Most active commenters

    ←back to thread

    How Dropbox Hacks Your Mac

    (applehelpwriter.com)
    1037 points 8bitben | 21 comments | 09 Sep 16 15:52 UTC | HN request time: 0.001s | source | bottom
    Show context
    newhouseb ◴[09 Sep 16 18:15 UTC] No.12464730[source]▶
    Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things —

    - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that.

    - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like.

    - We use accessibility APIs for the Dropbox badge (Office integrations) and other integrations (finding windows & other UI interactions).

    - We use elevated access for where the built-in FS APIs come up short. We've been working with Apple to eliminate this dependency and we should have what we need soon.

    - We never see or store your admin password. The dialog box you see is a native OS X API (i.e. made by Apple).

    - We check and set privileges on startup — the intent was to make sure Dropbox is functioning properly, works across OS updates, etc. The intent was never to frustrate people or override their choices.

    We’re all jumping on this. We’ll do a better job here and we’re sorry for any anger, frustration or confusion we’ve caused.

    replies(30): >>12464748 #>>12464757 #>>12464795 #>>12464842 #>>12464871 #>>12464901 #>>12464973 #>>12464992 #>>12465003 #>>12465065 #>>12465178 #>>12465579 #>>12465584 #>>12465819 #>>12465975 #>>12466068 #>>12466126 #>>12466141 #>>12466143 #>>12466315 #>>12466502 #>>12466626 #>>12466822 #>>12468525 #>>12468769 #>>12468833 #>>12469145 #>>12470515 #>>12473045 #>>12481821 #
    brentdax ◴[09 Sep 16 21:52 UTC] No.12466315[source]▶
    > - We never see or store your admin password. The dialog box you see is a native OS X API (i.e. made by Apple).

    To clarify for others: In /Library/DropboxHelperTools, you'll find a folder for each user full of setuid tools which run as root and do various privileged things. I assume that the client is presenting the normal OS X "ask for elevated access" UI and then using that elevated access to configure and install these. (I don't work for Dropbox or anything; I've just been poking around.)

    > - We use accessibility APIs for the Dropbox badge (Office integrations) and other integrations (finding windows & other UI interactions).

    @newhouseb, I don't have Office, so I've turned off the badge. Is Dropbox now going to leave my accessibility permissions the way I set them? Or is it going to reactivate a permission behind my back that it no longer even needs?

    I understand the desire to make your features "just work", but circumventing the user's privacy controls to do that is never acceptable. Especially accessibility, which is basically a general warrant to snoop on everything the user does. You wouldn't be on my system anymore if my work didn't require Dropbox. You're going to lose a lot of trust over this, and it won't even be half of what you deserve.

    And it's not even in your interest in the long term. This fiasco has probably made it more likely that Apple will further lock down the accessibility APIs, possibly even making them unavailable without an Apple-issued, potentially App Store-only entitlement. Since Dropbox can't really do its job when it's locked in a sandbox, I really don't think that's what you guys want to happen.

    Teams like yours are why we can't have nice things.

    (P.S. plz respect NSFileCoordinator this isn't Tiger anymore kthxbai)

    replies(4): >>12466524 #>>12466747 #>>12466921 #>>12467925 #
    1. newhouseb ◴[09 Sep 16 23:24 UTC] No.12466747[source]▶
    > @newhouseb, I don't have Office, so I've turned off the badge. Is Dropbox now going to leave my accessibility permissions the way I set them? Or is it going to reactivate a permission behind my back that it no longer even needs?

    Yep, we’re going to fix this so that if you uncheck it, we leave it unchecked.

    > This fiasco has probably made it more likely that Apple will further lock down the accessibility APIs, possibly even making them unavailable without an Apple-issued, potentially App Store-only entitlement.

    As alluded to elsewhere in this thread, this is already happening in macOS 10.12. We’ll be switching to the same approach that Steam (among others) do to request accessibility.

    replies(2): >>12467026 #>>12468539 #
    2. electic ◴[10 Sep 16 00:31 UTC] No.12467026[source]▶
    Honestly, after the last year and a half, anything that wants root access, that is not open source, is out. Now, being open source does not make that automatically safe but it is a step in the right direction. Dropbox, MS Office, etc, are closed source tools that puts too much at stake.

    Granted my team is small, but we just uninstalled dropbox today. Going to use the web interface and look for another solution in the meantime.

    replies(3): >>12467179 #>>12467208 #>>12470386 #
    3. godzillabrennus ◴[10 Sep 16 01:22 UTC] No.12467179[source]▶
    Mac OS X is a mostly closed source operating system so I don't understand why you are drawing the line with third parties.
    replies(2): >>12467910 #>>12468043 #
    4. jkmcf ◴[10 Sep 16 01:31 UTC] No.12467208[source]▶
    I'd love to hear what you find. My research has shown that Dropbox is mostly the only sync service supported in mobile apps. iCloud is next. After that it's very rare to see any other integration.

    I'd love to see Box or someone else encourage popular apps to support their sync platforms, but I doubt it will happen. I blame Apple for not supporting easy 3rd party integrations.

    replies(3): >>12467780 #>>12469923 #>>12470261 #
    5. wlkr ◴[10 Sep 16 05:00 UTC] No.12467780{3}[source]▶
    I switched from Dropbox to Mega a few years ago and they now have mobile apps, sync clients for multiple operating systems and decent browser extensions in addition to a more generous storage allowance. There is also the added benefit of encryption. So far I remain impressed with their service.
    replies(1): >>12467895 #
    6. PhantomGremlin ◴[10 Sep 16 05:52 UTC] No.12467895{4}[source]▶
    I switched from Dropbox to Mega

    Really?

    FWIW Kim Dotcom, the founder of Mega, has distanced himself from it, saying the company had "suffered from a hostile takeover by a Chinese investor who is wanted in China for fraud"[1]

    So yeah, don't trust Dropbox. Instead trust some shady Chinese characters. Can you name one of them? In comparison, note that Ben Newhouse, a Dropbox employee, is actually posting in this discussion.

    There is also the added benefit of encryption

    Without full source code to said encryption, all you have to go on is "trust us".

    Forced to choose between the two, I know who I'd trust, and it wouldn't be Mega. YMMV.

    [1] https://en.wikipedia.org/wiki/Mega_(service)

    replies(2): >>12468028 #>>12480154 #
    7. fredsir ◴[10 Sep 16 05:58 UTC] No.12467910{3}[source]▶
    I suspect many would like to run something more open than OS X/macOS, but because of the alternatives, it's just not viable for business purposes not to, according to what their needs are. I know that is the situation for me.
    8. kuschku ◴[10 Sep 16 06:51 UTC] No.12468028{5}[source]▶
    Luckily, there's third party clients that are open source for Mega.

    And they're actually usable.

    9. stephenr ◴[10 Sep 16 06:57 UTC] No.12468043{3}[source]▶
    Apple has shown itself to be trustworthy.

    Dropbox has done the opposite.

    10. brentdax ◴[10 Sep 16 10:05 UTC] No.12468539[source]▶
    I should say, Ben, thank you for coming out in public and sharing your team's perspective. Your users are angry—and I think rightly so—but it does help that we are being told why it was done, that it was merely poor judgement rather than deliberate misbehavior, and that you are working to make the Dropbox client a more responsible citizen. Is it as good as not having done it in the first place? No. But it's much better than radio silence.
    11. nameauser ◴[10 Sep 16 16:40 UTC] No.12469923{3}[source]▶
    I have no idea what Dropbox actually is or does (I'm FOSS-only, at home and at work), I've only heard of it, so I may be way off the mark.

    With that said, on the assumption that it is a way to exchange files between computers and/or share with other users, it would seem to be the case that ownCloud (nextCloud) fits the bill. You can host it yourself (as I do) or use a third party to host it for you. I have been using it for a number of years and I'm entirely happy with it.

    Also, depending on your use scenario, another possible option may be https://www.stackfield.com/ a German end-to-end encrypted storage company. I believe there are others offering similar services.

    12. niutech ◴[10 Sep 16 18:03 UTC] No.12470261{3}[source]▶
    Seafile (https://www.seafile.com) and ownCloud (https://owncloud.org) both are open source and have mobile apps. Worth checking!
    replies(2): >>12472503 #>>12472737 #
    13. fmajid ◴[10 Sep 16 18:40 UTC] No.12470386[source]▶
    Try SyncThing. It's cross-platform (written in Go), fast and secure (BitTorrent Sync style, but open-source).
    replies(1): >>12471575 #
    14. tjl ◴[11 Sep 16 00:52 UTC] No.12471575{3}[source]▶
    I use it, but there's no iOS solution so I can't use it for a number of things.
    replies(1): >>12472507 #
    15. killerpopiller ◴[11 Sep 16 08:25 UTC] No.12472503{4}[source]▶
    for synching between devices I use BT-Sync, now Sync.. closed source but reliable as a background daemon not needing intervention
    16. killerpopiller ◴[11 Sep 16 08:27 UTC] No.12472507{4}[source]▶
    BT-Sync is the original of syncthing with iOS-support but considered bad because its closed source and comercial

    I like it though

    replies(1): >>12474398 #
    17. stridera ◴[11 Sep 16 10:16 UTC] No.12472737{4}[source]▶
    box.com as well. We have free accounts, hipaa/gov grade encryption and security, and lots of collaboration options. :)
    replies(2): >>12549533 #>>12555540 #
    18. tjl ◴[11 Sep 16 17:18 UTC] No.12474398{5}[source]▶
    I don't use BT Sync because if I'm on my local university network they block BitTorrent. It's not a big deal since I've graduated, but I still go there and use the library and meet with people so it would be inconvenient.
    19. Jean-Philipe ◴[12 Sep 16 14:53 UTC] No.12480154{5}[source]▶
    > Instead trust some shady Chinese characters.

    What does Chinese have to do with this?

    20. JANorman ◴[21 Sep 16 16:14 UTC] No.12549533{5}[source]▶
    Have you tried StorageMadeEasy.com ? Connects to dropbox and other clouds too.
    21. niutech ◴[22 Sep 16 09:08 UTC] No.12555540{5}[source]▶
    But it isn't open source.