My Nextcloud Conference 2025

At the end of September the Nextcloud community gathered in Berlin for a weekend of conference and a week of bonding, workshops and coding. It is a means to bring together members of the company with all sorts of contributors, forming our community. The conference was accompanied with the next mayor Nextcloud release, called Nextcloud Hub 25 Autumn. Here I would like to shed some views and impressions of mine, as one of the employees present.

The conference weekend

bUm in in Berlin was the venue that hosted this years conference, and it turned out to be slightly small already. Frank Karlitschek`s keynote was well-visited, the room completely full, and so I decided to stay outside in the hall to give room to other participants. Hence I missed being called out by Frank when he talked about the roots and first contributors of the project.

The number of people also affected me in some way. On the one hand there were so many known faces to talk to, as well as many people i met first time in person as not only Nextcloud the company keeps growing, Even for "my" team it was tricky to get hold of me. That said, the conference and the following week were extremely intense, exhausting, yet satisfying, fun and exciting!

Again on a personal level I experienced the conference from a different set of eyes. As I was acting as a deputy team lead for the last three months roughly, I was much more involved with people on a non-technical level, had the chance to gather the otherwise distributed team locally including members who were having their first conference, and deal with some people matters as well.

Look out: Refurbished LDAP Wizard in Hub 26

Over the years I got closer connections to people from across the team that I do not have contact with in the usual everyday work life, who are just in different teams or even departments. So I could get insights into management of the Pre-Sales Team (they are desperately looking for new colleagues!), tap the Talk team or hear stories from my old Files team.

There @artonge was overhauling the LDAP settings wizard front-end and migrating it to Vue. This is something that I feel still connected to, as it is a piece of functionality that I implemented twelve (in figures: 12) years ago and you may have read about it here. Back then, before the Nextcloud fork, before Vue, and with the stipulation to actually not add more Javscript frameworks, the need was to implement it with what we had and vanilla JS (which i still hold dear). With another iteration, if I recall correctly, I was designing it in a way that was, as @artonge told me, easy to follow, understand and re-implement.

The refurbished LDAP settings wizard will ship with Hub 26 somewhere early next year, but you can try today with the git master checkout or daily images.

Side app: Audiowaveform preview provider

One small app was born already the previous year following discussions with a fellow forums moderator who also has ties to some music production. There was a wish to have the audiowaveform of a music file available as preview. Having just looked briefly at the related interface, I prototyped an app, showed him the repository to try, and it was fine. And sitting there.

A little before this conference he reached out to me about a misbehaviour when processing big files. After fixing this one, I polished the app a little and published Audiowaveform Preview Provider on the app store. It does not have settings for a better convenience (call it minimal?), but does it job once you have a binary installed.

Experimental offensive hacking session

During the contributor week I organized an offensive security session with a naive approach to collect some first ideas and feedback and evaluate a future workshop to be held at the next conference. I prefer my workshops to be hands-on: keep the chalk and talk to a minimum, give out the bare instructions and let the participants act collaboratively. It ensures that people actually personally deal with the matter and deepen their understanding through their own actions, questions and discussions.

I used the same format, but at the same time relied on the skills of the participants. The task was to form into small groups of three or four (we had two in the end), pick a popular Nextcloud app and try to exploit it in some way. The thinking behind it was to get away from a mindset of a defensive programmer and into offensive thinking. I gave some ideas on how to approach it, but not limiting choices otherwise.

In this two hour sessions we only managed to find a bug that could help with a DDoS attack, and a few others with interesting but not security-relevant behaviour.

Feedback from the participants concluded that such a workshop should be repeated, with some modifications however. A slot of 2 hours does not have much time for deep analysis, especially not for sophisticated attempts. Apps to target should be pre-selected already to save some time on deciding what to explore. There was some demand for a deeper introduction in how to attack software.

The bottom line is that it was an encouraging experience and I am looking forward to the next iteration already.

Shout out to friends

Last but not least at shout out to friends at the other organizations who participated at the Nextcloud conference, who I loved to see and meet in person again and are simply an important part of the free and open source environment. For example there was Marie Kreil from the Prototype Fund, Matthias Kirschner from the Free Software Foundation Europe (have your kids read Ada & Zangemann yet?), or the folks around Michael Meeks and Pedro Pinto Silva from Collabora.

Kudos go out, of course, to the even team, who made this marvelous conference happen with all their passion – a big thank you!

There is a ton more I could write about (like the keynote by MySQL and MariaDB founder Monty Widenius; you can still find the agenda on the conference web page), alas I think I made my key points and did not expect to write so much already :) Drop by next year and make your own experience!