Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox on Mac now updates itself with a process in background

dropbox.com

Post reply on HN
Print view View original

61–70 of 93 posts

Re: Dropbox on Mac now updates itself with a process in background

#61

Post by acdha »

samastur wrote: post #21
threeseed wrote: post #13

Earlier quoted context omitted.

Or Office, Creative Suite or dozens of other major applications.

Microsoft Office does not autoupdate. It notifies you of an update, but you have to confirm the transfer and installation. At least that's how it works on my Mac.

That's because they don't have a robust self-update feature for the Microsoft Updater app. They added an automatic update mode and it appears to be on by default now, which is probably good given the number of exploits Office has had over the years.

Re: Dropbox on Mac now updates itself with a process in background

#62

Post by acdha »

konceptz wrote: post #6
gkoberger wrote: post #5

Earlier quoted context omitted.

(Assuming this is true....) Because if they're stuck supporting old versions of Dropbox, they're miserable (having to support dozens of versions) and you're miserable (things start to break). I understand why people would be worried about Dropbox auto-downloading software, but honestly... if you're the kind of person worried about the security around Dropbox auto-updating the same way every app on your phone does, yo…

Good points. Though this is not a phone app and Dropbox does have a history of mistakes causing data loss. I assume it's true because: "If you don’t want Dropbox Update to run on your computer, you can uninstall the Dropbox application. You can still access your files on dropbox.com and using the Dropbox mobile apps."

> Though this is not a phone app and Dropbox does have a history of mistakes causing data loss.

A history of random forum posters making huge assertions which inevitably turn out to be significantly overstated. It's trendy in certain circles to complain about Dropbox and the hype factor makes it easy to forget that for every person repeating anecdotes on HN there are a million normal people who use the service without issues.

Re: Dropbox on Mac now updates itself with a process in background

#63

Post by revmoo »

larsnystrom wrote: post #26

Of course I see the possibility of harm here, but really, isn't automatic updates pretty standard by now? I mean, it's got to be better than letting a large swath of users run old versions of the software because they don't know how/don't care to update it. I mean, isn't that the more severe security issue at hand? And if you're conscious enough about your digital security that you really do mind Dropbox updating its…

> I mean, it's got to be better than letting a large swath of users run old versions of the software because they don't know how/don't care to update it.

Dead wrong. A monoculture is much, much worse for global infosec.

Re: Dropbox on Mac now updates itself with a process in background

#64

Post by aroch »

microtonal wrote: post #45
jhasse wrote: post #33

Earlier quoted context omitted.

> Both of them doing that in mandatory fashion is unacceptable. Don't install their apps then. There are lots of alternatives out there.

So, what is a good alternative to Dropbox that supports LAN sync, block-level uploads [1], revisions, and that most of my colleagues, friends and friends have or can set up? If you actually look at the competition, most of them do not have LAN sync or block sync (OneDrive, Google Drive), they do not have proper support for revisions (Resilio Sync), or are hard to set up for most people (Syncthing). [1] So that if I c…

Seafile works pretty well, they install a client a lot like the Dropbox client and sync away. And it is even mostly open source

seafile.com

https://github.com/haiwen/seafile

Re: Dropbox on Mac now updates itself with a process in background

#65

Post by revmoo »

Twice I've seen Dropbox delete data. It actually nuked our honeymoon photos. The logs showed my wife logging in during a holiday while she was with me and deleting everything. Then months later I found a note from Dropbox in my spam folder that they were deleting MY account and it was months old. DO NOT trust Dropbox with your data. The company is run by absolute clowns. I'd especially not hand over the keys to my computer to them.

Re: Dropbox on Mac now updates itself with a process in background

#66

Post by angry_octet »

eps wrote: post #16
cdransf wrote: post #7

This doesn't seem any worse than Chrome continually updating itself.

Both of them doing that in mandatory fashion is unacceptable. I might be OK with running this bit of their code on my computer, but it's not an open bar for dropping anything executable onto my machine at will.

It is pretty easy to prevent chrome auto-updates with a firewall rule and by configuration (https://www.chromium.org/administrators/turning-off-auto-upd...).

But unless you audited the chrome code (with a team of 1000 experts) you have already trusted them, both to write quality code and to prevent malicious code sneaking in. Why not trust them to patch your browser against malware?

Feel free to contribute to ungoogled chromium: https://github.com/Eloston/ungoogled-chromium

Re: Dropbox on Mac now updates itself with a process in background

#67

Post by angry_octet »

natch wrote: post #41
victorhooi wrote: post #39

Earlier quoted context omitted.

If it's unacceptable, why would you use the Google Chrome browser? It's open-source (Chromium project) - just compile it yourself? Once you've run somebody else's binary, you're already conferring significant trust on them. And I might be biased, but the Chrome team has shown themselves to be very vigilant with security, and generally on-the-ball on all of these things. (Memory issues aside...although I'm not going t…

>Once you've run somebody else's binary, you're already conferring significant trust on them. This is the "you agreed to a date, that means you agreed to go all the way" argument. Even when a someone extends trust or tentative trust, that doesn't mean they should be expected to give up the right to maintain control of that choice at each successive moment in time. EFF strongly discourages auto updates that can't be t…

Chrome updates can be turned off. Easily.

Re: Dropbox on Mac now updates itself with a process in background

#68

Post by angry_octet »

saurik wrote: post #31
derefr wrote: post #24

Earlier quoted context omitted.

Chrome is a program that has standalone functionality where the program would still do useful work without updating. The Dropbox sync service, on the other hand, is literally just the client half of Dropbox's own proprietary backend. If Dropbox makes an ABI-incompatible change to their sync protocol on the server side, the non-updated client will just break until you update. Wanting to disable updates to such a servi…

Websites are sandboxed sufficiently that they aren't supposed to be able to do anything crazy to my computer or access any of my data as new versions come out: the same is not true of Dropbox. I don't want some system automatically upgrading the code running on my computer. I want to be able to download new code for my computer and choose to install it. This means that if there's a bug introduced by the new software…

The source code is available and GPLed. Patch it if you want.

https://www.dropbox.com/help/247

Re: Dropbox on Mac now updates itself with a process in background

#69

Post by angry_octet »

izacus wrote: post #52
nkristoffersen wrote: post #17

Earlier quoted context omitted.

That is funny to me because I assume my phone is much more secure (with strict sandboxing) compared to my desktop.

Except that each of those sandboxed apps keeps uploading your behavioural and private data pretty much constantly with no ability for you to limit or stop it like you can on the deskop :)

And you can never downgrade to an old version. Or add a firewall that will block ads. Or disable javascript selectively. Or control when programs can run. Or know whether they use crypto safely. Or have any control over when your phone will get patched for the 200-day level 10 RCE bug.

Now I just want to smash my phone with a hammer. Smash it into tiny tiny pieces.

Re: Dropbox on Mac now updates itself with a process in background

#70

Post by brians »

dexcs wrote: post #20

I wonder how they did the auto-update that brought that feature to me... I have a pretty shitty internet connection here and i recognized the dropbox updater sucking up my bandwidth yesterday... I've not triggered any manual update...

They've had an auto-updater for many years. They've now separated it into a separate process, so the Dropbox sync daemon doesn't have to have privileges to self-modify.
Post reply on HN