Synology patches unannounced multiple zero-day vulnerabilities | Hacker News Reader

Synology patches unannounced multiple zero-day vulnerabilities

synology.com

62 pointsguiambros11 comments

Things like this are why I keep throwing sidelong glances at Synology instead of QNAP I currently use. Sure, the QNAP is only behind my LAN, and it's job is exclusively to manage hard drives and give a warning when one gives out (or is about to) - and it does that well.

But being able to have it closer to the WAN (even if just to share photos to others without Google Photos or similar), and the attention to security that enables that, is something I keep half-wishing I'd gone with Synology for.

Maybe Immitch (or similar for sharing photos with friends) will improve to the point I can use that on my Debian server instead, and treat the QNAP as bulk storage and nothing more. And if there are suggestions for something better (for photo sharing outside the LAN), I'm all ears!

QNAP largely ignores security researchers that finds major flaws. I honestly wouldn't trust them because of that attitude alone.

https://www.theregister.com/2024/05/20/qnap_watchtowr/

Of course, their lack of care for the quality of the product goes back aways(2012): https://forum.qnap.com/viewtopic.php?t=67450

My combination for photo hosting is:

- headscale+tailscale

- immich

- syncthing

I am not using native immich photo upload due to historical reasons and old habits. I set up native upload using immich to my child, will see in a couple of months how it pans out.

I've been using immich for ~3 months and am really happy so far. It was so good that I bought a server license[1]. ;)

Setting it up is quite simple. Most of the LoC comes from sharing the folders between my user (which owns the photos) and immich: https://git.jakstys.lt/motiejus/config/src/commit/6ecb1625e0...

[1]: https://immich.app/blog/2024/immich-licensing/

You could switch to Synology to use their photo app: https://www.synology.com/en-global/DSM70/SynologyPhotos

I've seen people do the self-hosted route such as Nextcloud, and people commonly suggest Immitch, but I think these solutions are at least partially about the love to tinker and self-host first, and useful photo sharing second. It's hard to beat the Apple and Google solutions and their polish and low-friction sharing. The price/GB is superior to what I can self-host, and there's no tinkering required.

How are you taking these photos in the first place? If it's iOS or Android, why not stay in those ecosystems? Being sentimental and a bit of an organizer, I've ended up as a bit of a digital archivist, and found my family actually engages and shares back more when I just use Google Photos.

Please don't buy a Synology just for that app. It is absolutely horrible. As of lately they have deferred HEIC / HEVC encoding to the devices uploading the photo/videos, because they don't want to pay for the license.

Next to that the application touts itself as a backup application. When I think backup, I think matching checksums. So when you take video on an iPhone in slow motion (120/240 fps) I expect the uploaded version to be the same fps, and just played slower to give the effect of slow motion.

Except the application exports the video, so you end up with a 30fps video.

Imagine you backing up your PSDs with 473 layers, and the backed-up version is a flattened PNG. That is what Synology does.

Do yourself a favor and get immich.

Immich is great and you can use a debian server to do the photo processing part while the main management app runs on synology directly. It works really well and it’s come a really long way. The only feature I’m missing from google photos right now is the bulk delete from the phone, they’re just hesitant to implement that because they don’t want to be liable for accidentally deleting the wrong photos I suppose.

Thank you for mentioning this! That's utterly terrible. I have had a Synology for years but never got around to trying the Photos app. This makes me not want to bother trying.

Personally I'm running a combination of Google Photos, Ente and syncthing.

Might have a look Immich, first time I'm hearing about it.

And this darn update is going to force all the holdouts who still wanted server side encoding/decoding into removing it or being vulnerable.

I wouldn't use either of them.

You only have to spend a few minutes poking around any of these corporations' custom Linux distros to see they are almost universally fucking awful. Consider, Synology ship many of their NAS type devices with BTRFS as the default/only option, as if that were a perfectly reasonable thing to do. And QNAP's engineers might be dangerously overconfident in their understanding of ZFS, implementing basic features in ways that seem more cargo-cult driven than informed by actual ZFS mechanics—and as if that isn't enough, recklessly extending it at a low level while continuing to call it ZFS because who wouldn't want to ride those coattails?

I suppose this is probably obvious, but I believe meaningful quality and capitalism are fundamentally incompatible—especially security, as in the real (i.e. non-theatre) version, because it tends to be obnoxious when done correctly, and the moment the marketing department gets to veto boring nerd shit, well, good luck. Just look at the so-called enterprise network security vendors like Fortinet and SonicWall, it's honestly mind-blowing what they get away with.

The idea with market driven progress is that products and services that meet demands will by competition for consumer money win out. One problem here is the lack of clear metrics or authorities for comparing performance and security. Another problem is that consumers tend to prefer extremely cheap solutions even if they do not work well. None of this necessarily blocks good solutions. It is important to acknowledge just how relatively young the market for consumer network storage peripherals is.

I agree with most of this, but I'd argue that the "products that meet demands will [win]" part is specious: marketing / sales often target a business demographic of people who consider themselves technical but aren't.

Reply on news.ycombinator.com