scr4ve

So many true points in there. Thanks for the read!

FWIW, I found that you can either deterministically deduce a cell or prove that the choice is irrelevant for at least two of the conditions. In this case, you can fill it with the solution that gives you the most flexibility for the third.

> Out of curiosity, can you point me at a significant case cryptolockering of NAS data?

http://www.theinquirer.net/inquirer/news/2358733/synology-na...

> I have nothing on my WD MyCloud that isn't duplicated somewhere else (either it's a backup of google photos/videos, or dupe'd to a USB drive)

It sounds like it doesn't apply to your case, but a potential issue with Dropbox/ownCloud/Google Drive is that the master server can instruct all copy-holders to delete their copies. You should have off-site backups, but I suspect many people don't.

> I assume one could not run off of the WD box and the Raspi/Owncloud base is too small to target.

This is not really an issue - there are multiple router-based botnets as well. You can't really mine bitcoins, but there are tons of other stuff you can do, e.g. DDoS is usually not constrained by the processing power.

> but I'm at a loss as to why some 'hacker' would go to the effort to sift through the type of content that is typically stored on the average NAS box. Like you said, family photos, birthday videos...

It's not 'some hacker' going through your stuff, it's an automated attack scheme. Your adversary may choose to do something CryptoLocker-like or more stealthy stuff that makes your NAS part of a botnet. Neither option is good.

As others pointed out, it is highly likely that the ownCloud instance ends up publicly accessible, because that's the primary way to access files from the outside.

> "Please look at this commit so you know how you can hack us", sounds certainly like a much better idea ;-)

I think that'd be better than a deceptive commit message, yes. ;-) IMO, security-related changes should clearly be marked as such - if you don't want to have them publicly, you can keep it on a private branch for the time being.

> When was there a single very grave vulnerability within the core of Wordpress? Mostly plugins are the root of all evil there.

The same (plugins) probably applies to ownCloud, still that doesn't make it better. I personally think that embracing PHP's low entry barrier [1] is the wrong approach and I'd rather see a security-driven design.

> This is wrong. Until now there has not been a single moment where customers did receive patches in advance. The only difference being is that they see the advisories earlier, but at this moment patches are already available for all.

Thanks for the clarification - very sorry for the FUD. I got this info at a conference from one of your enterprise customers not-so-technical management guys, who is apparently misinformed.

> For the record we receiced until now 340 reports by over 150 individuals and until now only 1 vulnerability within the server has been pointed out. (Full Path Disclosure of the ownCloud root folder such as "/var/www")

My argument was that the market price of vulnerability is more or less a metric for security strength [2], and 500 USD doesn't seem to be much. If we presume that the value of a critical ownCloud exploit exceeds 500 USD, your bounty program provides very little incentive to search for or report critical vulnerabilities and you'd only get low-quality reports (which seems to be the case).

> What makes you thinl they are more secure?

I think that ownCloud has a big problem with automated vulnerability scanning and the security properties of managed appliances are generally superior. I unfortunately can't edit my original post anymore, but I should have added that running ownCloud behind a VPN is a very good idea as well.

[1] https://owncloud.org/blog/owncloud-and-php/ [2] https://events.ccc.de/congress/2005/fahrplan/attachments/542...

I don't really get why one wants to trust ownCloud with private files:

- "logging changes": https://github.com/owncloud/core/commit/eea96298951805dfc6eb... vs https://owncloud.org/security/advisory/?id=oc-sa-2014-020

- ownCloud is a PHP application with quite a few third-party modules of varying quality. Looking at the security history of Wordpress, it's not hard to imagine what's going to happen.

- The maximum bug bounty for ownCloud is 500 USD. I think my data easily exceeds that.

- From what I've heard, security fixes are provided to enterprise customers first, so if you're lucky your adversary is one of them and knows about vulnerabilities way ahead of you.

To their credit, ownCloud openly publishes security advisories for every vulnerability, but I still think it's architecturally designed to fail. Exposing this to the internet is probably a bad idea. If you just need storage, you probably should just use dumb storage. If you need project management stuff and care about privacy, maybe look at https://protonet.info/ or something along those lines. Also https://www.boxcryptor.com is really nice - the Dropbox desktop client does proper cert pinning (ownCloud doesn't) at least.

Other than that, storage connected to a raspi via USB will probably yield rather bad transfer speeds?

mitmproxy keeps all requests in memory, so that you can browse them quickly. If you want better performance, you can just swap "mitmproxy [args]" with "mitmdump [args]" and get all features in a headless mode which scales well and keeps a low constant memory profile.

Charles is definitely good, but to be fair, you get all of that (except mappings) in mitmproxy as well. :-)

We finally ended up picking http://dgrid.io/ over SlickGrid and jqGrid. As with every table component, there are some quirks, but we're really happy with it. Feels like the most modern table component to us.

I wonder why Backbone is getting so much attention. For small tasks, jQuery is completely sufficient (as in this example as others have noted). If you're going to develop applications on a larger scale, Dojo is a way better alternative in most cases IMO. It comes with modularization, build tools, i18n etc... Backbone is somewhere in the middle, neither highlevel nor lowlevel JS. I really don't see a spot where Backbone significantly outperforms either Dojo or jQuery. Can anyone tell me what's so special about it?