Slashdot Mirror
OwnCloud Dev Requests Removal From Ubuntu Repos Over Security Holes
operator_error notes a report that ownCloud developer Lukas Reschke has emailed the Ubuntu Devel mailing list to request that ownCloud (server) be removed from the Ubuntu repositories because it contains "multiple critical security bugs for which no fixes have been backported," through which an attacker could "gain complete control [of] the web server process." From the article: However, packages can't be removed from the Ubuntu repositories for an Ubuntu version that was already released, that's why the package was removed from Ubuntu 14.10 (2 days before its release) but it's still available in the Ubuntu 14.04 and 12.04 repositories (ownCloud 6.0.1 for Ubuntu 14.04 and ownCloud 5.0.4 for Ubuntu 12.04, while the latest ownCloud version is 7.0.2). Furthermore, the ownCloud package is in the universe repository and software in this repository "WILL NOT receive any review or updates from the Ubuntu security team" (you should see this if you take a look at your /etc/apt/sources.list file) so it's up to someone from the Ubuntu community to step up and fix it. "If nobody does that, then it unfortunately stays the way it is", says Marc Deslauriers, Security Tech Lead at Canonical. You can follow the discussion @ Ubuntu Devel mailing list. So, until (if) someone fixes this, if you're using ownCloud from the Ubuntu repositories, you should either remove it or upgrade to the latest ownCloud from its official repository, hosted by the openSUSE Build Service."
That seems like a lot of dick-measuring on the part of developers. Why wouldn't Canonical simply update the repository with patches that address known security vulnerabilities? Where is the years of support? When you update your package list, the developers of those packages should be able to post updates...
This is why Linux is not desktop ready... to many stubborn minds pushing their way.
The developer has fixed the code. They're not responsible for maintaining the repositories of every single distribution or there, that's the job of the package maintainer of the distribution. Problem is, the package maintainer hasn't done their job, the developer has raised concerns, and has asked for it to be pulled until they do their job. It's just irresponsible for the package maintainers to come back and say "we can't pull it, we're leaving it as is, and we're not patching it either".
Someone had to do it.
No, they're responsible for maintaining their packages in every repository they wish to add their package to, though. If they want to be part of the Ubuntu repo, rather than hosting their own repository, they play by Ubuntu's rules. Don't like it? Run your own repository.
They do: http://software.opensuse.org/d...
They're not the ones maintaining the packages in Ubuntu's repos, that's Ubuntu-folks' own doing.
Because ubuntu dosen't allow new major versions to be added to a distro that has already been released.
null
Even if they did remove it, it will only prevent new installations of that package, it will _not_ remove all those instances already running.
Think ahead, folks.
Because ubuntu dosen't allow new major versions to be added to a distro that has already been released.
Do they allow packages to be ranamed? Then changing only 5 bits woudl rectify the situation.
If they just leave the code as-is, but change the name from "ownCloud" to "pwnCloud", then the actual functionality of the package would be clear to everyone.
[quote]It's just irresponsible for the package maintainers to come back and say "we can't pull it, we're leaving it as is, and we're not patching it either".[/quote]
The package maintainers didn't say that. This package is in the universe repository. The entire purpose of this repository is that volunteers can upload packages that Canonical has decided they aren't going to support. So Canonical isn't the package maintainer and you can't really blame them for not supporting packages that they said they aren't going to support.
Furthermore, it sounds like the ownCloud developers want Ubuntu to either use the latest & greatest release, or remove the package entirely. If that is correct, then I think it is irresponsible on the developer's part. Version 7 only came out 3 months ago, so they really ought to be providing security patches for version 6.
There are lots of things they can do, however: they can upgrade to an empty package, upgrade to a package that requires positive confirmation from the user upon upgrade, or upgrade to a package with a non-existent dependency.
The general issue with Bennett Haselton is simple.
Everyone else in the world submits articles, slashdot summarizes them, links back to the full article, and the comments here ensue.
In some cases the article links are just a link back to the article submitters own blog (and this is gently mocked but usually tolerated), in other cases the links are broken (also mocked), in some cases they are linked to an unrelated article (you bet we mock this too), and very occasionally for those people who enjoy the thrill of the hunt, they do go back to an original article in some legitimate or quasi-legitimate source of news. (Hooray!) (In which case we can mock everyone who didn't read TFA.)
Bennett however, as if you've read any of his articles you will know, is special. He read about the virtues of conciseness, efficiency, brevity and then wrote a short epic about how why they really shouldn't apply to him.
When he looked at what it would take to get his very own blog up and running he quickly realized that it was a pretty serious undertaking. He'd have to register somewhere, choose a password, maybe even pick a theme. Do you know how much that would cut into his actual writing time? Several minutes, at least, and he really just doesn't have that kind of time to spare, what with already being slammed just keeping up with writing down every thought that pops into his brain.
So, long story slightly less long, he decided why not just use slashdot itself as his very own personal blog? It saves him having to sign up for one, and better still he argues, saves us a mouse click by eliminating that superfluous step of having to click through to get to the full article.
After having this explained to him, Bennett rejected the argument and suggested we should be delighted at being able to reach his thoughts without having to make that one extra click to an external source.
So now we just mock Bennett.
I think that sums it up fairly concisely, at least relative to what Bennett would have said. ;)
The last option would result in the current version remaining on user's machines. If a dependency for an update is not available, apt will hold the package back.
Lukas from ownCloud here (the one mentioned in that article). I have to say, that this quickly escalated in a way that I did certainly not intend to. However, I'd like to clarify one thing.
The article states "for which no fixes have been backported". With that I meant to refer to the Ubuntu packages and not Version 5 or 6. We still support ownCloud 5 for security patches and critical bugfixes and ownCloud 6 for bugfixes and security patches. This might have been unclear.
I sent this request to Ubuntu because we're very much concerned about our users. While some of us might know that using the "Universe" repository is not a that great idea for internet facing software, most people don't. Furthermore, I don't believe it's the responsibility of the developer to update packages in every single distribution out there. Especially with distributions such as Ubuntu you have to follow quite complex processes such as SRU which consumes a lot of time.
Additionally, some people in the comments seem to claim that "one developer of ownCloud is noted as maintainer for the Debian package". This entry is a legacy entry and as you can see in the changelog at http://metadata.ftp-master.deb... Thomas did last modify the packages at 11 Oct 2012.
We're always recommending to our users to use one of the supported installation methods such as owncloud.org/install where we even provide our own repositories for most distributions.
(Disclaimer: Opinions expressed in this post are solely my own and do not necessarily also express the views of the ownCloud project or my employer)
It is up to the package maintainer to backport security fixes if they want them. If they don't want to remove the package fair enough, but they should be popping up copious warnings, and maybe push a package update that alerts via script (even if it doesn't secure the package) that "THIS PACKAGE IS INSECURE AND UNMAINTAINED - it is recommended you deinstall and upgrade via original sources" or similar. This is similar to how FreeBSD ports work.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
As I understand it, this package is not part of the official ubuntu distribution, but part of the third party not officially supported packages, so that should not preclude it from being updated.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
Of course it makes sense: this is Ubuntu. When they say "it's from universe", you should understand: "we synced from Debian, and we wont do any more work on the package, as we don't give a shit about what we ship".
I think it's more than time that everyone understand Ubuntu is not a good fit for running a server, unless you remove nearly all software from it (that is: everything that is "synced from Debian"). So then, why not using Debian in the first place?
The reasons that I often hear is more reliable release cycle and supported hardware enabledment kernels during the first two years of and LTS. But yes, most Ubuntu users do not understand the security ramifications of using packages from the Universe component.
The Ubuntu security team (which is mostly paid Canonical employees) provides security updates for packages in the main and restricted component. Packages in universe (such as owncloud) and multiverse are not supported by the security team.
That's correct. It's in the "universe" repo, which is community maintained, so it's not Canonical's responsibility to keep it updated. It's up to the package maintainer(s) to back-port security fixes, and I don't think anyone has volunteered to take that on.
The universe repository is not supported by Ubuntu. There are four sections:
Main - Officially supported software.
Restricted - Supported software that is not available under a completely free license.
Universe - Community maintained software, i.e. not officially supported software.
Multiverse - Software that is not free.
So someone in the "community" once made an ownCloud package, got it in universe and isn't maintaining it. Ubuntu is saying "that's not ours, you fix it" while the developers are saying "that's not ours, you fix it" and they're both making valid arguments. Ubuntu is saying the quality of the universe packages is what the community makes of it, if it's broken or vulnerable it stays that way until the community provides a fixed version. Otherwise they'd get overrun by lazy packagers who get it into the release repository then orphan it and ditch the maintenance responsibility on Ubuntu. If the developers won't jump through the hoops to fix it then it can't be that important to them.
The developers of course see it differently, they never asked for their software to be put in this repository. They never broke it, why should they fix it? Clearly they're a victim here. Still, just because you're a victim there might still be a process. If you send an angry mail to YouTube saying "Hey you bastards, stop sharing my video kthxbye" they might redirect you to say here's the report copyright violation form, fill this out and we'll process it and you go "Nuh uh, too much work and I already told you stop so stop already." you won't get far. And Ubuntu is legally in the clear here, if they want to keep shipping that package they can. It's a request, not a demand.
Live today, because you never know what tomorrow brings
So now we just mock Bennett.
I'm not sure if he deserves all the mockery. Maybe some people think that he has posted a couple of silly opinion pieces, but that does not make him a malicious monster.
No, because renaming it has the same effects on existing systems. The installed package "ownCloud" is no longer there (by that name) so future usage of apt-get can still break.
I'm less familiar with Ubuntu specifically but have extensive Debian experience, so can't comment on the Ubuntu policy, but I suspect Ubuntu views this more as removing a package is them breaking package management on existing systems, vs leaving it as is would still be breaking the system due to the vulnerabilities but not Ubuntu's fault (which I still find arguable, but again it's also just my guess)
Debian stable will also out right refuse to break apt by removing a package, however Debian has a large security patch repo plus a huge backports repo and community - which typically spends their own time back porting patches for newer app versions from the original developers back to older versions the devs stopped patching.
Many years ago at least Ubuntu still did not have the infrastructure for this nor dedicated any man power to the task. Sounds like that is still at least partially the case there.
This is also why ownCloud distributes their stuff in their own repo, which is the best way to go about it (so props to ownCloud there)
That way it is completely up to them how "stable" they want their software to be viewed.
They can either force people to upgrade to a new major version, breaking all existing installs until configs can be updated - or they can try to be stable and backport patches - or anything in between.
It's just mind boggling some dip decided that despite the fact ownCloud has their own maintained packages and even a repo for them, that it would at all be necessary to claim "now i'm the package maintainer!" and put it in Ubuntus repo...
Was this Ubuntus direct doing?
In Debian only the core system is packaged by their own team. 3rd party stuff however anyone can step up and decide to be the package maintainer, compiling from src to debian standards and releasing debs. But it's usually easier to see who to point the finger at in that case.
Bennett has been posting these long ramblings since a very long time before Dice bought Slashdot. Unfortunately, I think that your complaints are not likely to be heard because Slashdot seems to have had a policy for a long time of not recruiting editors from people who regularly read the site...
I am TheRaven on Soylent News
Theres also the fact that his ideas are often enough repellent, such as when he explains how we dont really need the double jeopardy or self incrimination protections of the 5th amendment, or how Computer Acceptable Use Policies and the corresponding network IDS and filtering systems are literally Hitler.
His ideas are very often absurd, and appear very much as if he recently learned about (or began thinking on) a topic, and immediately crafted an opinion on how everyone else who is an expert in said field is wrong.
Notable entries in this category:
* Why the 5th amendment is totally unnecessary.
* More questions about the 5th amendment, indicating a lack of understanding of its background and purpose (leading one to question in what way Bennett was qualified to raise objections to it).
* Why corporate network filtering and intrusion prevention are tyranny
* Why you should ignore every lawyer's advice of "dont talk to cops".
There are hundreds more, if you do a search for Bennett Haselton. The guy is well intentioned-- he clearly has a passion for getting rid of censorship and fixing the world-- the trouble is that hes proven massively susceptible to the Dunning-Kruger effect.
Was. His account no longer exists. All prior articles no longer have a link to his profile page, and manually typing it in gets a "not found".
It's not my code, i am only a user.
But in my experience, the developers are reacting quite good on "issues" on their github (see the repos of haiwen).
On the other hand, the owncloud devs tend to "i close this (still open) bug due to inactivity", when the inactivity is on their side, because they just need to fix the stuff with all information already provided.
No, because renaming it has the same effects on existing systems. The installed package "ownCloud" is no longer there (by that name) so future usage of apt-get can still break.
Of course it can. The repository maintainer can introduce a new package pwnCloud and turn ownCloud into a metapackage that requires pwnCloud. This "transitional package" pattern happens often in Ubuntu updates.
If PHP ought to be banned, then what migration path do you propose for (say) Wikipedia, which runs MediaWiki software, which is written in PHP? This migration path proposal might give ownCloud's developers ideas on how to migrate from PHP.
yep, its a filesync tool.
for calendar and contacts you may still consider owncloud, but there are a lot of "groupwares", which do a fine job. ... which gives quite a cloud replacement if you look at google, but may be a bit too much for a single project, which needs to maintain all this stuff.
owncloud tries to do everything
i used owncloud and despite the other flaws, the missing incremental sync (which will not be added later) was the top argument. you cannot upload 100 mb each time you change a tiny bit.
My tablet has it's own spell checker, why doesn't yours?
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
If you are an decently qualidied Adminsitrator, then you always conciously choose between the following:
a) You customize/install/update/recompile/patch the software you need on your own time. Usually you do thos when the service availability is absolutely critical and at the same time no out of the box solution exists
b) You use an "out of the box" solution. This solution should be supported, and used within its nominal use case.
Ubuntu very clearly states that Universe packages may - at best - only receive a minimal quality check at the distibution release and are patched by maintainers, which are not necessarily authors of the software nor employees of ubunut. As such their time which they may spend to predictably react to problems is limited, and, if anything in their life changes they just have to stop doing anything for the package without further warning - if the packge is important enogh for you, donate money to the maintainer and pay him.
I appreciate that the author loudly raises his concers, but i think anybody running an unsupported port of an program is responsible for himself. Pulling the pckage is not good. I for my part run any service for myself (file sharing etc) on a machine which only shows a single port for a vpn to the outside world. If something other than a security problem in the VPN software apprears, i would prefer to contunue using (and reinstalling) the packages which I chose.
If I run SW which faces the internet, then if fix it myself
why is it officially part of the stable release?
It's not. The stable release consists of the repos that are enabled by default, a list which does not include universe. The universe repository also comes with the following warning:
## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team. Also, please note that software in universe WILL NOT receive any
## review or updates from the Ubuntu security team.
There are similar, but stronger, warnings on multiverse and backports, as well. It's not like they don't tell you what you're getting yourself into when you choose to enable those sources.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
You mean warnings like this comment above the disabled by default universe repository (where owncloud exists)?
## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team. Also, please note that software in universe WILL NOT receive any
## review or updates from the Ubuntu security team.
That covers the entire repository, including its contents, which would include owncloud, if installed from Ubuntu's repository. If installed from elsewhere, it's not Ubuntu's responsibility, anyway.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Unfortunately nothing else comes even close to OwnCloud in terms of feature. Like LDAP/AD integration, proper quota, multi-platform client (although the Linux client is a shameful mess)
Been running Owncloud for a year now and every upgrade again gives me this sick feeling in my stomach. What will they break this time... The idea behind Owncloud is solid, however their development model is a mess. Loads of re-appearing bugs in every new major release, big features which get borked during upgrades etc. It would be nice if they stopped messing about with new stuff so much, focused more on stability and made sure their stuff works without issues on common platforms such as RedHat Enterprise 6 (both server and client, without warnings)
Meh, what did the user do before owncloud, which is a rather home grown software? I did not test a lot of groupwares, but i am aware, that there are many to choose from, with many users. Some are very old already and i guess they have many of the features a normal users needs. tine looks nice, horde is more mailcentric, egroupware is some other name i never tested ... and you can combine single products. While owncloud is nice and each feature is not too bad, there is another more complete software for each feature, which is just not integrating into a single product, which is the advantage of owncloud.
Call the Ubuntu specific version PwnCloud...
Thank you, I'll be here all week.
LK
"Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
Lol!!!! Where are my mod points...
Although I've used Linux as my main OS for many years, the idea that bundling applications locked to version that cannot be update is insane and one of the things that I hate about Linux distros. Ubuntu did the same stupid thing with Firefox and Open Office at one point. Being stuck with outdated and potential insecure software, unless you compile your own or used another unofficial repository, is crazy. This is a great example of a system that is designed to fail and a huge security flaw.
I do often compile and install or directly install debs or add other repos. It isn't difficult but can become a hassle when it expects a base Linux environment that is very different. It is about time for some standardisation in the Linux distros. That would also help with a broader adoption of Linux in a desktop role and attract more commercial software to Linux that is currently Windows only. Commercial devs can chose between developing for a small number of Windows versions or a shitload of constantly changing version of Linux. Learn something from the example of Android as a commercially successful version of Linux...
Locking the core OS and software necessary to provide a common base makes some sense but this is taken too far. Either keep software in repositories updated or don't provide them. Ubuntu don't have to be the ones updating but they can have a policy of removing software that isn't keep up to date and banning it from future versions. Shift it back to the original developers to decide what distros to support and install the software directly, rather than through the broken repository approach.
Try seafile - not saying they cover everything, but for file sync, it seems to work very well (and scales better then Owncloud when you have a few thousand files).
Wolde you bothe eate your cake, and have your cake?