News: Looking for new maintainers

[BernhardPosselt]

I don't have time anymore to work on the News app and my priorities have shifted to other things. I wasn't able to work on new features or bigger bugfixes in the past few months so it's probably dead anyways :)

Let me know if you are interested in taking over News :)

---

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

[JKingweb]

I am sad to see this, because NextCloud News has the best sync protocol of available alternatives (and the draft of v2 is even smarter).

I've actually been working on an independent implementation of the server side of the protocol without a dependence on NextCloud. Given my lack of interest in NextCloud, I would not be willing to maintain NextCloud News, but I would love to collaborate with a prospective future maintainer in further developing the sync protocol.

[karloluiten]

Oh no @BernhardPosselt :( . I really like News and hope you can find the time...

[cosenal]

I am sorry I can't jump in at this moment. Thank you a lot for maintaining the app till now!

[sonologic]

Hi,

First of all, thank you for creating this app in the first place and maintaining it so far! Great app, been using it for quite a while and really wouldn't know what to do about it.

I recently upgraded to nextcloud 12 at which point it broke for me. Reading this, I guess I know why :)

I'm tempted to take over maintenance of this app, because it is an important one to me. I'll sleep on it and let you know. I'm also not in the luxury of having seas of time unfortunately, but i've been meaning to find a way to contribute to nextcloud anyway and this might be a nice one.

• Koen

[BernhardPosselt]

@sonologic sure, just go ahead and create some pull requests for bugs/issues that you want to tackle and if you feel like you can tackle the complexity I will transfer things to you :)

[BernhardPosselt]

you can start with https://github.com/nextcloud/news/issues/163 btw :)

[BernhardPosselt]

And join #nextcloud-dev on irc.freenode.net ;)

[sonologic]

Joined #nextcloud-dev as gmc, will have a look at #163 to get started.. It'll be a bit of a learning curve, given that this is my first foray into nextcloud-related development, so bear with me ..

[sonologic]

Hi - so by now it has become obvious that I seem to have even less time than Bernhard. When I signed on, it seemed I could invest the time to make this work but as has become obvious that is not the case.

I'm happy to make contributions whenever and whereever I can, but for the forthcoming 3-4 months I will only be available sporadically unfortunately.

So if anyone else is able to step up and take responsibility for the news app, that would be beneficial to the future of the app.

[tflidd]

I feel a bit like such postings are rather scary and it would be better to search for other maintainers first (and they can slowly take over). Any way, they will need your (@BernhardPosselt) expertise in the beginning.

[BernhardPosselt]

@tflidd nah, perfectly fine. A lot of things were fixed and people are quite active. As for @sonologic: people are at different points in their life and if its not your job things it's perfectly normal.

[SMillerDev]

I'd be willing to give the PHP side of things a go. Is there anything with more priority then other issues @BernhardPosselt ?

[BernhardPosselt]

@SMillerDev Nope, just get accustomed to it and maybe clean up some stuff ;)

This is probably a task which is neat to do https://github.com/nextcloud/news/issues/264
See https://github.com/nextcloud/news/blob/master/lib/Utility/OPMLExporter.php#L28 and https://github.com/nextcloud/news/blob/master/lib/Command/Updater/UpdateFeed.php

[BernhardPosselt]

The big thing to do is to probably take over picofeed (since the dev dropped it and rewrote it in Go)

[JKingweb]

For what it's worth, I've started writing my own feed parser to replace picoFeed, which I also use in my own implementation of NextCloud News (and Tiny Tiny RSS). It's nowhere near usable yet, but long-term I aim to give it a feature set roughly comparable to picoFeed's (simple API, content scraper), though with support for considerably more feed extensions.

[BernhardPosselt]

Looks pretty neat :)

Did you guard against XXE, XInclude, DTD DDoS, billion laughs, etc? https://www.owasp.org/index.php/XML_Security_Cheat_Sheet

Just a small tip: it's better to split functionality from data, so style wise you shouldn't do the parsing inside the Entry object. Then you can also get rid of inheritance :)

[JKingweb]

Did you guard against XXE, XInclude, DTD DDoS, billion laughs, etc?

No(t yet), but I am cognizant of the need to do so eventually. That the parser fails in those situations is part of my application's test suite, so I'm unlikely to forget.

https://www.owasp.org/index.php/XML_Security_Cheat_Sheet

That looks like a very useful resource, though a lot to digest at once; thanks for mentioning it.

Just a small tip: it's better to split functionality from data, so style wise you shouldn't do the parsing inside the Entry object. Then you can also get rid of inheritance :)

Yes, I expect to shuffle things around more than once before I'm done.

[danopz]

Is there a reason why we shouldn't go with something well supported like Zend-Feed?

[BernhardPosselt]

When I ditched simplepie Zend feed was garbage. Seems to be better now but it misses full text feed as far as I can tell.

[JKingweb]

I had not been aware of Zend Feed, It looks like it doesn't perform content sanitization, either---which is understandable, but still something NCN would need.

[nicola88]

Hi everyone, I started using this app recently and I really like it, so I would love to contribute and eventually take over as maintainer.

I have some experience with PHP, but not with Nextcloud, so I'm going to fill this gap before joining #nextcloud-dev and starting to work on some issues.

[SMillerDev]

There's a lot of issues to pick from, welcome 🙂