TinyCP - Any experiences?

Ympker · December 2019

Has anyone been using TinyCP? Any experiences you can share regarding this cp?
It looks pretty light-weigth and clean.

SagnikS · December 2019

@Ympker said:
Has anyone been using TinyCP? Any experiences you can share regarding this cp?
It looks pretty light-weigth and clean.

Demo: https://tinycp.com/page/show/demo

I started using it after facing several stupid issues with Virtualmin. The UI is really fast and clean, and seems to just work so far. I'd like to have nginx support though

Ympker · December 2019

@SagnikS said:

@Ympker said:
Has anyone been using TinyCP? Any experiences you can share regarding this cp?
It looks pretty light-weigth and clean.

Demo: https://tinycp.com/page/show/demo

I started using it after facing several stupid issues with Virtualmin. The UI is really fast and clean, and seems to just work so far. I'd like to have nginx support though

Thanks for the feedback

vyas · December 2019

Thanks.. just installed it - I agree that the UI is fast and clean. This is definitely something I can keep using on a test vps till it is ready for prime time.

Amitz · December 2019

The name of the panel though... Pedobear, pedobear...

But it looks like a nice sleek panel. I wish there was something like a security audit that it has passed...

Ympker · December 2019

@Amitz said:
The name of the panel though... Pedobear, pedobear...

But it looks like a nice sleek panel. I wish there was something like a security audit that it has passed...

Free panels rarely pay for audits like this since they only live from donations anyway.

Amitz · December 2019

Sure. It just helps with trust issues...

SagnikS · December 2019

Amitz said: I wish there was something like a security audit that it has passed...

To be honest, if it were open source one can technically get it audited themselves, but it being closed source doesn't help

Ympker · December 2019

@SagnikS said:

Amitz said: I wish there was something like a security audit that it has passed...

To be honest, if it were open source one can technically get it audited themselves, but it being closed source doesn't help

Well since they are (not yet) making any money from it, they don't have to proof anything to anyone. Those who like it can participate on their forums and get to know the members of the team, their ideals etc. those who don't.. well, can just use another free solution. If it was a paid panel, it'd be another story. I mean, my YmpKit on GitHub is nowhere near as stable/advanced as a project like Tinycp. But I also developed it for me to ease my personal workflow, not anyone elses. I shared it to get potential feedback/bug reports and to let others benefit from it, too. I don't want to proof anything to anyone though. That being said, I don't think they'd be opposed to someone donating them a security audit, or a security firm that wants their product to succeed, doing it for free. Wasn't there some security audit guy on this forum?

SagnikS · December 2019

@Ympker said:

@SagnikS said:

Amitz said: I wish there was something like a security audit that it has passed...

To be honest, if it were open source one can technically get it audited themselves, but it being closed source doesn't help

Well since they are (not yet) making any money from it, they don't have to proof anything to anyone. Those who like it can participate on their forums and get to know the members of the team, their ideals etc. those who don't.. well, can just use another free solution. If it was a paid panel, it'd be another story. I mean, my YmpKit on GitHub is nowhere near as stable/advanced as a project like Tinycp. But I also developed it for me to ease my personal workflow, not anyone elses. I shared it to get potential feedback/bug reports and to let others benefit from it, too. I don't want to proof anything to anyone though. That being said, I don't think they'd be opposed to someone donating them a security audit, or a security firm that wants their product to succeed, doing it for free. Wasn't there some security audit guy on this forum?

Fair enough, afaik, they have a plan to make it paid sometime in the future (about $1/mo iirc..?) They probably will get something done then I believe.

Ympker · December 2019

@SagnikS said:

@Ympker said:

@SagnikS said:

Amitz said: I wish there was something like a security audit that it has passed...

To be honest, if it were open source one can technically get it audited themselves, but it being closed source doesn't help

Well since they are (not yet) making any money from it, they don't have to proof anything to anyone. Those who like it can participate on their forums and get to know the members of the team, their ideals etc. those who don't.. well, can just use another free solution. If it was a paid panel, it'd be another story. I mean, my YmpKit on GitHub is nowhere near as stable/advanced as a project like Tinycp. But I also developed it for me to ease my personal workflow, not anyone elses. I shared it to get potential feedback/bug reports and to let others benefit from it, too. I don't want to proof anything to anyone though. That being said, I don't think they'd be opposed to someone donating them a security audit, or a security firm that wants their product to succeed, doing it for free. Wasn't there some security audit guy on this forum?

Fair enough, afaik, they have a plan to make it paid sometime in the future (about $1/mo iirc..?) They probably will get something done then I believe.

Yeah, they suggest on the frontpage that they may be charging a "minimal fee" at some point. But until then, I believe that one shouldn't expect them to invest any money in an audit. Once they go commercial, that's another story.

Moe · December 2019

Thanks for this. I'm going to give this a try on my development server as a possible replacement for Virtualmin. The interface seems to be very clean and easy-to-use.

ulayer · December 2019

It looks nice, I'll give it that, but their security claims on the index don't make much sense... kind of turned me away from it.

Our custom security layer over HTTP.
Connection to the IP is now secured.
Our own guardian software.

flips · December 2019

Not HTTPS, but HTTP + some custom something? Sounds weird ...
Did try it out a bit on Debian 9. A bit buggy for Apache. Will retry on Debian 10.

Neoon · December 2019

@ulayer said:
It looks nice, I'll give it that, but their security claims on the index don't make much sense... kind of turned me away from it.
Our custom security layer over HTTP.
Connection to the IP is now secured.
Our own guardian software.

You can encrypt stuff with javascript on the client and then pass it to the server.
So its even encrypted when send over HTTP, without HTTPS.

ulayer · December 2019

@Neoon said:
@ulayer said:
It looks nice, I'll give it that, but their security claims on the index don't make much sense... kind of turned me away from it.
Our custom security layer over HTTP.
Connection to the IP is now secured.
Our own guardian software.
You can encrypt stuff with javascript on the client and then pass it to the server.
So its even encrypted when send over HTTP, without HTTPS.

This sounds questionable. From their statement, can't really gather what they're doing at all, they're using buzzwords.

The JavaScript to do all of that could be modified in transit if sent over HTTP though. It sounds like a backwards concept.

Ympker · December 2019

@ulayer said:
@Neoon said:
@ulayer said:
It looks nice, I'll give it that, but their security claims on the index don't make much sense... kind of turned me away from it.
Our custom security layer over HTTP.
Connection to the IP is now secured.
Our own guardian software.
You can encrypt stuff with javascript on the client and then pass it to the server.
So its even encrypted when send over HTTP, without HTTPS.
This sounds questionable. From their statement, can't really gather what they're doing at all, they're using buzzwords.

The JavaScript to do all of that could be modified in transit if sent over HTTP though. It sounds like a backwards concept.

Sounds weird indeed?

geekyhillbilly · December 2019

But aren't all the browsers wanting everyone to use HTTPS now? Or at least be moving your websites to use HTTPS in the near future.

Ympker · December 2019

@geekyhillbilly said:
But aren't all the browsers wanting everyone to use HTTPS now? Or at least be moving your websites to use HTTPS in the near future.

I think forcing SSL wouldn't be an issue. What the guys don't feel well about (including me) is that they use their "custom hardened HTTP" connection while they should be using HTTPS. Going with that people would assume there'd be more security flaws. Not that this has been proofed yet afaik but still..

TinyCP - Any experiences?

Comments

This Site is currently in maintenance mode.
Please check back here later.

TinyCP - Any experiences?

Comments

This Site is currently in maintenance mode.Please check back here later.

This Site is currently in maintenance mode.
Please check back here later.