@scottalanmiller said:

I'll be not as far away as I normally am and would love to make it (based in Romania on 1st June so pretty close) but I can't be there without a visa extension as my German visa is exhausted until much later in the year and I don't speak enough German (read: basically none) to be useful at a German convention. If I spoke German and had the visa time to use I'd love to be there.

That's good to hear--not that you won't be there but that you'd want to, I mean

So ownCloud, Inc. takes care of enterprises using ownCloud in their business. But there are plenty enterprises using ownCloud who aren't customer of ownCloud, Inc. and as we care about the whole ownCloud ecosystem rather than only the part that directly makes us money, we're organizing an event for them.

It's a bit of a trial, the first time we do this so it's restricted to the German speaking market right now - that was mostly a matter of convenience for us.

We do it alongside a customer event, adding a 2nd track with only community speakers - and we're still looking for new speakers. If you're interested in participating we'd really appreciate it if you were willing to talk a little about your use case and how you employ ownCloud (community edition) in your business! See here for more info on to participate and tick the box if you're willing to talk about your use on our registration page.

Feedback on the initiative is very much welcome!

Now obviously, lots of companies use open source tools and incorporate open source libraries in their in-house software because it saves them a load of time and costs. Also obviously, you have to keep an eye out on vulnerabilities coming in that code.

So I read this scare-mongering title on CIO:
Open source code is common, potentially dangerous, in enterprise apps

And I think - wow. Is this another round of FUD, or? Reading the article, I don't think it's wrong per-se. It is just that all the dangers it talks about are double, if not triple true for proprietary libraries and code incorporated in an enterprise application... Those often have worse security policies - no disclosure, for example. Loads of vendors still think "if I just keep this secret, nobody will notice how insecure my software is" and while that's bad for applications, you'll at least update them at some point due to a bug fix release you need. With libraries - well, unless there's a REAL good reason (say a zero-day vulnerability?) you won't update them out of fear of breaking your app... Transparency is thus crucial and it's a core feat of open source.

Of course the article points out that it's not just open source even pointing to Windows XP as part of a 'product' that was problematic (duh!).

Still, the title makes it seem like a big anti-open-source-diatribe and claims: "Problem solved, at least in this instance. But the underlying issue – the routine practice of reusing open source code in new software – remains."

That's an issue!?!??!?

What do you think, is this a new way of making people afraid of open source or just a misguided title and a few stupid statements by the writer?

@JaredBusch yeah, the forums have few if any developers. That's volunteers/home users helping each other out...

@wirestyle22 all comma's correct and stuff like that? This comes super close

Dear ownCloud users!

ownCloud 9.0.1 can be found on our download servers, get it while it is hot.

This release brings over 120 updates to core ownCloud functionality including sharing, CalDAV and CardDAV, external storage, encryption and much more. Find it extensively documented in our changelog.

For more details see our release blog.

As usual: it is strongly recommended to upgrade, for reasons of stability as well as security. We're very proud that we've been able to publish some good news in the latter department (one and two) but you'll only benefit if you stay up to date!

Note that our automatic updater app will offer you this new version some time over the weekend.

For those waiting for the Enterprise Edition, it's coming next week, building on the community version with features allowing admins to keep their files in compliance with various legal regulations.

As usual - many thanks to everybody involved, testing, developing, designing, translating or telling me about silly mistakes on the website

Without your input, ownCloud would not be what it is today! And it is an awesome product, giving millions of users control over what happens to their private data. Keep up the good work and, of course, share the news and let us know what you think.

Greetings,
Jos

@scottalanmiller true, looking forward to packages of Plasma 5.6. Running 5.5 now, quite OK but some buggyness

@scottalanmiller True, if/when it grows a bit stronger this could be a SMB platform as well. The new enclosure we work on can handle 2 7mm hard drives, thus even offering RAID posibilities.

But the Raspberry platform itself (1, 2 or 3) doesn't have SATA capabilities and probably won't get that. I'm still hoping/waiting for a platform which does have that, yes, you're right that SATA is really a big boost for performance. So would be 1Gbit ethernet...

@scottalanmiller Cinnamon is nice but - building on GTK I don't see it going anywhere. GTK just isn't a platform anybody builds on unless they have a deep-seated hate for anything with a Q or + or K in it. And that kind of us-vs-them behavior is exactly what he triggered starting GNOME - and what keeps companies away from the platform. Luckily we see now a bit of a convergence on a reasonable enterprise-quality technology with many smaller projects as well as all of Canonical moving to Qt. That's good for the Linux desktop, of course - but coming 15 years too late if you ask me.

@Dashrender for us the end goal is to provide something for home users, way cheaper and more flexible than a NAS.

The idea of backup to a cloud service - YES YES YES

@scottalanmiller said:

Only so long, Gnome started doing huge damage nearly from day one. It divided the community right at the start of competing for the desktop. Hard to say if Windows NT would have gained the traction that it did if people saw a unified Linux desktop option at the time. KDE was years ahead of Windows 2000.

Very true, but if he did it for this reason, he only got rewarded now - that's quite a long time to wait

Of course, there might've been some money at an earlier stage and Novell, of course, bought Ximian - an even more brilliant ploy as it destroyed the strongest KDE distribution (SUSE) through infighting and allowed Red Hat to take the market, pushing inferior (to this day...) technology to the Linux Desktop.

yeah, the versioning history is file specific and not a security thing.

Ubuntu's Snap tech perhaps could be made that way, or something like btrfs snapshots but those have a cpu and memory overhead.

These images are specifically made for the Raspberry Pi + Western Digital PiDrive (see here for info). WD wants to sell a special ownCloud edition of the PiDrive with ownCloud preinstalled and asked the ownCloud community to create an image for it - we took the challenge

@mlnews Yes, widely held theories. Hard to know if there's any truth to them.

What I also heard from people who should know (as in, people who contributed to KDE in its infancy) is that he first tried to contribute to KDE, was turned down, then to XFCE (which, indeed, predates GNOME), was turned down - then moved to create his own desktop.

Well, if this was all a ploy to harm Linux on the desktop, it succeeded, though it's a long play - far longer even than Stephen Elop destroying Nokia and MeeGo to give MS a chance with Windows Phone.

Hi all,

You might remember we were working with Western Digital on an #ownCloud #RaspberryPi device! Well, it took a bit longer than planned but our first testing images are ready. By the end of next week our first batch of 30 test devices will be available for sale, followed by another batch of 50 about a month later while we gear up for a small production run of 500.

Future versions (including the 500 production run) will probably also be available for other Pi like devices including Beagle Board and Banana Pi. We choose Raspberry Pi as base device as it's so ubiquitous and we'll be building on Snappy Ubuntu Core 16.04 (pre-beta!) as that provides a great base for a device like ours, with its transactional upgrades, embedded focus and wide user base and support in the industry.

Want to provide a safe home for your own data? This is the time to get involved and help us test and improve this!

I just published a blog here and you can grab the images directly here. There are three images there: one for the SD card (the bootable), one for the hard drive (the larger one) and a two-in-one for testers without hard drive (the largest image). Scripts are here, that's also where contributions can go

As many of you have experience with performance tuning, I'm hoping we can get some help with making the Pi faster for serving ownCloud!

Enjoy and let us know what you think of it.

@scottalanmiller said:

@jospoortvliet said:

Here's the cURL bug, yes, related to a NSS issue: https://bugzilla.redhat.com/show_bug.cgi?id=1241172

More misdirection. This isn't a security problem. Yes it has a bug, so? So does ownCloud and they wont even admit it. Red Hat takes this so seriously they are actually working on it. Big difference. They don't pretend that that's okay that there are bugs.

Why is this is a reason to stop using Red Hat's repos and go to rolling out own? That's insane. You can't actually expect us to take this seriously?

Read the header. "Security & Setup warnings" -> not exclusive security. This has a bug. Red Hat is working on it, but you get a warning now, because it is there. What is wrong with that?

There is no misdirection here. You are getting upset about us being conservative and giving warnings where we suspect or expect problems. Again, if you are certain that there are no problems here, you can ignore them. They have clearly shown problems in the past.

I get your point about false errors, and clearly as you said - you prefer NO error over a potentially false one. Fair enough, we've chosen to warn if we think there is probably a problem. I guess it's a policy decision we disagree on.

@scottalanmiller said:

@jospoortvliet said:

@scottalanmiller said:

@jospoortvliet said:

YOU say they are bugs. I don't. I believe they are real issues a sysadmin should fix.

Okay, whatever. Clearly I'm taking your platform way too seriously.

Seriously? You didn't read the links? Wow. Good night...

I did. That's CentOS 6 from 2013. It's important why?

Because it shows exactly what I said - these warnings are useful. They were in those cases and by your own account (not trusting LTS releases), they are now. Also note when they were opened and when they were fixed.

What more do you want? That we, real-time, update these warnings based on existing vulnerabilities that aren't disclosed or fixed? That would be awesome, don't get me wrong - but rather ambitious.

@scottalanmiller said:

@jospoortvliet said:

YOU say they are bugs. I don't. I believe they are real issues a sysadmin should fix.

Okay, whatever. Clearly I'm taking your platform way too seriously.

Seriously? You didn't read the links? Wow. Good night...

@scottalanmiller said:

@jospoortvliet said:

Look, these are warnings. If you're confident there is no problem, you can ignore them.

This is not a professional response to being informed clearly that there is a bug.

You just told me to ignore a bug. Are we 100% clear that that's what's going on? Is that how ownCloud feels about security issues? Sweet them under the rug? Be wrong and hope that users ignore them?

YOU say they are bugs. I don't. I believe they are real issues a sysadmin should fix. You claim our security guy is incompetent and you trust Red Hat. Fine. Just two links then about PHP:
https://access.redhat.com/solutions/641423
https://bugzilla.redhat.com/show_bug.cgi?id=662707

Here's the cURL bug, yes, related to a NSS issue: https://bugzilla.redhat.com/show_bug.cgi?id=1241172

As I said - before I take your input as 'bugreports' I need some proof that these warnings are wrong. For now, I have some reason to think it is GOOD to warn of projects no longer supported by upstream: clearly, distributions don't do a good job keeping up with issues in them and clearly, our warnings (no matter how annoying) are helpful.

Ok, let me give you one more then: https://statuscode.ch/2016/02/distribution-packages-considered-insecure so you can read a bit from the guy we're talking about. There's a reason Lukas is pretty well known in the security world - he knows his stuff. And works for us. These warnings are there because these ARE issues. Perhaps not today because RH just fixed one - but again next week as they are 'maintaining' something which isn't easy to maintain and they don't do such a great job. Wait, wasn't that what you said yourself about LTS earlier? Ah!

Oh and really, if you're right about our security guy, you can make loads of money: https://hackerone.com/owncloud

If you don't mind, I'll retreat from this conversation. If the three links above is not enough proof that these warnings are useful - nothing will be. I honestly think you're barking up the wrong tree - we are careful to warn when there's a serious potential for trouble. Maybe that's zealous - overzealous even. But better safe than sorry.

@scottalanmiller said:

@jospoortvliet said:

We could disable these errors - it might make you feel better but it would make your platform equally insecure. That is called a false sense of security. Gosh, I expected that you'd appreciate the fact that we won't do that.

Honestly, I find your attitude offensive. This is pathetic. The errors are wrong and that's obvious. Your security guy is a fraud and you are clearly trying to cover for him. I'm sure your a small company and he's a friend but I'm sorry, he's making you look bad and you are making the company look worse.

These aren't real errors, the security issue isn't a problem. Sorry if I trust Red Hat engineering more than a random guy who clearly doesn't understand the platform. Feel free to prove me wrong but you crossed a line here and I don't feel that ownCloud has any clout to stand on here and needs to prove itself anew. This is a ridiculous, offensive statement.

Seriously? There is ONE error with a bad wording. I'll report it. The other errors - they are good warnings as far as I can tell - at least - I have not seen any evidence that the are not (in which case I could submit a bug report, perhaps). Again, this is to help people secure their system.

@scottalanmiller said:

@jospoortvliet said:

There is a PHP version warning. That PHP version is old and no longer supported by the PHP project. Yes, it there might not be a newer version from your vendor for your platform. That does not make it any less outdated etc etc etc.

Ah, but it does. It makes this a bug. It makes this ownCloud's problem. Why are you throwing an error for a fully updated, fully supported PHP version? Don't try to claim that it isn't. What it is not is not supported by PHP. If you mention PHP's support, that means we have a disconnect. We are in IT, not home hobbyists. Our support is from Red Hat, not PHP. Who gets support from PHP? Seriously?

This is a scary disconnect from how IT and Linux work. Here are some problems:

• ownCloud doesn't understand their target platform.
• ownCloud is throwing errors on things it doesn't understand.
• ownCloud is stating that things are old that are not. PHP on CentOS is fully up to date, it's just a different family. The patch level on it is very current. It is a misunderstanding of the versions levels causing the issue.

All of these things are worrisome. Very, very worrisome when you claim that you trust your internal "security" guy who is missing these very, very basic concepts of the platforms he's supposed to be your expert on!!

Look, these are warnings. If you're confident there is no problem, you can ignore them. This is the community edition of ownCloud: it is for common home users, not for large enterprises. These warnings are meant to help home users who run ownCloud on their raspberry pi to get a more secure setup. If this is confusing a professional sysadmin - well, I expect them to be able to figure out what to do more than home users.

The enterprise edition comes with a phone number to dial in these cases. I think you're taking this a little too serious, to be honest. We're trying to be helpful and easy to use here.