Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Dropbox Hacks Your Mac

applehelpwriter.com

Post reply on HN
Print view View original

61–70 of 435 posts

Re: How Dropbox Hacks Your Mac

#61

Post by Dylan16807 »

lm2s wrote: post #53
Dylan16807 wrote: post #50

I don't really understand the conclusion here. So the scenario is you trust dropbox with your files, and you trust them with a kernel blob implementing the filesystem, but you don't trust them to silently have accessibility rights?

You're assuming everyone trusts Dropbox with all their files and that everyone installs their kernel extension, which is a wrong assumption.

If we're worried about theoretical abuse, the client could access all of your files because it runs as you.

You can opt out of the kernel extension? Still, you give it root to install, and it has a long history of hacking the file browser to get icon overlays... it seems weird to me that this would be a deciding factor.

Re: How Dropbox Hacks Your Mac

#62

Post by Vendan »

gruez wrote: post #21

The fact that any application can spoof the os password prompt makes me wonder why they don't have a prominent feature to show the prompt is from the OS. On windows there is the secure desktop with the dimming effect.

Note that that is not what that "effect" is for. It's not, strictly speaking, even an actual "effect". Windows is creating and attaching another "desktop" to your screen, and putting the dialog there. The alternate "desktop", the "Secure Desktop", is inaccessible from any other software on the computer, so a piece of malware can't say "Ask for permission to do blah, then find the 'Allow' button and click it" The "dimming" is to make it clear that this dialog is completely modal, and you can't get to anything else while it's around. It's in no way meant as a "Look, this is an OS prompt", and it's quite easy to match the effect from another program, just grab a screenshot, dim it, throw it up full screen, then throw your dialog in front of it.

Re: How Dropbox Hacks Your Mac

#64

Post by krrrh »

BinaryIdiot wrote: post #55
new299 wrote: post #29

Dropbox circumventing security restrictions (albeit for legit reasons) is particularly worrying because they have board members who support warrentless surveillance. In my mind Dropbox became a company not worth supporting when Rice joined Dropbox's board ( http://www.drop-dropbox.com/ ). Personally, with a board member who advocates warrentless surveillance it seems unlikely that we share similar views on the securi…

Honestly they're pretty much the most expensive out of all of the storage solutions. Other than versioning they have less features than their competition as well. If they were born today I can't imagine they would have gone much of anywhere. Not sure how they're doing financially today but it seems each product they create flops. So even outside of this surveillance stuff I don't get the point in using them.

Their client just works better at syncing quickly and reliably. A huge criteria for me is how much CPU it uses in the background compared to competing solutions from Google or MS and it was often an order of magnitude less (other clients may have improved in the last year or two, I haven't checked).

Another significant advantage is that they support a stable command line client for Linux.

Re: How Dropbox Hacks Your Mac

#65

Post by Dylan16807 »

new299 wrote: post #37
Myrth wrote: post #26

Earlier quoted context omitted.

And if you're using Ubuntu, you're trusting package managers, and if you're using Gentoo, you're trusting original developers (how often do you audit source code?)

It's interesting because at some level, particularly with closed source products trusting the company developing the product is important. Apple have made some effort to stand up for the privacy of their users. Dropbox on the other hand have board members who support and have authorized warrantless wiretaps: http://www.drop-dropbox.com/

> board members

Plural? Who else?

There's a difference between bringing in a single famous person and the rest of the board agreeing with them on certain issues.

Re: How Dropbox Hacks Your Mac

#66

Post by jsmthrowaway »

Sir_Cmpwn wrote: post #58
pyre wrote: post #51

Earlier quoted context omitted.

Isn't a bit naive to think that your solution, which has obvious flaws is one-size-fits-all? I use cloud storage (e.g.) have access to my password file between my computers and my mobile devices. NFS shares on ~/share that only work on the local network don't really solve this issue.

Did I say it was a one-size-fits-all, or that it was flawless? I also suggested OwnCloud before describing my own setup. All of your software choices come with tradeoffs. For my passwords I use pass and store them in a private git repo on a server I trust. http://password-store.org

Yes, you implied that you know better when you critiqued the author's choice to reach for iCloud and suggested your self-hosted 'alternatives' instead as better. Except the one you prefer is not an alternative. It's not even playing the same game.

Some people are willing to spend their finite life building personal infrastructure and the rest pay others to do it. You conflate the two at your peril. The best decision I've ever made was to stop running all of my own stuff -- you get literal days back in your life. Days.

Re: How Dropbox Hacks Your Mac

#67

Post by untog »

tqkxzugoaupvwqr wrote: post #27
ejcx wrote: post #2

Just wanted to give the author a shoutout for being awesome. This article is published with an AMP version[0] too, which is pretty unusual for smaller blogging sites. AMP articles are so much easier on my eyes (and the author can't include their own javascript on an AMP page, so there is less bloat). I wish all bloggers started to publish AMP pages. [0] - http://applehelpwriter.com/2016/08/29/discovering-how-dropbo..…

AMP is not the solution. Anyone willing to use AMP to reduce bloat could also just not add bloat to HTML pages in the first place. And, using AMP itself adds bloat[1]. I couldn’t even read the author’s AMP version without enabling JavaScript. [1] https://www.ampproject.org/docs/get_started/create/basic_mar...

This is what really confuses me about AMP. All it does, really, is force authors to strip their page down to core, performant components.

Another way to do that is to strip your page down to core, performant components without loading a JS library from Google. But Google dangles the carrot of improved SEO with AMP, so everyone has to do it anyway.

(note: they don't actually prioritise AMP pages, they prioritise page load speed. But AMP pages are put inside a Google CDN, so, what do you know, they load fastest)

Re: How Dropbox Hacks Your Mac

#68

Post by rcarmo »

krrrh wrote: post #64
BinaryIdiot wrote: post #55

Earlier quoted context omitted.

Honestly they're pretty much the most expensive out of all of the storage solutions. Other than versioning they have less features than their competition as well. If they were born today I can't imagine they would have gone much of anywhere. Not sure how they're doing financially today but it seems each product they create flops. So even outside of this surveillance stuff I don't get the point in using them.

Their client just works better at syncing quickly and reliably. A huge criteria for me is how much CPU it uses in the background compared to competing solutions from Google or MS and it was often an order of magnitude less (other clients may have improved in the last year or two, I haven't checked). Another significant advantage is that they support a stable command line client for Linux.

This. I cannot stress how important both of these factors are.

I still haven't found a solution other than (http://meocloud.pt, which was implemented by my former colleagues) that was within an order of magnitude as fast and/or as light in terms of CPU load, _and_ that supported Linux directly (let alone had halfway decent MacOS support).

Re: How Dropbox Hacks Your Mac

#69

Post by bahoom »

I'm using the same techniques for my apps to enable accessibility access (which is needed for window management), although I'm asking users for confirmation before doing so.

It's kind of hacky, but the standard Apple way (click the tiny lock icon on the bottom left, find the app in the list, click the checkbox) is way to cumbersome for users.

Why not displaying a simple yes/no popup similar to the "allow access to contacts / calendar items" dialog?

Re: How Dropbox Hacks Your Mac

#70

Post by _razvan »

anf wrote: post #59
new299 wrote: post #29

Dropbox circumventing security restrictions (albeit for legit reasons) is particularly worrying because they have board members who support warrentless surveillance. In my mind Dropbox became a company not worth supporting when Rice joined Dropbox's board ( http://www.drop-dropbox.com/ ). Personally, with a board member who advocates warrentless surveillance it seems unlikely that we share similar views on the securi…

What are the legit reasons? Isn't it just reading and writing files to the Dropbox folder?

The accessibility features of the OS are used by Dropbox to implement the Dropbox Badge / Project Harmony feature.
Post reply on HN