Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Dropbox Hacks Your Mac

applehelpwriter.com

Post reply on HN
Print view View original

331–340 of 435 posts

Re: How Dropbox Hacks Your Mac

#331

Post by stephenr »

godzillabrennus wrote: post #287
electic wrote: post #282

Earlier quoted context omitted.

Honestly, after the last year and a half, anything that wants root access, that is not open source, is out. Now, being open source does not make that automatically safe but it is a step in the right direction. Dropbox, MS Office, etc, are closed source tools that puts too much at stake. Granted my team is small, but we just uninstalled dropbox today. Going to use the web interface and look for another solution in the…

Mac OS X is a mostly closed source operating system so I don't understand why you are drawing the line with third parties.

Apple has shown itself to be trustworthy.

Dropbox has done the opposite.

Re: How Dropbox Hacks Your Mac

#332

Post by pvdebbe »

kuschku wrote: post #92
pvdebbe wrote: post #48

Earlier quoted context omitted.

One example: in my static blog I provide very nice maths using MathJax, but I also provide fallback PNG renders of the formulae. The small JS my blog has, it reads these pictures' alt texts and renders the latex if found. This stuff is not rocket science, people just don't want to spend time on this kind of stuff.

You might want to switch to katex instead - and katex can also be run on the server to return HTML directly.

KaTeX looks very good, but currently I let org-mode do the backend lifting for me. Maybe if I rewrite my blog engine once again... ;-)

Re: How Dropbox Hacks Your Mac

#333

Post by breatheoften »

Anybody know a good OS X app to scan the file system for suid binaries? I guess I could do this with find from the shell, but a little utility app with a nice ui (and possibily some integration with a database to hide or categorize by threat level) seems like a smart thing to have on my system and run every so often.

Re: How Dropbox Hacks Your Mac

#334

Post by breatheoften »

gr2020 wrote: post #229
ejcx wrote: post #2

Just wanted to give the author a shoutout for being awesome. This article is published with an AMP version[0] too, which is pretty unusual for smaller blogging sites. AMP articles are so much easier on my eyes (and the author can't include their own javascript on an AMP page, so there is less bloat). I wish all bloggers started to publish AMP pages. [0] - http://applehelpwriter.com/2016/08/29/discovering-how-dropbo..…

I'd be a lot happier with AMP if they'd stop hijacking the scrolling behavior on iOS (speed and momentum is different than on a regular web page). It drives me absolutely crazy.

Oh no!! I never heard of AMP before but now I hate it with a passion. Anything that spreads the terrible gmail style scrolling behavior is all bad in my eyes.

Re: How Dropbox Hacks Your Mac

#335

Post by voltagex_ »

pkamb wrote: post #326
brentdax wrote: post #236

Earlier quoted context omitted.

> - We never see or store your admin password. The dialog box you see is a native OS X API (i.e. made by Apple). To clarify for others: In /Library/DropboxHelperTools, you'll find a folder for each user full of setuid tools which run as root and do various privileged things. I assume that the client is presenting the normal OS X "ask for elevated access" UI and then using that elevated access to configure and install…

> more likely that Apple will further lock down the accessibility APIs, possibly even making them unavailable without an Apple-issued, potentially App Store-only entitlement. Please feel free to duplicate my radar! Accessibility and Productivity/Utility app developers would love a Sandbox entitlement. rdar://13570189 - Sandbox entitlement for Accessibility API to allow apps for the disabled The Accessibility toolkit…

Is it worth adding that to OpenRadar?

https://openradar.appspot.com/search?query=13570189

Re: How Dropbox Hacks Your Mac

#336

Post by tigershark »

tomku wrote: post #6

Non-clickbait title: "How Dropbox uses the root access that you give it during installation to give itself Accessibility authorization without triggering the usual popup".

No, it's not that the point. The point is that they somehow store your sudo password to set again the accessibility permission at every login. I honestly don't see why the title should be considered a click-bait, it looks pretty much very accurate to me.

Re: How Dropbox Hacks Your Mac

#337

Post by microtonal »

__jal wrote: post #164
seanhunter wrote: post #124

Earlier quoted context omitted.

It's very strange that after I remove Dropbox from the accessibility list you think it's ok to add it back in again. That's the reason I'll be closing my account.

Absolutely. I dropped Dropbox some time back, when it became obvious that they didn't respect the user's wishes at all. This has been a long-standing thing with them - some years back there was some stink about the forced Dropbox branding in the Finder (which we now see is related to this). Many people (including me) found it rude that it insists on adding useless widgets, badging icons and inserting crap in the Find…

badging icons and inserting crap in the Finder sidebar

Their branding strategy is really annoying. I pay 10 Euro per month for Dropbox Pro, but they have Dropbox Business ads plastered all over the web interface.

Re: How Dropbox Hacks Your Mac

#339

Post by microtonal »

chris_7 wrote: post #298
lucb1e wrote: post #246

Earlier quoted context omitted.

There is a difference between having all my files and being able to access all my files via a client. 1) My files are not on their service and thus not available at their discretion; they would first have to be uploaded. 2) With that logic all applications "have" all my files, but you bet I'd find it weird if I caught Libreoffice uploading files of interest to a service of theirs. That said, I do see your point. Most…

> 2) With that logic all applications "have" all my files, but you bet I'd find it weird if I caught Libreoffice uploading files of interest to a service of theirs. On macOS this is not true though, for well-behaved document-based apps! Sandboxing prevents access to anything you haven't explicitly granted access to. I don't know if Libreoffice implements it correctly, though.

And before someone says that this is not feasible for a Dropbox-like application: OneDrive is distributed via the App Store (with its sandboxing requirements).

Re: How Dropbox Hacks Your Mac

#340

Post by tigershark »

Kadin wrote: post #180
0x0 wrote: post #96

Earlier quoted context omitted.

No respectable package would put up a fake sudo prompt only to stash away your password for later use.

It's a good thing Dropbox isn't doing that, then.

Then please explain how it manages to set the accessibility privilege at every login after the user explicitly revokes it. I can see only two options:

1) the Dropbox client stores the password and uses it to hack the accesses db at every login.

2) the Dropbox client runs as root and does the same thing.

Both options are simply terrible from a security point of view

Post reply on HN