In the first sentence they sound very bitter: "using recently poached developers" - Almost as if they're trying to say that poaching developers is a bad thing. Developers are people, you don't own them and they owe you zero allegiance.
- Lukas (Nextcloud'er - see also http://www.zdnet.com/article/owncloud-founder-forks-popular-...)
I know nothing of PHP other than its reputation. But apparently ownCloud is written in PHP and JavaScript. And PHP has its own "Security" section in its Wikipedia entry. And it has a reputation for security problems.
So, how "secure" (whatever that means) is ownCloud / Nextcloud? Has security been a problem for this software in real life?
There is often the perceiption that ownCloud would be insecure because we have so many advisories. But these are just there because we proactively look for security vulnerabilities and patch them. (see also https://statuscode.ch/2015/09/ownCloud-security-development-...)
Oh! And we also run a bug bounty program for ownCloud and Nextcloud will have one with probably even higher rewards soon! - HackerOne did even do a case study with us so it can't be too bad ;) (https://hackerone.com/resources)
Quite the contrary, most probably yes. Mistakes happen, but different languages make different kinds of mistakes impossible or very easy. You can't get segfault when manipulating strings in Perl or Python, while in C it takes plenty of effort to avoid.
But many of these problems can also be caught using the right tools and framework. With Ruby, using Rails will eliminate entire groups of risks you would have without it.
This is the same with PHP and frameworks like Symfony - which, incidentally, we use large parts off. And Lukas has been working a LOT on doing this kind of work, making sure we eliminate types of problems and mistakes developers could make. Combined with training (giving talks and workshops on writing secure code to our developers at events), code reviews by him and others, static code checking and so on, you get something that is really quite secure.
I am confident enough to say that our code base is the most secure way of sharing and syncing files using open source. Of course, before you or somebody else brings it up, SSH and rsync makes for a more secure experience but that's not exactly what Nextcloud competes with so perhaps add 'that gives a dropbox-like experience' to the above qualification :D
Radicale will also automatically commit every change into a Git repo, so you can always go back to any point in time. Just amazing.
https://www.stavros.io/posts/private-contacts-and-calendars-...
That said, we'll likely have Webcal support (https://github.com/owncloud/calendar/pull/443), that way you can at least in ownCloud view your Google calendars. (it's not synced though)