8 ms·

Dropbox is using an unsigned binary to install kernel extensions on your Mac

263 points by tnorthcutt 10y ago

j_s 10y ago
Dropbox has been willing to get their hands dirty in their pursuit of user-friendliness since day one, especially on the Mac¹. Didn't find any examples where they walk it back; usually they stick to their guns with a few minor tweaks (and top-of-HN-discussion PR replies). Dropbox Hasn't Learned Their Lesson https://news.ycombinator.com/item?id=12619722 https://news.ycombinator.com/item?id=12619722 (2016) "You seem to completely miss the point. It's not about the feature itself, it's your way of "hacking" or "injecting" Dropbox features into places the user didn't expect." How Dropbox Hacks Your Mac https://news.ycombinator.com/item?id=12463338 https://news.ycombinator.com/item?id=12463338 (2016) "It's very strange that after I remove Dropbox from the accessibility list you think it's ok to add it back in again." Dropbox accesses all the files in your PC? https://news.ycombinator.com/item?id=9136546 https://news.ycombinator.com/item?id=9136546 (2015) "It does, however, 'QueryBasicFileInformation' and and 'QueryDirectory' when I create a file on my desktop." The Tech Behind Dropbox’s New User Experience on Mobile, Part 2 https://news.ycombinator.com/item?id=8203164 https://news.ycombinator.com/item?id=8203164 https://blogs.msdn.microsoft.com/ieinternals/2014/09/04/caveats-for-authenticode-code-signing/ https://blogs.msdn.microsoft.com/ieinternals/2014/09/04/cave... (2014) "what good is a code-signed executable when that executable can simply download a payload from the internet like this Dropbox installer does" Dropship — successor to torrents? https://news.ycombinator.com/item?id=2478567 https://news.ycombinator.com/item?id=2478567 (2011) "Apparently Dropbox notices they already have that file, and instead of you uploading it they just make it appear in your account." CEO Drew Houston actually did the PR for the cleanup: https://news.ycombinator.com/item?id=2482712 https://news.ycombinator.com/item?id=2482712 ¹ http://mjtsai.com/blog/2011/03/22/disabling-dropboxs-haxie/ http://mjtsai.com/blog/2011/03/22/disabling-dropboxs-haxie/ (2011) "Dropbox injects code into the Finder in order to draw the green and blue badges atop your icons"
- nallerooth 10y ago
  Out of curiosity, do you know if competitors (like Google Drive) are doing similar things like injecting code into Finder?
  - cprecioso 10y ago
    Not really. In the latest versions (maybe since Yosemite?), Apple has provided a Finde Extension API that has hooks for badges and right-click menus. That's what everyone's using.
    - nallerooth 10y ago
      I was hoping for an answer like yours. Thanks!
    - pilif 10y ago
      To be fair though: Dropbox is using that Extension API too for all the features it provides which basically is: Overlay icons and context menus. They patch the Finder for all the additional features like their overlay toolbar and other little things, none of which I particularly like, but still - they are additional features lacking in Google Drive and friends. As such I think it's not quite fair to say that Google Drive is much better for using the official API when it also doesn't provide additional features that are not supported by the official API. Also remember that without DropBox and friends patching Finder in the past, we would likely never have gotten the API in the first place. Sometimes, in order to make a platform owner advance a platform, you have to work around their existing restrictions.
- ThomPete 10y ago
  to be quite honest. I am happy they do these little hacks to improve the usability. If anything i find Apples lack of pushing OSX forward to be the real issue.
  - charlesdm 10y ago
    Not enough companies do this. User experience and ease of use is frankly one of the most important things (and this is coming from a developer). I can't remember the amount of times I've gotten frustrated with (beautifully written) open source software, but with a horrible complex UI that takes hours to figure out how to use. Those are hours of my life I'm not getting back. Why can't stuff just work? Disclosure: I've actually made a fair penny taking open source projects (not adjusting anything) and slapping a nice UI on it, doing nothing more than that. Good UI and UX matters and people will pay for it.
    - ThomPete 10y ago
      Agree but if you want thing to work on appstore it become even worse. Thats why i pulled my app from the app store 6 months after lunch and instead are selling directly. Havent looked back since.
      - charlesdm 10y ago
        How was the revenue from the App Store for your app? How is it now in comparison? How do you market it?
        ThomPete 10y ago
        The rev is the same. I was in top 10 on the app store for a good while it didn't do much to my sales so the benefits unless Apple decides to promote you for OSX are more or less null. At least in my experience. I realized that for the kind of niche productivity software I made Google is a much better app store. I mostly live of organic traffic and only do actual marketing once in a while. The best is when the product gets exposed to communities who are into productivity.
- josteink 10y ago
  > Dropbox has been willing to get their hands dirty in their pursuit of user-friendliness since day one, especially on the Mac¹. Where Apple is providing zero of the APIs you typically find on more open platforms, like Linux and Windows. Can't say I blame them. The other option would be to have a completely user-hostile installer and we all know how well they fare with the general public. Installation these days has to be one click, or nothing at all. Otherwise you've lost your user.
  - _jal 10y ago
    > The other option would be to have a completely user-hostile installer I'm unconvinced that a horrible installer is the only alternative, but even if it were, you are asserting that you see subverting OS security mechanisms and intentionally ignoring user intent as somehow not user-hostile? From my perspective, DB was kinda nifty when it first came out. The gap has been filled by commodity software for folks who can deal with self-hosting, so I'm personally happy. For other people, everyone and their pets wants to offer us all seamless hosted storage; there's no need for a glorified rsync service to be this creepy, evasive and intrusive. > Otherwise you've lost your user. I remain unconvinced that the various actions linked in the above were all required for a nifty install experience. Indeed, some of them are only required for forcing "features" on users that many have repeatedly indicated they don't want, after that all-singing, all-dancing install experience is over. Which, turns out, is a great way to lose your user.
newhouseb 10y ago
Hi folks, I work at Dropbox... - We assert the validity of this binary through other (cryptographic) means in the Dropbox Application. - We're going to start sign it using the means that JZ's tweet refers to, in addition to our existing checks, to avoid confusion. - The kernel extension / driver is signed by Dropbox (and this binary asserts that anything we install is signed only by us). - The kernel extension / driver is opt-in and not enabled for the general population (it's used in our implementation of Smart Sync, née Infinite).
- danieldk 10y ago
  Can you please make installing a kext an option, rather than trying to install it behind our backs? If you unload + remove the kext, it gets installed again automatically. The only way to block the kext is using e.g. Little Flocker. Moreover, the kext does get installed on my machines and I have a Pro account without Smart Sync. I have been pondering to uninstall Dropbox, because all this behaviour is not acceptable. Unfortunately, I haven't found a good alternative yet.
  - newhouseb 10y ago
    Can you check if you're in the (opt-in) Beta Channel by looking at https://dropbox.com/account https://dropbox.com/account at the checkbox that says "Include me on early releases"? It's not uncommon for folks to have clicked this long in the past and not given it thought since.
    - danieldk 10y ago
      Yes, I am in the early releases channel, sorry for not mentioning that in my earlier comment. But I still don't see why it should install a kext for functionality that is not provided?
      - mmjaa 10y ago
        The only reason for this kext to be installed as aggressively as this, is because it is vital for Dropbox Inc. to use to capture their users. There is no valid reason for this kext: none, zilch. Frankly, I find this use of kext's offensive. I'm putting Dropbox in my "do not recommend" list.
topspin 10y ago
What value of "kernel" is involved here? It's a tweet, so there isn't much to go on. I ask because I have this possibly naive view that one shouldn't need an actual "kernel extension" to sync some files...
- arachnids 10y ago
  Probably the "Infinite" extension [1] that lets you evict files from your disk while still storing them in Dropbox. It's an opt-in feature (and perhaps only available to Business customers?). [1] - https://blogs.dropbox.com/tech/2016/05/going-deeper-with-project-infinite/ https://blogs.dropbox.com/tech/2016/05/going-deeper-with-pro...
- mmjaa 10y ago
  One shouldn't need a third-party to get involved in sync'ing some files, but .. we do.
thunder-ltu 10y ago
Uninstalled and closed the account. Thanks Dropbox!
sidcool 10y ago
The Twitter account seems to have been deleted.
- rplnt 10y ago
  mirror: https://webcache.googleusercontent.com/search?q=cache:CgzTBD2JNGAJ:https://twitter.com/JZdziarski/status/836022552770326529 https://webcache.googleusercontent.com/search?q=cache:CgzTBD... content: > So @dropbox is using a completely unsigned binary to install kernel extensions on your Mac. This behavior is indistinguishable from malware.
- dschep 10y ago
  archive.is copy: http://archive.is/Wl7Ma http://archive.is/Wl7Ma
deleted 10y ago
[deleted]
dandare 10y ago
Is Condoleezza Rice still working for Dropbox?
- sp332 10y ago
  Yeah. http://www.bloomberg.com/research/stocks/private/board.asp?privcapId=49093148 http://www.bloomberg.com/research/stocks/private/board.asp?p...
revmoo 10y ago
Dropbox has deleted my own data without prompting, as well as one other person I know. I wouldn't trust them to store scratch data. The company is run by idiots.

263 points by tnorthcutt 10y ago

j_s 10y ago

Dropbox has been willing to get their hands dirty in their pursuit of user-friendliness since day one, especially on the Mac¹. Didn't find any examples where they walk it back; usually they stick to their guns with a few minor tweaks (and top-of-HN-discussion PR replies). Dropbox Hasn't Learned Their Lesson https://news.ycombinator.com/item?id=12619722 https://news.ycombinator.com/item?id=12619722 (2016) "You seem to completely miss the point. It's not about the feature itself, it's your way of "hacking" or "injecting" Dropbox features into places the user didn't expect." How Dropbox Hacks Your Mac https://news.ycombinator.com/item?id=12463338 https://news.ycombinator.com/item?id=12463338 (2016) "It's very strange that after I remove Dropbox from the accessibility list you think it's ok to add it back in again." Dropbox accesses all the files in your PC? https://news.ycombinator.com/item?id=9136546 https://news.ycombinator.com/item?id=9136546 (2015) "It does, however, 'QueryBasicFileInformation' and and 'QueryDirectory' when I create a file on my desktop." The Tech Behind Dropbox’s New User Experience on Mobile, Part 2 https://news.ycombinator.com/item?id=8203164 https://news.ycombinator.com/item?id=8203164 https://blogs.msdn.microsoft.com/ieinternals/2014/09/04/caveats-for-authenticode-code-signing/ https://blogs.msdn.microsoft.com/ieinternals/2014/09/04/cave... (2014) "what good is a code-signed executable when that executable can simply download a payload from the internet like this Dropbox installer does" Dropship — successor to torrents? https://news.ycombinator.com/item?id=2478567 https://news.ycombinator.com/item?id=2478567 (2011) "Apparently Dropbox notices they already have that file, and instead of you uploading it they just make it appear in your account." CEO Drew Houston actually did the PR for the cleanup: https://news.ycombinator.com/item?id=2482712 https://news.ycombinator.com/item?id=2482712 ¹ http://mjtsai.com/blog/2011/03/22/disabling-dropboxs-haxie/ http://mjtsai.com/blog/2011/03/22/disabling-dropboxs-haxie/ (2011) "Dropbox injects code into the Finder in order to draw the green and blue badges atop your icons"

nallerooth 10y ago
Out of curiosity, do you know if competitors (like Google Drive) are doing similar things like injecting code into Finder?
- cprecioso 10y ago
  Not really. In the latest versions (maybe since Yosemite?), Apple has provided a Finde Extension API that has hooks for badges and right-click menus. That's what everyone's using.
  - nallerooth 10y ago
    I was hoping for an answer like yours. Thanks!
  - pilif 10y ago
    To be fair though: Dropbox is using that Extension API too for all the features it provides which basically is: Overlay icons and context menus. They patch the Finder for all the additional features like their overlay toolbar and other little things, none of which I particularly like, but still - they are additional features lacking in Google Drive and friends. As such I think it's not quite fair to say that Google Drive is much better for using the official API when it also doesn't provide additional features that are not supported by the official API. Also remember that without DropBox and friends patching Finder in the past, we would likely never have gotten the API in the first place. Sometimes, in order to make a platform owner advance a platform, you have to work around their existing restrictions.
ThomPete 10y ago
to be quite honest. I am happy they do these little hacks to improve the usability. If anything i find Apples lack of pushing OSX forward to be the real issue.
- charlesdm 10y ago
  Not enough companies do this. User experience and ease of use is frankly one of the most important things (and this is coming from a developer). I can't remember the amount of times I've gotten frustrated with (beautifully written) open source software, but with a horrible complex UI that takes hours to figure out how to use. Those are hours of my life I'm not getting back. Why can't stuff just work? Disclosure: I've actually made a fair penny taking open source projects (not adjusting anything) and slapping a nice UI on it, doing nothing more than that. Good UI and UX matters and people will pay for it.
  - ThomPete 10y ago
    Agree but if you want thing to work on appstore it become even worse. Thats why i pulled my app from the app store 6 months after lunch and instead are selling directly. Havent looked back since.
    - charlesdm 10y ago
      How was the revenue from the App Store for your app? How is it now in comparison? How do you market it?
      - ThomPete 10y ago
        The rev is the same. I was in top 10 on the app store for a good while it didn't do much to my sales so the benefits unless Apple decides to promote you for OSX are more or less null. At least in my experience. I realized that for the kind of niche productivity software I made Google is a much better app store. I mostly live of organic traffic and only do actual marketing once in a while. The best is when the product gets exposed to communities who are into productivity.
josteink 10y ago
> Dropbox has been willing to get their hands dirty in their pursuit of user-friendliness since day one, especially on the Mac¹. Where Apple is providing zero of the APIs you typically find on more open platforms, like Linux and Windows. Can't say I blame them. The other option would be to have a completely user-hostile installer and we all know how well they fare with the general public. Installation these days has to be one click, or nothing at all. Otherwise you've lost your user.
- _jal 10y ago
  > The other option would be to have a completely user-hostile installer I'm unconvinced that a horrible installer is the only alternative, but even if it were, you are asserting that you see subverting OS security mechanisms and intentionally ignoring user intent as somehow not user-hostile? From my perspective, DB was kinda nifty when it first came out. The gap has been filled by commodity software for folks who can deal with self-hosting, so I'm personally happy. For other people, everyone and their pets wants to offer us all seamless hosted storage; there's no need for a glorified rsync service to be this creepy, evasive and intrusive. > Otherwise you've lost your user. I remain unconvinced that the various actions linked in the above were all required for a nifty install experience. Indeed, some of them are only required for forcing "features" on users that many have repeatedly indicated they don't want, after that all-singing, all-dancing install experience is over. Which, turns out, is a great way to lose your user.

newhouseb 10y ago

Hi folks, I work at Dropbox... - We assert the validity of this binary through other (cryptographic) means in the Dropbox Application. - We're going to start sign it using the means that JZ's tweet refers to, in addition to our existing checks, to avoid confusion. - The kernel extension / driver is signed by Dropbox (and this binary asserts that anything we install is signed only by us). - The kernel extension / driver is opt-in and not enabled for the general population (it's used in our implementation of Smart Sync, née Infinite).

danieldk 10y ago
Can you please make installing a kext an option, rather than trying to install it behind our backs? If you unload + remove the kext, it gets installed again automatically. The only way to block the kext is using e.g. Little Flocker. Moreover, the kext does get installed on my machines and I have a Pro account without Smart Sync. I have been pondering to uninstall Dropbox, because all this behaviour is not acceptable. Unfortunately, I haven't found a good alternative yet.
- newhouseb 10y ago
  Can you check if you're in the (opt-in) Beta Channel by looking at https://dropbox.com/account https://dropbox.com/account at the checkbox that says "Include me on early releases"? It's not uncommon for folks to have clicked this long in the past and not given it thought since.
  - danieldk 10y ago
    Yes, I am in the early releases channel, sorry for not mentioning that in my earlier comment. But I still don't see why it should install a kext for functionality that is not provided?
    - mmjaa 10y ago
      The only reason for this kext to be installed as aggressively as this, is because it is vital for Dropbox Inc. to use to capture their users. There is no valid reason for this kext: none, zilch. Frankly, I find this use of kext's offensive. I'm putting Dropbox in my "do not recommend" list.

topspin 10y ago

What value of "kernel" is involved here? It's a tweet, so there isn't much to go on. I ask because I have this possibly naive view that one shouldn't need an actual "kernel extension" to sync some files...

arachnids 10y ago
Probably the "Infinite" extension [1] that lets you evict files from your disk while still storing them in Dropbox. It's an opt-in feature (and perhaps only available to Business customers?). [1] - https://blogs.dropbox.com/tech/2016/05/going-deeper-with-project-infinite/ https://blogs.dropbox.com/tech/2016/05/going-deeper-with-pro...
mmjaa 10y ago
One shouldn't need a third-party to get involved in sync'ing some files, but .. we do.

thunder-ltu 10y ago

Uninstalled and closed the account. Thanks Dropbox!

sidcool 10y ago

The Twitter account seems to have been deleted.

rplnt 10y ago
mirror: https://webcache.googleusercontent.com/search?q=cache:CgzTBD2JNGAJ:https://twitter.com/JZdziarski/status/836022552770326529 https://webcache.googleusercontent.com/search?q=cache:CgzTBD... content: > So @dropbox is using a completely unsigned binary to install kernel extensions on your Mac. This behavior is indistinguishable from malware.
dschep 10y ago
archive.is copy: http://archive.is/Wl7Ma http://archive.is/Wl7Ma

deleted 10y ago

[deleted]

dandare 10y ago

Is Condoleezza Rice still working for Dropbox?

sp332 10y ago
Yeah. http://www.bloomberg.com/research/stocks/private/board.asp?privcapId=49093148 http://www.bloomberg.com/research/stocks/private/board.asp?p...

revmoo 10y ago

Dropbox has deleted my own data without prompting, as well as one other person I know. I wouldn't trust them to store scratch data. The company is run by idiots.