Nextcloud 14: focus on security and compliance

[hostingnuggets]

@jospoortvliet

I don’t know exactly what you mean with ‘core team’. Sure, there’s a team of people who get paid to work on Nextcloud, but they get paid by customers to work on what these customers want. On github and this forum you will only find volunteers.

Sorry for not being precise enough. With core team I meant people who have deep technical and security knowledge of Nextcloud such as Lukas Reschke (where is he btw?) and not someone from PR/marketing.

@jospoortvliet

Well, as far as I know, it works just fine for 99% of the users - and bugs get fixed. But there are always corner cases. Fixing bugs that hit a single home user, like yours - it depends on when someone (a volunteer…) has time and interest to look into it.

On what facts do you base that this bug is hitting only a single home user? Please cite your sources here and your analysis how you found out that this bug is only affecting one single home user.

What about this server-side encryption issue (503 Encryption not ready: multikeydecrypt with share key failed · Issue #8349 · nextcloud/server · GitHub)? It is open since February, seems to hit more than one user and does not have any solution or fix yet.

@jospoortvliet

As a reminder, you should think about saying ‘thank you’ frequently

I take the opportunity here to thank you for your answer and in advance I would like to thank the developers for taking seriously and fixing these type of server-side encryption bugs which can lead to data loss.

@jospoortvliet

In general, we make clear recommendations to use a server-wide key, not per-user key. The former is far more robust and the latter provides very little additional security but loads of issues.

Please cite the sources in the official Nextcloud documentation where these recommendations you are speaking of are written in clear text?
I checked the relevant server-side documentation in the admin guide (e.g.: https://docs.nextcloud.com/server/13/admin_manual/configuration_files/encryption_configuration.html) as well as in the user guide (e.g.: Encrypting your Nextcloud files on the server — Nextcloud 13 User Manual 13 documentation) and could not find anything about this recommendation of using server-wide key and not per-user key you mention.

Again thank you very much all in advance for focusing on fixing current and old serious issues such as server-side encryption instead of new fancy product-marketing features.