Cloudreve - Self-hosted file management and sharing system

[Kubernetes]

Just a single binary to run, looks easy to package on first sight

[necrevistonnezr]

Has mobile apps, e.g. https://cloudreve.org/ios - nice!

The iOS app description says:

Support all official Cloudreve backend, for both community edition and Pro edition

From https://cloudreve.org/pro (Google Translate)

Donation Edition Exclusive Features

• Complete list of exclusive features for the Contribution Edition
• The donation version and the community version are updated synchronously, and new exclusive functions will be added as appropriate when each version is updated.
• Bind multiple storage policies to the same user group, and users can switch freely
• Transfer files between storage policies
• Capacity pack purchase
• user purchase
• Points recharge
• Activation code (redemption user group, capacity pack, points)
• Create a share for downloading with credits
• Third-party payment docking (PAYJS, Alipay face-to-face payment, WeChat code scanning payment)
• QQ Internet login
• Save other users to share to their own network disk
• Bind different storage policies to different directories
• Share reports and handle
• Specify the initial file for newly registered users
• Site announcement module
• Register email suffix whitelist/blacklist
  (continuously updated...)

These wouldn’t really matter to me….

[LoudLemur]

These 3rd party payment processors look like they would be useful in China.

"Third-Party Payment Docking
Third-party payment docking refers to the use of payment processing services provided by companies other than the ones directly involved in a particular transaction. This can include third-party payment gateways or processors that handle online payments, as well as third-party docking stations that allow for convenient charging or connection of devices.

In some cases, using third-party payment docking may be more convenient or cost-effective for individuals or businesses. However, it is important to carefully consider the risks and benefits of using these services, as there may be additional fees or security concerns that need to be taken into account.

When considering third-party payment docking options, it's important to research the various providers and their fees, security measures, and reputation within the industry. It's also important to ensure that any third-party docking stations used for charging or connection are compatible with your devices and won't cause any damage to them."

[timconsidine]

Maybe I shouldn't feel like this, but .... a binary ?
How does anyone know what's in it ?
Has its source code been compiled independently and compared to released binary, or other security checks ?

Personally I wouldn't touch this with a very long bargepole, whatever the feature list and however pretty.

[Kubernetes]

You can check the source and compile it yourself as it is open source.

[timconsidine]

@Kubernetes true ... but that needs a correctly built dev + compile environment, plus a level of technical ability.
And that's never as straightforward as it should be.

I do feel that Cloudron definitely needs an additional app choice in this category.
But I will pass on this one.
Doesn't stop anyone else of course !

[fbartels]

Go can also be built in a reproducible manner. much easier than e.g. c++

[LoudLemur]

@timconsidine said in Cloudreve - Self-hosted file management and sharing system:

Maybe I shouldn't feel like this, but .... a binary ?
How does anyone know what's in it ?
Has its source code been compiled independently and compared to released binary, or other security checks ?

Personally I wouldn't touch this with a very long bargepole, whatever the feature list and however pretty.

For what is worth, I am inclined to agree with you on this and I appreciate your vigilance and thank you for bringing this concern to our attention.

[timconsidine]

@fbartels that's good to know.

The performance improvement of compiled vs interpreted on an app like this can't be that significant.

I just don't see the point of releasing as binary, it just "smells" as an approach.

Anyway, I will shut up and leave it to those who are comfortable with it.

[Kubernetes]

It doesn't matter if a binary or a interpreted code. If there is something bad in it, it will be bad in both. (I don't say that it is good to trust anything )

btw, there are more cloudron apps which are binaries, for example the AdGuard Home App

[nebulon]

The app is written in go and go simply compiles to native code. This is the main reason here compared to other interpreted languages like JS or python. So on that front this is simply a matter of the technology used.

For us, go apps are usually very easy to package due to the fact that they compile into a single binary.

[timconsidine]

OK, thanks for the feedback which is educational for me.