbox", and certainly you can hypothetically build what OwnCloud is aiming at on such a platform. But it's going to take a lot more time and be harder to get right and be reliable and be easy to install and run. I think OwnCloud is trying to be as easy to install and run as possible, to get a replacement for the google suite wwith apps that work as well as possible and are as easy to use as possible. I think this is a good goal, and they are making reasonable choices toward accomplishing that goal. I am not sure how well they've succeeded.
  - vertex-four 12y ago
    I believe the point of Sandstorm is to allow people to install mail/docs/calendar apps as simply as possible. It already has multiple document editors ported. To install apps into Sandstorm, you literally just click on a link - Sandstorm will manage grabbing the app and installing it for you. Sandstorm itself is a self-contained daemon that can run on any Linux server (and, at some point, there'll be an ISO to install an auto-updating Linux with Sandstorm on it).
  - 12y ago