8 ms·

Hi folks, I work at Dropbox... - We assert the validity of this binary through other (cryptographic) means in the Dropbox Application. - We're going to start

Hi folks, I work at Dropbox... - We assert the validity of this binary through other (cryptographic) means in the Dropbox Application. - We're going to start sign it using the means that JZ's tweet refers to, in addition to our existing checks, to avoid confusion. - The kernel extension / driver is signed by Dropbox (and this binary asserts that anything we install is signed only by us). - The kernel extension / driver is opt-in and not enabled for the general population (it's used in our implementation of Smart Sync, née Infinite).

danieldk 10y ago
Can you please make installing a kext an option, rather than trying to install it behind our backs? If you unload + remove the kext, it gets installed again automatically. The only way to block the kext is using e.g. Little Flocker. Moreover, the kext does get installed on my machines and I have a Pro account without Smart Sync. I have been pondering to uninstall Dropbox, because all this behaviour is not acceptable. Unfortunately, I haven't found a good alternative yet.
- newhouseb 10y ago
  Can you check if you're in the (opt-in) Beta Channel by looking at https://dropbox.com/account https://dropbox.com/account at the checkbox that says "Include me on early releases"? It's not uncommon for folks to have clicked this long in the past and not given it thought since.
  - danieldk 10y ago
    Yes, I am in the early releases channel, sorry for not mentioning that in my earlier comment. But I still don't see why it should install a kext for functionality that is not provided?
    - mmjaa 10y ago
      The only reason for this kext to be installed as aggressively as this, is because it is vital for Dropbox Inc. to use to capture their users. There is no valid reason for this kext: none, zilch. Frankly, I find this use of kext's offensive. I'm putting Dropbox in my "do not recommend" list.
    - newhouseb 10y ago
      The beta channel exists so that we can ensure upcoming components are stable, if you're uncomfortable with this you can always switch back to the stable channel. We'll add a help center article to make it more clear what happens when you opt-in to early releases.
- dvcrn 10y ago
  Thanks for the Little Flocker tip! Didn't know this app yet!
  - seanp2k2 10y ago
    +1 shut up and take my money :)
- rcarmo 10y ago
  I second this. I would much rather not have Dropbox install any kexts at all, and the only thing preventing me from replacing it (so far) is widespread support on iOS apps and Linux (which I rely on for a few things). Otherwise I'd have switched by now - as many folk point out, this is the third or fourth time this kind of approach has come to light, and it reflects badly on the company and the product.
  - JelteF 10y ago
    For Google Drive on Linux I've been using Insync happily for a long time now: https://www.insynchq.com/ https://www.insynchq.com/
    - steven_pack 10y ago
      I installed that software on Linux. It then randomly spread my music library around my Gooogle Drive. Support's answer "Your local sync db must have got corrupted. But here is a list of all the files that got moved" wtf?!
- JensRex 10y ago
  These shenanigans finally made me delete my Dropbox account, and set up an OwnCloud instance on Digital Ocean. I've found the OC client to be very nice on the platforms I use (Linux, Windows, iOS). The Dropbox client on Linux was terrible to the point of being unusable.
  - trome 10y ago
    Yeah, can vouch for Owncloud (although I've moved to the NextCloud fork), its a convenient replacement for Dropbox, just thrown an OrangePi Zero ($7), a JMS567 USB 3.0 to Sata adapter ($3) and any old HDD and you've got yourself a libre Dropbox that uses just a few watts and works consistently on all platforms. Note that the Wifi drivers aren't libre, but besides that everything else on the OrangePi Zero, from audio to ethernet is in kernel 4.10 under GPLv2.
    - jbf1001 10y ago
      Do you think something like this is feasible for a home media server? I suspect things like video streaming from this would be slow, am I wrong?
      - cat199 10y ago
        Am not OP, and not speaking from direct experience, but a coworker was using a Pi-2 as a home media server without issue in some situations - basically he did the math on the bitrates per second and determined that the disk/wifi I/O (on the shared USB bus) was fast enough for his use case (IIRC streaming to main TV, possibly 1-2 more devices) I do know he was looking at upgrading to another mini-arm board with a dedicated PCI Nic or separate SATA due to the bus contention on the USB limiting data/network I/O because he wanted to serve more clients (family of 5 and associated devices) so I guess the short answer is 'maybe, depending on use case'..
        trome 10y ago
        The OrangePis have much better IO (with the exception of the OrangePi+ 2, which is a bad buy), with each USB port being direct wired & capable of 40MB/s, and an onboard 100mbps PHY. Comparatively, the Raspi shoves all that over 1 USB port, ethernet included, so 4 to 5MB/s is about the best your gonna get with it.
- therealmarv 10y ago
  My personal experience here only: Google Drive + INSYNC is a pretty damn good combination which replaced Dropbox entirely for me. (edited... written insync wrong).
- swiley 10y ago
  I've had an extremely good experience with syncthing. There's no kext and volunteers run relay servers to get around NAT (everything is encrypted so you don't need to worry.)
  - alyandon 10y ago
    I wish they'd combine the relay server functionality into syncthing itself so that it could automatically use peers as relay servers. I'd prefer not to rely on the generosity of others or running the relay server and having to manually configure syncthing clients to use it.
alphonsegaston 10y ago
Is there a culture at Dropbox that just encourages these kind of dark patterns? I originally started using the service out of respect for Guido's work, but it seems obvious at this point that Dropbox has little respect for users' security or privacy and will push through this kind of nonsense, hoping that their less-knowledgeable user base won't catch onto the implications.
- deong 10y ago
  Well, as far as I'm aware, there have been no actual implications. I think it's a perfectly reasonable summary to say that Dropbox does a bunch of weird shit to enable features customers want that can't realistically be delivered any other way, and so far there have been no drawbacks to the approach in practice. I get the argument from the other side as well, but if you're Dropbox, you just want to make the best file-syncing application you can make, and any other choice they could have made in these situations would be worse in lots of ways. We can quibble over which set of compromises is the right set, but I doubt you'll find a single set of uniformly preferred options. To be sure, there are probably some low cost wins they could make -- making the signing status of everything more obvious, etc., but I'm not sure what your desired outcome here really is. I guess I mostly just find it annoying that people seem to think anything other than presenting my 67 year old mother with a dialog of full disclosure about kernel extensions is somehow the nefarious work of a shady company rather than a conscious design arrived at through a reasonable comparison of the options.
  - cat199 10y ago
    Because there is no middle ground here, like, say, a sensibly labeled checkbox in the preferences, which defaults to on? As for implications: We're here talking about it. That is an implication. This is not the first time either. As for uniformly preferred: not futzing around with system level stuff without a preference or notification tends to be pretty much universal.
    - geofft 10y ago
      What is a "sensibly labeled checkbox"? [x] Enable Smart Sync [x] Install Dropbox drivers required for Smart Sync What happens if I uncheck the second checkbox but not the first? Does Smart Sync just sit there and look sad? Maybe just a note under the Smart Sync thing saying "Smart Sync drivers are installed. Disable Smart Sync to remove"? Will that actually make anyone happier? Also—Dropbox is a filesystem. (Logically, the entire product is a filesystem; pedantically, traditional Dropbox might not be but Smart Sync definitely fits the definition of a network filesystem.) Traditionally on UNIX, if you're installing a third-party filesystem like AFS or Lustre or ZFS or whatever else, you're installing drivers. The fact that installing a filesystem installs both userspace software and drivers doesn't feel weird to me at all.

danieldk 10y ago

Can you please make installing a kext an option, rather than trying to install it behind our backs? If you unload + remove the kext, it gets installed again automatically. The only way to block the kext is using e.g. Little Flocker. Moreover, the kext does get installed on my machines and I have a Pro account without Smart Sync. I have been pondering to uninstall Dropbox, because all this behaviour is not acceptable. Unfortunately, I haven't found a good alternative yet.

newhouseb 10y ago
Can you check if you're in the (opt-in) Beta Channel by looking at https://dropbox.com/account https://dropbox.com/account at the checkbox that says "Include me on early releases"? It's not uncommon for folks to have clicked this long in the past and not given it thought since.
- danieldk 10y ago
  Yes, I am in the early releases channel, sorry for not mentioning that in my earlier comment. But I still don't see why it should install a kext for functionality that is not provided?
  - mmjaa 10y ago
    The only reason for this kext to be installed as aggressively as this, is because it is vital for Dropbox Inc. to use to capture their users. There is no valid reason for this kext: none, zilch. Frankly, I find this use of kext's offensive. I'm putting Dropbox in my "do not recommend" list.
  - newhouseb 10y ago
    The beta channel exists so that we can ensure upcoming components are stable, if you're uncomfortable with this you can always switch back to the stable channel. We'll add a help center article to make it more clear what happens when you opt-in to early releases.
dvcrn 10y ago
Thanks for the Little Flocker tip! Didn't know this app yet!
- seanp2k2 10y ago
  +1 shut up and take my money :)
rcarmo 10y ago
I second this. I would much rather not have Dropbox install any kexts at all, and the only thing preventing me from replacing it (so far) is widespread support on iOS apps and Linux (which I rely on for a few things). Otherwise I'd have switched by now - as many folk point out, this is the third or fourth time this kind of approach has come to light, and it reflects badly on the company and the product.
- JelteF 10y ago
  For Google Drive on Linux I've been using Insync happily for a long time now: https://www.insynchq.com/ https://www.insynchq.com/
  - steven_pack 10y ago
    I installed that software on Linux. It then randomly spread my music library around my Gooogle Drive. Support's answer "Your local sync db must have got corrupted. But here is a list of all the files that got moved" wtf?!
JensRex 10y ago
These shenanigans finally made me delete my Dropbox account, and set up an OwnCloud instance on Digital Ocean. I've found the OC client to be very nice on the platforms I use (Linux, Windows, iOS). The Dropbox client on Linux was terrible to the point of being unusable.
- trome 10y ago
  Yeah, can vouch for Owncloud (although I've moved to the NextCloud fork), its a convenient replacement for Dropbox, just thrown an OrangePi Zero ($7), a JMS567 USB 3.0 to Sata adapter ($3) and any old HDD and you've got yourself a libre Dropbox that uses just a few watts and works consistently on all platforms. Note that the Wifi drivers aren't libre, but besides that everything else on the OrangePi Zero, from audio to ethernet is in kernel 4.10 under GPLv2.
  - jbf1001 10y ago
    Do you think something like this is feasible for a home media server? I suspect things like video streaming from this would be slow, am I wrong?
    - cat199 10y ago
      Am not OP, and not speaking from direct experience, but a coworker was using a Pi-2 as a home media server without issue in some situations - basically he did the math on the bitrates per second and determined that the disk/wifi I/O (on the shared USB bus) was fast enough for his use case (IIRC streaming to main TV, possibly 1-2 more devices) I do know he was looking at upgrading to another mini-arm board with a dedicated PCI Nic or separate SATA due to the bus contention on the USB limiting data/network I/O because he wanted to serve more clients (family of 5 and associated devices) so I guess the short answer is 'maybe, depending on use case'..
      - trome 10y ago
        The OrangePis have much better IO (with the exception of the OrangePi+ 2, which is a bad buy), with each USB port being direct wired & capable of 40MB/s, and an onboard 100mbps PHY. Comparatively, the Raspi shoves all that over 1 USB port, ethernet included, so 4 to 5MB/s is about the best your gonna get with it.
therealmarv 10y ago
My personal experience here only: Google Drive + INSYNC is a pretty damn good combination which replaced Dropbox entirely for me. (edited... written insync wrong).
swiley 10y ago
I've had an extremely good experience with syncthing. There's no kext and volunteers run relay servers to get around NAT (everything is encrypted so you don't need to worry.)
- alyandon 10y ago
  I wish they'd combine the relay server functionality into syncthing itself so that it could automatically use peers as relay servers. I'd prefer not to rely on the generosity of others or running the relay server and having to manually configure syncthing clients to use it.

alphonsegaston 10y ago

Is there a culture at Dropbox that just encourages these kind of dark patterns? I originally started using the service out of respect for Guido's work, but it seems obvious at this point that Dropbox has little respect for users' security or privacy and will push through this kind of nonsense, hoping that their less-knowledgeable user base won't catch onto the implications.

deong 10y ago
Well, as far as I'm aware, there have been no actual implications. I think it's a perfectly reasonable summary to say that Dropbox does a bunch of weird shit to enable features customers want that can't realistically be delivered any other way, and so far there have been no drawbacks to the approach in practice. I get the argument from the other side as well, but if you're Dropbox, you just want to make the best file-syncing application you can make, and any other choice they could have made in these situations would be worse in lots of ways. We can quibble over which set of compromises is the right set, but I doubt you'll find a single set of uniformly preferred options. To be sure, there are probably some low cost wins they could make -- making the signing status of everything more obvious, etc., but I'm not sure what your desired outcome here really is. I guess I mostly just find it annoying that people seem to think anything other than presenting my 67 year old mother with a dialog of full disclosure about kernel extensions is somehow the nefarious work of a shady company rather than a conscious design arrived at through a reasonable comparison of the options.
- cat199 10y ago
  Because there is no middle ground here, like, say, a sensibly labeled checkbox in the preferences, which defaults to on? As for implications: We're here talking about it. That is an implication. This is not the first time either. As for uniformly preferred: not futzing around with system level stuff without a preference or notification tends to be pretty much universal.
  - geofft 10y ago
    What is a "sensibly labeled checkbox"? [x] Enable Smart Sync [x] Install Dropbox drivers required for Smart Sync What happens if I uncheck the second checkbox but not the first? Does Smart Sync just sit there and look sad? Maybe just a note under the Smart Sync thing saying "Smart Sync drivers are installed. Disable Smart Sync to remove"? Will that actually make anyone happier? Also—Dropbox is a filesystem. (Logically, the entire product is a filesystem; pedantically, traditional Dropbox might not be but Smart Sync definitely fits the definition of a network filesystem.) Traditionally on UNIX, if you're installing a third-party filesystem like AFS or Lustre or ZFS or whatever else, you're installing drivers. The fact that installing a filesystem installs both userspace software and drivers doesn't feel weird to me at all.