NextCloud, a security analysis
ownyourbits.com
ownyourbits.com
There are things you can do, of course. But unless your app is basically read-only, there are almost always one or two noteworthy vulns.
You can save yourself some headache by using best practices and clearing away all the low hanging fruit before contracting with an expert. For example, but deploying on HHVM, aggressively using static analysis tools and clearing up issues that lead to compiler warnings, and running external application vulnerability scans from things like local Burp Pro or the hosted Tinfoil Security.
Seriously WTF are the PHP devs smoking? Just look at these tables: https://secure.php.net/manual/en/types.comparisons.php
Given the size of the codebase and the insecure language and frameworks it's built on, I would consider a NextCloud instance that touches the internet to be at enormous risk of compromise.
If you want to investigate my gut there are a million and one things having to do with its architecture and implementation that you want to look into. None of those things involve what TLS cipher suites it uses.
If someone here feels challenged: We look forward to your reports. :)
That aside, Nextcloud and similar user-extensible platforms are very hard to secure as it only takes a single slip of the thought by a single app author to open up the doors for unwanted visitors. As it is just the flexibility which gives Nextcloud (et al) its appeal this is a hard problem to solve.
The upside is that you don't have to install much serverside.
* What do you do for mobile access?
* How do you share to a single person or a group?
* What do you do for team collaboration?
I also don't need to share since all I need is to sync between my laptop and my Desktop.
There is also Unison, which is similar.