8 ms·

Dropbox Forums: New Sharing Model

125 points by bigwill 16y ago

callmeed 16y ago
This is pretty awesome. Might replace senduit.com and similar services for me.
bryanh 16y ago
A natural progression. I'm glad they finally went there. I am a happy customer of their 50 gig offering. I know there are a lot of YC companies out there (most of which I am not interested in the least, but hey, different market), but they hit a big market with DropBox. I'm signing my parents up to coordinate pics, music and videos soon.
Groxx 16y ago
Important point: Any file or folder in your Dropbox is now linkable! But not quite yet, presumably very soon. Apparently appears in the 0.8 beta clients only, didn't see anything specific about the website (though I don't see it on my account).
- edanm 16y ago
  Another important point (mentioned in a later comment): unlike public folders, only things you choose to make linkable can be viewed. The public folder continues to work the same way.
- malbiniak 16y ago
  If you're feeling bold, here's a link to the experimental build: http://forums.dropbox.com/topic.php?id=21406&replies=22 http://forums.dropbox.com/topic.php?id=21406&replies=22
deleted 16y ago
[deleted]
- jufemaiz 16y ago
  o.O https://www.dropbox.com/pricing https://www.dropbox.com/pricing Pro 50(GB) $9.99 / month
ptn 16y ago
That is beyond cool. I bet you can put a git repo in dropbox and clone it using the shareable link. I'd test if I didn't have a program to deliver in 4h.
- ludwigvan 16y ago
  I don't believe you can do that. I have tried, but it failed. The interface is primarily for viewing a folder via a web interface I suppose.
natrius 16y ago
Bonus points to the first person to write a FUSE filesystem to mount shared Dropbox folders so you can easily download the entire contents of a folder. Or they could just add a "download folder" link, but that sounds boring. It also looks like they want people to use "Copy to my Dropbox" for that, which would lead to more signups.
- ivankirigin 16y ago
  There is a link at the top that says "copy to my dropbox"
Artifex 16y ago
Is this a security risk? Could someone, theoretically, enter in a random string of characters and land on your files?
- gizmo 16y ago
  I'd have to go with yes. Hate to be an entropy nazi, but here goes: Hash is 6 characters long, characters are alphanumeric (a-zA-Z0-9). So that makes: (26 * 2 + 10) ** 6 => 5.6E10 That looks like a big number, but it isn't. Because at the scale of dropbox there will be 10 million links out there in no time. So then the math goes: ( (26 * 2 + 10) ** 6 ) / 10_000_000 => 5680 So you have to make only a few thousand guesses to get a random file from another user. I'd say that's not very secure. Note that the links redirect to a page with a far longer (and presumably far more secure) hash code. Any time when you see short hash -> longer hash alarm bells should go off. I'm assuming the share links last forever. If the share links would last only 24 hours then system looks pretty safe. Anyway, this is only my first impression. I might very well be wrong. Either way I think it's pretty silly to give up so much entropy to get a prettier URL. Why not just use the complete 128bit hash?
  - brlewis 16y ago
    I haven't used the feature yet, but from reading the forum thread it sounds like the 6 random characters are only created if someone chooses to shorten their link with db.tt (presumably Dropbox's shortener). By default, resources have 15 random characters. Since URL shortening is mostly for use with twitter, I think the number of non-public files/folders with a corresponding 6-random-character link will not approach 10MM any time soon.
    - blaix 16y ago
      Actually, I got the impression that no public link was available at all unless you chose to create it.
- stricken 16y ago
  No, you still choose which files and folders to make linkable. Anything you give a url to you should consider to be public anyway.
mgw 16y ago
I bet with the public launch, they will put bandwidth restrictions in place. Otherwise this will be misused in no time.
- aero142 16y ago
  Yeah. It's all fun and games until someone shares an image and it goes to the front page of Reddit.
  - blaix 16y ago
    Wouldn't this already be an issue with the Public folder?
    - logic 16y ago
      Yes: https://www.dropbox.com/help/45 https://www.dropbox.com/help/45 "There are currently no hard limits on public bandwidth usage. We do, however, have an automated system for detecting and flagging unusual amounts of bandwidth usage. We will send an email notification whenever an account is flagged. Once flagged, public links will be temporarily disabled and users who use the links will see an error page instead of your file." So, there's no bandwidth limit, but there's a bandwidth limit. :)
      - woid 16y ago
        Yes, it happened to me already. They temporarily disabled the public link after 10GB of traffic or so.
brown9-2 16y ago
Dropbox has a music player now?
dpcan 16y ago
I don't know why, but I all of a sudden feel like all my private dropbox data is now vulnerable to some form of hack, bug, exploit, malicious script, etc, that turns it all into a public web page. Sharing with just people I know is one thing, but creating a web page of some of my data is another. I don't know, it just doesn't feel right. Dropbox, remember, you're dealing with private files on our personal computers, and one step too far and you're looking at mass exodus. Learn from Facebook. Use caution with new features.
- apowell 16y ago
  Yes, I have to add to this sentiment. In my mind, I imagine Dropbox to be just as secure and private as my own hard drive. It's a bit of a fiction, I know, but until now nothing caused me to really question it. I use it for important files -- the sensitive ones that I really don't want to lose. Maybe it's all perception, but this makes my private files feel dangerously close to the wide open web. Dropbox, don't make me feel dumb for using your service for stuff that matters. If your service is meant for funny cat pictures and not my tax returns, please tell me now.
  - toastador 16y ago
    Hey guys, I helped build this feature and just wanted to say we're as concerned about privacy and security as you are. A couple specifics that might help: * No feature is for everyone -- this is opt-in in the strictest sense. (And, since you pick the files/directories, as fine-grained as you want.) * You can disable a link anytime: from the the sharing tab (https://www.dropbox.com/share https://www.dropbox.com/share), click "Linked Items" to see all your links and disable anything. * 3 means of sharing (shared folders, a public dir, and sharing links) gives you more control over privacy, not less. * Similar to etherpad links, the shortened db.tt links are public but unfeasible to guess. We've heard a few concerns about the 6-digit hashes -- well, as more links are shared, don't assume the hash will stay at 6 digits :) can't get into details but we do a few more things to make link fishing near-impossible.
    - MikeCapone 16y ago
joshwa 16y ago
This sounds a lot like drop.io or mediafire etc.. file sharing services with a web interface. Since people were already using the public links to share individual files it makes a lot of sense to expand it to the folder level.
codemechanic 16y ago
Tonido 1-click share does the same thing. Get a shareable link to a file or folder: http://www.youtube.com/watch?v=NtFRqNcGIP4 http://www.youtube.com/watch?v=NtFRqNcGIP4
ryanpetrich 16y ago
This feature has been available in the iPad client for some time now.
woid 16y ago
I tried the feature and I like it. The only confusion was about "Copy to my DropBox" button. It does only one-time snapshot of the shared area. I would expect to have live access to shared area through my local folder.

125 points by bigwill 16y ago

This is pretty awesome. Might replace senduit.com and similar services for me.

A natural progression. I'm glad they finally went there. I am a happy customer of their 50 gig offering. I know there are a lot of YC companies out there (most of which I am not interested in the least, but hey, different market), but they hit a big market with DropBox. I'm signing my parents up to coordinate pics, music and videos soon.

Groxx 16y ago

Important point: Any file or folder in your Dropbox is now linkable! But not quite yet, presumably very soon. Apparently appears in the 0.8 beta clients only, didn't see anything specific about the website (though I don't see it on my account).

edanm 16y ago
Another important point (mentioned in a later comment): unlike public folders, only things you choose to make linkable can be viewed. The public folder continues to work the same way.
malbiniak 16y ago
If you're feeling bold, here's a link to the experimental build: http://forums.dropbox.com/topic.php?id=21406&replies=22 http://forums.dropbox.com/topic.php?id=21406&replies=22

deleted 16y ago

[deleted]

jufemaiz 16y ago
o.O https://www.dropbox.com/pricing https://www.dropbox.com/pricing Pro 50(GB) $9.99 / month

ptn 16y ago

That is beyond cool. I bet you can put a git repo in dropbox and clone it using the shareable link. I'd test if I didn't have a program to deliver in 4h.

ludwigvan 16y ago
I don't believe you can do that. I have tried, but it failed. The interface is primarily for viewing a folder via a web interface I suppose.

natrius 16y ago

Bonus points to the first person to write a FUSE filesystem to mount shared Dropbox folders so you can easily download the entire contents of a folder. Or they could just add a "download folder" link, but that sounds boring. It also looks like they want people to use "Copy to my Dropbox" for that, which would lead to more signups.

ivankirigin 16y ago
There is a link at the top that says "copy to my dropbox"

Artifex 16y ago

Is this a security risk? Could someone, theoretically, enter in a random string of characters and land on your files?

gizmo 16y ago
I'd have to go with yes. Hate to be an entropy nazi, but here goes: Hash is 6 characters long, characters are alphanumeric (a-zA-Z0-9). So that makes: (26 * 2 + 10) ** 6 => 5.6E10 That looks like a big number, but it isn't. Because at the scale of dropbox there will be 10 million links out there in no time. So then the math goes: ( (26 * 2 + 10) ** 6 ) / 10_000_000 => 5680 So you have to make only a few thousand guesses to get a random file from another user. I'd say that's not very secure. Note that the links redirect to a page with a far longer (and presumably far more secure) hash code. Any time when you see short hash -> longer hash alarm bells should go off. I'm assuming the share links last forever. If the share links would last only 24 hours then system looks pretty safe. Anyway, this is only my first impression. I might very well be wrong. Either way I think it's pretty silly to give up so much entropy to get a prettier URL. Why not just use the complete 128bit hash?
- brlewis 16y ago
  I haven't used the feature yet, but from reading the forum thread it sounds like the 6 random characters are only created if someone chooses to shorten their link with db.tt (presumably Dropbox's shortener). By default, resources have 15 random characters. Since URL shortening is mostly for use with twitter, I think the number of non-public files/folders with a corresponding 6-random-character link will not approach 10MM any time soon.
  - blaix 16y ago
    Actually, I got the impression that no public link was available at all unless you chose to create it.
stricken 16y ago
No, you still choose which files and folders to make linkable. Anything you give a url to you should consider to be public anyway.

mgw 16y ago

I bet with the public launch, they will put bandwidth restrictions in place. Otherwise this will be misused in no time.

aero142 16y ago
Yeah. It's all fun and games until someone shares an image and it goes to the front page of Reddit.
- blaix 16y ago
  Wouldn't this already be an issue with the Public folder?
  - logic 16y ago
    Yes: https://www.dropbox.com/help/45 https://www.dropbox.com/help/45 "There are currently no hard limits on public bandwidth usage. We do, however, have an automated system for detecting and flagging unusual amounts of bandwidth usage. We will send an email notification whenever an account is flagged. Once flagged, public links will be temporarily disabled and users who use the links will see an error page instead of your file." So, there's no bandwidth limit, but there's a bandwidth limit. :)
    - woid 16y ago
      Yes, it happened to me already. They temporarily disabled the public link after 10GB of traffic or so.

brown9-2 16y ago

Dropbox has a music player now?

dpcan 16y ago

I don't know why, but I all of a sudden feel like all my private dropbox data is now vulnerable to some form of hack, bug, exploit, malicious script, etc, that turns it all into a public web page. Sharing with just people I know is one thing, but creating a web page of some of my data is another. I don't know, it just doesn't feel right. Dropbox, remember, you're dealing with private files on our personal computers, and one step too far and you're looking at mass exodus. Learn from Facebook. Use caution with new features.

apowell 16y ago
Yes, I have to add to this sentiment. In my mind, I imagine Dropbox to be just as secure and private as my own hard drive. It's a bit of a fiction, I know, but until now nothing caused me to really question it. I use it for important files -- the sensitive ones that I really don't want to lose. Maybe it's all perception, but this makes my private files feel dangerously close to the wide open web. Dropbox, don't make me feel dumb for using your service for stuff that matters. If your service is meant for funny cat pictures and not my tax returns, please tell me now.
- toastador 16y ago
  Hey guys, I helped build this feature and just wanted to say we're as concerned about privacy and security as you are. A couple specifics that might help: * No feature is for everyone -- this is opt-in in the strictest sense. (And, since you pick the files/directories, as fine-grained as you want.) * You can disable a link anytime: from the the sharing tab (https://www.dropbox.com/share https://www.dropbox.com/share), click "Linked Items" to see all your links and disable anything. * 3 means of sharing (shared folders, a public dir, and sharing links) gives you more control over privacy, not less. * Similar to etherpad links, the shortened db.tt links are public but unfeasible to guess. We've heard a few concerns about the 6-digit hashes -- well, as more links are shared, don't assume the hash will stay at 6 digits :) can't get into details but we do a few more things to make link fishing near-impossible.
  - MikeCapone 16y ago

joshwa 16y ago

This sounds a lot like drop.io or mediafire etc.. file sharing services with a web interface. Since people were already using the public links to share individual files it makes a lot of sense to expand it to the folder level.

codemechanic 16y ago

Tonido 1-click share does the same thing. Get a shareable link to a file or folder: http://www.youtube.com/watch?v=NtFRqNcGIP4 http://www.youtube.com/watch?v=NtFRqNcGIP4

ryanpetrich 16y ago

This feature has been available in the iPad client for some time now.

woid 16y ago

I tried the feature and I like it. The only confusion was about "Copy to my DropBox" button. It does only one-time snapshot of the shared area. I would expect to have live access to shared area through my local folder.