<story><title>Nextcloud: Open-Source Cloud Apps</title><url>https://nextcloud.com/</url></story><parent_chain><item><author>obnauticus</author><text>I originally wanted to do this but the CVE history is a bit too colorful for something I’d want to trust as a “cloud replacement”:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;cve.mitre.org&amp;#x2F;cgi-bin&amp;#x2F;cvekey.cgi?keyword=nextcloud&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;cve.mitre.org&amp;#x2F;cgi-bin&amp;#x2F;cvekey.cgi?keyword=nextcloud&lt;/a&gt;&lt;p&gt;A common misconception IMO is that running and owning your own infrastructure is somehow more secure. To that I lol, and I’m confident that the thousands of AWS&amp;#x2F;GCP&amp;#x2F;Azure&amp;#x2F;iCloud security engineers are all doing a more thorough job than you can. At the very very least they receive embargoed bugs which they often mitigate before the general public.</text></item></parent_chain><comment><author>bravetraveler</author><text>One doesn&amp;#x27;t &lt;i&gt;have&lt;/i&gt; to expose it to malicious actors. It is most-useful that way, sure. Mine is at &lt;i&gt;10.27.0.68&lt;/i&gt;. Have fun, hackers!&lt;p&gt;Also, I lol at most CVEs. Butterfly farted outside, oh uh.&lt;p&gt;Take the top one:
    In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable. This is fixed in 3.13.4.&lt;p&gt;You mean to tell me a few minor point releases imitated umask, making world-readable &lt;i&gt;[and possibly added writable]&lt;/i&gt;? Oh no! The tragedy! Keep in mind most clients are single user systems anyway.&lt;p&gt;Judge them on their facts, there are vulns and then there are &lt;i&gt;vulns&lt;/i&gt;. CVEs are a sign of attention on a project. No more or less.</text></comment>
<story><title>Nextcloud: Open-Source Cloud Apps</title><url>https://nextcloud.com/</url></story><parent_chain><item><author>obnauticus</author><text>I originally wanted to do this but the CVE history is a bit too colorful for something I’d want to trust as a “cloud replacement”:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;cve.mitre.org&amp;#x2F;cgi-bin&amp;#x2F;cvekey.cgi?keyword=nextcloud&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;cve.mitre.org&amp;#x2F;cgi-bin&amp;#x2F;cvekey.cgi?keyword=nextcloud&lt;/a&gt;&lt;p&gt;A common misconception IMO is that running and owning your own infrastructure is somehow more secure. To that I lol, and I’m confident that the thousands of AWS&amp;#x2F;GCP&amp;#x2F;Azure&amp;#x2F;iCloud security engineers are all doing a more thorough job than you can. At the very very least they receive embargoed bugs which they often mitigate before the general public.</text></item></parent_chain><comment><author>zigzag312</author><text>&amp;gt; I’m confident that the thousands of AWS&amp;#x2F;GCP&amp;#x2F;Azure&amp;#x2F;iCloud security engineers are all doing a more thorough job than you can&lt;p&gt;I&amp;#x27;m not so confident about that:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;cve.mitre.org&amp;#x2F;cgi-bin&amp;#x2F;cvekey.cgi?keyword=azure&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;cve.mitre.org&amp;#x2F;cgi-bin&amp;#x2F;cvekey.cgi?keyword=azure&lt;/a&gt;&lt;p&gt;It really depends on what you self-host.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;cve.mitre.org&amp;#x2F;cgi-bin&amp;#x2F;cvekey.cgi?keyword=syncthing&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;cve.mitre.org&amp;#x2F;cgi-bin&amp;#x2F;cvekey.cgi?keyword=syncthing&lt;/a&gt;&lt;p&gt;&amp;quot;Do everything&amp;quot; solutions go against the principle of minimizing the attack surface.&lt;p&gt;EDIT: More is not always better in security. With more people doing more things, the statistical odds of miscommunication and misconfiguration increases.</text></comment>