5 ms·

> They're deploying this across a fleet of company laptops ... How comfortable are engineers with that? I worked for the corporate infrastructure team at Dropb

> They're deploying this across a fleet of company laptops ... How comfortable are engineers with that? I worked for the corporate infrastructure team at Dropbox, at the time my team was responsible installing/managing things like osquery on laptops, with the data going to the security team's tools, so I have thought about this. Speaking for myself, the Dropbox culture takes trustworthiness very seriously. "Be worthy of trust" is #1 on the list of company core values, and it is deeply embedded into the culture. The trust covers so much of how the company operates, including privacy. Spying on employees is so against company culture, even though I knew exactly what data being sent, I trusted the security team would not use that for anything other than protecting me. The detection and response team is made up of the most security and privacy conscious people I've ever met. I think the mindset of respecting coworker privacy is important for anyone in corporate infrastructure, including network and system administrators. But I've worked for other big corporations too, without that trust. I think employees need to know that when they use corporate computers and communications systems, they aren't private. Don't do stuff you shouldn't be doing at work. > what do you do with all that information? I see how this addresses malware response, and I see how this would be useful as a forensic archive for general IR. But as a day-to-day tool, connection-by-connection, file-by-file granular data When I worked there the security team reached out to me to ask about anomalous behavior, so there is active detection going on. That was a couple years ago, I'm sure they have improved since then too. Keep in mind, they have a full time detection and response team, in addition to all the other security teams.

kripy 8y ago
Interesting that osquery is developed by Facebook and Santa is developed by Google. I do some work with Facebook and during a video conference with one of their employees the connection dropped out. When we reconnected I asked what happened and they said that the machine updated itself. I thought this was kind of an odd time to update and dropped it into the conversation and was told that their laptops are updated every day. Without an understanding of the inner workings of Facebook it seems like they may be snapshotting employee machines, daily.
- antoncohen 8y ago
  I doubt it was snapshotting. It is common to force OS updates. For macOS there are tools where the employee will be prompted to update, and can dismiss for a while, but eventually they will be forced to restart. My guess is that the Facebook employee had ignored update prompts and was then forced to update. Every day does seem odd, I can't think of an update type that would require restarts/logoff every day. At least a couple years ago Facebook and Dropbox were managing their Macs in similar ways, with similar tools, I'd be surprised if they changed to something that required daily restarts.
  - antoncohen 8y ago
    Facebook has a Chef cookbook called cpe_nightly_reboot for their Macs. I can't think of why that would be required, but they must have a reason. https://github.com/facebook/IT-CPE/tree/master/chef/cookbooks/cpe_nightly_reboot https://github.com/facebook/IT-CPE/tree/master/chef/cookbook...
    - MagerValp 8y ago
      I don't work at Facebook, but I'm fairly certain this is for things like build servers, not client machines. They use Munki for software updates, which, just like you describe, gives the user a grace period where they can reboot at their leisure. Ignore it for long enough and it'll crank up the nagging, and eventually force a reboot.
      - icebraining 8y ago
        this is for things like build servers, not client machines. It talks about killing GUI processes. Is it common to run a display server on macOS servers?
        MagerValp 8y ago
        Yes. Services that can run without a display are better run on a Linux server anyway.
stirner 8y ago
When Dropbox deliberately circumvented Apple's security features to make itself difficult to remove [1], was the company's #1 core value of "Be worthy of trust" in mind, or was that only added in retrospect? [1] http://applehelpwriter.com/2016/08/29/discovering-how-dropbox-hacks-your-mac/ http://applehelpwriter.com/2016/08/29/discovering-how-dropbo...
- antoncohen 8y ago
  This issue has been addressed already: https://news.ycombinator.com/item?id=12464730 https://news.ycombinator.com/item?id=12464730 I don't believe there was any intention of making Dropbox hard to uninstall. I think the intention was to make the process seamless for users, and there was a bug that caused a setting to get reapplied after a user changed it.
  - saagarjha 8y ago
    I believe that Dropbox doesn't really have poor intentions here: they're trying to make their product easy to use or work better or whatever. I don't think their intentions are malicious. However, I strongly disagree with the method that they use to achieve this: installing kernel extensions, bypassing Accessibility prompts, having a hooks in every process they could possibly get their hands on, etc. is going too far. There's a reason those checks are there: they keep the user safe. Trying to get around these is, in my mind, arrogant. They think that they're better than every other company that abides by the rules. Google Drive doesn't do this. Box doesn't do this. Even iCloud Drive doesn't do what Dropbox does. I was talking to someone just two days ago, who was tearing their hair out because their application's "Open" panel took something like ten seconds to open. Why? Because the Dropbox extension decided it didn't want to play along nicely. It's foolish to think that your software will not have bugs, and outright foolhardy to do this for so little benefit.
    - antoncohen 8y ago
      Dropbox pushes the state of the art for file sync. They added sync status icons on Mac OS X before Apple had an API for it, later Apple added an API. Those icons are part of what makes the product so usable. The kernel extension is another example. AFAIK it was added for Smart Sync[1] (née Infinite[2]). Infinite is amazing, truly amazing, and the only way to implement it is via a kernel extension. Microsoft tried to implement it via the GUI with OneDrive's "smart files" (aka placeholders), they removed it because the files didn't work in too many places, like via syscalls and from command line. Dropbox Infinite is kind of like the source control systems Google and Microsoft created to handle their huge repos. Microsoft's GVFS uses a file system filter driver (kernel extension) called GvFlt (or ProjFS)[3]. From what I understand, Google's Piper uses FUSE[4], which would be a third-party kernel extension on macOS. My point is, these are technical achievements that provide seamless and intuitive user experiences, they aren't betrayal of trust. [1] https://www.dropbox.com/smartsync https://www.dropbox.com/smartsync [2] https://blogs.dropbox.com/tech/2016/05/going-deeper-with-project-infinite/ https://blogs.dropbox.com/tech/2016/05/going-deeper-with-pro... [3] https://www.visualstudio.com/learn/gvfs-architecture/ https://www.visualstudio.com/learn/gvfs-architecture/ [4] https://cacm.acm.org/magazines/2016/7/204032-why-google-stores-billions-of-lines-of-code-in-a-single-repository/fulltext https://cacm.acm.org/magazines/2016/7/204032-why-google-stor...

kripy 8y ago

Interesting that osquery is developed by Facebook and Santa is developed by Google. I do some work with Facebook and during a video conference with one of their employees the connection dropped out. When we reconnected I asked what happened and they said that the machine updated itself. I thought this was kind of an odd time to update and dropped it into the conversation and was told that their laptops are updated every day. Without an understanding of the inner workings of Facebook it seems like they may be snapshotting employee machines, daily.

antoncohen 8y ago
I doubt it was snapshotting. It is common to force OS updates. For macOS there are tools where the employee will be prompted to update, and can dismiss for a while, but eventually they will be forced to restart. My guess is that the Facebook employee had ignored update prompts and was then forced to update. Every day does seem odd, I can't think of an update type that would require restarts/logoff every day. At least a couple years ago Facebook and Dropbox were managing their Macs in similar ways, with similar tools, I'd be surprised if they changed to something that required daily restarts.
- antoncohen 8y ago
  Facebook has a Chef cookbook called cpe_nightly_reboot for their Macs. I can't think of why that would be required, but they must have a reason. https://github.com/facebook/IT-CPE/tree/master/chef/cookbooks/cpe_nightly_reboot https://github.com/facebook/IT-CPE/tree/master/chef/cookbook...
  - MagerValp 8y ago
    I don't work at Facebook, but I'm fairly certain this is for things like build servers, not client machines. They use Munki for software updates, which, just like you describe, gives the user a grace period where they can reboot at their leisure. Ignore it for long enough and it'll crank up the nagging, and eventually force a reboot.
    - icebraining 8y ago
      this is for things like build servers, not client machines. It talks about killing GUI processes. Is it common to run a display server on macOS servers?
      - MagerValp 8y ago
        Yes. Services that can run without a display are better run on a Linux server anyway.

stirner 8y ago

When Dropbox deliberately circumvented Apple's security features to make itself difficult to remove [1], was the company's #1 core value of "Be worthy of trust" in mind, or was that only added in retrospect? [1] http://applehelpwriter.com/2016/08/29/discovering-how-dropbox-hacks-your-mac/ http://applehelpwriter.com/2016/08/29/discovering-how-dropbo...

antoncohen 8y ago
This issue has been addressed already: https://news.ycombinator.com/item?id=12464730 https://news.ycombinator.com/item?id=12464730 I don't believe there was any intention of making Dropbox hard to uninstall. I think the intention was to make the process seamless for users, and there was a bug that caused a setting to get reapplied after a user changed it.
- saagarjha 8y ago
  I believe that Dropbox doesn't really have poor intentions here: they're trying to make their product easy to use or work better or whatever. I don't think their intentions are malicious. However, I strongly disagree with the method that they use to achieve this: installing kernel extensions, bypassing Accessibility prompts, having a hooks in every process they could possibly get their hands on, etc. is going too far. There's a reason those checks are there: they keep the user safe. Trying to get around these is, in my mind, arrogant. They think that they're better than every other company that abides by the rules. Google Drive doesn't do this. Box doesn't do this. Even iCloud Drive doesn't do what Dropbox does. I was talking to someone just two days ago, who was tearing their hair out because their application's "Open" panel took something like ten seconds to open. Why? Because the Dropbox extension decided it didn't want to play along nicely. It's foolish to think that your software will not have bugs, and outright foolhardy to do this for so little benefit.
  - antoncohen 8y ago
    Dropbox pushes the state of the art for file sync. They added sync status icons on Mac OS X before Apple had an API for it, later Apple added an API. Those icons are part of what makes the product so usable. The kernel extension is another example. AFAIK it was added for Smart Sync[1] (née Infinite[2]). Infinite is amazing, truly amazing, and the only way to implement it is via a kernel extension. Microsoft tried to implement it via the GUI with OneDrive's "smart files" (aka placeholders), they removed it because the files didn't work in too many places, like via syscalls and from command line. Dropbox Infinite is kind of like the source control systems Google and Microsoft created to handle their huge repos. Microsoft's GVFS uses a file system filter driver (kernel extension) called GvFlt (or ProjFS)[3]. From what I understand, Google's Piper uses FUSE[4], which would be a third-party kernel extension on macOS. My point is, these are technical achievements that provide seamless and intuitive user experiences, they aren't betrayal of trust. [1] https://www.dropbox.com/smartsync https://www.dropbox.com/smartsync [2] https://blogs.dropbox.com/tech/2016/05/going-deeper-with-project-infinite/ https://blogs.dropbox.com/tech/2016/05/going-deeper-with-pro... [3] https://www.visualstudio.com/learn/gvfs-architecture/ https://www.visualstudio.com/learn/gvfs-architecture/ [4] https://cacm.acm.org/magazines/2016/7/204032-why-google-stores-billions-of-lines-of-code-in-a-single-repository/fulltext https://cacm.acm.org/magazines/2016/7/204032-why-google-stor...