Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Dropbox Hacks Your Mac

applehelpwriter.com

Post reply on HN
Print view View original

151–160 of 435 posts

Re: How Dropbox Hacks Your Mac

#151

Post by infodroid »

newhouseb wrote: post #121

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. - We use accessibility APIs for…

In the long run, the best way to demonstrate that your software is trustworthy is to release the source code for your client software under an open source license.

Re: How Dropbox Hacks Your Mac

#153

Post by Mister_Snuggles »

pyrophane wrote: post #103
krrrh wrote: post #64

Earlier quoted context omitted.

Their client just works better at syncing quickly and reliably. A huge criteria for me is how much CPU it uses in the background compared to competing solutions from Google or MS and it was often an order of magnitude less (other clients may have improved in the last year or two, I haven't checked). Another significant advantage is that they support a stable command line client for Linux.

I've had significant issues attempting to run dropbox headless on the server for file syncing. We needed to include files from another group that was used to primarily working in Dropbox in a daily report build, and so our first go at it was to just run dropbox on that machine and pull the files directly from there. Long story short, the Dropbox client crashed periodically and would stop syncing due to issues with it…

I didn't think Dropbox was meant for use on servers. I can see reasons why you would, but it seems like mapping a drive / mounting a share / etc would be better suited for accessing files on a server.

Re: How Dropbox Hacks Your Mac

#155

Post by skybrian »

kuschku wrote: post #91
gibrown wrote: post #73

Earlier quoted context omitted.

They've been pretty good about accepting PRs to support any ad network from what I've heard: https://github.com/ampproject/amphtml/pulls?utf8=%E2%9C%93&q...

Yes, just as ABP has been good about accepting PRs to add "unobtrusive ads" - until they started demanding money. NEVER give this power to a central authority that's not democratically controlled. And yet, some people still do that mistake.

All open source projects have some kind of "central control" in the sense that they can accept or reject pull requests and define what the official version is.

But you can fork them, so it should be okay, right?

Re: How Dropbox Hacks Your Mac

#156

Post by ddp »

0x0 wrote: post #11

What the fuck Dropbox! How do I get rid of the backdoor in /Library/Application\ Support/com.apple.TCC/TCC.db even after uninstalling Dropbox.app and rm -rf'ing ~/.dropbox and /Library/DropboxHelperTools? Do I just sudo sqlite3 and delete the row? Or is there an official tool (tccutil)? Edit: Crap, there's a /Library/Extensions/Dropbox.kext too now. :(

I did this:

sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db

sqlite> delete from "access" where (service=="kTCCServiceAccessibility" and client=="com.getdropbox.dropbox");

...and it seems to have done the trick.

Re: How Dropbox Hacks Your Mac

#157

Post by techer »

ch4s3 wrote: post #149
riobard wrote: post #147

Earlier quoted context omitted.

At this point you need to follow up with convincing technical details of why Dropbox needs the circumvention to counter the accusation and rebuild the damaged trust. The reason for needing Accessibility API listed in your response is pretty vague, especially for those Mac users not having Microsoft products tainting their systems. I've deleted Dropbox from my Mac for now. I'm not installing it back till there's reaso…

I agree with you general sentiment, but would Word or Excel really "taint" your system?

Morally?

Re: How Dropbox Hacks Your Mac

#158

Post by ROFISH »

newhouseb wrote: post #121

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. - We use accessibility APIs for…

I really wish there was some type of option to go "I really don't want all that fancy crap; give me the version that works via standard APIs"

Re: How Dropbox Hacks Your Mac

#159

Post by SamBam »

toomim wrote: post #137
thenewwazoo wrote: post #104

Earlier quoted context omitted.

Corrected proposed non-clickbait title: "How Dropbox fakes an authorization prompt to trick you into entering credentials that it then caches in order to bypass restrictions on what root is able to do so that it can persist a security bypass mechanism." The first bit, for me, is key.

It doesn't do that. It doesn't cache the credentials. It doesn't even see your password.

How is it adding itself back to the list after being removed, then?

(Not disbelieving you at all, I just haven't understood this part.)

Re: How Dropbox Hacks Your Mac

#160

Post by gnicholas »

xenadu02 wrote: post #136
newhouseb wrote: post #121

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. - We use accessibility APIs for…

Can you also tell us why Dropbox eats lots of CPU cycles anytime there is any filesystem activity? If I unzip a large archive in /tmp, Dropbox is eating 60% of my CPU. If I open the new Xcode for the first time (and the system verifies all the signatures) Dropbox is eating 100% of one CPU. It really seems like the Dropbox client is monitoring the entire filesystem (all FSEvents) instead of just the dropbox syncing fo…

I uninstalled the desktop client because of this exact issue. I just drag/drop via the web interface now. Might not work for some people, but it suits me fine.
Post reply on HN