10 ms·

Given Drew runs a very privacy-focused profitable business, I'd imagine he'd have at least a slightly different perspectives on things.

by aprao 7y ago

yuvadam 7y ago
Um, how is Dropbox anything even close to "privacy-focused"?
- lacker 7y ago
  They make their money from enterprise software, for which privacy and access controls are very important. The other tech leaders on the board are more consumer-focused businesses, and consumer-focused businesses generally don't care as much about privacy.
  - sintaxi 7y ago
    1) Files are not encrypted on Dropbox servers. 2) The Dropbox client scans files on your machine that are outside the Dropbox folder. 3) collaboration with others via 3rd party app requires you to grant the app access to your entire Dropbox directory. Not only is privacy not a focus at Dropbox. It isn't even a consideration.
    - shadre 7y ago
      Do you have a source for claim #2? Please share
      - sintaxi 7y ago
        https://www.dropboxforum.com/t5/Installs-integrations/Too-high-disk-activity/td-p/109863 https://www.dropboxforum.com/t5/Installs-integrations/Too-hi...
        asveikau 7y ago
        Most people in that thread are just complaining of high disk usage without specifying where access occurs. Then page 3 has the following user report: > I'm running Windows 10 and my Dropbox is located on my E drive (E:\Dropbox). I also notice high disk activity. However when I look in Resource Monitor I noticed that the high activity generated by Dropbox.exe is on the C drive (not E). To which an employee says the reason is that dropbox is installed on C:. > Although you have your Dropbox folder on your E: drive, the application is still installed on your C: drive, so that’s why you’re seeing the activity there.
        sintaxi 7y ago
        Sorry, I did a poor job explaining. The smoking gun is CPU usage not file system activity. Perhaps you know more about this and can explain it to me. If I copy files from one place on my system that is outside of my Dropbox folder to any other location that is also outside of my Dropbox folder, how is it even possible for the Dropbox client to consume CPU resources if it isn't monitoring files outside of the Dropbox folder? Here is link showing more people reporting the same problem. Files being copied from one part of the file system to another and the Dropbox client consumes 60%-100% CPU. I cant even comprehend how that is possible. https://news.ycombinator.com/item?id=12464901 https://news.ycombinator.com/item?id=12464901
        asveikau 7y ago
        > how is it even possible for the Dropbox client to consume CPU resources if it isn't monitoring files outside of the Dropbox folder? I did not debug this or look at anything, so I can't tell you. One plausible explanation is they are effectively polling Dropbox folder instead of blocking until actual changes occurr. So maybe that hogs CPU scanning the Dropbox folder at inappropriate times, meaning that other activity on the machine has to compete for CPU time and lock acquisitions with unrelated but very noisy requests from the Dropbox client. The fact that some users say that adjusting ACLs might get their client "unstuck" would fit this theory. Maybe they had a bug that generates noisy scans on the disk when they get "access denied" in an unexpected place. But really I have no idea.
    - xwowsersx 7y ago
      You seem to be living in some imaginary world in which Dropbox is able to sell to enterprise companies of all sizes and yet privacy is not even a consideration. A little weird how most companies are extremely hesitant due to concerns about compliance, regulatory and privacy issues and yet unbeknownst to them (but known to you apparently), privacy isn't even a consideration at DB! You might have legitimate complaints about the level of security DB offers, but to claim privacy isn't even a consideration is just stretching it to absurdity because DB would have ZERO chance or selling to a large portion of its highest paying customers if privacy and security weren't considerations at all.
      - xwowsersx 7y ago
        Little weird they have a 45 page whitepaper on security even though it isn't a consideration at all! https://aem.dropbox.com/cms/content/dam/dropbox/www/en-us/business/solutions/solutions/white_paper/dfb_security_whitepaper.pdf https://aem.dropbox.com/cms/content/dam/dropbox/www/en-us/bu...
        sintaxi 7y ago
        Security and privacy are not the same thing.
      - asveikau 7y ago
        Excuse me for saying I think there is a lot of unnecessary rage-caps and hostile sarcasm in this reply. Gp is not personally attacking you, but it reads like you take threats to Dropbox's honor pretty personally. I do not think gp is living in imaginary worlds for example.
      - sintaxi 7y ago
        I haven't made any complaints about Dropbox's security. I made complaints about their privacy - which you are incredibly naive about. Have you ever built a business on the dropbox API? Have you ever had to store and manage thousands of "full access" tokens of other users? Are you aware that every 3rd party that has a "full access" token has unbound access to read any of the files since the files are unencrypted? The following url tells you how many 3rd parties have "full access" to your dropbox files. Take a moment to appreciate your privacy is dependant on the security and discretion of each and every one of those 3rd parties. https://www.dropbox.com/account/connected_apps https://www.dropbox.com/account/connected_apps
    - meowface 7y ago
      Claim 3 is false. You can jail them to specific directories.
      - sintaxi 7y ago
        Dropbox supports two types of 3rd party apps each with different file permissions. 1) Sandbox, and 2) Full Access. If you jail by registering a "Sandbox App", you give up the ability to share/collaborate in a directory with other Dropbox users. To have a third party project that provides sharing you must abandon the "Sandbox" permissions and instead request "Full Access" - which means you get a token that give you access to the users entire dropbox directory. I have several email threads with the Dropbox team discussion this issue at length. Perhaps this has changed since I was neck deep in this issue but I don't see anything in their changelog to suggest that.
        meowface 7y ago
        Ah, wasn't aware of that.
    - daniel_iversen 7y ago
      Claim 1 is 100% false also (ex Dropboxer here), they encrypt files at rest in 4MB chunks for all versions of the product (from free, pro, plus, business and enterprise). It’s in their security white paper too: https://www.dropbox.com/static/business/resources/Security_Whitepaper.pdf https://www.dropbox.com/static/business/resources/Security_W...
      - Strom 7y ago
        Claim 1 is 100% true if we're talking about end-to-end encryption where Dropbox doesn't have the key. That is more likely what the parent meant.
      - sintaxi 7y ago
        Security and privacy are not the same thing - and how the files are stored on disk is irrelevant. Obviously the files are also encrypted in transit as well. The bottom line is Dropbox holds the keys on their end and has unencrypted access to the files on while on their servers. They can read the files at will. That is not an architecture that is focused on privacy - which is fine, but it shouldn't claim to be otherwise.
  - xwowsersx 7y ago
    You're 100% correct and the replies to your comment are missing the point. People can have whatever complaints they want about the equality of encryption etc (and maybe those are valid, I don't know), but your point still stands. People here seem to be missing that when you're dealing with enterprise customers, their primary concerns are security, compliance, etc. So yes, running a company that sells to enterprise gives you a very different perspective from what you'd have running a consumer media company. Whether that helps FB I have no idea, but that's a separate debate.
    - fragmede 7y ago
      How it helps FB is that it is trying to expand its market into business software - aka using Facebook Groups and FB Messenger, on your own shard. It competes with Slack and other similar worksplace IM systems. Drew Houston's experience at Dropbox is greatly helpful as Facebook tries pushing harder into that market.
      - xwowsersx 7y ago
        Great point, thanks for this
    - kamilszybalski 7y ago
      FB has a little something called Workplace - https://work.workplace.com/ https://work.workplace.com/
      - xwowsersx 7y ago
        Right! Totally forgot about this, thanks
  - txcwpalpha 7y ago
    >They make their money from enterprise software AFAIK they don't, though. Dropbox is still primarily getting its revenue from consumers, not b2b. They have been attempting to pivot to serving more enterprise customers, but are struggling to get traction there. Given that, combined with the second part of your comment, kinda makes the parent comment's point.
ThePhysicist 7y ago
Dropbox might be secure but I wouldn’t say they are privacy focused. There are other offerings like Tresorit or Spideroak that offer end to end encryption of files, that’s more something that I’d call privacy focused.
vanusa 7y ago
One could also describe Dropbox as "corridors of power" focused. Which is pretty much the main reason they have Condaleezza Rice on their board.
tl 7y ago
My response is Condoleezza Rice [1] followed by Prism [2] followed by hysterical laughter. [1] http://www.drop-dropbox.com/ http://www.drop-dropbox.com/ [2] https://en.m.wikipedia.org/wiki/PRISM_(surveillance_program) https://en.m.wikipedia.org/wiki/PRISM_(surveillance_program)
- dang 7y ago
  > bashing Dropbox is HN-suicide That's not true, and why would you go to the trouble of making a footnote about a six-year-old thread yet skip providing the link? https://news.ycombinator.com/item?id=7566069 https://news.ycombinator.com/item?id=7566069 grellas' comment has 270+ replies, and HN's software currently paginates threads at 250 comments. That is purely for performance reasons, and I can't wait to be able to turn it off. If you go to the subsequent pages, there are many other top-level comments: https://news.ycombinator.com/item?id=7566069&p=2 https://news.ycombinator.com/item?id=7566069&p=2 https://news.ycombinator.com/item?id=7566069&p=3 https://news.ycombinator.com/item?id=7566069&p=3 https://news.ycombinator.com/item?id=7566069&p=4 https://news.ycombinator.com/item?id=7566069&p=4 grellas' comment is at the top because the ranking algorithm put it there; many of his comments have gotten upvoted heavily over the years. Moderators didn't do any of that.
- asveikau 7y ago
  People here don't like to hear things that smell like politics, but the Condi Rice thing is a big deal. Excuse my bluntness, but she was one of the public faces of thousands of preventable deaths in Iraq. To have no problem with this I think has so something to do with what people mean when they say many in tech have basic ethics problems.
mehrdada 7y ago
Where did you get "profitable" from?

Given Drew runs a very privacy-focused profitable business, I'd imagine he'd have at least a slightly different perspectives on things.

by aprao 7y ago

Given Drew runs a very privacy-focused profitable business, I'd imagine he'd have at least a slightly different perspectives on things.

yuvadam 7y ago

Um, how is Dropbox anything even close to "privacy-focused"?

lacker 7y ago
They make their money from enterprise software, for which privacy and access controls are very important. The other tech leaders on the board are more consumer-focused businesses, and consumer-focused businesses generally don't care as much about privacy.
- sintaxi 7y ago
  1) Files are not encrypted on Dropbox servers. 2) The Dropbox client scans files on your machine that are outside the Dropbox folder. 3) collaboration with others via 3rd party app requires you to grant the app access to your entire Dropbox directory. Not only is privacy not a focus at Dropbox. It isn't even a consideration.
  - shadre 7y ago
    Do you have a source for claim #2? Please share
    - sintaxi 7y ago
      https://www.dropboxforum.com/t5/Installs-integrations/Too-high-disk-activity/td-p/109863 https://www.dropboxforum.com/t5/Installs-integrations/Too-hi...
      - asveikau 7y ago
        Most people in that thread are just complaining of high disk usage without specifying where access occurs. Then page 3 has the following user report: > I'm running Windows 10 and my Dropbox is located on my E drive (E:\Dropbox). I also notice high disk activity. However when I look in Resource Monitor I noticed that the high activity generated by Dropbox.exe is on the C drive (not E). To which an employee says the reason is that dropbox is installed on C:. > Although you have your Dropbox folder on your E: drive, the application is still installed on your C: drive, so that’s why you’re seeing the activity there.
        sintaxi 7y ago
        Sorry, I did a poor job explaining. The smoking gun is CPU usage not file system activity. Perhaps you know more about this and can explain it to me. If I copy files from one place on my system that is outside of my Dropbox folder to any other location that is also outside of my Dropbox folder, how is it even possible for the Dropbox client to consume CPU resources if it isn't monitoring files outside of the Dropbox folder? Here is link showing more people reporting the same problem. Files being copied from one part of the file system to another and the Dropbox client consumes 60%-100% CPU. I cant even comprehend how that is possible. https://news.ycombinator.com/item?id=12464901 https://news.ycombinator.com/item?id=12464901
        asveikau 7y ago
        > how is it even possible for the Dropbox client to consume CPU resources if it isn't monitoring files outside of the Dropbox folder? I did not debug this or look at anything, so I can't tell you. One plausible explanation is they are effectively polling Dropbox folder instead of blocking until actual changes occurr. So maybe that hogs CPU scanning the Dropbox folder at inappropriate times, meaning that other activity on the machine has to compete for CPU time and lock acquisitions with unrelated but very noisy requests from the Dropbox client. The fact that some users say that adjusting ACLs might get their client "unstuck" would fit this theory. Maybe they had a bug that generates noisy scans on the disk when they get "access denied" in an unexpected place. But really I have no idea.
  - xwowsersx 7y ago
    You seem to be living in some imaginary world in which Dropbox is able to sell to enterprise companies of all sizes and yet privacy is not even a consideration. A little weird how most companies are extremely hesitant due to concerns about compliance, regulatory and privacy issues and yet unbeknownst to them (but known to you apparently), privacy isn't even a consideration at DB! You might have legitimate complaints about the level of security DB offers, but to claim privacy isn't even a consideration is just stretching it to absurdity because DB would have ZERO chance or selling to a large portion of its highest paying customers if privacy and security weren't considerations at all.
    - xwowsersx 7y ago
      Little weird they have a 45 page whitepaper on security even though it isn't a consideration at all! https://aem.dropbox.com/cms/content/dam/dropbox/www/en-us/business/solutions/solutions/white_paper/dfb_security_whitepaper.pdf https://aem.dropbox.com/cms/content/dam/dropbox/www/en-us/bu...
      - sintaxi 7y ago
        Security and privacy are not the same thing.
    - asveikau 7y ago
      Excuse me for saying I think there is a lot of unnecessary rage-caps and hostile sarcasm in this reply. Gp is not personally attacking you, but it reads like you take threats to Dropbox's honor pretty personally. I do not think gp is living in imaginary worlds for example.
    - sintaxi 7y ago
      I haven't made any complaints about Dropbox's security. I made complaints about their privacy - which you are incredibly naive about. Have you ever built a business on the dropbox API? Have you ever had to store and manage thousands of "full access" tokens of other users? Are you aware that every 3rd party that has a "full access" token has unbound access to read any of the files since the files are unencrypted? The following url tells you how many 3rd parties have "full access" to your dropbox files. Take a moment to appreciate your privacy is dependant on the security and discretion of each and every one of those 3rd parties. https://www.dropbox.com/account/connected_apps https://www.dropbox.com/account/connected_apps
  - meowface 7y ago
    Claim 3 is false. You can jail them to specific directories.
    - sintaxi 7y ago
      Dropbox supports two types of 3rd party apps each with different file permissions. 1) Sandbox, and 2) Full Access. If you jail by registering a "Sandbox App", you give up the ability to share/collaborate in a directory with other Dropbox users. To have a third party project that provides sharing you must abandon the "Sandbox" permissions and instead request "Full Access" - which means you get a token that give you access to the users entire dropbox directory. I have several email threads with the Dropbox team discussion this issue at length. Perhaps this has changed since I was neck deep in this issue but I don't see anything in their changelog to suggest that.
      - meowface 7y ago
        Ah, wasn't aware of that.
  - daniel_iversen 7y ago
    Claim 1 is 100% false also (ex Dropboxer here), they encrypt files at rest in 4MB chunks for all versions of the product (from free, pro, plus, business and enterprise). It’s in their security white paper too: https://www.dropbox.com/static/business/resources/Security_Whitepaper.pdf https://www.dropbox.com/static/business/resources/Security_W...
    - Strom 7y ago
      Claim 1 is 100% true if we're talking about end-to-end encryption where Dropbox doesn't have the key. That is more likely what the parent meant.
    - sintaxi 7y ago
      Security and privacy are not the same thing - and how the files are stored on disk is irrelevant. Obviously the files are also encrypted in transit as well. The bottom line is Dropbox holds the keys on their end and has unencrypted access to the files on while on their servers. They can read the files at will. That is not an architecture that is focused on privacy - which is fine, but it shouldn't claim to be otherwise.
- xwowsersx 7y ago
  You're 100% correct and the replies to your comment are missing the point. People can have whatever complaints they want about the equality of encryption etc (and maybe those are valid, I don't know), but your point still stands. People here seem to be missing that when you're dealing with enterprise customers, their primary concerns are security, compliance, etc. So yes, running a company that sells to enterprise gives you a very different perspective from what you'd have running a consumer media company. Whether that helps FB I have no idea, but that's a separate debate.
  - fragmede 7y ago
    How it helps FB is that it is trying to expand its market into business software - aka using Facebook Groups and FB Messenger, on your own shard. It competes with Slack and other similar worksplace IM systems. Drew Houston's experience at Dropbox is greatly helpful as Facebook tries pushing harder into that market.
    - xwowsersx 7y ago
      Great point, thanks for this
  - kamilszybalski 7y ago
    FB has a little something called Workplace - https://work.workplace.com/ https://work.workplace.com/
    - xwowsersx 7y ago
      Right! Totally forgot about this, thanks
- txcwpalpha 7y ago
  >They make their money from enterprise software AFAIK they don't, though. Dropbox is still primarily getting its revenue from consumers, not b2b. They have been attempting to pivot to serving more enterprise customers, but are struggling to get traction there. Given that, combined with the second part of your comment, kinda makes the parent comment's point.

ThePhysicist 7y ago

Dropbox might be secure but I wouldn’t say they are privacy focused. There are other offerings like Tresorit or Spideroak that offer end to end encryption of files, that’s more something that I’d call privacy focused.

vanusa 7y ago

One could also describe Dropbox as "corridors of power" focused. Which is pretty much the main reason they have Condaleezza Rice on their board.

tl 7y ago

My response is Condoleezza Rice [1] followed by Prism [2] followed by hysterical laughter. [1] http://www.drop-dropbox.com/ http://www.drop-dropbox.com/ [2] https://en.m.wikipedia.org/wiki/PRISM_(surveillance_program) https://en.m.wikipedia.org/wiki/PRISM_(surveillance_program)

dang 7y ago
> bashing Dropbox is HN-suicide That's not true, and why would you go to the trouble of making a footnote about a six-year-old thread yet skip providing the link? https://news.ycombinator.com/item?id=7566069 https://news.ycombinator.com/item?id=7566069 grellas' comment has 270+ replies, and HN's software currently paginates threads at 250 comments. That is purely for performance reasons, and I can't wait to be able to turn it off. If you go to the subsequent pages, there are many other top-level comments: https://news.ycombinator.com/item?id=7566069&p=2 https://news.ycombinator.com/item?id=7566069&p=2 https://news.ycombinator.com/item?id=7566069&p=3 https://news.ycombinator.com/item?id=7566069&p=3 https://news.ycombinator.com/item?id=7566069&p=4 https://news.ycombinator.com/item?id=7566069&p=4 grellas' comment is at the top because the ranking algorithm put it there; many of his comments have gotten upvoted heavily over the years. Moderators didn't do any of that.
asveikau 7y ago
People here don't like to hear things that smell like politics, but the Condi Rice thing is a big deal. Excuse my bluntness, but she was one of the public faces of thousands of preventable deaths in Iraq. To have no problem with this I think has so something to do with what people mean when they say many in tech have basic ethics problems.

mehrdada 7y ago

Where did you get "profitable" from?