Dropship — successor to torrents? • Hacker News Board

Re: Dropship — successor to torrents?

#11

Post by alex1 » Sun, Apr 24, 2011, 10:58 AM UTC

limmeau wrote: post #9

tlrobinson wrote: post #6

From the README, in case it wasn't obvious: "These utilities make use of the deduplication scheme of Dropbox__ to allow for "teleporting" files into your Dropbox account given only a list of hashes, provided of course that the files already exist on their servers. This enables arbitrary, anonymous transfers of files between Dropbox accounts." Between this and the minor information leakage issue I suspect Dropbox will…

Napkin-cryptographic way how Dropbox could fix this while still getting full deduplication: currently, when the client discovers that a file has been added locally, it sends hashes of 4MB blocks, and the server considers the file added. Additional measure at that point: the server could challenge the client to provide the values of bytes at a couple of arbitrarily chosen byte offsets of the original file. (Could prec…

What would stop pirates from querying each other (maybe on some P2P network) for those random bytes?

Client A wants the file that Client B has so when Dropbox asks Client A for some random offset, Client A asks Client B in the background and relays the result to Dropbox.

It really depends on how far pirates would be willing to go.

Re: Dropship — successor to torrents?

#12

Post by ugh » Sun, Apr 24, 2011, 11:22 AM UTC

dbuxton wrote: post #10

schrototo wrote: post #3

This isn't even remotely similar to bittorrent, it's more akin to rapidshare et al. You're completely at the whim of a 3rd party, Dropbox. And I'm pretty sure something like this would violate whatever contract you agree to when signing up. So no, not a successor to torrents.

I'm pretty sure I've seen stuff suggesting that Dropbox occasionally purges copyrighted files from its system (which is made super-easy by the hash fingerprinting system that it uses to deduplicate storage) so I agree that this is not likely to meet most people's use case for torrents; i.e. stealing copyrighted music and films. I wonder why the github repo has been taken down.

How do they decide which copyrighted content to delete? The files in the Dropbox are by default not public. Merely having copyrighted files in your Dropbox is certainly no violation of copyright law.

At which point does it become illegal? Is sharing it with one or two people ok? I would think that even putting it in your public folder is not necessarily illegal: What if you don't share the link publicly (or only with one or two people)?

Services like Rapidshare thrive on those ambiguities. They let you upload any file and give you a link, only after this link really becomes public will they take down copyrighted content (which introduces a time delay).

I have actually never seen that happen with Dropbox links (which, I think, is the right strategy for them: It would be bad for their brand if they were to become "that piracy website"), so they must be doing something different.

Re: Dropship — successor to torrents?

#13

Post by ZoFreX » Sun, Apr 24, 2011, 11:27 AM UTC

ugh wrote: post #12

dbuxton wrote: post #10

Earlier quoted context omitted.

I'm pretty sure I've seen stuff suggesting that Dropbox occasionally purges copyrighted files from its system (which is made super-easy by the hash fingerprinting system that it uses to deduplicate storage) so I agree that this is not likely to meet most people's use case for torrents; i.e. stealing copyrighted music and films. I wonder why the github repo has been taken down.

How do they decide which copyrighted content to delete? The files in the Dropbox are by default not public. Merely having copyrighted files in your Dropbox is certainly no violation of copyright law. At which point does it become illegal? Is sharing it with one or two people ok? I would think that even putting it in your public folder is not necessarily illegal: What if you don't share the link publicly (or only with…

> Merely having copyrighted files in your Dropbox is certainly no violation of copyright law.

Actually, it could be. Copyright means exactly that: the right to copy.

Re: Dropship — successor to torrents?

#14

Post by limmeau » Sun, Apr 24, 2011, 11:28 AM UTC

alex1 wrote: post #11

limmeau wrote: post #9

Earlier quoted context omitted.

Napkin-cryptographic way how Dropbox could fix this while still getting full deduplication: currently, when the client discovers that a file has been added locally, it sends hashes of 4MB blocks, and the server considers the file added. Additional measure at that point: the server could challenge the client to provide the values of bytes at a couple of arbitrarily chosen byte offsets of the original file. (Could prec…

What would stop pirates from querying each other (maybe on some P2P network) for those random bytes? Client A wants the file that Client B has so when Dropbox asks Client A for some random offset, Client A asks Client B in the background and relays the result to Dropbox. It really depends on how far pirates would be willing to go.

Of course, Dropbox can't prevent people from sharing content out of band. But if Client A and Client B are offering arbitrary byte ranges to complete strangers, they are effectively playing BitTorrent again.

Re: Dropship — successor to torrents?

#15

Post by wladimir » Sun, Apr 24, 2011, 11:30 AM UTC

dbuxton wrote: post #10

schrototo wrote: post #3

This isn't even remotely similar to bittorrent, it's more akin to rapidshare et al. You're completely at the whim of a 3rd party, Dropbox. And I'm pretty sure something like this would violate whatever contract you agree to when signing up. So no, not a successor to torrents.

I'm pretty sure I've seen stuff suggesting that Dropbox occasionally purges copyrighted files from its system (which is made super-easy by the hash fingerprinting system that it uses to deduplicate storage) so I agree that this is not likely to meet most people's use case for torrents; i.e. stealing copyrighted music and films. I wonder why the github repo has been taken down.

Arash (the CTO) asked me to, in a really civil way. So I decided to respect his wish and take down the repository.

Myself, I really regarded dropship as a nice feature. As Dropbox had implemented the great idea of putting all humanity's data in one big hash-addressable vat, sharing is a logical extension. If you would cache the popular blocks locally (dropbox already does this in a way with LAN P2P), global data distribution would be pretty much a solved problem.

Obviously, this affects legal and illegal files in the same way. It's really a shame that people are still so obsessed with the illegal applications, that they become blinded to how useful this is for legal ones.

Re: Dropship — successor to torrents?

#16

Post by codeflo » Sun, Apr 24, 2011, 11:38 AM UTC

dbuxton wrote: post #10

schrototo wrote: post #3

This isn't even remotely similar to bittorrent, it's more akin to rapidshare et al. You're completely at the whim of a 3rd party, Dropbox. And I'm pretty sure something like this would violate whatever contract you agree to when signing up. So no, not a successor to torrents.

I'm pretty sure I've seen stuff suggesting that Dropbox occasionally purges copyrighted files from its system (which is made super-easy by the hash fingerprinting system that it uses to deduplicate storage) so I agree that this is not likely to meet most people's use case for torrents; i.e. stealing copyrighted music and films. I wonder why the github repo has been taken down.

Can anyone give a reference for this or indicate if it's true? I use Dropbox to backup my purchased music downloads; the thought that when my hard disk crashes, I can't restore them from my Dropbox because they might have been "purged" is rather worrying.

Re: Dropship — successor to torrents?

#17

Post by dchest » Sun, Apr 24, 2011, 11:40 AM UTC

ZoFreX wrote: post #13

ugh wrote: post #12

Earlier quoted context omitted.

How do they decide which copyrighted content to delete? The files in the Dropbox are by default not public. Merely having copyrighted files in your Dropbox is certainly no violation of copyright law. At which point does it become illegal? Is sharing it with one or two people ok? I would think that even putting it in your public folder is not necessarily illegal: What if you don't share the link publicly (or only with…

> Merely having copyrighted files in your Dropbox is certainly no violation of copyright law. Actually, it could be. Copyright means exactly that: the right to copy.

Yes, and having a copy of something doesn't mean that you don't have the right to have this copy.

Re: Dropship — successor to torrents?

#18

Post by ugh » Sun, Apr 24, 2011, 11:49 AM UTC

ZoFreX wrote: post #13

ugh wrote: post #12

Earlier quoted context omitted.

How do they decide which copyrighted content to delete? The files in the Dropbox are by default not public. Merely having copyrighted files in your Dropbox is certainly no violation of copyright law. At which point does it become illegal? Is sharing it with one or two people ok? I would think that even putting it in your public folder is not necessarily illegal: What if you don't share the link publicly (or only with…

> Merely having copyrighted files in your Dropbox is certainly no violation of copyright law. Actually, it could be. Copyright means exactly that: the right to copy.

Copyright law is quite a bit more complicated than that. It's at any rate not only the copyright owner who is allowed to make a copy. You can, for example, rip your CDs and copy those files on your HDD as often as you want.

Re: Dropship — successor to torrents?

#19

Post by 0x0 » Sun, Apr 24, 2011, 12:31 PM UTC

limmeau wrote: post #9

tlrobinson wrote: post #6

From the README, in case it wasn't obvious: "These utilities make use of the deduplication scheme of Dropbox__ to allow for "teleporting" files into your Dropbox account given only a list of hashes, provided of course that the files already exist on their servers. This enables arbitrary, anonymous transfers of files between Dropbox accounts." Between this and the minor information leakage issue I suspect Dropbox will…

Napkin-cryptographic way how Dropbox could fix this while still getting full deduplication: currently, when the client discovers that a file has been added locally, it sends hashes of 4MB blocks, and the server considers the file added. Additional measure at that point: the server could challenge the client to provide the values of bytes at a couple of arbitrarily chosen byte offsets of the original file. (Could prec…

Does that mean that the current protocol allows users to steal arbitrary files given a hash?

For example if some web site charges per download of a file, but still has the hash posted publicly, you can try to "steal" it from someone who has it stored privately in Dropbox?

IOW, the file hash is equivalent to your account login/password combo [restricted to any given file]?

Re: Dropship — successor to torrents?

#20

Post by limmeau » Sun, Apr 24, 2011, 12:42 PM UTC

0x0 wrote: post #19

limmeau wrote: post #9

Earlier quoted context omitted.

Napkin-cryptographic way how Dropbox could fix this while still getting full deduplication: currently, when the client discovers that a file has been added locally, it sends hashes of 4MB blocks, and the server considers the file added. Additional measure at that point: the server could challenge the client to provide the values of bytes at a couple of arbitrarily chosen byte offsets of the original file. (Could prec…

Does that mean that the current protocol allows users to steal arbitrary files given a hash? For example if some web site charges per download of a file, but still has the hash posted publicly, you can try to "steal" it from someone who has it stored privately in Dropbox? IOW, the file hash is equivalent to your account login/password combo [restricted to any given file]?

As far as I understand the original posting, you can download any file from Dropbox's servers if you know its Dropbox hash, which apparently is a sequence of SHA256 hashes of 4MB blocks.

If you have a sub-4MB sensitive file, and you publish its SHA256, and the Dropbox protocol applies the hash function in the same way as file hashing tools (e.g. doesn't include a tag meaning "this hash is computed particularly for Dropbox deduplication" into the SHA computation), yes, then apparently people can download your file.

However, I rarely see SHA256 checksums along with download links; more SHA1 and MD5.