It's a novel exploit of deduplication, but I don't see how it's practically any better than moving a file into the /Public directory and handing them a URL.
Dropship — successor to torrents?
31–40 of 74 posts
Re: Dropship — successor to torrents?
#32Here's a mirror: https://github.com/steipete/dropship
And here's a tar mirror on Dropbox: http://dl.dropbox.com/u/7562426/laanwj-dropship-464e1c4.tar....
Re: Dropship — successor to torrents?
#33It's centralized, not distributed. You are at the whim of dropbox. This is not a successor to torrents at all.
Re: Dropship — successor to torrents?
#34Here's a mirror: https://github.com/steipete/dropship
Thanks a lot! How'd you manage to grab it? Your post is from just one hour ago, but it was already gone when I checked a few hours ago.
Re: Dropship — successor to torrents?
#35It's a novel exploit of deduplication, but I don't see how it's practically any better than moving a file into the /Public directory and handing them a URL.
In theory, developing this a bit more would lead to searchable directories of files and an easy way to retrieve them, very similar to a torrent tracker.
That has significant benefit over shared files and I have to think would scare the heck out of dropbox because of the ire it might bring upon them. This would have to be a worst nightmare for them. Although removing deduplication would solve it for them (with significant increase in what has to be stored).
Re: Dropship — successor to torrents?
#36Earlier quoted context omitted.
Does that mean that the current protocol allows users to steal arbitrary files given a hash? For example if some web site charges per download of a file, but still has the hash posted publicly, you can try to "steal" it from someone who has it stored privately in Dropbox? IOW, the file hash is equivalent to your account login/password combo [restricted to any given file]?
As far as I understand the original posting, you can download any file from Dropbox's servers if you know its Dropbox hash, which apparently is a sequence of SHA256 hashes of 4MB blocks. If you have a sub-4MB sensitive file, and you publish its SHA256, and the Dropbox protocol applies the hash function in the same way as file hashing tools (e.g. doesn't include a tag meaning "this hash is computed particularly for Dr…
Just read the reappeared sourcecode (assuming it works as advertised): The hash is an SHA256 of pure 4MB blocks in the input file. They add no message type information which could prevent mixups between Dropbox-deduplication hashes and hashes computed for other purposes.
The following dropship file was assembled using only shasum, ls and vi:
{"blocks": ["f3f754a5dcd93f271ad013a5ee84f495a36da84f152e0a1fec4646345b0c10d6"], "name": "ostseestrand.jpg", "size": 514779}
Re: Dropship — successor to torrents?
#37It's a novel exploit of deduplication, but I don't see how it's practically any better than moving a file into the /Public directory and handing them a URL.
Consider
1) User buys a file from the rights owner and explorers it into his Dropbox
2) User obtains a blockwise hash of the file and runs dropship on it
3) User obtains a public URL from somebody who has the file and downloads the file from the Dropbox web server
The point is that the Dropbox server cannot distinguish 1 from 2, but both from 3. Therefore, 2 should be more robust against takedown notices than 3.
Re: Dropship — successor to torrents?
#38Earlier quoted context omitted.
I'm pretty sure I've seen stuff suggesting that Dropbox occasionally purges copyrighted files from its system (which is made super-easy by the hash fingerprinting system that it uses to deduplicate storage) so I agree that this is not likely to meet most people's use case for torrents; i.e. stealing copyrighted music and films. I wonder why the github repo has been taken down.
How do they decide which copyrighted content to delete? The files in the Dropbox are by default not public. Merely having copyrighted files in your Dropbox is certainly no violation of copyright law. At which point does it become illegal? Is sharing it with one or two people ok? I would think that even putting it in your public folder is not necessarily illegal: What if you don't share the link publicly (or only with…
I have copyrighted material in my Dropbox right now. It's copyrighted by me and my business partners. We're making a film and the material on our dropbox will eventually make it into the public eye.
We're not Big Media people, but what about other content creators? Especially musical collaborators...
Re: Dropship — successor to torrents?
#39Earlier quoted context omitted.
Arash (the CTO) asked me to, in a really civil way. So I decided to respect his wish and take down the repository. Myself, I really regarded dropship as a nice feature. As Dropbox had implemented the great idea of putting all humanity's data in one big hash-addressable vat, sharing is a logical extension. If you would cache the popular blocks locally (dropbox already does this in a way with LAN P2P), global data dist…
I think that's a very poor business choice by Arash. Third party developers need freedom.
They don't want their brand associated with piracy. According to the developer, they have resolved the issue in a civil way. I don't see a problem here.
Re: Dropship — successor to torrents?
#40I think the real successor to torrents was actually its predecessor, and that's binary usenet files. Download speeds are bottleknecked at your own downstream, most providers have SSL support for encryption of everything you download, and there's a plethora of content. People don't really know about it though