Dropbox Attempts To Kill Open Source Project • Hacker News Board

Re: Dropbox Attempts To Kill Open Source Project

#191

Post by kragen » Mon, Apr 25, 2011, 11:13 PM UTC

crocowhile wrote: post #140

kragen wrote: post #108

Earlier quoted context omitted.

AIM used to ask for a cryptographic checksum of a randomly chosen byte range of the AIM executable. The Gaim (now Pidgin) developers had to set up a server that would return checksums on demand. This doesn't meet your requirement of the verifier needing a small key. Given that Dropbox apparently has no qualms about perjuring themselves in order to stop Dropship (or, as discussed in an earlier thread, lying about thei…

caveat utilitor.

Thanks, fixed. My acquaintance with Latin is mostly by way of Spanish, where it is utilisador (well, in normal speech, usuario.)

Re: Dropbox Attempts To Kill Open Source Project

#192

Post by ugh » Mon, Apr 25, 2011, 11:13 PM UTC

mtogo wrote: post #61

arashf wrote: post #21

This is Arash from Dropbox. We removed the ability to share the project source code because it enables communications with our servers in a manner that is a violation of our Terms of Service. By our TOS, we reserve the right to terminate the account of users in this case. However, we chose to remove access to the file instead of terminating the account of the user. We recently built a tool that allows us to ban links…

You do realize that Dropbox submitted the DMCA request under penalty of perjury, and that if it was in fact incorrect Dropbox has perjured themselves?

Dropbox did not send a takedown request. They (erroneously) claimed they had received one from a third party which is not perjury.

Re: Dropbox Attempts To Kill Open Source Project

#193

Post by rorrr » Mon, Apr 25, 2011, 11:16 PM UTC

arashf wrote: post #138

marshray wrote: post #130

Earlier quoted context omitted.

Help me, I'm trying to get my head around this. You developed a file sharing system that allows anyone to obtain the full contents of a file by simply knowing its hash? Then when developers make tools to allow using this for simple cross-account file transfer you send DMCA takedown notices, claiming you are the rightful copyright holder of their code, to places like GitHub? You seem to equate other file transfer serv…

No DMCA takedown requests were sent to GitHub. We simply nicely asked the author of Dropship to take down the link and he fully understood our position and took the code down. The only erroneous use of DMCA was when we attempted to take down the link on Dropbox, which was an entirely honest mistake.

I'm pretty sure sending fake DMCA requests is illegal, and it doesn't matter if it's a mistake.

Re: Dropbox Attempts To Kill Open Source Project

#194

Post by fragmede » Mon, Apr 25, 2011, 11:26 PM UTC

ZackOfAllTrades wrote: post #27

arashf wrote: post #21

This is Arash from Dropbox. We removed the ability to share the project source code because it enables communications with our servers in a manner that is a violation of our Terms of Service. By our TOS, we reserve the right to terminate the account of users in this case. However, we chose to remove access to the file instead of terminating the account of the user. We recently built a tool that allows us to ban links…

Best thing you can do now: offer the dropship guy a job. He knows your product well enough to "break" it and he has the motivation to create something strong enough that it is causing a fuss. Learn from Geohot. Don't scare away people who want to play with and extend your product.

The original dropship guy isn't the one causing the fuss.

Re: Dropbox Attempts To Kill Open Source Project

#195

Post by [deleted] » Mon, Apr 25, 2011, 11:26 PM UTC

dhouston wrote: post #106

drew from dropbox here. i hope you guys can give us the benefit of the doubt: when something pops up that encourages people to turn dropbox into the next rapidshare or equivalent (the title on HN was suggesting it could be the successor to torrents), you can imagine how that could ruin the service for everyone -- illegal file sharing has never been permitted and we take great pains to keep it off of dropbox. the inte…

[deleted]

Re: Dropbox Attempts To Kill Open Source Project

#196

Post by [deleted] » Mon, Apr 25, 2011, 11:27 PM UTC

[deleted]

Re: Dropbox Attempts To Kill Open Source Project

#197

Post by trotsky » Mon, Apr 25, 2011, 11:27 PM UTC

dhouston wrote: post #106

drew from dropbox here. i hope you guys can give us the benefit of the doubt: when something pops up that encourages people to turn dropbox into the next rapidshare or equivalent (the title on HN was suggesting it could be the successor to torrents), you can imagine how that could ruin the service for everyone -- illegal file sharing has never been permitted and we take great pains to keep it off of dropbox. the inte…

we've fixed the deduplication behavior serverside to prevent "injection" of files you don't actually have, for a variety of reasons

I think this was a good call, and not just for the piracy issues but for the substantial information disclosure and possible misappropriation of sensitive documents that it could have facilitated. This is something that's been on my radar for some months, and frankly seemed like a significant reason to not trust dropbox with anything that wasn't effectively public.

So I'd consider the event a net positive for your firm and customers. I might consider trying to get out in front of any negative publicity that's going on here by publicly thanking the programmers and researchers that have brought these risks to light in the past month paying a few bug bounties to them. A few bounties similar in size to the ones the mozilla and chromium projects pay out certainly wouldn't break the bank, and might do something for public opinion. Not to mention the benefits of an ongoing program - people might be more inclined to contact you first instead of immediately going public with future issues.

Re: Dropbox Attempts To Kill Open Source Project

#198

Post by originalgeek » Mon, Apr 25, 2011, 11:29 PM UTC

tptacek wrote: post #41

Consider that maybe what's happening here is boring. Recognize that we all have a cognitive bias towards narratives, and especially interesting narratives. The discussion on this story is trying to build a narrative about Dropbox vs. open source developers. The real story is probably not that interesting. The CTO of a service as technically interesting as Dropbox certainly knows that he can't prevent the disclosure o…

I'm seeing a much different narrative, which is very interesting to me. It is the continuing narrative about Dropbox and security. Last week it was the revelation that their crypto is backdoored. This week it is the revelation that their devs are piggybacking ACL functionality onto their dedupe hashing algorithm. I'm seeing a pattern here, that your files are nowhere near as safe on Dropbox as you think they are, nor as safe as Dropbox represents them to be.

Wonder what the next headline is going to be.

Re: Dropbox Attempts To Kill Open Source Project

#199

Post by rryan » Mon, Apr 25, 2011, 11:33 PM UTC

Anyone saying that Dropship has legal uses is wrong -- you're stealing from Dropbox by using it whether you're sharing your academic, public-domain dataset or your pirated movie.

Dropship sidesteps the TOS of Dropbox by letting users get unlimited sharing bandwidth. Dropbox itself has a share feature which uses the exact technical mechanism by which Dropship works, except it also puts rate limits and caps on sharing.

OT: This is probably the worst comments thread I've ever read on HN. It's like an echo-chamber telephone game. Jeez.

Re: Dropbox Attempts To Kill Open Source Project

#200

Post by trotsky » Mon, Apr 25, 2011, 11:39 PM UTC

gergles wrote: post #150

mrud wrote: post #141

Earlier quoted context omitted.

> we've fixed the deduplication behavior serverside to prevent "injection" of files you don't actually have, for a variety of reasons.) Already done.

Doesn't seem to be done, as I just used the code in question to get the example trailer and I did not have the file in advance.

This is one of the more interesting comments in this thread. Can anyone confirm it still works?

EDIT: I get the following error:

[xxx@xxx laanwj-dropship-464e1c4]$ ./dropship examples/sintel_trailer-1080p.mp4.json ('Oops, blocks are not known: %s', ['lykR7INbdxXNk04IpJUxTvO97GeETwAbobol2283eqY', 'ciZ4YYqkiA9VssSpfmcagRJaYMtD3wNqZ4NTeV9BvOc', '7qe_U9KLL8t1RRH3K01PdTxnEGCnm1nP8S30ZkXK0KI', 'cPJPJ_uch8hJFhKaEeXufETDZ-q6Fqz1cibxoYwL8G8'])