From ff042c03b37daa1595f5624693a480e2b204b0a8 Mon Sep 17 00:00:00 2001 From: Bob Mottram Date: Tue, 8 Aug 2017 17:18:43 +0100 Subject: [PATCH] nextcloud advisory --- doc/EN/app_nextcloud.org | 2 ++ website/EN/app_nextcloud.html | 22 +++++++++++++++------- 2 files changed, 17 insertions(+), 7 deletions(-) diff --git a/doc/EN/app_nextcloud.org b/doc/EN/app_nextcloud.org index 93b3d044..949faf50 100644 --- a/doc/EN/app_nextcloud.org +++ b/doc/EN/app_nextcloud.org @@ -24,6 +24,8 @@ NextCloud is a system for file synchronisation and also has many other plugins f The videoconferencing plugin requires a browser with WebRTC support and so is unlikely to work in a Tor browser, but may still be a better option than using proprietary systems. +* Operational considerations +If your ISP or the government in your area is part of your threat model then NextCloud may not be the best choice for hosting files and [[./app_syncthing.html][Syncthing]] could be preferable. In the past NextCloud is known to have remotely scanned servers without permission and reported server admins who don't immediately update to the latest version of the software to their ISPs or to questionable government agencies. Depending upon where you are located such activities by the developer, which are not really in the spirit of independent self-hosting, could have very undesirable results. * Installation Log into your system with: diff --git a/website/EN/app_nextcloud.html b/website/EN/app_nextcloud.html index 30a804ce..7fbc383b 100644 --- a/website/EN/app_nextcloud.html +++ b/website/EN/app_nextcloud.html @@ -3,7 +3,7 @@ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> - + @@ -264,9 +264,17 @@ NextCloud is a system for file synchronisation and also has many other plugins f The videoconferencing plugin requires a browser with WebRTC support and so is unlikely to work in a Tor browser, but may still be a better option than using proprietary systems.

-
-

Installation

-
+
+

Operational considerations

+
+

+If your ISP or the government in your area is part of your threat model then NextCloud may not be the best choice for hosting files and Syncthing could be preferable. In the past NextCloud is known to have remotely scanned servers without permission and reported server admins who don't immediately update to the latest version of the software to their ISPs or to questionable government agencies. Depending upon where you are located such activities by the developer, which are not really in the spirit of independent self-hosting, could have very undesirable results. +

+
+
+
+

Installation

+

Log into your system with:

@@ -286,9 +294,9 @@ Select Add/Remove Apps then nextcloud. You will then be asked for
-
-

Initial setup

-
+
+

Initial setup

+

Go to the Administrator control panel and select Passwords then nextcloud. This will give you the password to initially log in to the system and you can change it later from a client app if needed.