Nextcloud AMA!!
-
Have you heard of SQRL authentication and have you investigated including it?
-
@IRJ Yes. There is the External Storage app that can do that. So far there is no connector for Box or onedrive. But this should be relatively easy to do. Maybe someone in the community is interested in doing this as a first contribution?
-
@jospoortvliet said in Nextcloud AMA!!:
Probably because so many people and companies and governments (!) still put their data at some random company and that scares me. I think we should control our data and I want to help citizens & organizations get there
Can you expand upon what you mean by this?
-
@IRJ Yes. There are always big and cool new features coming.
Actually the Nextcloud community is more active then ever. But it's not clear yet which features make it into the next major version. So we have to wait until the first beta is done. -
Are there any considerations for 2FA?
-
Have you heard of SQRL authentication and have you investigated including it?
I happen to have heard about it but we didn't look into that. In terms of authentication, at the moment we're working on actively improving our SSO plugin which now also supports Kerberos for example.
As Nextcloud is quite modular adding another authentication module via API should be quite easy. If you're interested in adding support SQRL authentication and have some PHP knowledge, I'd recommend to join us on help.nextcloud.com in the developers forum or on IRC #nextcloud-dev in Freenode.
-
@Dashrender Not sure what you mean? A way to safe into Nextcloud directly from the Office Safe Dialog? This is of course possible. Just safe in a specific folder that is then synced to the server with the Desktop Client. Is this what you mean?
-
@IRJ said in Nextcloud AMA!!:
Are nextcloud downloads exceeding owncloud downloads yet?
we actually don't have solid numbers. Part of that is due to packages already in a few distributions, part because we don't track that stuff too closely... That was similar at ownCloud so it is very hard to compare, even if I had recent numbers.
What I can see is that the numbers we DO have grow nicely, with January being almost 10% more than December last year... But it fluctuates quite a bit.
-
@RojoLoco As a server OS? We tried to do this in the past but PHP on Windows is just not very good. So the recommended way is to run a Linux VM on the Windows Server. This works fine.
-
Are there any considerations for 2FA?
@dafyre We've already added support for 2FA support in our latest major release. We officially support hardware two-factor auth using U2F and TOTP. See https://apps.nextcloud.com/?order_by=name&ordering=asc&is_featured=true.
-
@Frank-Karlitschek said in Nextcloud AMA!!:
@RojoLoco As a server OS? We tried to do this in the past but PHP on Windows is just not very good. So the recommended way is to run a Linux VM on the Windows Server. This works fine.
Paying for a Windows license defeats the purpose of Open Source anyway
Not to mention that windows servers eat resources.
-
There does not seem like an easy way for a Windows user to setup & use Nextcloud.
Can you comment on this? -
@Frank-Karlitschek said in Nextcloud AMA!!:
@Dashrender Not sure what you mean? A way to safe into Nextcloud directly from the Office Safe Dialog? This is of course possible. Just safe in a specific folder that is then synced to the server with the Desktop Client. Is this what you mean?
While what you explained is possible, that sync client puts all the files at risk of a cryptoware attack.
What I am specifically looking for/asking about is an API that plugs-in to MS Office to save directly to the server without the sync client, like MS Office has for Sharepoint. Access through an API like this significantly reduces the ability of cryptoware to affect the files through this avenue.
-
With almost all software I am a heavy propoent of the repo based model because it drastically simplifies things for the administration side of the house.
I know I can log into every single system and
yum updateorapt-get updateand be done.I can also be very confident that it will always just work.
With NextCloud, you have decided against doing a repository based model and have an auto updater.
Why is this being done this way? What possibly administration benefit do I gain from it?
-
@FATeknollogee On Nextcloud.com you can download fully configured VMs. Should be easy to run.
-
@LukasReschke said in Nextcloud AMA!!:
Have you heard of SQRL authentication and have you investigated including it?
I happen to have heard about it but we didn't look into that. In terms of authentication, at the moment we're working on actively improving our SSO plugin which now also supports Kerberos for example.
As Nextcloud is quite modular adding another authentication module via API should be quite easy. If you're interested in adding support SQRL authentication and have some PHP knowledge, I'd recommend to join us on help.nextcloud.com in the developers forum or on IRC #nextcloud-dev in Freenode.
I'm not a coder at all, so I would be of little to no help here
The principals behind SQRL pretty much get us away from usernames and passwords on websites, and also mostly gets rid of the reasons for 2FA (though there is still an argument for 2FA)
-
This post is deleted! -
@Dashrender Another way of doing this is to use WebDAV as a mount and directly safe there.
-
@Frank-Karlitschek said in Nextcloud AMA!!:
@RojoLoco As a server OS? We tried to do this in the past but PHP on Windows is just not very good. So the recommended way is to run a Linux VM on the Windows Server. This works fine.
And no licensing issues.
-
@Dashrender said in Nextcloud AMA!!:
Can you expand upon what you mean by this?
Sure. You might remember the epic 'dick pics' episode from John Oliver & Edward Snowden: https://www.youtube.com/watch?v=XEVlyP4_11M
This was quite awesome but at the same time - there really is an issue here. And most people have no idea. A lot of people clearly are storing their data at Google, Dropbox etcetera. Now that would be fine as long as that is data that can't be abused but that is often not the case. The terms of service of these companies doesn't protect you or your data and they are massive targets for hackers. Yes, they have good security people but nothing is ever perfectly secure and it is sooooo attractive to hack them...
And businesses are not too different - lots of them, even schools and universities and hospitals, store data on public clouds or at providers outside their country. And that can be abused in a whole bunch of ways, from government spying to corporate espionage to extortion of companies and individuals.
THAT scares me. Just look at the DNC scandal influencing politics in the USA. If you put your data at a public cloud, you're painting a massive target on it. If you have your own IT team taking care of it, as political organization, you can (emphasis on CAN, of course) do a much better job keeping it safe. And that can steer elections, politics, economics, everything.
That was the main motivation for Frank, back in the day, to announce a project to solve this and we at Nextcloud share this goal.
