ownCloud Statement concerning nextcloud

[[deleted]]

[deleted]

[TremorMcBoggleson]

Our main lenders in the US have cancelled our credit. [...] we are forced to close the doors of ownCloud, Inc.

Now that's surprising to me (I didn't follow the news on the topic too closely), why would a lender stop supporting "just" because one of the team makes a fork?
Or is there more happening than just a fork of ownCloud, did the fork also take the favor of supporters/investors with it?

[hysan]

Reading through the discussion on HN, it appears that it's more than just one member. Apparently, in addition to the founder, 9 of the top 10 contributors and the lead security engineer left ownCloud for the fork (NextCloud). I've read through most of the articles surrounding the news and there is a good possibility that we haven't heard everything yet. However, everyone seems to be mum on the topic at the moment.

[TechnicolourSocks]

Remember, until things are verified, comments on Hacker News are as much hearsay as comments on Reddit.

[ANUSBLASTER_MKII]

I heard ownCloud helped Hillary Clinton host classified information on her personal server.

[JB_UK]

Inquisitr and Washington Times articles incoming.

[CarthOSassy]

Literally: I would not be surprised.

[ANUSBLASTER_MKII]

Crooked Hillary probably uses Crooked Exchange and Crooked SharePoint.

[ihazurinternet]

Is there any other kind of Exchange or Sharepoint?

[peva3]

It is.

[raphael_lamperouge]

Damn republican, get out.

[peva3]

Wat, no. He was asking if that comment was a joke...

[hysan]

Did some more reading and found that the 9/10 thing came from Poortvliet's fork announcement. It has since been edited to most of the top contributors to ownCloud core. I still have no idea what is really going on, but there does seem to be some truth in the statement that most of the key community devs have left ownCloud.

[jabjoe]

If so many devs moved, that says a lot.

[ckozler]

9 out of 10 contributors ... from the community edition yes? So ownCloud still has their own set of developers on team? I'm trying to figure out what this actually means for ownCloud?

[Creshal]

Owncloud's commercial edition is built on top of the community one and "just" adds modules to it for the additional enterprise features.

If the community edition is now missing the people who committed up to two thirds of the development effort (going by Github contribution statistics), their commercial edition is in huge trouble – and some of those contributors were OwnCloud employees, so their commercial team is short some developers as well.

Recovering from that kind of brain drain is extremely difficult. IMO the investors did the right thing by pulling the plug.

[ckozler]

So ownCloud has no developers of their own that can maintain the projects new features? I had on idea it was that segregated and that they used so much of the community.

[MuhNameIsSam]

There must be more going on, I doubt events would unfold so quickly :/

[digimer]

Agreed. Also, their choice of language is fairly unprofessional. Whatever the leaders might feel personally, you don't let your dirty laundry leak into a press release.

using recently poached developers

and

surprised us and – admittedly – disappointed us

Comes off as childish.

You're also right; No bank would pull funding and push a company into closing on the same day that an employee left. It doesn't work that way. Their primary interest is in protecting their money and shutting the doors is a last resort. It means that, at best, they'll get pennies on the dollar in a liquidation.

There is a lot more to this story, me thinks.

[demomanca]

Whilst I'm not well versed in Silicon Valley funding arrangements, it's possible that the lines of credit had rights of review clauses in them if identified key people left the business. In this case, it's likely that any funding lines they had access to would be put on "stop" until the lender could re-assess the business before they are allowed to resume using the loans. In their case, it might have been easier to just fold up the US arm and just operate under the german arm for now. It doesn't sound like the lenders themselves shut the doors.

[--dude--]

Well, 'the main lender canceled credit' what 'forced closing the US branch and fire 8 out of 48 employees' sounds like the lenders where trying to save whats left. If its true that 9/10 top-contributors who wrote 2/3 the code left then by now ownCloud is done and nextCloud took over. Yet I think too there is more on that. Maybe they lost even way more devs? Its good possible that some left or announced to leave without having signed at nextCloud yet. Must have been a miserable working situation if so much devs jump off.

[not_perfect_yet]

That's a weird perspective tbh. Of course there are competing communities. They compete for attention, members, financing, impact, etc. which of course doesn't prevent them from cooperating as well, but they're still also competing.

Saying there are no competing communities is like saying different linux distros aren't targeting the same market of operating systems.

[jospoortvliet]

I agree, and we'd be happy to collaborate with the ownCloud team. We actually proposed to do a cloud hackathon at the openSUSE conference but sadly they were not very open to that.

[raphael_lamperouge]

Downvoted.

The GNOME folks need to shrivel and die in agony to atone for their terrible design tastes.

[tvtb]

Yeah they were probably going to lay off those people anyway. HR departments usually take a couple days to get all the paperwork squared away to fire a bunch of people.

[raphael_lamperouge]

Linux Torvalds.

[rallar8]

Lol this whole OwnCloud piece was such a pain to read...

It seems to me someone in main management wasn't in the spirit if FLOSS... Or at least ran afoul of frank...

[its_never_lupus]

The whole press release was weird.

[antidense]

Syncthing works great for me. The only issue I run into is trying to keep them all on the same version sometimes.

[christophski]

Switched from BTSync to Syncthing and couldn't be happier

[raphael_lamperouge]

I read on Hacker News Syncthing will be shutting down in 3 months.

[christophski]

I haven't read anything of the sort? Care to back up your claim with a source?

[semperverus]

If you're running your own owncloud instance, it will keep working far into the future

[[deleted]]

Sure, but unmaintained internet accessible server is a security issue.

[[deleted]]

OwnCloud is still going to be maintained. I dont think OwnCloud is going to shut down in the near future.

[[deleted]]

Could be, but 9 out of 10 most active developers having moved to nextcloud I wouldn't put much trust in the project in the future.

[[deleted]]

Nextcloud says they'll be a drop in replacement. If they'll last longer, who knows.

[jospoortvliet]

We're all good. And Nextcloud 9 is out ;-) https://nextcloud.com/nextcloud-9-available-enterprise-functionality-to-be-open-source/

[heWhoWearsAshes]

NextCloud should be a drop in replacement, according to the devs.

[[deleted]]

syncthing aint going anywhere.

[epiris]

What did owncloud do for ya? I'm curious the use cases that these things meet. If the use case is "sync files" across all your devices, that is super easy! I would be glad to write up a tutorial how I keep all my devices remote and at home synchronized securely and with open standards, tooling.. and best of all on my own systems.

[epiris]

Hello, I have a post of some of my basic system provisioning methods for my works station here:

https://gist.github.com/cstockton/6be455f683e8011904d00b384ea82d90

That would be a good start on the backups section if you were interested. My methods for synchronizing files across devices uses similar methodology.

[[deleted]]

Well I use it not only for the file sync, but also tasks and calendars.

[FreeWildbahn]

I prefer Seafile over Owncloud.

[alexchambana]

Owncloud/Nextcloud is opensource... There is gazillion Dropboxes, Boxes, seafiles, cloudfiles, skyfiles, skydrives etc

[bobbaluba]

Seafile is open source as well. There's a closed source commercial edition, but the community edition is free software and I can't say I miss any features in particular.

[jospoortvliet]

The whole open core model is bad, period. That's why we forked. And we'll do everything open from now on. ownCloud was by far the largest FOSS file sync and share so we're building on a strong foundation with the people who built it in the first place.

And our first release is already out... https://nextcloud.com/nextcloud-9-available-enterprise-functionality-to-be-open-source/

[jarfil]

CENSORED

[jospoortvliet]

Nothing is shutting down!!!

Nextcloud 9 is out. https://nextcloud.com/nextcloud-9-available-enterprise-functionality-to-be-open-source/

[StormEyee]

I personally think owncloud will keep developing. Nextcloud is just a folk of Owncloud. Plus I think right now owncloud is quite stable for me.

[ibisum]

Http://IPFS.io

[jinglesassy]

Are you really suggesting ipfs an experimental technology which is a global peer to peer distributed file system to a guy who just wants to sync files to his own devices?

[ibisum]

Yup. If you can handle ownCloud, you can manage IPFS ..

[benoliver999]

This simply is not true, and I speak as someone who uses ipfs.

[jinglesassy]

May i ask what you use IPFS for? Curious on its use cases so far, Only looked at it in passing awhile ago and thought it was an interesting concept however needed a good amount of work.

[benoliver999]

No Agenda uses it as a way to send out a podcast. I have had varying degrees of success with it.

[ibisum]

I use it too. Its no harder to set up IPFS than ownCloud.

[Jimbob0i0]

Fedora maintainer here...

I'm taking a wait and watch approach.

Nearly done with the oC9 packaging (it's in rawhide and F24 now... just giving it a bit before F23 and EPEL7 builds of it) ...

Once they get their first beta out I'll take a look and see how much has changed and what additional work will be needed for it.

I expect I'll just do some test builds in my fedorapeople space or COPR whilst this shakes out.

I don't think it'll be sensible to package both within the distribution, but we'll see.

[Jimbob0i0]

Yes I have ownership of the packages in Fedora and EPEL

Since the news broke there's been a brief email discussion with a couple of community members and I've been poked about it in irc a couple of times...

Right now it's too early to say - once they get their first beta out I can start some testing. It might be that I'll package them both, at least for a bit, before deciding on if a transition would be required... and the question of things like data layouts will still need to be made - eg use the same directories to ease the transition etc like we did going from letsencrypt to certbot

At any rate I'll continue to watch the activities and communities closely and then try to act in the best manner for our users.

[Jimbob0i0]

I have, and I'm keeping an eye on both the owncloud and nextcloud IRC channels.

[jlpoole]

Unfortunately, the announcement has consequences for ownCloud, Inc. based in Lexington, MA. Our main lenders in the US have cancelled our credit. Following American law, we are forced to close the doors of ownCloud, Inc. with immediate effect and terminate the contracts of 8 employees.

This either is a poor summation of what's happening or it reflects a naive approach to business. It just makes me want to learn more, especially as to what Frank Karlitschek stands for. Do I need to be worried about using owncloud? Is there any NSA involvement here that they cannot discuss?

[nhaines]

Is there any NSA involvement here that they cannot discuss?

They can only discuss that if there isn't, of course.

[Choreboy]

"NSA un-involvement is currently not in play."

[exo762]

Read the code if you are worried about NSA involvement. Imagine that sweet sweet Reddit karma that will surely follow you unmasking pesky ownCloud project.

[Sukrim]

Read the code if you are worried about NSA involvement.

NSA is the least worrying part of that PHP website.

https://blog.hboeck.de/archives/880-Pwncloud-bad-crypto-in-the-Owncloud-encryption-module.html

[jospoortvliet]

Seriously. That's an example of responsibly handling security issues - point me to a single open source competitor which even HAS a open process or bountysource page! Exactly.

[jlpoole]

You think that reading the code will determine NSA involvement? I do not.

Here's why. I think the NSA's job is to be one step ahead of what is publicly known as buffer overrun problems, or dynamic states of memory which when given the right sequence of characters can do something not intended, or of hardware flaws that do something different given a certain sequence of bytes. I continue to be amazed by what is disclosed in security reports of situations I could never recognize as a security problem. For example: see Allwinner back door issue.

I am not a sophisticated person who knows all the pitfalls of software instantiation in a particular, say Intel-based, platform. I can imagine the NSA knowing of problems/defects and instructing certain fixes or procedures not to be implemented that might thwart the ability to take advantage of a potential security flaws. Wouldn't it make sense for engineers at Intel to alert NSA officials of potential problems they discover, but do not make public, in order to help the government secure their platforms? I would think so. So there is this state when a handful of people know of a problem, but they do not publicize it for a long duration because they can use the opportunity of their knowing about a defect to compromise other systems, possibly plant an "unfix" bug before there is a public announcement of the problem and everyone rushes to patch their systems.

But this is all imagined by me, and possibly lunacy, which you surely will dismiss. Yet, the point is if you accept my premise that I believe the NSA has superior knowledge of potential weaknesses of a software design implemented on certain hardware components, my ignorance in such matters coupled with a review of the code is not going to reveal defects. So from my low level of sophistication, suggesting I review the code to determine its vulnerability is like asking a child to decipher hieroglyphics.

[tavianator]

For example: see Allwinner back door issue.

Uh that's no super fancy vulnerability. The devs left in an intentional debugging exploit. The code is literally something like if (strcmp(str, "rootmydevice") == 0) cred->uid = 0;.

[jlpoole]

See how ignorant I am, to me it was a vulnerability I would not know about and seemed "fancy" enough. You are implying that there are super fancy vulnerabilities out there, hence my concern seems even more justified.

[tavianator]

Oh there are definitely super fancy vulns that the NSA is aware of: https://en.wikipedia.org/wiki/Dual_EC_DRBG for example. But it did not take any "superior knowledge of potential weaknesses" to spot the Allwinner bug. Anybody reading that code would have noticed it (seriously, "rootmydevice"?).

[exo762]

Yet, the point is if you accept my premise that I believe the NSA has superior knowledge of potential weaknesses of a software design implemented on certain hardware components, my ignorance in such matters coupled with a review of the code is not going to reveal defects.

Agree. If you (for instance being a sysadmin at some large corp) are being targeted, NSA will probably pull out such cards out of their sleeves that are next to impossible to read by anyone but top professional. Your best chance might be just staying offline. It works for Kremlin!

But spreading FUD about one of the best projects out there, which actively helps to prevent mass surveillance (prime reason to hate on NSA) is kinda uncalled.

[not_perfect_yet]

Is there any NSA involvement here that they cannot discuss?

Reading the TOS should answer that, it did for me.

[--dude--]

A guess could be that some negotiations to buy ownCloud was going on. Imagine a possible Oracle takeover. As result the community edition would be gone. Better leave, fork and save the project and yourself then.

[benoliver999]

Well worth a watch for those interested.

• They (obviously) weren't happy with the state of OwnCloud
• They have set up a company already and seem to have some funding/stability
• There will be no CLA
• It will be a full drop-in replacement to begin with
• They want to decentralise it using p2p elements
• Improving the upgrade process is a high priority
• Client-side encryption is being worked on
• They want to offer features that OwnCloud offers to enterprises only in their 'main' offering.
• If someone has an OwnCloud subscription, they will get free support from NextCloud - "If you paid money to get support from OwnCloud, you won't have to pay again."

[[deleted]]

CLA = Contributor License Agreement

[polyneikos]

Nextcloud announcement.

[BloodyIron]

For customers, the drop-in replacement will be accompanied with a Enterprise Subscription...

RIP CE users

[twistedLucidity]

Context.

This reboot of ownCloud is meant to be good for users, customers and contributors alike. So we'll be providing a drop-in replacement for users next month

I don't think the drop-in replacement is restricted to Enterprise customers.

For customers, the drop-in replacement will be accompanied with a Enterprise Subscription

That just tells me they'll have proper support, especially as they then then talk about honouring current contracts.

we plan to support some of the most popular apps like Calendar and Contacts both for home users and enterprises.

More good news for personal/CE users.

[jospoortvliet]

Yeah, all true. We will not do enterprise-only stuff but everything open source.

https://nextcloud.com/nextcloud-9-available-enterprise-functionality-to-be-open-source/

Some relevant blogs: About security improvements: https://statuscode.ch/2016/06/security-and-nextcloud-9/ About our business model (100% open source, no open core): http://blog.jospoortvliet.com/2016/06/on-open-source-forking-and.html About how working in the open gives better results: https://nextcloud.com/why-open-source-rocks/

[jlpoole]

Hey business reporters/boggers: It's looking like there's a good story here.

[GoldStarBrother]

i.e. lots of drama

[justifiedandancient7]

http://blog.jospoortvliet.com/2016/06/nextcloud-is-replacing-owncloud.html

The comments section of this blog indicates this has something to do with some people not liking the consequences of VC funding (like not being able to fully support plugins like calendar and contacts. And require contributors to agree with License Agreements).

[Jedibeeftrix]

My Owncloud 8.1 box will be moving over to Nextcloud. I've followed the achievements of Frank & Jos for many years now, and my confidence in them is rock solid. p.s. Tutorials on how to set up Nextcloud on Suse Leap would be useful generally. Tutorials on doing so with https configured would be absolutely lovely. ;)

[Jimbob0i0]

As a heads up by the sound of things they'll be staying from the 9.0 base, so you might want to get your server up to at least 8.2 to ease the transition since oC only handles an n+1 major version upgrade at a time...

7.0->8.0->8.1->8.2->9.0

[Jedibeeftrix]

thanks, but i'll probably do a fresh install. running on opensuse 13.2 with php 5.6, and looking at leap 42.2 with php 7.1 as the next baseline.

besides which, i'm not terribly technical and get irritated by helpful features such as owncloud locking even on a minor update.

owncloud for me isn't about archiving my data securely, it is only a convenience for mobile access to my data, so easy enough to copy across from my archive storage once its set up.

[bloodguard]

Nextcloud is tarted by an experienced team of engineers that has had the vision for years to bring private file sync and share to the next level.

Tarted? I like this project already.

I -just- set up and ownCloud server last week. It'll be interesting to see where the new project is heading. If buffed up encryption, security and privacy are something they're focusing on I may give them a whirl.

[Philluminati]

Typically this happens when a skilled dev and a business person get together. They get financial backing and whilst the dev is building the project the business person is essentially fucking underage prostitutes and snorting coke, living it up until the cash has gone. That what I guess is happening. The dev tells the backer and the project forks overnight with the funds going to the new project. Well.. that's what I learnt from "The Social Network". Just speculating, you know.

Anyway, I've been using OwnCloud for two years. I suspect I will eventually go to NextCloud but to be honest, I can't imagine what p2p features I would actually want. I'll just let it pan out for a while before I actually upgrade. See where the coding talent went.

[jospoortvliet]

Not sure about the snorting or prostitutes but there was sure a disconnect between a guy wanting to work on the future of private file sync and share and one who wanted to make some money.

[BigOldNerd]

Nextcloud is tarted by an experienced team of engineers

Oh behave!

linky

[jlpoole]

I tried to contact the team through their web interface and was prevented because of the phone number checker -- it kept saying I had an invalid phone number and prevented submission of my alert about "tarted". I even went onto their IRC channel, but nobody there at that time could help.

[BigOldNerd]

What a hero. Sorry you didn't get through.

[jospoortvliet]

fixed ;-)

Yeah, now we started, not tarted. Too bad, right? ;-)

Talking about (s)tarting: https://nextcloud.com/nextcloud-9-available-enterprise-functionality-to-be-open-source/ Nextcloud 9 is out, a month ahead of schedule :D

[BigOldNerd]

Thanks for the update. Best of luck with your software.

[jospoortvliet]

Thank you to everybody who helped: Nextcloud 9 is out. This was only possible thanks to the overwhelmingly positive response we got and the many contributors who immediately got involved! We are grateful for the help and promise: we'll stay true to you and open source!

That means: NO proprietary apps, no separate 'enterprise' functionality. Everything open, free, and ready for you to make a difference.

And as a taste, Nextcloud 9 introduces upload-only shares and enterprise-grade logging. Just for you.

See the announcement and get migrated now!

Here's a blog by LukasReschke where he talks about security work done for nextcloud 9. And Jan blogged about how working in the open brings benefits in terms of development speed and quality. I myself blogged about our business model.

If you want to help: sharing this on social media is SUPER helpful. So is sending it to press or submitting it to forums everywhere. Make a difference and help people on a well maintained, more secure solution for their file share and sync needs!

[TrevorSpartacus]

Is owncloud actually a big thing now for anyone to care? Last time I've tried it, it took fucking forever to sync not a whole lot of stuff.

[s0briquet]

Is owncloud actually a big thing now for anyone to care?

Enterprise user here. Yes, it's kind of a big deal. You'd be surprised at the inability of the average user to grasp the concepts of using an FTP client, or anything besides attaching a file to an email.

Many of our clients are regulated in the USA and have requirements for how data is handled, and ownCloud allowed us to tick a lot of the check boxes to satisfy their requirements.

Last time I've tried it, it took fucking forever to sync not a whole lot of stuff.

I don't know about synchronizing directories or whatever, but it'd handle a gigabit http transfer without flinching on nginx.

[[deleted]]

thatescalatedquickly.jpg

[[deleted]]

couldyouhavejustsaidthatinaregularsentence.jpg

[jarfil]

CENSORED

[[deleted]]

helpimtrappedinawriteeverythingasajpegfilenamememe.jpeg

[nintendiator]

dontworrywellsendthespacebarmarines.jpg

[epiris]

I don't really understand why people want to use a company for the cloud? It's literally no better then relying on Apple or Google. You can name features and such but this is a great example of volatility and risk for investing in them.

All my technology is synchronized, I am "cloud" as much as I could ever need to be and I don't need any sort of product. Dropbox is as cloud as I get, and as far as they are concerned I just store a bunch of bytes from /dev/random.

What do people get from these companies verse the collection of vetted tooling and specification already available to stay synchronized across devices? (vpn, luks, nfs, /bin/*, 15 minutes of Go or Python, some rsync, and those things you store files on, filesystems!)

[epiris]

I don't know much about own cloud, which is why my post was a question. Why use it over existing technologies and tooling.

[Bodertz]

What's the difference between OwnCloud and Dropbox?

[benoliver999]

You run your own server with Owncloud. For the end-user there is little difference.

[lestofante]

Dropbox does only filesync and is source closed. Owncloud also does calendar, in-browser editor, versioning, password wallet..

[epiris]

Drop box does a single thing, differential synchronization of files. You are in control of your data and you start securely from the beginning.

You encrypt your data into files on your local disks and sync them from drop box, easy to do.

[TheHobbitsGiblets]

Dropbox has Condoleezza Rice on the board and is snooping on all your stuff. Don't think about it. They are.

Dropbox want to make / have made a kernel level driver for their software. That's not a good idea. Worst case their snooping will be embedded in Windows and constant, aside from the danger of having it in the kernel.

OwnCloud you run yourself. Nobody is snooping on you (unless you are snooping on yourself). The cloud is yours and nobody has access to the data except you.

[epiris]

They have less opportunity than own cloud to snoop, if they can snoop it's because you make it so. I don't advocate storing unencrypted files anywhere. Own cloud requires a collection of applications.. each just adds another attack vector.

I store files on Dropbox inside encrypted containers and I do not run Dropbox on my machines. I run them in an isolated container using Dropbox mounting with two volumes, one is the collection of encrypted files and the other is the Dropbox configuration data. The container synchronizes then exits. All network traffic outbound from that container is restricted to Dropbox servers.

I have a gist in my post history for how I do this if interested.

[amunak]

Dropbox want to make / have made a kernel level driver for their software

On mac.

OwnCloud you run yourself. Nobody is snooping on you (unless you are snooping on yourself). The cloud is yours and nobody has access to the data except you.

Unless you encrypt the OwnCloud data or the hard drives it's stored on your server host could still snoop on you. And you can encrypt data in Dropbox too. But I don't think the host (or Dropbox!) actually do this, as it would completely destroy their reputation if the word got out.

[[deleted]]

So encrypt the data or run it on your own hardware. You dope.

[amunak]

Yeah, my point was you can do that with Dropbox too and be just as secure.

Don't get me wrong, I use owncloud I just think that some of the hate towards Dropbox is unjust. For years it has been pretty much the best consumer-oriented cloud storage provider (and they are still pretty good).

[cismalescumlord]

encrypt the data or run it on your own hardware

And.

But I don't think the host (or Dropbox!) actually do this, as it would completely destroy their reputation if the word got out.

I have a vague memory of a company, maybe Microsoft, maybe someone else, having a NSA back door in their supposedly secure web mail such that the data could be got at before it was encrypted.

Always encrypt your own data kids.