Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox sued for June 19 Authentication Bug

consumeraffairs.com

Post reply on HN
Print view View original

51–60 of 123 posts

Re: Dropbox sued for June 19 Authentication Bug

#51

Post by ssharp »

darklajid wrote: post #34

Disclaimer: Subjective, no offense intended. This is once again proving that, while I understand the language, probably shop the same things, the USA is a strange place for me. This 'just sue' culture seems weird. It seems that the whole point is to run to the court and claim 'He did something wrong. Please spend a lot of time to check that I actually have a point and if I'm lucky, please define a grossly exaggerated…

People and companies, in the United States, and many other common law countries, have certain duties to other people. If McDonald's serves coffee, they have a duty not to serve it so hot and make it so difficult to open that it can spill on you.

That case is just a terrible example of frivolous lawsuits because it had plenty of merit. Actually the vast majority of lawsuits labeled as frivolous, with huge judgement, tend to skim over the details and make it look like the plaintiff hit the lottery with a mild inconvenience: "Oops, she spilled coffee and became a millionaire!"

While our legal system could certainly use a lot of improvements, lawsuits that actually go to trial are being vetted quite a bit.

Re: Dropbox sued for June 19 Authentication Bug

#52

Post by Maxious »

ry0ohki wrote: post #42
tzury wrote: post #37

According to the TOS, which all drop box users claimed of "reading and agreeing with" he's got no case ($100 at most) see https://www.dropbox.com/terms#terms Cloud brings risks, one shall be aware of it, and do the math of advantages/disadvantages. I will keep my dropbox account, despite that incident, and know deep in my heart that such glitch can happen to me as well, no matter how well my develop/test/deploy routi…

I've always wondered if these really work. We all use these EULAs and TOS that essentially say "you can't sue us for anything no matter what!" but I have a feeling that kind of thing doesn't actually hold up in court.

It doesn't that's why they have: > Severability > In the event that any provision of these Terms of Service is held to be invalid or unenforceable, the remaining provisions of these Terms of Service will remain in full force and effect.

In Australia, Europe and the UK, there are laws that make "unfair" clauses unenforceable... where unfair includes all kinds of things you see in every consumer level contract like no liability for death/injury or avoiding delivery with no notice or compensation.

For US examples, see "The Puzzling Persistence of Unenforceable Contract Terms" http://moritzlaw.osu.edu/lawjournal/issues/volume70/number5/...

Re: Dropbox sued for June 19 Authentication Bug

#53

Post by acangiano »

matt1 wrote: post #41
sadlyNess wrote: post #39

Would the "Limitations on Liability" section on their TOS help them in this case? FREE ACCOUNT HOLDERS: YOU AGREE THAT THE AGGREGATE LIABILITY OF DROPBOX TO YOU FOR ANY AND ALL CLAIMS ARISING FROM THE USE OF THE SITE, CONTENT, FILES AND/OR SERVICES IS LIMITED TO TWENTY ($20) U.S. DOLLARS. THE LIMITATIONS OF DAMAGES SET FORTH ABOVE ARE FUNDAMENTAL ELEMENTS OF THE BASIS OF THE BARGAIN BETWEEN DROPBOX AND YOU. PREMIUM A…

I'd love to hear a professional chime in here. Does adding this to your Terms of Service actually have an impact? If the answer is yes, why are the woman and her lawyer suing Dropbox anyway? And if no, why do most Terms of Service include similar wording?

My guess, and IANAL, is that it would hold in many courts, but not in Californian ones. California seems to have little tolerance for contracts that restrict basic freedoms (e.g., non-compete agreements.) In this case the basic freedom is to be compensated according to the tort perpetrated, and not limited to a specified arbitrary amount.

Re: Dropbox sued for June 19 Authentication Bug

#54

Post by edoloughlin »

buro9 wrote: post #50
meow wrote: post #31

I wonder if the developer who caused the bug got fired. As a developer, this is one of the few nightmares I get at night :) (making a small change and bringing every thing down)

Every developer makes mistakes, to err is human. With that understood, systems and processes should be designed to catch the errors early and hopefully long before they reach live. This is the insurance policy that TDD gives you, this is why you make all of those unit tests, functional tests, etc. I wouldn't sack a developer who did this, I'd look at my processes and ask why they didn't catch this. After all, if 1 de…

This is the insurance policy that TDD gives you, this is why you make all of those unit tests, functional tests, etc.

TDD was discussed with Greg Wilson on a recent Stackexchange podcast (http://blog.stackoverflow.com/2011/06/se-podcast-09/) and the (early) evidence seems to be that TDD does not improve quality:

[...] while Test Driven Development is very popular right now, a survey of all of the studies that have been done on TDD have shown that the better the study done, the weaker the signal as to its benefit.

Re: Dropbox sued for June 19 Authentication Bug

#55

Post by DanielBMarkham »

darklajid wrote: post #34

Disclaimer: Subjective, no offense intended. This is once again proving that, while I understand the language, probably shop the same things, the USA is a strange place for me. This 'just sue' culture seems weird. It seems that the whole point is to run to the court and claim 'He did something wrong. Please spend a lot of time to check that I actually have a point and if I'm lucky, please define a grossly exaggerated…

At some point in the last 50 years the US has developed a significant subculture of lawyer-worship. It's not unusual to see commercials hourly on TV asking for people who might have suffered in one way or another to contact a law firm for a lawsuit. Lawyers find "little people" who have been wronged, sue in court, pocket millions, then go on to the next case. Effective lawyers make a killing at this business, and don't be mistaken: it is a business.

The little folks, seeing other people make all the bucks, aren't stupid. They look for ways in which they might have been wronged and contact lawyers. For many, "winning the lottery" and "having a big lawsuit" are the same thing -- a way to easy money. The lawyers are all too willing to play along, setting up mills where good cases are sorted from bad ones. They take part of the profits to advertise for more. It becomes a feedback loop, which is sad, because there are a lot of people who have been really wronged and need legal help.

What we need is tort reform, but every time somebody brings it up they're called either an apologist for big evil corporations or a heartless bastard who could care less for the downtrodden. So the cycle continues.

Re: Dropbox sued for June 19 Authentication Bug

#56

Post by jvandenbroeck »

Interesting, I just had a course in which they say there's a difference between risk for software company's and other company's.

If Toyota makes an error with their gas pedal, massive lawsuit. Bug in Windows? Nobody even thinks about suing Microsoft although it brings countless businesses in danger.

Ok there's a difference, but generally, people expect bugs in software and they don't expect them in other goods. It's a huge market failure which doesn't do software security any good.

Now for Dropbox, I hope this turns out well, I like Dropbox:-) but I don't think suing for bugs is a bad evolution.

Re: Dropbox sued for June 19 Authentication Bug

#57

Post by jvandenbroeck »

random42 wrote: post #11
avree wrote: post #3

This is a ridiculous response, and one which seems very ungrounded in the law. Dropbox made a mistake—a big one. They pushed bad code to production that allowed for unauthenticated account access. But, they're still a startup. There's no SLA. They responded quickly, fixed the bug as soon as they caught it, and have been thorough in investigating any unauthorized access of accounts. Why sue them? It's just going to di…

> This is a ridiculous response, and one which seems very ungrounded in the law. What is the basis of such assertion? Let the courts decide that if the basis is unfounded or not. > But, they're still a startup. This is no excuse, if you charge money for your services AND claim to be military grade secure with respect to data. https://www.dropbox.com/security > There's no SLA. They responded quickly, fixed the bug as…

Idd, being a startup is no excuse, how hard can it be to make a test case which tests if their authentication works?

Re: Dropbox sued for June 19 Authentication Bug

#58

Post by dpatru »

tzury wrote: post #37

According to the TOS, which all drop box users claimed of "reading and agreeing with" he's got no case ($100 at most) see https://www.dropbox.com/terms#terms Cloud brings risks, one shall be aware of it, and do the math of advantages/disadvantages. I will keep my dropbox account, despite that incident, and know deep in my heart that such glitch can happen to me as well, no matter how well my develop/test/deploy routi…

Most people don't read the terms of service, but they do read the marketing copy. If the marketing copy contradicts the terms of service, the contract should be based on the marketing copy. The terms of service should not be a license to make false or misleading marketing claims.

Re: Dropbox sued for June 19 Authentication Bug

#59

Post by ohyes »

darklajid wrote: post #44
tomjen3 wrote: post #40

Earlier quoted context omitted.

>braindead users don't get the concept of 'hot coffee' and it's your fault The coffee was served hotter than it should have been, and wastely hotter than it would have been if it had been taken from the machine at home, it was served in a cup that was so difficult to open that the customer had to put it between her legs, and when the coffee was spilled she suffered 3th degree burns to her crotch. And she only asked t…

Okay, okay. I don't claim to be an expert on that case. But: If you buy coffee, it's hot enough to hurt you (or it's crap. There's a range of temperatures that are decent, and personal factors determine what is deemed too hot as well). I don't buy the 'had to put between the legs to open the cup' thing. In that case don't do it near your private parts, open it properly. Not between your legs, probably sitting in a ca…

It was hot enough to melt her genitals and cause serious disfigurement. If she had spilled it anywhere, she would have been seriously injured...

The coffee was scalding hot. The temperature of the coffee was from a corporate order intended to save a few bucks on having to re-brew coffee. The McDonald's corporation was negligent.

In this case, Dropbox was horribly negligent. Releasing all of the data in my Dropbox folder to everyone is not a 'minor inconvenience'. It is a big fucking deal, particularly if I had no idea it could happen so easily, and I am paying them under the assumption that their service is relatively secure.

Re: Dropbox sued for June 19 Authentication Bug

#60

Post by abrahamsen »

darklajid wrote: post #44
tomjen3 wrote: post #40

Earlier quoted context omitted.

>braindead users don't get the concept of 'hot coffee' and it's your fault The coffee was served hotter than it should have been, and wastely hotter than it would have been if it had been taken from the machine at home, it was served in a cup that was so difficult to open that the customer had to put it between her legs, and when the coffee was spilled she suffered 3th degree burns to her crotch. And she only asked t…

Okay, okay. I don't claim to be an expert on that case. But: If you buy coffee, it's hot enough to hurt you (or it's crap. There's a range of temperatures that are decent, and personal factors determine what is deemed too hot as well). I don't buy the 'had to put between the legs to open the cup' thing. In that case don't do it near your private parts, open it properly. Not between your legs, probably sitting in a ca…

> Which leads to my first post again: A culture of fear for being sued, with damages completely out of proportion [1].

There had been more than 700 previous cases, where McDonald had settled with the victims for a total of more than US$ 500.000, but hadn't changed their practice. The wast majority of the damages in this case was not "compensatory damages", intended to compensate the victim for her injury, but "punitive damages", intended to be large enough that McDonald would change their business practice. The punitive damages were set to be equivalent to two days worth of coffee sold at McDonald.

http://en.wikipedia.org/wiki/Liebeck_v._McDonald%27s_Restaur...

We can argue whether McDonald should be forced by law to lower the serving temperature. A UK court came to the opposite conclusion in a similar case. However, if we accept that as a premise, the size of damages doesn't seem out of line.

Post reply on HN