Live data from Hacker News

Dropbox: The Inside Story Of Tech's Hottest Startup

forbes.com

61–70 of 109 posts

Re: Dropbox: The Inside Story Of Tech's Hottest Startup

#61
post #9

Then come Chris, Jason and Joe (who has a Dropbox tattoo on his arm because he feels “Drew is changing the world”), more MIT brothers aiming to live a California dream they all imagined back in Cambridge as “billionaires, bottles and babes.” Eww, that's offputting.

Might as well say vast swaths of all young men are off-putting. These are pretty standard motivations (though usually not stated so bluntly + publicly).

Re: Dropbox: The Inside Story Of Tech's Hottest Startup

#62
post #9

Then come Chris, Jason and Joe (who has a Dropbox tattoo on his arm because he feels “Drew is changing the world”), more MIT brothers aiming to live a California dream they all imagined back in Cambridge as “billionaires, bottles and babes.” Eww, that's offputting.

It was almost certainly a joke. Avoid sarcasm when talking to journalists; some quotes, out of context, are too good to pass up.

wildly out of context (comically so if you know me IRL) -- oh well :)

Re: Dropbox: The Inside Story Of Tech's Hottest Startup

#63
post #56

Earlier quoted context omitted.

They are injecting code into running Finder process? Hmmm, so they figured one of the jump instructions target address in Finder process ( for a function invocation, most likely the code to show the pop-up), and changed that location to jump to a different address where they injected their code? Don't you need root privileges to muck with Finder's process space? I see dropbox process running with non-privileged uid.…

A process can't change the address space of another process, period. Even if one is a root process. Separation of address spaces is a basic security service provided by the operating system. So I'm also puzzled how they are able to modify memory in Finder's address space. The closest thing I can think of is that Finder executes arbitrary processes on behalf of the user. That is, when I double click on something, Find…

Not true, at least on OS X:

http://www.slideshare.net/rentzsch/dynamic-overriding

https://github.com/rentzsch/mach_star

I don't know if this is how Dropbox works, but it seems likely.

Re: Dropbox: The Inside Story Of Tech's Hottest Startup

#65
I really like Dropbox. I wish they were actually encrypting users' data in a manner like they originally advertised they were. This is my only concern with using their service.

I understand that they wish to save space with deduplication and that this requires them to look at your files a fair bit prior to encryption. I just prefer they let users opt into using their own private keys.

Re: Dropbox: The Inside Story Of Tech's Hottest Startup

#68
post #56

Earlier quoted context omitted.

A process can't change the address space of another process, period. Even if one is a root process. Separation of address spaces is a basic security service provided by the operating system. So I'm also puzzled how they are able to modify memory in Finder's address space. The closest thing I can think of is that Finder executes arbitrary processes on behalf of the user. That is, when I double click on something, Find…

Not true, at least on OS X: http://www.slideshare.net/rentzsch/dynamic-overriding https://github.com/rentzsch/mach_star I don't know if this is how Dropbox works, but it seems likely.

The first chunk of those slides talk about library hijacking. Say, you define your own version of malloc, make sure the application links to your version of malloc, and play your tricks from there. Process isolation has not been violated.

The last five slides seem to be doing this: http://www.blackhat.com/presentations/bh-usa-09/DAIZOVI/BHUS...

Slide 4 is the difference: OSX is BSD running on top of Mach. So these techniques use the Mach layer to get around basic process protection. This is terribly insecure.

Re: Dropbox: The Inside Story Of Tech's Hottest Startup

#69
post #68

Earlier quoted context omitted.

Not true, at least on OS X: http://www.slideshare.net/rentzsch/dynamic-overriding https://github.com/rentzsch/mach_star I don't know if this is how Dropbox works, but it seems likely.

The first chunk of those slides talk about library hijacking. Say, you define your own version of malloc, make sure the application links to your version of malloc, and play your tricks from there. Process isolation has not been violated. The last five slides seem to be doing this: http://www.blackhat.com/presentations/bh-usa-09/DAIZOVI/BHUS... Slide 4 is the difference: OSX is BSD running on top of Mach. So these te…

Yeah, the injection stuff was what I was referring to.

Apple apparently changed OS X in 10.4.4 to only allow root or procmod group to do this http://guiheneuf.org/mach%20inject%20for%20intel.html

Re: Dropbox: The Inside Story Of Tech's Hottest Startup

#70
post #15

Jobs never changed his interpretation of things. He did in fact feel cloud storage was a feature and not a product, and that's exactly what iCloud is. For Apple it's a feature that will hopefully tie people in to their iOS devices. And with the likelihood that over time they will offer greater amounts of storage for free or a minimum payment, that's not good for Dropbox. I like Dropbox, I use it almost daily. But so…

I love dropbox - and I just recently switched to a paid account. I have gotten my whole team on it - we have a virtual team of 10 consultants all working from our homes. Dropbox is key to keeping everything between us shared. We haven't yet gone for the Team account - but we will be doing so shortly. It is expensive - but the simplicity and value it offers it (so far) unmatched.

Have they improved on their lack of security yet? I'd recommend using wuala for work documents as they offer client side encryption, if you don't mind having java around.
Post reply on HN