ownCloud 9 is Here
-
@jospoortvliet said:
@jospoortvliet said:
@JaredBusch the alternative would be for us to ship a PHP stack, CURL and everything else which is outdated or broken. We're not a distribution
Or, of course, to cease support for the platform. And we dropped support for some with ownCloud 9.0 - see the upgrade blog.
I would agree that if you feel the need to not trust the vendors that you support that you should remove them and focus on fewer. I think that throwing alerts for PHP while saying that you support the platform that you alert on is a bad combination. Don't call CentOS 7 fully patched "out of date" while saying you support the platform. Just say you don't support it and move on.
-
I think that this page is confusing. It doesn't just list CentOS and RHEL as peers with everyone else, it even lists CentOS first. If CentOS and RHEL are not supported, but are just "included for repos" there should be something that makes that clear. Going to this page led me to believe that CentOS was a top tier supported option:
https://download.owncloud.org/download/repositories/stable/owncloud/
-
What are the officially supported, no "you shouldn't run that", recommended distro(s) for ownCloud? How do we run it so that OC never sees us as doing anything except what is absolutely intended and recommended? I can't find clear documentation on that. What I found led me to the wrong stuff.
-
@scottalanmiller said:
@jospoortvliet said:
@jospoortvliet said:
@JaredBusch the alternative would be for us to ship a PHP stack, CURL and everything else which is outdated or broken. We're not a distribution
Or, of course, to cease support for the platform. And we dropped support for some with ownCloud 9.0 - see the upgrade blog.
I would agree that if you feel the need to not trust the vendors that you support that you should remove them and focus on fewer. I think that throwing alerts for PHP while saying that you support the platform that you alert on is a bad combination. Don't call CentOS 7 fully patched "out of date" while saying you support the platform. Just say you don't support it and move on.
That is the problem.
-
Here is what ownCloud is showing me as their distros. I'm confused...
Which of these are red herrings and which are real? CentOS and RHEL we've been told are "out of date" and unsupported in the other thread. SLE is old in the same ways as those. OpenSuse comes in Leap and Tumbleweed varieties. Leap is identical to SLE, so should have the same issues of being out of date. Debian isn't really a production platform. Same for Fedora. Ubuntu isn't ideal and has the confusion of their fake LTS and their every six months current release.
Where do we turn? What does ownCloud expect us to do?
-
I have a feeling that OpenSuse Tumbleweed, which many shops would be scared to run, is the actual only supported platform. That's not a horrible thing, if that is the case I would say just announce that, focus on it and move forward. Don't pretend that there aren't dependencies there and don't act like we aren't trying to stay totally current when we think we are doing what is recommended.
Just make it insanely clear that Tumbleweed is the one and only true supported platform and be done.
-
What's even crazier is that the worst possible option would be Ubuntu LTS. All of the "out of date" of something like CentOS 7 yet without the support infrastructure. ownCloud said that they are not in the distro business. Yet... they build their appliances on the most out of date, least supported option of the bunch, Ubuntu 14.04!! So these things totally conflict. ownCloud themselves is actively promoting the least business class, least supported, most out of date option while telling us that we are out of date and unsupported for trying to do the opposite.
I find this very upsetting. The message to the customers is extremely mixed.
-
@IRJ said:
The 9.0 appliance is built on Ubuntu 14.04
ownCloud just told us that LTS releases are conceptually bad (and I'm not disagreeing), so by extension, they don't feel that their own appliances are serious.
-
I'm not saying CENTOS or RHEL are not supported. I'm saying that those old versions ship with software with some know security issues and we warn for that. That is all. We're not in charge nor feel responsible for fixing those problems - they are Red Hat's or CentOS' problems, simple as that. But we want ownCloud users to be aware of problems we detect.
In case of the 'no internet access', this can be caused by a number of problems, from missing proper certificates to other stuff. I don't know why we don't give a more specific error message - perhaps nobody had time to investigate it, perhaps it is impossible as it is on a level below ownCloud (CURL is used by PHP which is used by ownCloud - we might not have access to the error that CURL throws).
Generally, the error is related to broken/insecure openSSL. My security guy tells me we actually do catch the broken-curl thing separately but some others are bunched together still.
Obviously, if customers bump into this, our support helps them track down the exact problem. There are probably even knowledge base articles available on our enterprise site on this subject. But that's different from users of the community edition of course. They have each other and the forums and github... Well, and a bit of me sometimes
-
@scottalanmiller said:
What's even crazier is that the worst possible option would be Ubuntu LTS. All of the "out of date" of something like CentOS 7 yet without the support infrastructure. ownCloud said that they are not in the distro business. Yet... they build their appliances on the most out of date, least supported option of the bunch, Ubuntu 14.04!! So these things totally conflict. ownCloud themselves is actively promoting the least business class, least supported, most out of date option while telling us that we are out of date and unsupported for trying to do the opposite.
I find this very upsetting. The message to the customers is extremely mixed.
A clarification: a customer is somebody who is paying us. Our messaging to them is on owncloud.com and perfectly clear with regards to platforms - CENTOS and RHEL are actually the preferred platforms, and ownCloud 9 is not available for customers at all.
-
@jospoortvliet said:
I'm not saying CENTOS or RHEL are not supported. I'm saying that those old versions ship with software with some know security issues and we warn for that. That is all. We're not in charge nor feel responsible for fixing those problems - they are Red Hat's or CentOS' problems, simple as that. But we want ownCloud users to be aware of problems we detect.
What old versions? We are clearly showing you that it is CentOS 7.2 release 1511. This is the most current and up to date version of CentOS that exists.
-
@jospoortvliet said:
I'm not saying CENTOS or RHEL are not supported. I'm saying that those old versions ship with software with some know security issues and we warn for that. That is all. We're not in charge nor feel responsible for fixing those problems - they are Red Hat's or CentOS' problems, simple as that. But we want ownCloud users to be aware of problems we detect.
But you are still calling them problems. That, itself, is a problem. You are saying that the platform itself is a problem. This isn't a bug, this is the concept of the platform.
-
On a different note, with each release our packages have been in flux - we very much recognize that by trying to provide packages, we've taken on a task which seems to be too large. We might do what most other PHP web apps do - just offer zip and tar balls. But that's up in the air, I really don't know what we'll do here. Help with packaging is obviously welcome...
-
@jospoortvliet said:
@scottalanmiller said:
What's even crazier is that the worst possible option would be Ubuntu LTS. All of the "out of date" of something like CentOS 7 yet without the support infrastructure. ownCloud said that they are not in the distro business. Yet... they build their appliances on the most out of date, least supported option of the bunch, Ubuntu 14.04!! So these things totally conflict. ownCloud themselves is actively promoting the least business class, least supported, most out of date option while telling us that we are out of date and unsupported for trying to do the opposite.
I find this very upsetting. The message to the customers is extremely mixed.
A clarification: a customer is somebody who is paying us. Our messaging to them is on owncloud.com and perfectly clear with regards to platforms - CENTOS and RHEL are actually the preferred platforms, and ownCloud 9 is not available for customers at all.
You just got done say that they are problems, said that we run old versions for using them and acted like they are jokes that need to be warned about. You are warning about the use of your preferred distro? Something is very wrong.
-
@scottalanmiller said:
@jospoortvliet said:
I'm not saying CENTOS or RHEL are not supported. I'm saying that those old versions ship with software with some know security issues and we warn for that. That is all. We're not in charge nor feel responsible for fixing those problems - they are Red Hat's or CentOS' problems, simple as that. But we want ownCloud users to be aware of problems we detect.
But you are still calling them problems. That, itself, is a problem. You are saying that the platform itself is a problem. This isn't a bug, this is the concept of the platform.
well, if you are running a broken CURL or openSSL, we warn you. If those come with your platform, even if we support that platform, it is still broken, so we warn you. I don't see how that is bad...
-
@jospoortvliet said:
On a different note, with each release our packages have been in flux - we very much recognize that by trying to provide packages, we've taken on a task which seems to be too large. We might do what most other PHP web apps do - just offer zip and tar balls. But that's up in the air, I really don't know what we'll do here. Help with packaging is obviously welcome...
Packaging is good, but I would limit it to platforms that you feel are modern and supportable. If you feel the need to warn, I would hesitate to provide a package in the same way as the full support packages.
-
@scottalanmiller said:
@jospoortvliet said:
On a different note, with each release our packages have been in flux - we very much recognize that by trying to provide packages, we've taken on a task which seems to be too large. We might do what most other PHP web apps do - just offer zip and tar balls. But that's up in the air, I really don't know what we'll do here. Help with packaging is obviously welcome...
Packaging is good, but I would limit it to platforms that you feel are modern and supportable. If you feel the need to warn, I would hesitate to provide a package in the same way as the full support packages.
Yeah, that's sane, I don't disagree with you here. But we also have to provide what users need - and many run RHEL and CENTOS. And, as there are ways to fix the problems we point out (you can grab a newer openSSL or CURL), we warn...
And we did drop a number of platforms to keep things more manageable... Hope this will help improve stuff.
-
@jospoortvliet said:
well, if you are running a broken CURL or openSSL, we warn you. If those come with your platform, even if we support that platform, it is still broken, so we warn you. I don't see how that is bad...
Because you are warning about the most recent, fully supported platform options. Is cURL broken? I'm not sure that I agree. Being misused, certainly. You aren't warning that cURL is old, you are throwing a false error for something you didn't even check for.
I think you need to think about this as an end user. I see no warning that cURL is out of date, I see a warning that ownCloud isn't reporting things properly. That's a very different thing.
-
@jospoortvliet said:
Yeah, that's sane, I don't disagree with you here. But we also have to provide what users need - and many run RHEL and CENTOS. And, as there are ways to fix the problems we point out (you can grab a newer openSSL or CURL), we warn...
But many of us only did that because we thought that that was what was recommended. I'm rebuilding my install with Suse now to avoid the "unsupported out of date" issue you said in the other thread.
-
@scottalanmiller said:
@jospoortvliet said:
Yeah, that's sane, I don't disagree with you here. But we also have to provide what users need - and many run RHEL and CENTOS. And, as there are ways to fix the problems we point out (you can grab a newer openSSL or CURL), we warn...
But many of us only did that because we thought that that was what was recommended. I'm rebuilding my install with Suse now to avoid the "unsupported out of date" issue you said in the other thread.
Even though he just said above that CentOS is preferred. See:
@jospoortvliet said:
A clarification: a customer is somebody who is paying us. Our messaging to them is on owncloud.com and perfectly clear with regards to platforms - CENTOS and RHEL are actually the preferred platforms, and ownCloud 9 is not available for customers at all.
