jospoortvliet

Hi folks,

It's true some of our functionality can be rebuilt if we rewrite this functionality with SAF - even though it makes the user experience a bit worse. We have a file manager/document management app, which fits the use case for the full permission. There are some functions that are popular with some users like syncing a whole SD card, the download folder or the data of specific apps (in Android/data - some users use our app in a way as backup) that are just not possible with SAF. We get the security concerns from Google, but Box has this permission, so do quite some others, so our preferred solution is to re-gain the permission rather than bring back part of the functionality.

The good news is that this morning Google got back to us and told us that on resubmission we will regain the permission we need and our users regain all functionality within a few days.

So, this seems to have been resolved in a nice way. Thanks, all for the support!

Maintaining a server can be a pita, and not upgrading frequently is both a security risk as well as problematic from a stability pov.

My recommendation would be to use our All-in-One docker image. It takes care of updates and is supremely easy to use, plus likely to bring nice performance benefits as it has all this stuff that makes it fast like the HPB for Files.

The Memories app is a LOT faster than the built in Photos app. I use it myself and it's quite nice, very doable on my down clocked old Intel CPU.

It's risky business, though, as code of course gets reviewed a few times (at least at Nextcloud). If it gets detected once ppl are put on notice. If somebody can squirrel out that the code came from a competitor, a lawsuit is waiting... And just imagine the bad publicity it causes.

Besides that, it is unethical and I wouldn't want to work at a company that pulls such stunts. I think a lot of people wouldn't. It'd be hard to keep secret, too, I mean, 5 years later the employee that was asked to do it works somewhere else and BOOM.

So all together, I think it's extremely unlikely to happen.

I CAN imagine a disgruntled ex employee or angry employee at a competitor would pull something like this. We have seen employees at a competitor create social media sock puppet accounts to spread FUD about us - but management at the competitor put a stop to that once we notified them.

This is, of course, exactly what Nextcloud does. It will most certainly refuse to run and break your system. And yes, it also refused that 3-4 years ago.

Not saying it never breaks anything, but since 2016 we for example check PHP versions and other infra to not update to a broken system. We rewrote the updater in 2016 for this purpose. It's possible this has had a bug at some point of course - but it is more likely that the original poster who had this issue had this in the ownCloud times before 2016.

The good news is that neither has investors...

With regards to security, nothing is perfect but I'm absolutely positive that Nextcloud is ahead of the vast majority of open source projects. And if you know of a security hole, go and collect your USD 10K at HackerOne.

Note that we're not backed by a a venture capital firm that needs a 10X exit, we're self-funded and have been sustainably growing ~50%/year since we got started. We're over 100 people so paying for 2 developers on Roundcube (tripling the resources being put into Roundcube today) would be trivial for us.

We'll look what users want, what's best for the ecosystem etc, but we're not looking to kill it and if we ever would, it won't be for the money.

Ha, I wish. Been working on this for weeks, it's even a little annoying oC kind'a pooped on the party by having that massive security hole...

In the AIO you have to explicitly choose to install them, in the bare metal setup they are not installed unless you choose so when you install for the first time. You're right that Nextcloud has gotten bigger, but Collabora is in no way a default part that you can't uninstall...

You might like to hear that in the upcoming release we re-wrote the front-end of Files, that'll be snappier. Hope it'll work well for you!

It'll depend on your requirements. Keep in mind that Nextcloud is the largest on-prem collab platform out there, so more users means more complaints... It is used in huge enterprise and government installations so it can definitely work, but it needs a decent setup. For a small company, use the Nextcloud AIO container I would say. For a big one, get Nextcloud Enterprise (starts at 100 seats) to make sure you get any issues addressed quickly.

Same here, but it's a big and complicated beast. I never lost data but then with hundreds of thousands of servers out there, somebody is bound to. Even if it's just due to bloody cosmic rays ;-)

I have good news for you: https://apps.nextcloud.com

Nextcloud is nothing more than a collection of small apps. You can disable even core things like sharing.

I beg to differ and so would our over 1000 customers, none of them with less than 100 seats (we don't sell below that). Most have 1000 users or more.

The largest has several tens of millions of users and they are using Global Scale. One customer runs nearly 4 million users on a single cluster.

Nextcloud is a complicated beast, and scaling to tens of thousands of users isn't trivial, but then that is what Nextcloud Enterprise is for. So if you need a large scale installation, no problem - contact our team and we get you up and running.

Let me also link to the rather long launch video: https://www.youtube.com/watch?v=8eoo7YhDECw

Loving it, that's very creative leoossa!

He, of course it is. Though, Google etc are doing a good job progressively taking control over email, they already have made running a private mail server a huge pita.

All reasonable if the company wasn't 8 years old, had 2500 employees and a turn-over of 600 million. They invested clearly near nothing in security over the last years. The extra scrutiny showed that, but it didn't CAUSE it.

You make it sound like a startup that build a piece of software quickly and forgot a few things.

There are two issues with that argument. First, they put in EXTRA effort to break the security of their users. The feature of 'upon de-installation, install a daemon on the system that silently re-installs the app whenever a zoom link is clicked' is MORE work than not doing that, for example. Second, they are 8 years old, have 2500 employees and a revenue of over 600 million. I work at a 30 ppl startup and I would not at all be surprised of we invested more hours in security in 2019 than Zoom did...

Well, yes, but now you're saying our trust is limited because other companies do bad.

But we have a pretty good reason, beyond that, to not trust Zoom - THEY clearly never gave a shit about security, given in a few weeks of people taking a slightly deeper look we've had pretty much every possible leak and bug and problem you can imagine crop up.

How long did it take Microsoft to go from "no-shits-are-given-security" to "security-is-core"? 2 decades, something like that?

So yeah, sure, 90 days, that's... well, maybe the beginnings of a start.

Actually, we already quoted them in an earlier blog: https://nextcloud.com/blog/a-wave-of-cities-all-over-europe-...

;-)

They should contact us - Nextcloud GmbH. A contract with us contains all indemnification they could ever want, so it should not be an issue at all. (A)GPL is used in a countless business environments, they're tried-and-true licenses that have been proven to be pro-customer. Especially if you have a proper vendor contract it's actually a huge advantage over the various vendor licenses and their often heavy-handed anti-user clauses.

So both the German and French governments host Nextcloud firewalled off from the internet. Others use things like a reverse proxy (City of Geneva). Most customers just run Nextcloud internet-facing, as that is the easiest if you want to collaborate and work remotely. We trust Nextcloud to be perfectly safe for that, at least as safe as any complex piece of software can every be, of course. We have a very active security team, the latest security measures and a bug bounty program where you get up to $5K for reporting issues to us.

First of all, we forked 3 years ago and have progressed very fast since then - there is, from what I know, no code going between the two code bases since 2 years or so.

Second, there is simply no reason to rewrite everything from scratch. We know our code base well enough to be able to maintain and keep driving it forward.

Nextcloud can already scale to hundreds of millions of users. See nextcloud.com/globalscale - GS is in production since 2017 and at at least one customer, some nodes have shown to scale to 250K users, as part of a larger architecture designed for tens of millions. We have about a half dozen other customers using GS or working on deployments, and some in proof-of-concept stage.

In short, we have no plans to change a working, proven architecture which actually scales from Raspberry Pi to a global deployment for something which actually doesn't do either of those.

Things have changed a fair bit since the early ownCloud days - you'll be hard pressed to find a large PHP app with so few security issues, and that's not me saying that but quoting a pentest firm hired by the Swiss city of Geneva which audited Nextcloud recently. See https://nextcloud.com/secure - thoughts are, of course, always welcome.

Sadly it's still in testing, but we (finally) managed to hire a 2nd developer so we're moving forward... 3rd job position is still open so if you're in C++ or know somebody who is - let them mail us!

"Although the purpose of these regulations is to limit the powers of big US Internet companies like Google or Facebook"

This has been stated very explicitly by the law makers, so yeah, it wasn't hard to state that. I'm not even going to bother searching for that.

Over 210 companies have signed, as of now, and I still have quite a backlog of signatories to add.

Sorry that the English isn't perfect, it was not written by native speakers.

Pleasure, thanks for the kind words!

... and now I see I probably replied to a sockpuppet account. Sigh sorry for the noise.

ownCloud seems to be going for hosting small and medium sized businesses, I'm not sure what that means for big organizations in the future.

Our customers tend to be bigger, actually. Like the German federal government with 300K users, companies like Siemens, german Radio & TV stations (transferring over 1TB/day!). Our biggest deployment (in a single instance) is over 20 million users - see nextcloud.com/globalscale for how we pull that off. ownCloud has no equivalent solution for such installations and breaks down at about 50K users.

For home users or very small businesses, the difference might not be that big but the migrations we do for customers show time and again that there is a big improvement in performance and reliability, especially on large installations.