31–40 of 136 posts
The only thing to see here is that DropBox is potentially opening themselves up to a vulnerability, would be interesting to see if GET file://etc/passwd worked...
I would wager that they're opening it in order to generate a thumb or preview, or maybe for search indexing, and libreoffice is a good way to achieve this on linux - particularly if they're only opening it once, as they probably use the hash of the file. We do exactly this on our eCommerce platform, before wanging stuff into s3 or glacier and just keeping a reference kicking around. On the other hand, you have just d…
This seems unsafe; if I understand what this person has done, he'd essentially be coercing Dropbox's backend services to open arbitrary links on his behalf. That's a very dangerous capability to expose to adversaries.
Much ado about nothing. If you don't want your cloud storage provider reading the data you give them, then _encrypt_ that data _before_ you upload it.
I would wager that they're opening it in order to generate a thumb or preview, or maybe for search indexing, and libreoffice is a good way to achieve this on linux - particularly if they're only opening it once, as they probably use the hash of the file. We do exactly this on our eCommerce platform, before wanging stuff into s3 or glacier and just keeping a reference kicking around. On the other hand, you have just d…
This seems unsafe; if I understand what this person has done, he'd essentially be coercing Dropbox's backend services to open arbitrary links on his behalf. That's a very dangerous capability to expose to adversaries.
Did you bother asking Dropbox what's going on? This kinda reads like an ad for HoneyDocs...
Be concerned with the content and only the content. If the article has it, it's legit.
Earlier quoted context omitted.
This seems unsafe; if I understand what this person has done, he'd essentially be coercing Dropbox's backend services to open arbitrary links on his behalf. That's a very dangerous capability to expose to adversaries.
to be fair, it's possible that dropbox understands this and has taken steps to sandbox and isolate the process that does this fetching from the rest of their internal infrastructure. if this is done for the purposes of generating thumbnails/online previews, and the .doc includes external resources, what other choice do they have but to fetch it?
They could not fetch it and have a little blank bit in the thumbnail.
Chances are they're using a library they didn't develop and did not think of the possibility of external resources being loaded.
Edit: The most secure way I can think to handle preview generation is to have a virtual machine firewalled from the internet that previews a single document and is then reverted.
Did you bother asking Dropbox what's going on? This kinda reads like an ad for HoneyDocs...
I hate it whenever an article mentions a service or drops an affiliate link and someone's verdict is that the article looks like advertising. Do you prefer your reading content to be devoid of mentioning any products or brands? Should bloggers never make a dime off affiliate links? Be concerned with the content and only the content. If the article has it, it's legit.
I would wager that they're opening it in order to generate a thumb or preview, or maybe for search indexing, and libreoffice is a good way to achieve this on linux - particularly if they're only opening it once, as they probably use the hash of the file. We do exactly this on our eCommerce platform, before wanging stuff into s3 or glacier and just keeping a reference kicking around. On the other hand, you have just d…
This seems unsafe; if I understand what this person has done, he'd essentially be coercing Dropbox's backend services to open arbitrary links on his behalf. That's a very dangerous capability to expose to adversaries.