Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox on Mac now updates itself with a process in background

dropbox.com

Post reply on HN
Print view View original

81–90 of 93 posts

Re: Dropbox on Mac now updates itself with a process in background

#81

Post by jpalomaki »

tajen wrote: post #49
Gaelan wrote: post #11

Ugh. I'm all for calling out Dropbox (or anyone else) when they actually do something wrong, but this is getting ridiculous.

I think the concern might be that we are more and more granting ownership of our machines: If NSA wants to install a spyware on targetted systems, they have a dozen autoupdate channels to do it through now. Which is good because we do nothing wrong. Apart from Youporn, where only one underage model that you didn't know about could lead you to jail. You know, accusations do wonders for your career. Apart from this cat…

Given the amount of vulnerabilities in commonly used applications, they would not need the auto update to infect your computer with malware. Just modify some existing document stored in your computer and wait for you to open it.

And to do that, there's no need to work with Dropbox. Eve could just work her way through your colleagues you are sharing files with to find the weakest link, plant the documents on his computer and wait for them to automatically sync to yours.

Re: Dropbox on Mac now updates itself with a process in background

#82

Post by huhtenberg »

lokedhs wrote: post #56
huhtenberg wrote: post #53

Earlier quoted context omitted.

> You do realise that would probably increase the amount of customer support cases raised, from confused/angry users No, it won't. It's an urban legend. For every support request that cannot be answered from a stock pile of answers, the first reply is "update to the latest version and then come back." and not once did I see anyone ever complain about it (leave alone become angry) in my 20+ years in IT business. Never…

That depends on the industry. I have worked with support for about as long as you, and many clients wants to find a solution that they can use until they upgrade (since the upgrade process can take quite some time if you have lots of dependent software that needs validating).

Sure, there are clients like that and those who can't upgrade due to internal policies, QA restrictions, etc.

Point being is that the extra load from having to deal with clients on outdated versions is insubstantial and it certainly does not justify force-shoveling updates down everyone's throats.

Re: Dropbox on Mac now updates itself with a process in background

#85

Post by natch »

angry_octet wrote: post #67
natch wrote: post #41

Earlier quoted context omitted.

>Once you've run somebody else's binary, you're already conferring significant trust on them. This is the "you agreed to a date, that means you agreed to go all the way" argument. Even when a someone extends trust or tentative trust, that doesn't mean they should be expected to give up the right to maintain control of that choice at each successive moment in time. EFF strongly discourages auto updates that can't be t…

Chrome updates can be turned off. Easily.

Exactly. Dropbox should afford users the same respect.

Re: Dropbox on Mac now updates itself with a process in background

#86

Post by mmjaa »

tajen wrote: post #49
Gaelan wrote: post #11

Ugh. I'm all for calling out Dropbox (or anyone else) when they actually do something wrong, but this is getting ridiculous.

I think the concern might be that we are more and more granting ownership of our machines: If NSA wants to install a spyware on targetted systems, they have a dozen autoupdate channels to do it through now. Which is good because we do nothing wrong. Apart from Youporn, where only one underage model that you didn't know about could lead you to jail. You know, accusations do wonders for your career. Apart from this cat…

>I don't either see what's wrong

What's wrong is that the capability to safely serve and share files over the Internet to people you want to serve, safely and with some modicum of security, is perfectly within the reach of the vendors of Operating Systems.

However, these vendors have fallen asleep at the wheel and are allowing basic system services to be fractured at the base (i.e. in the base OS install), in order that third parties might fill the gap.

This is a heinous state of affairs for anyone thats been paying attention over the years, because there are no good reasons we can't just use our existing computers, and their operating systems, to provide the same kind of user experience as one might obtain with Dropbox, albeit without the creepy commercial-control/exploitation aspect.

I mean, honestly, if folks would just have a way to create their own VPN's out of the box, share the details, and set up a peer network as if it were .. y'know .. a function of the operating system instead of something you learn about from seeing it on a billboard or the back of a bus ..

Re: Dropbox on Mac now updates itself with a process in background

#87

Post by apostacy »

larsnystrom wrote: post #26

Of course I see the possibility of harm here, but really, isn't automatic updates pretty standard by now? I mean, it's got to be better than letting a large swath of users run old versions of the software because they don't know how/don't care to update it. I mean, isn't that the more severe security issue at hand? And if you're conscious enough about your digital security that you really do mind Dropbox updating its…

Because I hate it when features are irreversibly changed, at random. Which is what happens with "evergreen" software. I don't care if it only happens occasionally. Never is better than occasionally.

I want the peace of mind to know that if something stops working, that it's not because of an update.

If you're going to introduce feature regressions, you'd better at least make it easy to undo them.

If you're going to make users update on your schedule, you'd better be really really good at making your updates smooth. Google can almost get away with this, but Dropbox, OneNote, Skype, and especially Firefox have introduced major bugs without telling me.

Firefox is the worst offender, because even if you explicitly disable automatic updates, it will just repeatedly download updater.app anyway. I discovered this when I had to fix something on a 3G cellular connection on a strict deadline. Another morning, I woke up to find a bell icon added[1] next to my clock, with no obvious way to remove it. It brought me back to the bad old days of Windows 98 where drive by installers would just add stuff to your computer. Eventually, I just chflags -R schg /Applications/, and ripped out all of the updater daemons out of frustration, and I'm happier ever since.

The thing I object to the most, is for software you already have installed to have features removed and replaced with a nag to buy back the features you just had before the update. LogMeIn's Hamachi app did that, but thankfully I keep backups. Or, a classic example from a long time ago, was iTunes 4.01, which had an "emergency" update for iTunes 4 that removed the local network music sharing feature. [2]

Think about what's really going on with the updating ecosystem we have. Are you really OK with software like the deceptively named "keystone agent" running as root, that can add and execute data anywhere on your filesystem? Google Drive and Google Earth will try to reinstall it if you remove it, and nag you with deceptive messages about how they need you to authorize superuser access for them so that they can run properly, when in reality they are just adding the updater daemon, which they do not require to function.

After having been burnt by new bugs, and outright dishonesty, I'm very careful now.

[1] http://osxdaily.com/2014/03/30/disable-chrome-notification-b...

[2] https://apple.slashdot.org/story/03/05/27/2114240/apple-upda...

Re: Dropbox on Mac now updates itself with a process in background

#88

Post by gumby »

I don't understand the implementation. They already have a background process running (on my Mac it shows an icon in the menu bar) and that application talks to the network. Why use a second process? I can understand spawning a process to actually do an update once one has been downloaded. So what am I missing?

(and since this is HN: as for the updating, fine. It's no different from visiting a web site and having the pages served by different revisions of the back end, and it's not like it has a complex UI that could cause user confusion. I assume DB doesn't update all that often anyway).

Re: Dropbox on Mac now updates itself with a process in background

#89

Post by Gaelan »

tajen wrote: post #49
Gaelan wrote: post #11

Ugh. I'm all for calling out Dropbox (or anyone else) when they actually do something wrong, but this is getting ridiculous.

I think the concern might be that we are more and more granting ownership of our machines: If NSA wants to install a spyware on targetted systems, they have a dozen autoupdate channels to do it through now. Which is good because we do nothing wrong. Apart from Youporn, where only one underage model that you didn't know about could lead you to jail. You know, accusations do wonders for your career. Apart from this cat…

Huh, not an unreasonable argument. However:

Dropbox seems to be singled out for doing things like this, despite browsers, Win10, etc.

The updater changes nothing unless someone has done a full audit of the Dropbox binary.

Updater or not, Dropbox/$minitrue can read/write anything you store there. If you have any executables (incl. source code, word docs with macros enabled, git repos via hooks…) in Dropbox, you're pwned as well.

If you don't trust Dropbox, an updater is the least of your concerns.

Re: Dropbox on Mac now updates itself with a process in background

#90

Post by apostacy »

natch wrote: post #41
victorhooi wrote: post #39

Earlier quoted context omitted.

If it's unacceptable, why would you use the Google Chrome browser? It's open-source (Chromium project) - just compile it yourself? Once you've run somebody else's binary, you're already conferring significant trust on them. And I might be biased, but the Chrome team has shown themselves to be very vigilant with security, and generally on-the-ball on all of these things. (Memory issues aside...although I'm not going t…

>Once you've run somebody else's binary, you're already conferring significant trust on them. This is the "you agreed to a date, that means you agreed to go all the way" argument. Even when a someone extends trust or tentative trust, that doesn't mean they should be expected to give up the right to maintain control of that choice at each successive moment in time. EFF strongly discourages auto updates that can't be t…

All you can do is gently request that the google updater deamon (keystone agent) please not update. It is still running. And the way to disable it is very obscure, and no user would be able to discover how to disable it on their own.

If you remove it, and then try to run any Google Software, it will first lie to you and say that it needs you to authenticate so it can "function" properly. If you refuse, it will try to install it's code in ~/Library instead. If you intercept that, it will stop asking and work properly.

Google software does not depend on its updater in any way. There is no technical reason to keep asking you to install it. They just don't respect your agency. And if you say no to root installation, they will settle for just a user installation.

A lot of software that asks for authentication on first run is doing it solely to install it's helpers.

Not just is it creepy asf and wrong, but sometimes features will be removed or changed without my consent.

Software that was free when you downloaded it just got "upgraded" to shareware. Or maybe it just irreversibly converted all of its saved data to the new format that isn't backwards compatible.

You would never have agreed to install that update if you actually knew what it was going to do. That makes it dishonest.

Post reply on HN