Live data from Hacker News

How Dropbox Hacks Your Mac

applehelpwriter.com

141–150 of 435 posts

Re: How Dropbox Hacks Your Mac

#141

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. - We use accessibility APIs for…

That office integration is a PITA, is there anyway to disable it?

Re: How Dropbox Hacks Your Mac

#142

Earlier quoted context omitted.

Honestly they're pretty much the most expensive out of all of the storage solutions. Other than versioning they have less features than their competition as well. If they were born today I can't imagine they would have gone much of anywhere. Not sure how they're doing financially today but it seems each product they create flops. So even outside of this surveillance stuff I don't get the point in using them.

As far as I know, DropBox is the only service that does delta block uploads correctly and switches to LAN transfer when two synced computers are in the same network. I know it's CS 101, but neither Google Drive, iCloud, or OneDrive do this. Not to mention the other services have bizarre naming limits (e.g., dotfiles are forbidden on OneDrive). Also, DropBox supports Linux officially.

Syncthing does all of these, but doesn't have the "always available" feature where the service provider keeps a copy of everything for you. If that's not crucial, maybe Syncthing is a viable alternative.

Re: How Dropbox Hacks Your Mac

#143
post #138

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. - We use accessibility APIs for…

> We use elevated access for where the built-in FS APIs come up short.

Can you please provide an example of such shortcomings?

Re: How Dropbox Hacks Your Mac

#144
post #72

I wonder what will happen when Apple plugs those security holes. Will Dropbox cease to run as it does now, and suddenly for instance lose important features?

This appears to be impossible in Sierra, as the relevant db has been added to SIP. I have un-granted access, and the dropbox app has not been able to re-enable it, nor has it complained (and yes, I restarted).

Re: How Dropbox Hacks Your Mac

#145
post #12

Earlier quoted context omitted.

should be able to just uncheck Dropbox.app in SysPrefs -> Security & Privacy -> Privacy -> Accessibility

I tried this, but looks like Dropbox shenanigans are able to silently turn it back on.

Not in Sierra

Re: How Dropbox Hacks Your Mac

#146

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. - We use accessibility APIs for…

> We use elevated access for where the built-in FS APIs come up short.

Can you please provide an example of such shortcomings and accessibility APIs that are better?

Re: How Dropbox Hacks Your Mac

#147

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. - We use accessibility APIs for…

At this point you need to follow up with convincing technical details of why Dropbox needs the circumvention to counter the accusation and rebuild the damaged trust.

The reason for needing Accessibility API listed in your response is pretty vague, especially for those Mac users not having Microsoft products tainting their systems.

I've deleted Dropbox from my Mac for now. I'm not installing it back till there's reasonable explanation and remedies.

Re: How Dropbox Hacks Your Mac

#148

Earlier quoted context omitted.

AMP is not the solution. Anyone willing to use AMP to reduce bloat could also just not add bloat to HTML pages in the first place. And, using AMP itself adds bloat[1]. I couldn’t even read the author’s AMP version without enabling JavaScript. [1] https://www.ampproject.org/docs/get_started/create/basic_mar...

> Anyone willing to use AMP to reduce bloat could also just not add bloat to HTML pages in the first place. AMP is not meant for page authors — usually, they are painfully aware of how much bloat they add. They don't have a choice when sustainability is in the balance. AMP is for the ad networks. It draws sane restrictions to what they can do. On their end, ad networks agree to that because Google is a large partner…

> They don't have a choice when sustainability is in the balance.

This is not solved by AMP, it's absolutely the choice of publishers.

> AMP is for the ad networks.

Not really, you can see their official roadmap. Many of the original principles have already changed and many of the intrusive ad formats are already back in (like autoplay outstream video units). The only real optimization is better async loading which could already be done with proper coding by publishers and ad networks.

Re: How Dropbox Hacks Your Mac

#149

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. - We use accessibility APIs for…

At this point you need to follow up with convincing technical details of why Dropbox needs the circumvention to counter the accusation and rebuild the damaged trust. The reason for needing Accessibility API listed in your response is pretty vague, especially for those Mac users not having Microsoft products tainting their systems. I've deleted Dropbox from my Mac for now. I'm not installing it back till there's reaso…

I agree with you general sentiment, but would Word or Excel really "taint" your system?

Re: How Dropbox Hacks Your Mac

#150

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. - We use accessibility APIs for…

The dialog box you see is a native OS X API (i.e. made by Apple). Which API are you using that allows you to circumvent the OS X Accessibility Permissions control dialog? Or do you mean you're simply asking for administrative permissions in order to write directly to TCC.db? And in that case, what mechanism are you using to circumvent the permissions structure to permit you to rewrite to TCC.db without re-requesting…

The Accessibility Permissions dialogue doesn't just show up. You as a developer can control when it is shown (using AXIsProcessTrustedWithOptions).
Post reply on HN