5 ms·

and is the hashing done by the client, or server-side? because client-side would make spoofing even easier.

• steve19 16y ago
  Client side. If you upload a very popular 500+mb file, maybe try a popular linux distribution iso, it will sync instantly.
  • taken11 16y ago
    so has someone written a client where you just enter hashes of popular files you are interested in and get them snyced to your dropbox?
    • wladimir 16y ago
      As far as I know, not yet. It's not even publicly known how exactly the deduplication API works. For example: is the hash enough to "prove" you have a file? Or do you need the file size (and potentially other properties, such as the first block) as well? The only way to find this out would be to look at the protocol that the proprietary client uses.
    • bluelu 16y ago
      10 years ago, europeonline launched a service where your traffic downlink would be routed through a satelite connection. They also had a service that let you predownload files from http/ftp servers and then you could request an offline broadcast from their servers to your home pc. Instead of refetching every file again and again, they also optimized by only checking the file size + file name. So, someone came along and created a fake ftp server script, which just replied with a listing of the things you wanted to download, and they there instantly added to your account. You only had to know the filename + filesize.
• wladimir 16y ago
  Spoofing is the easy thing, as the hashing is done in the client. You'd just have to figure out the protocol to get the file with a known hash (and other metadata, probably). However, "guessing" the hash for a file that you don't have is not. The chance that you'll get a file by trying random hashes is very very very small.