Live data from Hacker News

How Dropbox Hacks Your Mac

applehelpwriter.com

251–260 of 435 posts

Re: How Dropbox Hacks Your Mac

#251
post #233

On the Linux side, has anybody looked at what installing Dropbox does? I'm guessing it's not going to be different from what it does on a Mac, but it would be nice to know exactly...

If you ctrl+f through the thread for Linux, I think I remember someone mentioning that it just runs in userspace without root.

Re: How Dropbox Hacks Your Mac

#252
post #72

I wonder what will happen when Apple plugs those security holes. Will Dropbox cease to run as it does now, and suddenly for instance lose important features?

This appears to be impossible in Sierra, as the relevant db has been added to SIP. I have un-granted access, and the dropbox app has not been able to re-enable it, nor has it complained (and yes, I restarted).

What is SIP? I've seen it mentioned elsewhere in the thread but not explained, and in the article ctrl+f SIP yields no results.

Re: How Dropbox Hacks Your Mac

#253

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. - We use accessibility APIs for…

> - We never see or store your admin password. The dialog box you see is a native OS X API (i.e. made by Apple). To clarify for others: In /Library/DropboxHelperTools, you'll find a folder for each user full of setuid tools which run as root and do various privileged things. I assume that the client is presenting the normal OS X "ask for elevated access" UI and then using that elevated access to configure and install…

Not from Dropbox but when you remove an app from accessibility permissions OS X will make you manually enable it again.

Re: How Dropbox Hacks Your Mac

#254

Ok. Now that Dropbox is shady as well as overpriced, are there any good alternatives?

I'm looking at this: http://www.tarsnap.com/ HN has mentioned this several times in the past. I'm now looking at the prior comments about this.

If anything is overpriced, tarsnap is -- or was, last time I compared prices. Also picodollars are a bit opaque.

I really wanted to use it and hoped it'd come out reasonably compared to alternatives, but I actually found none except buying a hard disk + raspberry pi myself and hosting it at a friend's place. That was cheaper by about a factor 2, which (at 3TB data) was too much to ignore for my student budget. This was about two years ago though.

Re: How Dropbox Hacks Your Mac

#255

Earlier quoted context omitted.

I've had significant issues attempting to run dropbox headless on the server for file syncing. We needed to include files from another group that was used to primarily working in Dropbox in a daily report build, and so our first go at it was to just run dropbox on that machine and pull the files directly from there. Long story short, the Dropbox client crashed periodically and would stop syncing due to issues with it…

I didn't think Dropbox was meant for use on servers. I can see reasons why you would, but it seems like mapping a drive / mounting a share / etc would be better suited for accessing files on a server.

There's a version that can be run on a linux server without X installed. IIRC Dropbox provides it, but doesn't really support or make any promises wrt its reliability.

If all you need is folder/volume sharing between two machines, samba or nfs (or something similar) works great, but as I mentioned the reason for attempting to use dropbox in that fashion was to integrate with a workflow already being used by another team.

Re: How Dropbox Hacks Your Mac

#256

I have given Dropbox access to my files, admins rights, and ability to run in the kernel. I'm not freaking out about the Accessibility API. setuid binaries: $ tree -p /Library/DropboxHelperTools/ /Library/DropboxHelperTools/ ├── [-r-s--x--x] DropboxHelperInstaller └── [drwxr-xr-x] Dropbox_u501 ├── [-r-s--x--x] dbaccessperm ├── [-r-s--x--x] dbfseventsd └── [-r-s--x--x] dbkextd kernel extension: $ kextstat -b com.getdr…

Since the arrival of FSEvents I don't understand why DB needs a kernel mod at all

Re: How Dropbox Hacks Your Mac

#257

Earlier quoted context omitted.

We use OneDrive at work and it works pretty much exactly as well as I recall Dropbox working back when I used it.

When I last tried it the performance was abysmal, almost as bad as Google Drive. Also, no Linux client. I didn't use it enough to know if it has the same conflict issues as many of the other ones I tried — Microsoft may well have managed to get that right.

There is an open onedrive client that works great.

Re: How Dropbox Hacks Your Mac

#258

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. - We use accessibility APIs for…

>We never see or store your admin password. The dialog box you see is a native OS X API (i.e. made by Apple).

Is it a native OS X dialog API, or native OS X authentication API? I could make a password prompt myself, and call that "being official Win32 API".

Can you show me the class where you invoke it, so I can judge for myself?

Re: How Dropbox Hacks Your Mac

#259

Earlier quoted context omitted.

> - We never see or store your admin password. The dialog box you see is a native OS X API (i.e. made by Apple). To clarify for others: In /Library/DropboxHelperTools, you'll find a folder for each user full of setuid tools which run as root and do various privileged things. I assume that the client is presenting the normal OS X "ask for elevated access" UI and then using that elevated access to configure and install…

Not from Dropbox but when you remove an app from accessibility permissions OS X will make you manually enable it again.

mikewhy: The article states that it re-adds itself to the list automatically the next time you log in, without asking for permission again. There's no option to keep it permanently disabled.

Re: How Dropbox Hacks Your Mac

#260

I have given Dropbox access to my files, admins rights, and ability to run in the kernel. I'm not freaking out about the Accessibility API. setuid binaries: $ tree -p /Library/DropboxHelperTools/ /Library/DropboxHelperTools/ ├── [-r-s--x--x] DropboxHelperInstaller └── [drwxr-xr-x] Dropbox_u501 ├── [-r-s--x--x] dbaccessperm ├── [-r-s--x--x] dbfseventsd └── [-r-s--x--x] dbkextd kernel extension: $ kextstat -b com.getdr…

Dropbox on Linux needs none of that. Sure it doesn't have the fancy icons in file managers, but it also runs in user-space without a kernel module.

There are plugins that give you the fancy icons for some file managers, and they still run in user-space (and as non-root).
Post reply on HN