5 ms·

I doubt most people are comfortable with deception around root access, in order to have a better user experience. This is evidenced by the fact that Dropbox fe

I doubt most people are comfortable with deception around root access, in order to have a better user experience. This is evidenced by the fact that Dropbox felt the need to apologize and alter their behavior. Largely through HN activism BTW https://techcrunch.com/2016/09/09/dropbox-responds-to-accusations-its-mac-desktop-client-hacks-os-x-security/ https://techcrunch.com/2016/09/09/dropbox-responds-to-accusa...

ThomPete 9y ago
Most people have no idea what root access mean. They explaining themselves is not evidence of what at all.
- threepipeproblm 9y ago
  Did you read the part of the statement where they promised to make changes to the application disclosures? Characterizing typical users as unable to understand rooting sidesteps the point that, when the concept is explained to them, most will not be comfortable with software companies doing this.
  - ThomPete 9y ago
    yes I did and no it doesn't actually sidestep it as the claim was that most people would be upset about it which is simply wrong as they don't even know it's an issue. If you want to see evidence of that then look at their current numbers.
  - deleted 9y ago
    [deleted]
  - threepipeproblm 9y ago
    I definitely should have used the subjunctive case there, but I was addressing an HN audience who does get it. A charitable reader might have responded to the gist of the criticism. Are you suggesting that because many of Dropbox's users don't know about the rooting thing, it's justified by their expansion? I think the important thing is that, were most users to understand the rooting issue, they would be upset. Most users could easily understand it, if explained clearly. This is likely why Dropbox didn't disclose at all until caught -- and now, presumably, has a techie-sounding disclosure instead of "can we 0wn your machine?", if they are even still doing this on Macs. This goes along with my original complaint about Dropbox: defaults that are ostensibly in Dropbox's interest, but not users'.
    - ThomPete 9y ago
      I am suggesting that the rooting was to improve the user experience and that only technical savy people really care about it. The potential security issue isn't big enough to claim it's a problem compared to making it easy to use for most people.
    - seanieb 9y ago
      That withstanding, what's your core threat model? The DB has network access and filesystem read and write access already.
CJefferson 9y ago
On most macs I suspect there is one user -- so there isn't that much difference between user access and root access, either way you can read my web history and all my e-mails.

ThomPete 9y ago

Most people have no idea what root access mean. They explaining themselves is not evidence of what at all.

threepipeproblm 9y ago
Did you read the part of the statement where they promised to make changes to the application disclosures? Characterizing typical users as unable to understand rooting sidesteps the point that, when the concept is explained to them, most will not be comfortable with software companies doing this.
- ThomPete 9y ago
  yes I did and no it doesn't actually sidestep it as the claim was that most people would be upset about it which is simply wrong as they don't even know it's an issue. If you want to see evidence of that then look at their current numbers.
- deleted 9y ago
  [deleted]
- threepipeproblm 9y ago
  I definitely should have used the subjunctive case there, but I was addressing an HN audience who does get it. A charitable reader might have responded to the gist of the criticism. Are you suggesting that because many of Dropbox's users don't know about the rooting thing, it's justified by their expansion? I think the important thing is that, were most users to understand the rooting issue, they would be upset. Most users could easily understand it, if explained clearly. This is likely why Dropbox didn't disclose at all until caught -- and now, presumably, has a techie-sounding disclosure instead of "can we 0wn your machine?", if they are even still doing this on Macs. This goes along with my original complaint about Dropbox: defaults that are ostensibly in Dropbox's interest, but not users'.
  - ThomPete 9y ago
    I am suggesting that the rooting was to improve the user experience and that only technical savy people really care about it. The potential security issue isn't big enough to claim it's a problem compared to making it easy to use for most people.
  - seanieb 9y ago
    That withstanding, what's your core threat model? The DB has network access and filesystem read and write access already.

CJefferson 9y ago

On most macs I suspect there is one user -- so there isn't that much difference between user access and root access, either way you can read my web history and all my e-mails.