00:00 I'm Seth For Privacy, and welcome to Season 2, Episode 11 of Opt Out. Opt Out's a show where I sit down with passionate people to learn why privacy matters to them, the tools and techniques they found and leveraged, and where we encourage and inspire others towards personal privacy and data sovereignty. Have you been looking for a solution to get off of Google or Apple's walled ecosystem and take back control of your data? This episode, we're sitting down with Yost Portfolio to chat about Nextcloud and the many solutions it has to offer.

Welcome on to Opt Out, Yost. I'm glad to be here, Seth. Thank you. Yeah, I mean, Nextcloud is one of my absolute favorite tools out there, and it being open source is obviously a key part of that, but it's been a go-to for me to host it for myself, recommending it to others, providing it as a private service for friends and family, and it's really just been something that's eased the transition away from the very simple ecosystems of Apple and Google and all of their tools that integrate well and really help people to migrate off in my own life.

So I'm very much looking forward to digging into Nextcloud with you today. But before we dive into that, do you mind just introducing yourself and telling us a little bit about what Nextcloud does? Yeah. First of all, I'm incredibly glad to hear what you're just saying because this is, I mean, why Nextcloud exists. You know, we wanted to put people in control over their data. So my name is Josport Fleet, and I'm a longtime open source advocate and privacy advocate.

I've been active in the KDE community, OpenSUSE, various other projects. And within KDE in about 2010, a good friend of mine, Frank Karliczek, he actually in the U.S. at a KDE event in San Diego, if I recall correctly, early 2010, he announced a project to bring back people's control over their data, so to say. And, yeah, this is over the years morphed into what is today Nextcloud. And Nextcloud is essentially, I'll call it a private cloud. It's a piece of software.

So we don't do any hosting. We don't want to do any hosting. It's a piece of software that you can run on a server, and that then provides you an environment that's similar to, yeah, maybe 365 for Microsoft or Google apps, you know, from Gmail to Google Drive, all this stuff. Not the search, right? But there's even a Maps application. So, you know, if you're so inclined, it's really a very wide range of functionalities from Google Photos and Dropbox and all these capabilities.

A lot of it is built around the files. That's where it started a bit with. But it covers the whole breadth of functionality through all kinds of apps that are developed by community members. Yeah, I think that's kind of Nextcloud in a nutshell. Yeah, I think you hit on the key points there and just the flexibility that it has. It's been awesome to see as I kind of onboard new friends and family into using Nextcloud. They ask for specific things. I'm able to just dig through the app store, find the right thing that works for them.

And it makes that process of finding the specific things that each person needs out of Nextcloud. It's very simple to integrate that. So that's been a huge win for me. And it's a real focus for why I've loved it is that I don't have to go out there looking for 25 different tools that all have different user interfaces and user experiences. And it gets tricky when you're trying to combine all those different things. But combining them into one central organized UI really does make a huge difference.

But before we dive too much deeper into Nextcloud, I want to get a little bit more of your background. And you mentioned that you've been in the FOSS space for a very long time. So this podcast is privacy focused, but the whole data sovereignty issue and really control over your data is a key focus as well. So I'd love to hear a little bit more about what it was that woke you up to the need for personal privacy or even data sovereignty. Because I know that's more of the focus of Nextcloud, even though it has obviously strong privacy benefits.

Yeah. I mean, what's in the words there? I mean, for me personally, it's really been a slow realization, I think. So when I was studying in the early 2000s, you know, I had these high hopes for the internet that I think most people back then had, you know, about democratizing, democratization of information. Which unfortunately has essentially now turned into a cesspool of weaponized fake news, if I can put it that way, which is really a disappointment.

And a big part of that, I think, has been kind of the attention economy that has made things worse, where, you know, if you've got a platform that's easy to monetize. And the way this happens is the whole surveillance capitalism that's been developing over the last 20 years. So essentially, it's user data that is monetized. And I was just today reading about an insulin pump application and thinking about how health data is apparently so incredibly valuable.

And I mean, you know, if you talk about privacy and security, especially if you talk about security, you probably have heard like, oh, the most valuable data is health care data. And I think, why? And I think, why? Like, why is my health care data valuable at all? Why is that worth money? Well, because your insurance wants to make choices whether to accept you or not and how much you pay based on that data, which is like, that's not cool. That isn't the point of insurance that you kind of have a pool where everybody shares equally so that, you know, if you get a car accident, the one in a thousand or 10,000 people that does that, that you might not be able to afford the costs.

But then the insurance pitches in. That's kind of the idea. And I don't know, there's in so many places where your data is being used to give you different prices or to push products on you. And I don't know, this just been slowly dawning on me over the years. If you look at the stuff that Facebook does, especially, of course, there, I mean, there are some of the most egregious examples, right, where they were advertising to advertisers. So there's this presentation, I think, in Australia, from Australia that leaked out where they explained to advertisers that they have such detailed psychological schemes or psychological profiles on their users that they know when a teenager is at the most vulnerable so that they can then show them the right ad.

So they purchase, say, I don't know, the right makeup or a leather jacket or, you know what? It's just, it makes you twitch just to think about, you know, that they're advertising disability. I mean, I don't know. You just wonder, like, the people who put that presentation together, did they not think for a few seconds, you know, like, I don't know, did they want that for their kids? You know, it's just quite amazing. So, yeah, privacy has been becoming more and more important for me personally in that regard.

It's one of those things where the more you learn and the deeper you fall down the rabbit hole of how data is being monetized. And I think you used the word weaponized in that as well. And I think that's a helpful word to get a better idea of what is being done with our data. Because it is really being, by many companies and organizations, I mean, obviously not everyone, but by many of these organizations, like you talked about Facebook or Meta, the parent company now, they're trying to use the data of the people on the platform against them for Facebook's own monetary gain.

And it's really a dark and evil practice that we're really seeing kind of grow in the Internet because of the way that it's become, because of this centralized structure, because of the amount of data that we're pouring into these platforms, even because of the approach that's been taken to continue to suck us in and prompt us to put more data on there and prompt us to post everything about our lives. And it's really created this nasty feedback loop that benefits those companies and harms us directly.

Yeah, and not just us as individuals, right? Like I have a psychology background. That's what I studied. And so one of the things I looked at initially was very much an individual level and people, humans simply like privacy is important for us. I mean, there's a reason why you decide to put like a picture of the party on Facebook, but not the picture of the hangover the next day. You know, we're all always creating an image towards other people that we want to control.

You want to be the perfect husband. You want to be, you know, that friendly lady at the soccer club. You want to be, you know, the faithful, you know, person in church. You know, like you always have a certain image you want other people to have. And a lot of people, you know, they don't open up that much. Some people find it harder than others, but it's important for us just as a psychological, as a safety thing to control how other people see us.

10:00 And all this surveillance just undercuts that. It really threatens our behavior. There's been studies done that when people know they're being watched, they change their behavior in all kinds of subtle ways. This has a huge impact on us as individuals. But of course, when you're talking about the stuff of a company like Facebook does, and their behavior has literally resulted in at least one genocide already, right? I don't know. I usually don't ascribe words like evil to a company, but what they are pulling is what you hear time and again from whistleblowers about how they knew what was happening, and they decided that it was too costly to do something about it.

It's just mind-blowing. It's absolutely mind-blowing. I mean, these companies just have become too big. The people on the top too far removed from, I would almost say, humanity, honestly. Yeah, I mean, something, this should be fixed. I don't have a real answer to that. But obviously, Nextcloud, we hoped it to be part of that answer. You know? I mean, look, there need to be political solutions to this, right? You can't fix this with technology. Technology can't fix everything.

I mean, like anything, it's a weapon that can be used for good and bad. And that's true for everything and certainly for the stuff that we're developing. I mean, you know, a good person can download Nextcloud and use it to protect, I don't know, data from a journalist, you know, who is reporting from Iran. But, you know, the Iranian government can also install Nextcloud and use it to store the data. I don't know, the torture reports or something.

You know what I mean? Like, it's a two-edged sword. It always is. And so we need politics to also change something. And for that, we need people to be aware, right? We don't just need an alternative to be available. We need people to be aware of it and to use it and also governments to, I don't know, use it and perhaps, well, act on the behavior of companies like Facebook and Google and Microsoft. And, you know what? Yeah, no, I definitely agree.

And I think that's why the education and the just the awareness piece of privacy and of data sovereignty and of just the activism around that is such an important piece. Because not only do we need these tools that allow people to opt out, that allow people to choose to break free of the Facebooks of the world, of the Googles, of the Apples. And start to take back control of those things so that their data cannot be monetized or weaponized against them.

But we obviously also need the piece where we're continuing to push people to consider, push people to look at what's being done with their data, push people to see the issues that are out there so that they want to start using tools like Nextcloud. And I think that's a great transition into just talking more about how Nextcloud can help people to get out of that. And it, I think, also provides a fairly unique way for people to also provide that as a service to their friends and family, specifically those people who are a little bit more tech savvy and able to host Nextcloud themselves.

I think it can provide a tool that's not only a personal privacy tool or a personal data sovereignty tool, but can really equip us to provide these things as services to the people around us so that they don't have to be tech savvy and running them themselves. So just to dive into a little bit of Nextcloud's history, do you mind walking us through what it was that really prompted the creation of Nextcloud? I think you mentioned that in 2010, it was kind of an idea at a conference and was launched at a conference in San Diego, if I recall correctly.

But any more details around kind of like why Nextcloud as a concept was kicked off? Well, it was very much like the KD community, they built an alternative desktop for Linux, right? Or a desktop for Linux. So it was very much about why it was a community that very much lives with these typical free software values, you know, choice, control, freedom, etc. And so at the conference, Frank pointed out, and the video is still online, that, well, with data moving to the cloud, being able to control the device that you run yourself becomes, well, maybe not meaningless, but it becomes not enough.

You know, because if your data is in the cloud, then the control is in the cloud. And so, yeah, it's wonderful that we're all building an alternative operating system that runs on your phone. Think of something like Android. It's, of course, also Linux-based and partially at least open source. But has that given us control? On the contrary. Yeah, even if you install your own software on it, etc. Most people's data is in the cloud. I mean, even if you manage to control, of course, your own data, then there are still other people who receive your data.

The emails that you sent, well, they're received by somebody else on their Gmail address, etc. So this was a trigger. And it was initially really seen as kind of meant to be a, yeah, call it an extension of Linux desktop. So the idea was initially really that, you know, you store your files there and then they're available on your Linux laptop and your Linux desktop. And it would really be integrated with the desktop, etc. But over time, yeah, the project kind of grew more ambitious.

And the web interface and the support for other platforms became more and more important. So it grew into a first into kind of a file access mechanism for everyone, you know, not just Linux users and not just KDE users, but also Windows users and Mac users and so on and on. And I think that's been all that's been healthy development because, of course, there's also opened it up to, well, business. Right. And then at some point, the opportunity came to try and build a business around that where, you know, we try to help these big organizations to deploy next route.

And I think of, you know, to use it for their own data and to stay in control of that. While, yeah, that money, of course, and helps us pay for developers to improve the product further. And that's been going fairly well in that way. And I love seeing that model work out because I think there's so much value in an open source project being able to build a sustainable business around it, which can then sustain the open source project. And as long as that's not kind of forgotten or put on the sidelines, which it definitely has not with with Nextcloud, I think there's a ton of value in finding those business opportunities to support the project and keep it sustainable.

I actually had no idea it came out of the KDE project or community. So that's that's news to me. Yeah, we still we're still kind of close in some ways. It's funny. We just hired a couple of people from that community. One's working on the desktop client, another one actually doing PHP code. So there's still, you know, some interaction, I guess, going on. I myself am not really active in KDE anymore. Just lack of time, you know, got another project now there where I have to try and ensure world domination.

Have your hands full with Nextcloud, I'm sure. Yeah, absolutely. Absolutely. Yeah, but it's I agree. It's been exciting to see the business side work. I must say it's not easy. It's very hard work, but we have managed to build a self-funded company that is growing organically and quite fast. You know, varied by your metrics, you know, 30 to 80 to 100 percent growth a year is quite nice. Wow. Yeah. So, I mean, again, without venture capital today, that's that's that's pretty neat and fully open source.

We have as a company really made a decision also not to do not monetize private users at all. So that kind of gives also a clarity where, you know, you can focus on on making the software better for everyone. And we do care a lot about home users because that's our personal primary motivation. Most people in the company are really they run next out themselves. They really care deeply about it, especially all the engineers for them. Many of them, they were privacy activists and are privacy activists.

And, you know, they contributed to the project before we hired them. So there's really a lot of dedication and energy in the company and in the community, of course, around it to make it a solution. And as you describe, you know, that people can run at home for the family, for their friends, et cetera. Of course, at the same time, if you would want to bring, let's say, this choice to a sizable number of people that it really has an impact on the market, you would need something like not like 0.3 percent, but like 30, you know.

And there's no way 30 percent of people can ever run their own server. So these big businesses are also important for us in fulfilling our mission, because if your telco provider and, you know, your local hosting providers and your company and your university and your school and your city council and your hospital are all running Nextcloud, then all the data is not at one big freaking company. You know, that's already a huge step up. So yeah, our vision and that regard goes beyond like we want people to be.

20:00 able to run their own server and we really put an incredible amount of effort to make that easy but like easy for running a server is still like crazy hard you know um so we also need all these other companies and organizations to do their part so to say and of course they do that because there's also money in it for them or because they have regulations like hospitals that require them to keep private data safe i mean again that comes the government back in right so yeah all these pieces are part of a big puzzle i would say um that are important for it it's not just you know a piece of software that you can run on your raspberry pi at home i mean that is important but we also need to and do support it for you know the entire german federal government runs Nextcloud for example as hundreds of thousands of people work there um and we have installations with many millions of users tens of millions even and so they bring of course Nextcloud to to huge number of people and in in a single you know from a single organization which is really important i think for our yeah for our success

because in the end we measure our success not by having a sustainable company i mean it's nice right i need to eat and we all do but in the end the success is when there is a real alternative and people actually pick it you know uh i mean we don't need 90 market share you know what i mean like we we don't care about you know beating microsoft per se but by being significant at 10 20 30 percent of the market we would force them to be honest we would force these big companies to well it's the same like you have companies that make like the fair phone you know this this this alternative completely ethically sourced or at least they try as ethically sourced as possible telephone um that's super hard and sure they're not going to take over apple's market share but by just being there showing it can be done they have moved the needle in the way that the other telephone companies are also sourcing much more you know ethically responsible materials and instead of letting kids dig cobalt out of the ground in the

congo they're not looking for well better ways of getting cobalt so we we we want to be like this this is a similar thing you know this this annoying little animal that's poking the bear and and making sure that it's uh you know doing the right thing yeah um yeah that's that's how we see ourselves i suppose then makes sense that there's a there's a much larger vision there so while there is so much value in people hosting Nextcloud themselves obviously like you mentioned that's that's never going to be the majority of the population it's just not going to be something that's that simple long term um so finding other ways to pull them on and um gaining that network effect too of having so many people know what Nextcloud is or know the name and and be able to to understand why that is a solution that maybe like you said your your school your government whatever is switching to um also has a large impact on on on getting more people interested in self-hosting maybe or just in figuring out a way to host it

between friends or finding a finding a family member whoever can handle that it has a lot of impact on the hosting provider you know one you can trust like in your city in your town and your region you know that's that's already yeah it makes a big difference because in the end it's all network effects you know like facebook is powerful because everybody's on facebook if everybody leaves then facebook is nothing and it's the same for twitter and all these other companies um and it's true for google and microsoft as well of course um so yeah we hope to to start the ball rolling well we did i think arguably to some degree already right definitely did i think there's a lot of brand recognition and and kind of network effect that a lot of other projects in the space don't really have which has been a great thing and it helps to get new users onto it when they have heard of Nextcloud and and understand a little bit about what it does um but for those people who jump into to using Nextcloud what's kind of the the one thing that you hope they

get from using it i know there's a ton of different apps and there's there's a lot of different functionality that they can get but what's kind of the focus for users who jump into Nextcloud what do you want them to get out of using it yeah this this this control i think that is in the end the key you know people should be in control over their own data where it is how it's used etc and this this is the fundamental yeah the fundamental goal that we have as a company and as a community um yeah whether that is because people are hosting themselves or at a company they trust or you know um or government or it doesn't really matter but this this level of control over their own data and of course for that next up needs to be easy to use it needs to be you know fulfilling like the the demands of users like do the things that they need to be done etc um so that's where the functionality comes in but the goal is to give people control over their data yeah yeah and i like that you mentioned that that that

comes even if you're not self-hosting like obviously or i don't know i should say obviously but like my recommendation is always if possible you self-host so that you have complete control over the hardware where the data is sitting you gain even more control in that case um but you do have a lot of control even when you're using some sort of like managed service provider and they're hosting the cloud for you you still have a lot more control there than you ever would with using like google apps or something like that because you know who has your data you know what Nextcloud does with it which is nothing it's it stays there um and you know exactly where everything is happening whereas you would never have that kind of control outside of that so there's there's a lot of benefits even if you're not self-hosting next cloud and there are lots of really local hosting providers you know like i know there is one in berlin where i live um i mean you'd be surprised um you know probably to figure out how many hosting

companies that might even be like in your city or in your state and i mean then you really have the option to physically go there you know look them in the eye and decide if you trust them or not and this is this is i think so incredibly valuable that really brings i think a level of of control even for non technical people you know trust in the end is is everything here um and these big companies you already know you can't trust them um so well find one that you can trust if you can't host yourself because again that's that's not easy of course if you do host yourself there are benefits aside from well you know some dirty people find it fun to do um but there is of course a cost benefit because in the end if you look at what you pay for a terabyte storage on a hard drive versus a terabyte storage online um yeah you can actually get a really good deal that way if you if you buy i don't know even if you buy like um an eight terabyte or a 10 terabyte hard drive and you connect it to a cheap device like a

raspberry pi you know this doesn't lose a lot of use a lot of power you connect it to your router you're not spending a lot of money on that and uh we actually introduced um uh late last year we introduced a backup app a peer-to-peer backup app we call it uh because it allows you to pick another next lot server and use it as backup so you know you give your your your parents you know raspberry pi with about eight terabyte hard drive and you have your own raspberry pi and your eight terabyte hard drive and then you configure them you know so that you have four terabytes of storage and four terabyte backup at your parents place and vice versa i can maybe get away with a bit less storage space because of course it's compressed and encrypted um you know and then even if god forbid a house your house burns down or that of your parents you know there's a backup of the data so yeah and if you would calculate that in costs per month um i actually think you come out pretty well and well and i mean yeah it's a bit of work but you know decentralization for the win yeah yeah you can save

so much money doing that and i'm glad you mentioned the the backup tool because i forgot that y'all had pushed that and i had a friend who was thinking about hosting his own Nextcloud and was wondering if there was a simple way to to have his data replicated to to my instance so i i'm glad that you mentioned that because i'm definitely gonna have to have to pass that on so he can spin up his own and start dumping his data towards me and me towards him and then just build that redundancy in a very simple way so just a another very important aspect of Nextcloud for sure yeah no these these things i mean as i said you know this is obviously this backup app is definitely not for business right this was really developed for the home user scenario um yeah just like we do do many other things that are for for private people um this is i know this this is very important to us um that people can get that control over their data and yes for the hosting for the big hosting providers and they have a bunch of features they need and we work on that

uh but you know there are things private users need too and yeah we also developed an all-in-one docker container a while ago um also late last year actually that should make it really easy to deploy next cloud on basically anything that supports docker um so there was a docker container but it was really complicated like you know you couldn't do

30:00 just say hey docker install Nextcloud and then you have it running you would really need to i know you would still have to choose an uh patch or engine x you'd have to pick your database and run separate storage etc etc and there's only one does away with all of that obviously doesn't scale to like tens of thousands of users but who cares right it's an all-in-one docker container for private use and that also makes it easier to move it to another device you know um definitely something for the friend of yours and of course everybody in the audience to check out because it makes it a whole lot easier to get up and running with Nextcloud and you still have the stuff with the ports and the firewall and you know you need to to get a remote connection this is not trivial but at least the part of like running the next out yourself i think we've taken care of to yeah to the best possible way at least as far as we could yeah removed as much friction as possible it's never going to be necessarily a one-click thing to do literally everything that you need but removing more and more

friction over time is important to let less and less tactical people be able to jump in and and run Nextcloud for themselves or their friends and family whoever um so digging more into like the actual usage of Nextcloud um what are some of the kind of the main use cases that you see for Nextcloud i know files is obviously the kind of the central thing that Nextcloud is built around um which is just a way to use essentially like a google drive like file storage uh but there's a lot of other functionalities so what are some of maybe just your favorite or most practical use cases for for Nextcloud itself yeah um there's really a wide range of functionality i mean we as core products develop um well we call it next.hub which is a combination of files uh groupware so that's email calendar contacts and some task management we have a kanban uh app called deck which we um yeah i use also internally in the company uh like my marketing team uses it to you know yes check our work and like you know schedule

things together and and collaborate um and then you have talk which is like audio video chat so you can have video calls um without well you know anybody looking in but also chat so like you really have like i don't know consider it like a whatsapp or other chat system replacement you know with mobile apps for your android and ios um so those are kind of the core functionalities that you really have yeah this basic set of things that you can do with it but you know like we have a password app on um on our next server here at home which my wife uses to manage her passwords um i haven't really transitioned to that yet still i'm terrible i have a text file with passwords i know i know that should be illegal but yeah it's synced with Nextcloud at least there's that um and um yeah you have a whole bunch of note-taking apps apps uh i think we are using that with my um partner again to uh synchronize like the shopping list because i do the shopping here and um well she just put stuff on there you know to make sure that i don't forget

it which i then occasionally still do but you know that's on me that's not the app to be clear um yeah what else is there i mean there's so much um i have of course a photos app um where you can you you know view your pictures and and and videos and uh play them and share them with other people etc um but also for example of forms and a polls app so a forms app is like google forms you know you can create like forms or like a survey or something and the polls app is like doodle you know that you can pick like a certain time and date um and even the core apps like the calendar uh for example is is pretty yeah it's pretty decent it has for example this feature uh that you might know from calently you know to book like meetings that you can say hey you know here's here's a link where you can go and like see what dates and times i'm available then you can you know schedule in your calendar automatically um a meeting so it's um yeah i mean look i'm not saying we're straight up uh there with all the

functionality of google and microsoft i mean they are slightly larger companies than we are but um you can run like your family life with it and and your work life a small business or a medium business or heck even a large business you can definitely do that with next slide you know there are 250 300 apps on the app store that art all kinds of stuff uh as i already mentioned the maps app which by the way can show you the locations of the photos that you've taken you know from the photos app like show overlay them on the map that's really cool um there's there's really countless other you know features and and possibilities that you have there so and the nice thing is you know unlike the big companies and we have no incentive to try and i don't know lock people up or move them to a cloud somewhere so you know if you schedule a call with somebody for your next talk you know we're not trying to first force them to download the app um or to you know uh sign up you know with the username and password so we get our email you know

there's none of that right it just you join it works right away just no shenanigans there and like i don't know it irritates me so much what zoom does right that when you go there and then the first tries to download the app and open it and then only after you said you know for coffee is your app like after one or two times trying then it suddenly shows the option oh yeah you can also join in the browser like are you kidding me and microsoft does the same thing by the way now um and webex i think always forces you to give an email address even though obviously why would you need that to join a call right that's ridiculous but again like these companies they're putting up barriers because of course a business model demands that they get your data right i mean if you look at the shenanigans they play like the zoom app you know basically acting as a rootkit on your laptop um and then of course getting hacked and basically the the zoom app was like huge security risk for like six months or something

you know it's was it necessary no of course not why did they do that well because they need to be like viral and nasty because that's their business model and we don't have that we just provide software you do with it what you want we have no incentive to try and make people create accounts or install apps or any of that stuff you know like we like it if people install the app because that they might then think hey let me also get an x cloud you know we do put a little link on on the bottom of a share that says hey this is next loud you know gain control over your data etc right we're not like we also want people to use next don't get me wrong but we're not we have no incentives to harm the user experience um just to force people in our ecosystem microsoft now making it impossible to install windows without making a microsoft account again are you kidding me that's yeah it's such a such an important point i'm glad that you brought that up because the the incentives there when those change when those

change to more really ethical incentives of building tools that people can use to take control of their data the focus that you have can be much more uh i guess much more narrow on building the thing that actually does what it's supposed to do like like you said with the talk app like the focus can be just building a talk app that works really well for audio and video chat you don't have to spend all this time focusing on making it essentially be malware that can harvest data and provide the company with things that they can sell you can just focus on the app works it does what it's supposed to we're going to present it in the best way possible for the user because like you said you don't have that incentive of okay so we want them to use zoom but really we want to harvest all this other data because that's where we make money that doesn't exist with Nextcloud it's such an important point that people understand when those incentives shift the product itself becomes better and becomes a product that cares about you as the

user yeah exactly we have no incentive to build an empty features and because our product is entirely open source if we were stupid enough to do it we would essentially get punished by people either taking it out and you know making a big fuss about it or both obviously or even a fork you know um yeah so that that keeps you honest and this is one of the benefits of open source and why we decided to go for this business model it keeps you honest it just makes sure that you can't play any of these kind of shenanigans because this will a quickly be discovered right we have hundreds and hundreds of people are contributing to the code so there's really very little we can do that will not be found out very quickly and second of all of course i mean you know people can actually take action they can take it out they can change the product um or even you know make a fork and the community can move somewhere else yeah yeah definitely the the fast focus there is a key one for allowing people to have oversight that they

wouldn't have in a closed sourced program like zoom or something like that there's so much value there in in so many ways um i'm very thankful that fos has continued to be a focus for Nextcloud um and the home hosting piece of that too yeah yeah look there's a saying in the world for speech depends on software free speech depends on free software i think there's a lot to say for that um and we try and you know live that i mean

40:00 again from a business perspective it's difficult uh doesn't make it easier but um yeah and i mean we certainly you know have like um yeah we try to offer of course companies like like well the benefits that that big companies need right i have no problem making a big company pay for Nextcloud um but for private users that's just you know open source is the best way there otherwise you can't trust it you know again back to the trust issue right you can trust Nextcloud because you can look at the code and the fact that you can't doesn't mean somebody else can't you know other people will and do yeah yeah absolutely agree there um and before we jump into the next question i also just wanted to kind of quickly share with listeners how i use Nextcloud because i think it's it's been something that has become integral to both my personal life and for everything that i do with this podcast um because really my my usages are i use files for all of my file storage for backups from phones for basically every type of cloud storage that i would have used before everything's

been migrated into Nextcloud um i use Nextcloud for all the photo backups from like my phone and my wife's phone so i can get out of google photos and icloud and all those other tools that are there works really really well i use Nextcloud for all of my contacts um synced from phones across all of my different devices calendar everything happens in xcloud for both personal calendar for work calendar for podcast calendar also sits in there and that again allows me to sync across devices without having to trust someone else with all of the details about how i run my life and live my life there um and then i'm glad you mentioned deck because that the conborn the con bond board capabilities there um have been really really essential for me planning out opt out as a podcast and i use that for the planning of every episode for the planning of getting guests scheduled um for organizing also even outside of the podcast organizing how i approach twitter as a platform for education uh how i approach blog posts

they're basically every aspect of my life at this point in some way touches Nextcloud or is this is um or Nextcloud is essential to that aspect of of my life and it's been a huge a huge improvement for me and has really simplified that process of moving off um so i just wanted to take a second and kind of i guess give a testimonial of of how Nextcloud has been a massively important tool for me and share just quickly some of the ways that that i use it but i definitely am thankful for all of those those different pieces there let's take a quick break from this episode to chat about the sponsors of opt out cake wallet and LocalMonero Cake Wallet is a key tool that i use daily as it allows me to easily and quickly use monero for private by default payments it's available in both ios and android it is a fantastic way to get started buying and using monero with a simple and easy to understand user experience i regularly onboard new users to Cake Wallet and hope that it will help simplify and ease your journey into

cryptocurrency if you're interested in purchasing monero for the first time or helping to bring others into a parallel economy i'd recommend you look at using LocalMonero like i do to buy and sell monero while maintaining your privacy and avoiding invasive exchange surveillance LocalMonero is entirely peer-to-peer and is an important part of opting out of the surveillance state and into a parallel economy thank you to both sponsors for their incredible support and partnership and i hope you'll take a moment after the episode to learn more in the show notes or at optoutpod.com slash sponsors diving back into learning a little bit more about Nextcloud uh i wondered if there were any specific settings or features that someone who's new to using Nextcloud like maybe they just spun it up as a self-hosted tool or maybe they just got started on a friend's Nextcloud instance what are some of maybe the first things that you'd recommend people should um should become familiar with when starting to use Nextcloud

yeah that's um it's a big question i mean there's a wide range of things that you can do with it of course as you just well you went over um i if you're like running it yourself so you're an administrator i would definitely of course dive into the app store don't try and install every single app uh like any app store of course they're not all of the same yeah and their their community maintained and and they're not all wonderful but a lot of them are really useful and definitely worth checking out um yeah i would uh i would install the clients right the android the ios we have clients for talks for the audio video chat and we have clients for the files so that you can access access your files on the go on your laptop on your desktop and on your phones and what's also really quite nice is we have then this integration with calendar and contacts so you can have your android phone back up your contact data and of course you can see sync rise all your contacts and see them from your phone and the same with the calendar this is really useful and once you install a couple of

apps you should also check out the the integrations we have between them and for example from files um you can share a file by essentially attaching it to a cart in deck yeah to a task by just you know um well you click on the share dialog and then there is um in the share field there's a button that says like share to uh attached to a cart and similarly you can share like a task into a chat room or you can share a file into a chat room um yeah you can turn a chat room message into a task you can see the tasks in the calendar uh you can now turn emails into um calendar items i believe or even tasks like all these things we try to integrate them in in a natural way and this is i think as a user you will slowly figure these things out and i would definitely look for them as well you know because it can really make your day-to-day life a bit yeah quicker and easier um nice thing in the app a lot so the desktop app a lot of people um they they sync the entire folder right so so you can essentially when you install the app

you have this dialogue where you can set up the synchronization between your files on your next cloud and on your private computer and yeah the standard setting here is that it just makes a folder called next loud in your home in your home you know on your computer and then it synchronizes all the files there and then you can choose to synchronize some folders not for example you don't need all your photos and holiday videos with you on your laptop right so you can then deselect that but it would still you know it syncs by default now for windows you have a virtual drive which is already really nice but what i also really like is that you can skip this step and then say look i have a local photos folder i will just create an individual sync connection between that local photos folder and my next up photos folder and you can do that for any number of folders so you can have a whole bunch of these you know folders that you sync individually with next loud it's a different way of using the client um and people will probably not be familiar with it because i don't think you can do

that with like google drive and with uh dropbox uh those those only have the one folder option which i think is um a nice i know it can be quite helpful i personally use this i find it um easier than to have like this one next up folder with all the stuff it just creates a bit of a mess um another tip i would give is with sharing so yeah it's a bit of a pro and con here like our sharing is in a way a bit more complicated because with google for example and microsoft they of course want everybody to have an account right so when you want to share a file or a folder there's one link and they can choose what access rights you give to individual people but you can't say i'm gonna make two links one link yeah no account needed you have read and write rights and the second link also no account read it you can only read and then i sent the read and write link to like i don't know to my wife and then the read only link to my parents to see you know the holiday pictures well my wife can then upload the holiday pictures or

maybe my friends who went with me on holiday you can't do that because there's only one link and with next slide you can you can make any number of links you can put multiple password each with an own password each with write or read only rights or even only the ability to drop files and not see the existing files there this can be completely you know you can have any number of these share links um as well as of course share individually to people via email where you can then also for each of these people set the rights the same way as you can do with the other players you know with nexot you don't need to give you an email address you don't need to give any data you can just create these public anonymous links and send them to people as again an example where um i think yeah we don't have this incentive to make people make an account therefore you know we made something that's actually more flexible and more powerful yeah and like you mentioned with that control can come some more complexity or

maybe just a little bit of a learning curve is get used to how things work when you get to control who has access to things rather than you just rely on a central company to hopefully keep things restricted but also they're usually appearing into that data it's not

50:00 but here you have that total control. So whenever you're taking back control of data and moving into something that you have total control over, you are likely going to have to get used to some new things, get used to some new approaches like the sharing dialogue with the Nextcloud and kind of start to shift focus into a world where you control your data and you get to choose. Yeah, exactly. You have people who, in the beginning, they create public link for everything.

And if you share a file within Nextcloud itself, well, then they have access to that file. So you don't need to send them another share link all the time. You can just use what we call internal link to access the file if you have access to it already. But yeah, this is a bit confusing and we are thinking of how we can make this a little bit simpler as well for people, you know, have your cake and eat it too. But as you say, it's inherent to the problem.

Like, you know, we do more in a way. Yeah, and you have also people who email me even personally sometimes. I'm going to email personally today where somebody was asking me if I could reset their password. So I was like, what? You know, it's like, I don't like they didn't realize that there are different Nextcloud servers, right? They just saw Nextcloud somewhere on their, you know, file share system. And then they Googled probably Nextcloud. And then the email Nextcloud.

Can you reset my password? Because people can't even imagine that we are not hosting, you know, that their company or their hosting provider or their telco is doing that themselves and they need to go there to get it reset. It's, yeah, it's causing confusion sometimes. It's kind of both funny and it's, of course, a little bit sad and frustrating. But then, you know, you have an opportunity to explain to people, you know, that, well, we're not a centralized server and why that's good for them as well.

So I guess it's also a positive. Definitely a good chance for education there when users who aren't familiar with how things can work when you do have control over your data. It definitely shifts the needle when people need to get used to kind of a new paradigm there. And we've talked a lot about the specific or some of the favorite features within Nextcloud. And this might be a little bit of a hard question to answer with how broad in scope Nextcloud is.

But are there any kind of key limitations that users should be aware of when maybe starting to use Nextcloud? That's a good question. I think as a user, just one-on-one, you know, just as a private user, I look, the biggest hurdle is the running of the server, you know. I think the software itself is, look, no software's perfect. Don't get me wrong. And our engineers would love to spend five years just fixing bugs. But by then we would be so far behind Microsoft and others in terms of functionality.

It wouldn't be useful for most people anymore. So there's the red race that you're in. So, yeah, sometimes there are things that don't work perfectly. But that's true for any piece of software. And I don't know. We have no specific limitations in terms of file sizes or anything. I mean, yeah, sure, if you put 5 million files in a folder and then try to sync that with the desktop client, yeah, you're not going to have fun. But are you really surprised?

Have you tried that with Dropbox, you know? So I don't think there are any specific limitations, honestly, that Nextcloud imposes other than, you know, technology and, like, this is how the world works. You know what I mean? Like we have, for example, some features that you can stop people from downloading a file. But, I mean, you know, they can take a screenshot. You know what I mean? Like this is how the world works. This is not really a Nextcloud limitation per se.

So... Yeah, I mean, I couldn't really think of any. And I think, like, if people have that question about, like, specific apps, that would be something definitely to maybe reach out to the app developer or file an issue on GitHub for that specific app or something. But there's, like you said, there's not really... That I can think of any kind of clear limitations or easy to call out limitations because it is something that can do so many things and it really is up to you how you want to use it and what apps you want to install and how you approach it.

So, yeah, I couldn't really think of any specific ones there. But I was curious if there were any that I hadn't thought of that you might want to share. But, yeah, it's definitely a tricky one with something as broad in scope as Nextcloud specifically. Now, are there any other chief competitors or alternatives that take a similar approach to Nextcloud? So, I mean, I know there's the Google Apps, there's the Microsoft Office 365, those kinds of solutions.

But are there any other alternatives to Nextcloud that take a similar, like, FOSS-first, we-care-about-privacy approach that people should know about and then maybe just kind of what makes Nextcloud better or unique, in your opinion? So there are a lot of projects that are doing, like, pieces of the puzzle, you know? There, for example, Open Projects, which really focus on project management, right? And, of course, what they do is better and more advanced than, like, Deck and the To-Do app and the Calendar.

And you have, yeah, you have, I don't know, Jitsi that just does video calls and you have Matrix that just does text chat. I think you have some other files sync and share, like, purely the files-focused projects, like a sync thing, a C file. So there are some other players, but there aren't really any that I can think of that offer such a, you know, the complete collaboration platform as we do or anywhere near the number of apps that we have. That's definitely in the open source world.

I have, you're not talking about Microsoft, et cetera. The open source world, that's definitely unique. We really try to, again, our competition is Microsoft 365, the Google apps, you know, their ecosystems. We're not just competing with one element of it, just chat, just files. We are trying to compete with the ecosystem because the whole, as you already said earlier, right, the whole is more than the sum of the parts. This is really important, I think, with this.

Could you take Jitsi and add it to Matrix and then bolt it onto C file and then add, I don't know, some groupware, I'm sure there are some out there, you know, and an email app and a, you know, I don't know, other project management. I mean, can you do that? Sure. But, you know, one of them will have the configuration on the bottom left, the other on the top right, the third on the bottom right. Like, it's going to all be, it's going to be a mess, right?

Maybe you can get a central authentication, but that's the best you're going to get. Now, if you are just looking for a calendar, there might be better calendars out than an exit calendar. And if you're just looking for project management, as I said, go for open projects. But I'm pretty sure that there is nobody who does the whole of it anywhere near as well as we do. And that was really going to be my only call out here was that, like, if you only need one of the things that Nextcloud does and you don't need any of the other functionality, like you said, like, you only need a calendar, maybe there's another solution that would work better.

You only need text chat, like, Matrix is probably a great solution there rather than running a whole Nextcloud server just for the chat functionality. But if you want something that can be really kind of a one-stop shop for a simple, easy-to-use version of so many different tools that have become a key part of many of our workflows or many of our lives, Nextcloud offers all of that in one, like you said, really homogenous, like, very well-tied-together, easy-to-understand package that really does just make it unique and makes it an easy recommendation if you need more than just one specific thing.

It's just there's not really competition out there in that sense. I definitely agree there. Now, diving a little bit more into the specifics of actually maybe the administration or the hosting of Nextcloud, there's two real main approaches. And one of those, we've really talked about both of these quite a bit, but one of those is using a managed service or a provider that actually hosts Nextcloud for you, and then the other one is obviously hosting Nextcloud yourself.

So I want to dive a little bit down both of those kind of rabbit trails and get a little context. But I think the key of what I want to chat about around the approaches is really what people should understand about their data when using each of the approaches and about the complexity of using that. So first off, the kind of a managed service approach for Nextcloud, I'm not sure if y'all have different naming for that or what y'all call that, but essentially letting someone else host the Nextcloud instance and you create an account and you use it.

What are some of the things that people should be aware of or understand when they're using that? And I think specifically, I'd love to hear a little bit more about how is the data protected in that case? So Nextcloud is fundamentally designed to trust the server. So while there are some end-to-end encryption features, for example, in Nextcloud talk, if you have a one-on-one video call with somebody, it's end-to-end encrypted. And so even the server has no access to the actual content of the video call.

And also for the files, we have an end-to-end encryption feature that basically,

1:00:00 keeps that only works in the clients of course and that keeps the files 100 hidden from you know the server even in case of a breach etc so there are a few areas where nextot has these functions but as a whole it is designed with the idea that you trust the server so for example we have this activity log where you know you can go in and you can see you know when you change a certain file on every file there is an activity tab you can see what happened to the file when and by whom is with this shared with other people now yeah this is stored in the database so even sysadmin is evil and they go into the database and they look at the activity log they can see who did what when etc this is this is how nextot is designed um and so yeah i mean obviously this is the case with google and microsoft and all these companies as well right let me be clear um but yeah you need to make so clearly people are comfortable with that but if you pick somebody to host your Nextcloud and they would have the same ability to do that and you should keep that in mind and again there is the

end-to-end encryption so you can hide a subset of files um completely from the server even in case of like an evil system administrator or you know somebody who hacks a server and is in there for weeks or months if you're using the end-to-end encryption in the client there's no way they can get the files i mean you know barring bugs in the security but it's designed to protect from a complete takeover of the server um but that's the only yeah that's the only case where that is at the calendar the context all this data is on the server now we have some other encryption features you have for example server side encryption so then files will be stored in encrypted form and if you use server side encryption um there are technically two variants of it but let me simplify it the idea behind that is that if you trust the storage so purely the drive let's say because it could be disconnected and stolen or because you're using amazon uh ac2 for storage you you can use like as um a object storage for storage in

next files um and then all the files will be encrypted before they're sent to the storage so then the the server itself where you run next slide on um still knows everything and has encryption keys but if the storage is disconnected from your next server and is an external server either um a object storage or an ftp drive or anything like that then they again would not have access to your data so there are some caveats here but as a general rule i would just name take the assumption as you shoot with microsoft and facebook and google that if they want yeah the people who host your server they have access to it and so the key point here is you need to trust them that's why i said you know find a local company go there talk to the people see if you trust them there are lots of like in there are even um i've said a collectives you know where like a group of people got together pulled some money and are hosting themselves those kind of initiatives obviously have a higher trust level um yeah this is

the thing to keep in mind once you let somebody else manage your Nextcloud they do have access to your data and if you don't trust them don't do it but obviously well that still makes it better than microsoft and google because i would trust a local provider a hundred times over microsoft and google because let's be honest those big companies they're not following any laws i mean sure they're legally technically following all the laws but let's be honest right i mean i wouldn't trust them as far as i can throw them uh while a local company who you can sue locally and actually have a chance of winning or at least you know negotiating because i mean who can sue microsoft right good luck um yeah i think that's a much healthier space to be in um if you don't wanna and can't host yourself yeah and i think incentives too like we talked about earlier come into play there as well like you could have that rogue sysadmin who decides to to log in use a kvm login and and view the database and see what

activities happening there or view the files themselves but the the hosting provider as a whole doesn't have a financial incentive at least to to take that data and do something with it yeah exactly like they would they are better off just charging you the money they're charging you to host there and making a business out of that which they would destroy if they started to to pry into people's data that's there so the incentives are much better there as well exactly the trust still needs to happen yeah no that's that's absolutely right um they have no incentive to to to touch your data and a lot of these companies they have of course very strict policies in place um where no single sysadmin could ever do what i just described right because no single sysadmin has access to the systems there's always a second pair of eyes for ice principle and that kind of stuff uh and they have processes procedures they log everything the admins do so if an admin would dare to do something nasty they would know about it um and

that well person would lose their job most likely and could even get sued right so um you know it's not as as you know as horrible and bleak as i kind of portrayed it like a sysadmin could it's usually not that easy and there are a lot of safeguards in place for that um i'm just saying out of principle right who accesses the next server has access to the data as an admin and this is this is a basic principle of it and there are some alternatives to next loud well not as i said earlier not full alternatives but that some aspects of it that um try to offer end-to-end encryption or serverless architecture or you know uh fully enter an encrypted chat um you know like matrix indeed um and then so yeah if you need that level of security if you do not trust the server if you are um target of i don't know government spying agencies i mean dark active targets right because we're all passively being monitored by them unfortunately as we now again figured out the ca is apparently also running a passive global surveillance program yay um so there's always that but like targeted if you're worried

about targeted attacks then well first of all you're kind of screwed because like you know that it's it's nearly impossible to really protect yourself from these big um yeah big spying agencies um so there's that but um next out is not really a tool for that right this is more next out is is there to disrupt the the rules that are currently on the market where basic surveillance capitalism is running the market and well with all the downsides political and social and and economic that we're currently seeing right like huge monopolies etc etc we can make a list um next out is means to disrupt that by giving by distributing data making sure that it's not in one place but that it's everywhere um and a lot harder to to you know it's a lot harder to steal data if it is in spread over 50 000 different hosting companies in the us than when it is all at one you know even if that one has obviously excellent security right because i don't want to diss google security people right just like the lawyers they're excellent doesn't mean that it's

right to put your data there yeah no that is definitely true that is that's one thing google has proven is they are a very good security company but obviously they only care about securing your data from other people and other companies getting into google they don't care about securing your data from themselves so that is not their focus unfortunately um but yeah no i'm glad that you made it very clear what those risks are because even if they're not something that everyone really necessarily needs to worry about it's very important that people who are using those services at least understand that that is a threat that is a risk and it's something that comes with kind of the territory of moving your data to someone else is that instead of knowing that google is accessing all of the data that you're putting into google drive and all that now you have the potential threat of a sysadmin accessing that data or something and that also does it really also does apply to people who quote unquote self-host Nextcloud

with a like a virtual private server or some sort of other hosting company that's not providing Nextcloud as a service but you're installing Nextcloud on like a vps or something a lot of the same principles they're going to apply where someone who has access to that that virtual machine that vps can log in can look at the specifics there they could pull the disks they could look at the the files like there there are those risks as well if you're hosting on a basically any hardware you don't own those risks exist and those risks with almost every piece of software that you could host there um so i do think a vps is probably slightly safer but it's also more work so you know you pay for that safety i think it's slightly safer because there are lots of modern encryption technologies that make like you know software running the clouds pretty well protected even from other processes on the same servers of course these things get hacked occasionally so it's like

1:10:00 You know, I see your VPS as a little bit of an in-between between a fully managed Nextcloud and a self-hosted one. You know, it is a bit less work. And of course, you're running somewhere in the cloud where you have a nice console to set your IP address and all these things. That saves a lot of headache. It's a bit more expensive, but it tends to be cheaper than fully managed. And it is a bit more secure, but it is less secure than running it. Well, less private.

Let's separate privacy and security here for a second. It is less private than, of course, running it at home and a little bit more expensive than running it at home. So it's a middle ground that for some people is better. Yeah, for sure. It can remove some of the complexity because you don't have to manage the hardware itself. You don't have to manage the operating system in many cases. It's pre-installed for you, and it can simplify a lot of those pieces.

But you definitely still have that trade-off of someone there that company could access your data in theory. Yeah. I think an important call out. Although it would be harder, right? And they won't know. Like, if you're hosting with a Nextcloud hosting provider, they know you're running Nextcloud, obviously, because you're paying through their service. So they may be, if they want to collect data of people using Nextcloud, they would know to go into that.

But if you're just paying through VPS and you're spinning up Nextcloud on top of it, the hosting provider would need to look into what you're doing and then decide they want to look into your Nextcloud data for some reason. So there's a little bit of security through obscurity there as well. Yeah. Yeah, exactly. It is. Yeah. As I said, it's really a middle ground. Yeah. And then, of course, you have the self-hosting, I guess. Then we should talk about the threat model there as well.

Yeah. And that's, by the way, I use that term for a reason. So threat modeling is what you need to do when you want to, you know, run the Nextcloud, I think. You need to decide, you know, yeah, what are you afraid of? You know, this is, well, with everything security related, the most important thing is that you clearly know what thing you're trying to protect from. As I said earlier, if you're trying to protect yourself from nation states targeting you actively, then Nextcloud can't really help you.

You know, I'm sure the NSA has some exploit lying around that they can hack any Nextcloud server. I mean, it sounds really shitty, but this is true for an iPhone too. And that's from a billion-dollar company, you know. So it would be really arrogant of me to assume that that's not the case for Nextcloud. But if you want to hide your data from Google and Microsoft and Apple, obviously running Nextcloud, even at a managed hosting provider, is already, well, does a trick, 100%, right?

And if you think that because you're, let's say, a celebrity, people might come after the data actively, you know, maybe then a managed Nextcloud is still a little bit too open. And maybe you do want this VPS or maybe even go another step further and do host it yourself. But you're constantly trading off, you know, privacy and security in a way because running your own server, and I think this is the key to understand about self-hosting Nextcloud.

Running a server is hard, especially if you want to run it really secure. And as we alluded to earlier, Google has excellent security, like really, really top in the world. And so does Facebook and Microsoft and these other companies. I mean, you and I both can't afford that level of security for our private Nextcloud, right? I mean, I'm sure that relatively speaking for, again, a nation state level attacker, my private Nextcloud server is running on an old desktop system, literally in my storage closet here in the house.

For such a nation state attacker, I'm sure it's Swiss cheese. They can just walk in. I have all the latest patches. I keep everything up to date. I'm running, you know, open SUSE leap. I run the latest Nextcloud, et cetera, et cetera. But still, I'm sure they can walk right in because I am just not a super experienced sysadmin. And even if I was, you know, I sleep eight hours a day. You know what I mean? And like, I'm not monitoring my server constantly because I have a very busy job.

So when you host with like a big hosting company, think of like here in Germany, have IONOS and even Deutsche Telekom, you know, the German telecom. And those are some of the biggest hosting companies in the world. And yeah, they can keep your data much more safe than I personally can on my private server. On the other hand, of course, as we just talked about, you trading off a little bit of privacy here. So yeah, you need to think for yourself, like, where is, what are you worried about?

You know, are you, as I said, a celebrity? And you think that, you know, there is maybe an incentive for this sysadmins at this company to do something with your data to look for it. When they see your name, for example, on a credit card receipt, you know, then, you know, maybe you are worried that your data will leak. You know, something like that. Or maybe you're afraid that, I don't know, the government might be looking for your data for some reason or another.

If you're a journalist, for example, the thing is, of course, that the government can always go to a hosting provider and say, Hey, here's a legal, you know, piece of paper, hand over the data for Seth. And then that company has to do that. And on top of that, there are probably going to be a gag order included that says, oh, and by the way, you can't tell Seth about it. So your data will then be handed over to, well, God knows who, and you will not know it.

If you run NextSlot on your own private server at home, well, that can never happen because they're going to have to come to you to get your data. And, well, you will know, obviously, you know. So, again, it depends what it is that you're worried about. Yeah, because if the NSA is after you, they're not going to ask. They're going to hack. And then it might actually be safer to go for a big hosting provider that runs NextSlot because they're going to have intrusion detection software that you can't even dream of.

And they might actually maybe, you know, stop that or make it harder at least. While if you're worried that somebody is going to come with like a legal, you know, piece of paper, that a judge will say, hey, give them data, access to that data. And you want to make sure you know about it. And it's a different scenario. And that's a different case where having your data at home is better. So, there are many different, you know, levels to look at the problem here.

It's not so easy to say, well, it's better to host at home. Well, it is unless you're afraid of being targeted by the Chinese government, you know, because then it's actually better to host at the Yonos because then the NSA is actually helping to keep your data safe. Right. Because they are work. VPS at Amazon is going to benefit from the protection. I'm not kidding of the NSA. Right. Because if there's a Chinese attack on Amazon, the NSA will warn them, will try to help them, etc.

Because, I mean, they're here to protect America's data. Right. But if then the US government wants your data, well, then they go to Amazon. And what do you think will happen? They will get it. So, again, it depends who are you trying to protect from. This is a choice you're going to have to make before you can decide where to host your data. And look, if you just want to make the world a better place and keep your data away from Google, Microsoft and Apple, well, then honestly, any of the three options is fine.

Right. A VPS or at a big hosting provider or at home. If you like playing with servers, by all means, run it at home. It's fun. It saves you a bit of money. So, you know, like you don't all have to think for three months and make a threat level model, etc. Yeah. No, thank you for diving into so many of the specifics there. Because it is not necessarily an easy question to answer. And it's really something that, like you mentioned, the actual person who's thinking about running Nextloud at home or running a VPS or using a managed service provider, like they have to decide, you as the listener have to decide, what is my threat model?

Like, what data do I want to keep safe? Who do I want to keep it safe from? And use that to prompt that decision. And I think for most people, I mean, really for everyone, any way that you approach Nextloud, whether it's self-hosted, a VPS or a managed service provider, you're going to be much better off using Nextloud through any of those methods than you are continuing to use Google's ecosystem or Apple's ecosystem or Microsoft's ecosystem. Those are going to be a net benefit for you and a net benefit for the world, really.

So there's really no going wrong in that way. But if you do have those specific constraints where, like, you don't want to have anyone else having access to your data except you, you want it on premise, you want it at your house, and you want to manage everything, like, you can get complete and total control over your data there. And that can be a much better solution. But, like, for self-hosting, I recommend that, like, if you're self-hosting Nextcloud, I do not share a self-hosted instance with anyone that I don't trust.

So, like, I'm only sharing it with friends and family members. I'm not making that a public use. Anyone who wants to can start using that Nextcloud server because I don't want to expose where...

1:20:00 where I host that and open it up to those kinds of attacks. Because like you said, that cybersecurity aspect, no one's doing the same job at home as some sort of huge hosting provider is doing. So definitely does require doing some, at least simple threat modeling and figuring out what works if you want to consider one of the other options. But even just using a managed service provider is a huge step forward in your overall privacy and data security, as opposed to continuing to just dump data into the giant data lakes of Google and Amazon and Apple and all of those where you know that they're looking at your data today.

Yep, exactly. Yeah, definitely an interesting one. But I am glad that Nextcloud is relatively straightforward to host from home. And it's been something that I've been self-hosting in a couple of different ways. And I use the Docker image and that does really simplify it and even have just a very simple GitHub repo that has Nextcloud proxy through Trafic, handles all the Let's Encrypt certs and all that fun stuff. So it's a very, very simple tool to get set up once you do get familiar with it.

So those people do want to self-host it. There's a lot of tools there, a lot of guides, again, because Nextcloud is such a popular tool. There are a ton of people who have put out specific guides for hosting it specific ways. So there definitely is a lot of possibility there. And definitely recommend looking into that if self-hosting is something that you want to do. Awesome. Well, thank you for diving through all of the specifics there. I know those were some very, very big questions and then hard ones to answer quickly.

So I'm glad we got to dig through some of the specifics there, the technicalities and the things people need to keep in mind with how they actually approach using Nextcloud. But I'd love to hear a little bit more about just how Nextcloud is funded or made sustainable. You talked mostly about it being a business where you offer the service to large clients. Is that really the key way or are donations or any other kind of avenues, a key piece of how Nextcloud sustains itself?

Yeah, so over the years, I mean, there's a long history to Nextcloud and a bit of a soapy story that I don't want to go into. But let's just say over the last 12 years, we've tried a bunch of different things, including venture capital, which did not work out. And in the beginning, of course, it started out as a pure open source project without any business side of it. So what we settled on is essentially offering a service to big companies to keep it running smooth for them.

If you're a big company, you have thousands, tens of thousands of users, it's not easy to run a system at scale. And if something breaks, you need to have it fixed quick, ideally within hours or a few days at most. Look, if for your family, your Nextcloud breaks, then it's annoying for five people. If it breaks for Siemens, then it's annoying for 50,000 people. That's a little bit more problematic, to put it mildly. And that's why such companies pay us money.

We fix a problem. They get essentially support from our engineers. So direct from the engineers, we have no separate support team. It's the people who write the code, who provide this service. We have a special build of Nextcloud, Nextcloud Enterprise, which is essentially a little bit like the Red Hat Enterprise Linux. No functional difference, but it's gotten a bit of extra testing. We provide some security services and other things. And this is the model.

We really aim this at bigger companies, you know, a thousand users and up, kind of. Technically, you can get a Nextcloud subscription, Nextcloud Enterprise, starting at 100 euros, but then the price per user is pretty stiff. You know, that goes down the price per user per year quite quickly for larger companies. So our idea is that, you know, if you have a company with 50 or 100 or 500 users, you should go to maybe one of our hosting partners and get an Nextcloud from them, you know, because running it in-house, if you have 50 employees and you're not an IT company, it's just not wise, you know, from a security, reliability, et cetera perspective.

I mean, hey, if you want to pay us money, we'll help you fix bugs in Nextcloud, no doubt. But look, your Apache can also go down and your database can go down and your file system might break and we can't fix these problems. You know, we only fix Nextcloud problems. For a big company, of course, they have a team of sysadmists and they have expertise in all the other infrastructure. So they just need the Nextcloud expertise from us. So that's fine.

Yeah, there's a clear match between the need and what we offer. Now we offer Nextcloud expertise. If you're a big company and you run Nextcloud and you know the rest of your infrastructure, your database, your file system, you know, your web server, your caching server, et cetera, that we will provide the Nextcloud expertise you need. But as a small company, on one hand, we try to make Nextcloud super easy to use. So, hey, if you're 25 people, you know, and you really want to host yourself, install the all-in-one Docker on the VPS.

It'll do you well. You know, it'll be fine. You don't really need us and we don't want you to need us because we can't help you with, you know, configuring your IP address. That's not what we do. You know, then if you need that kind of support, then you should go to a local hosting company or to one of the Nextcloud partners and let them run it for you or even help you manage it because we have a bunch of partners who help companies manage their own Nextcloud.

Yeah. So, it's certainly possible even if you're a smaller company. But when you're bigger, that's where we, our offer really fits well. And, yeah, that's how we earn our money. You know, I sometimes call it an insurance for the sysadmin, you know, job insurance for the sysadmin to be specific. You know, if you downloaded this thing from the internet and you're running it and then it goes down for a week and you didn't have a contract with the vendor, then, you know, if half the company depended on that, then you lost your job.

Right? Don't do that. Yeah. Talk to us, get a contract and we'll fix it and if worse comes to worse and even we can't fix it, which is highly unlikely, obviously, because we wrote the software. But even if we can't, then at least, well, you can point the finger at somebody else instead of having everybody point their finger at you for downloading random stuff from the internet and not getting a support contract. You know? So, yeah, and this model works.

I mean, it scales fairly well. We don't really do development work like consulting. You know, we don't sell hours. That's really a thing to keep in mind. Like, for bigger customers and, you know, we have partners who do development so it's not like, you know, if you need features, obviously, talk to us. Right? They might be in development or yes, we might be able to do them for you or work with a partner to do them. But we're not a consulting firm.

This is not our core business. Our core business is really to help you keep it running smooth at scale and this gives us the money. So, when you talk about things like donations and such, yeah, the challenge here is there are about 200, 300, 400,000, somewhere between 300,000 and 400,000 servers on the internet that run Nexlout. Now, that's a big number. Absolutely. And some of these servers have, as I said before, 10, 20 million users. So, total number of users, huge.

But as usual, the total number of users, the most users are on a few servers, which are pretty much our biggest customers. And the most servers are private home users like you and, well, me too, actually. So, earning money from those small ones, this long tail of small ones, it's quite hard. I mean, even if everybody on our forum, I mean, there are, what, 30, 40, 50,000 people on our forums? If they would all donate, I don't know, a few bucks a year, you know, we still can't run a company.

You know, like you, you, there's a, you need a lot of donations to pay for like 90 people, right? We have 90 people on board right now. Okay. Granted, only a little, more than half of that is engineers. So, you can say, well, if you run a donation, you can get rid of the sales and marketing people. I, well, aside from the fact that it's my job, I think if you get rid of marketing, that means you're doing a lot less to get the word out. So, that's not wise.

But sure, you could maybe then get rid of sales, but then still, you need a lot of donations to pay for 60, 70 people. You know, there aren't a lot of open source projects that manage to, to pay for that. No. Not very scalable. On the other hand, the Red Hat model, the SUSE model, we know it scales. It works, right? Red Hat is, was a multi-billion dollar company before IBM bought it. So, this is a model that we know works, that companies are willing to pay for.

And then, at the same time, you can make something for home users like Fedora. It works. So, yeah, that's the model we've

1:30:00 And like we talked about earlier, that model not only funds Nextcloud and funds the people who work in Nextcloud, which is a great thing, but it also improves the software that those people who do choose to self-host at home or on a VPS or something that they're using. All of the time that y'all are spending working with clients who are paying to support Nextcloud is also ending up in that final product as well that people can self-host for free.

So it's definitely a good ecosystem there. And obviously it's like a good approach. Yeah, it's really a win-win for everyone. Let the businesses who need the support pay for the product to be maintained. And then the people who don't need the support and can self-host can have an excellent product that's open source end-to-end and use it themselves and benefit from those large companies' time and from the money that's flowing there as well. Exactly.

Yeah, no, the whole idea behind it is to create a win-win between the business and the private users. Yeah. Yeah. And again, it's not always easy, right? You need to convince the big companies that that's worth paying for. And, you know, there are still a lot of companies who don't really understand open source. They think it's the same as freeware and they might have an internal policy against freeware, which is kind of funny, you know, because like the problem with freeware is, of course, that you can get locked into a proprietary product that then controls you.

And then you might be forced to pay or the company behind it might go bankrupt, right? This is the problem with freeware. But that's also to some degree a problem with proprietary software, right? I mean, there are plenty of big IT companies, I won't name names, but that are really squeezing their customers because they know the customer can't get away from them. And that's exactly the problem open source is there to solve. So equating freeware and free software as in open source is incredibly dumb.

But there are still a lot of companies that work that way. And other companies, they have rules like, I don't know, we're happy to pay a subscription, but it cannot be more than 20% of the license fee. Well, our software is open source, there is a license fee. So how are we going to charge you? You know, this kind of stuff. This is sometimes a bit of a nightmare and it's keeping our poor salespeople awake sometimes. So I'm very glad you've been able to make it work so far, though.

Definitely seems like a solid model. So I'm glad that it's sustained Nextcloud to this point. So obviously donations aren't a key thing. I found another model to not need to rely on donations. But what ways can listeners jump in and help to support what you're doing with Nextcloud outside of that? There are a lot of people about it. Seriously. You know, the way I see it, and I mean, it might be a little simplistic, but, you know, one out of every 5,000 Nextcloud servers becomes a paying customer and helps us pay an engineer.

You know? So help us get more Nextcloud servers out there, and then the customers will come. The thing is that our marketing, and there's also a marketing strategy, we don't do ads and this kind of stuff. Certainly not Google ads. Are you kidding? Yeah, right. And we don't track users either, right? We don't have extensive tracking software like Google Analytics and all that stuff on our websites. We don't, you know, yeah, if you download the white paper, ask for the email address.

That's because, like, the download system is a bit dumb. But that email address is deleted right away. And if you tick the box that you want to get a newsletter, then you just get a community newsletter. You know what I mean? Like, you're not added to a spam list. We don't sell your email address. None of that. So our marketing depends, actually, on people, like you, Seth, and many other home users to tell other people about it. And then hopefully some of these people work in a company and tell their boss, there's this Nexlout thing out there, which is much better for you than Microsoft, Google, and Apple, etc.

This is pretty much how we get all our business. People contacting us and saying, hey, we've been running Nexlout in a test run for 50 users at our company. We want to scale it up to 50,000. Can you help us? And this is, I think, honestly, you know, wonderful because it feels like an honest business that way. But it relies on people like your listeners to actually tell other people about Nexlout, even if they don't use it themselves. It's, this is literally our entire, you know, business model to, yeah.

Without that, it wouldn't work. So word of mouth is not, you know, I know everybody always says, like, I'll tell other people about it, etc. But seriously, it's the only way we get customers if people tell other people about it. So definitely that's what you can do and should do. Yeah, yeah, that's such a huge part of when we take back control of our data and privacy and when we're able to use these products that are built by companies that actually care about the end user and actually care about you.

So they're not doing those things like putting out Google ads and using deep analytics to track their users and doing all of these things that could make it easier for the company to monetize and to grow. But instead, they're putting the user first and the user's privacy and control over data first. It's so important that people who use those things, who use Nextcloud or who just look into Nextcloud, like you said, don't even use it, but end up just telling other people.

It's so, so vital that we do what we can to help fill in those gaps and do it out of a sense of respect for the company who's chosen to respect our data and respect our privacy and give back in such a simple way to tell more people about what Nextcloud is, what it's doing, how we use it specifically. How we can help to onboard those people if necessary, but really just get the word out and do what we can to help fill in those gaps that could be filled in by things that have ethical issues through tracking, through ads, through all of those things.

But instead, we're going to step into that gap and fill in that need for organizations and companies like Nextcloud. And free open source software has a lot of the same things there. So it's definitely something that I hope listeners will jump in and do. But it's definitely a kind of a call to action there is if you like Nextcloud, you like using it, or if you start using it and end up like using it, definitely jump in, tell somebody about it, talk to your friends about it, get more people thinking more deeply about their privacy and their control over their data and about thinking about using tools like Nextcloud.

So thank you so much for coming on, Yos. It was a great chat. We went into so much detail about a lot of the questions that I think people commonly have around Nextcloud. And I'm just very grateful to be able to use the platform here to get the word out about Nextcloud. It's been such a vital tool to me and to how I run so many aspects of my life, how I run the podcast. And so I'm really glad to be able to chat more about it and really just to be able to do what I can to get the word out there about an excellent product that actually cares about the user in Nextcloud.

So thanks for coming on. It was an absolute pleasure, Seth. Really thanks for an opportunity to give me an opportunity to talk to your audience and to you, of course, to hear about how you use it. This is the kind of stuff that's really motivating because it's really why we started this and what motivates us day to day. You know, all the private users who regain control over their data. So there's a bigger picture. But even these one-on-one conversations are really super important for us because it's just, you know, how you keep motivated in a world that's not always going in the right direction.

So thanks. Yeah, very true there. Well, have a great afternoon, Joss. Thanks for listening. And I hope you enjoyed this episode of Opt Out. If you did, please take a moment and subscribe to the podcast. Or if you're already subscribed, share it with one friend or family member this week. As always, you can check out the link to the guest's content and contact info, as well as links to all of the tools we discussed in today's episode. Now get out there and Opt Out this week.