Dropbox Attempts To Kill Open Source Project • Hacker News Board

Re: Dropbox Attempts To Kill Open Source Project

#321

Post by jarin » Wed, Apr 27, 2011, 10:51 AM UTC

marshray wrote: post #312

happyfeet wrote: post #265

Earlier quoted context omitted.

I think the comparisons are not correct. Dropbox is a privately held entity and the founders have every right to enforce the ToS and to compare that against Internet itself is not right.

Your logic sounds consistent with plenty of established principles. But keep in mind the US part of the internet is by and large a collection of privately held entities. By your logic, it's completely reasonable for Sen. Lieberman's to place calls to Amazon to suggest websites and services they might want to review for ToS violations and take them down. It cuts both ways dude. One day Dropbox, your ISP, whoever could…

There's a pretty easy solution if that happens. Host your files somewhere else. Your use of Dropbox (and their decision to allow you to use their service) is on a purely voluntary, at-will basis.

Re: Dropbox Attempts To Kill Open Source Project

#322

Post by UnFleshedOne » Wed, Apr 27, 2011, 9:53 PM UTC

bdesimone wrote: post #269

dhouston wrote: post #106

drew from dropbox here. i hope you guys can give us the benefit of the doubt: when something pops up that encourages people to turn dropbox into the next rapidshare or equivalent (the title on HN was suggesting it could be the successor to torrents), you can imagine how that could ruin the service for everyone -- illegal file sharing has never been permitted and we take great pains to keep it off of dropbox. the inte…

I sympathize. But could you please explain how that email was "auto-generated"? I'm trying to give you the benefit of the doubt, I love what dropbox does, I understand the need to protect yourself from people looking to abuse the service, but... come on... was it really autogenerated? I think that is the part that has everyone scratching their heads.

I think they only ever planned to manually remove user's files in the event of receiving a DMCA takedown notice. So they implemented an automatic notification stating that.

Or maybe it was a default option, one of several, and it wasn't changed to something more appropriate.

Re: Dropbox Attempts To Kill Open Source Project

#323

Post by knobst » Wed, Apr 27, 2011, 10:17 PM UTC

speleding wrote: post #306

naz wrote: post #201

Earlier quoted context omitted.

> ... the substantial information disclosure and possible misappropriation of sensitive documents that it could have facilitated They match duplicate files with an SHA256 sum and size in bytes. With those two factors, the probability of a collision is incredibly tiny and impossible to exploit usefully. If you tried a trillion combinations you might find a useless file, but by then you would be detected and banned fro…

It would still allow collision attacks though. There are probably a lot of legal and medical documents (recipes) that only differ in a few words, such as name and date of birth. By trying a bunch of combinations you can test if those documents exist.

The collision attacks outlined above still work, with a regular dropbox account, no dropship needed. You can create 100,000 attack files, and then upload each one. The ones that don't actually transmit bytes show you that the file exists. (EG a highly regular file like some health or banking record...) Its just watching if de-duplication happens or not.

They need to patch that hole, I think by requiring everything to upload, then deduplicate on the server...

Which is another way of saying what speleding points out.