20 ms·

Dropbox Attempts To Kill Open Source Project

886 points by driverdan 16y ago

thecoffman 16y ago
I can see why Dropbox would be upset about the existence of such a thing, but trying to force people to take it down seems incredibly foolish. The whole issue will garner them negative publicity and people will see it anyways thanks to the Streisand effect. I had actually missed the original post, but now thanks to their takedown attempts I've downloaded a copy for myself as its very interesting.
- cabalamat 16y ago
  > trying to force people to take it down seems incredibly foolish As does the fake DMCA takedown. If Arash Ferdowsi wants people to think he's dishonest, he's going the right way about it.
  - Goronmon 16y ago
    There was no DMCA takedown notice.
    - bigiain 16y ago
      That's not what Dropbox say: http://news.ycombinator.com/item?id=2482803 http://news.ycombinator.com/item?id=2482803 (admittedly, several hours after you posted)
      - ugh 16y ago
        There was no takedown notice. Those emails (erroneously) informed the recipient that a third party had sent a takedown request.
- apgwoz 16y ago
  Since when is any publicity ever bad? Isn't this Marketing 101?
  - burgerbrain 16y ago
    Yeah, I wish I had a time machine so I could go pick up some SCO stock.
    - apgwoz 16y ago
      Assume for a moment that this makes the nightly news. How many people in "average joe" America who don't know about Dropbox will checkout it out and say, "oh man, this is useful! and they even have a free account!" Do they care about this DMCA garbage, or what Dropbox actually did/did not do? Maybe, but the national news won't report it correctly anyway. Here's how it might be spun: "Hackers, today, are up in arms with Dropbox. The hackers claim that the illegal files being stored there were protected by the first amendment. Dropbox claims that their service could be attacked with those files and removed them."
      - burgerbrain 16y ago
        This won't make the nightly news. This will only be reported to the types of people who 1) already know about dropbox, and 2) understand the significance of DMCA takedowns made in bad faith. Bad publicity.
        apgwoz 16y ago
        You're right, it won't make the nightly news. But, you obviously have no imagination either.
        burgerbrain 16y ago
        In order to disprove the statement "there is no such thing as negative publicity" one merely needs to produce a circumstance where there is indeed negative publicity. This is pretty trivial to do, and doesn't require imagination.
cmatthias 16y ago
Wow, did not expect this from a savvy company like Dropbox. Filing a fake DMCA complaint? I think I'll take my files elsewhere.
- deleted 16y ago
  [deleted]
  - frossie 16y ago
    If I understood correctly, OP said that the Dropbox CTO stated the DMCA was "an accident". Why didn't they say it was "fake" if it was, ya know, fake?
  - deleted 16y ago
    [deleted]
  - deleted 16y ago
    [deleted]
  - deleted 16y ago
    [deleted]
  - deleted 16y ago
    [deleted]
  - cmatthias 16y ago
    Yes, there is: "We have received a notification under the Digital Millennium Copyright Act (“DMCA”) __from Dropbox__ that the following material is claimed to be infringing." (underscores mine)
  - andrewjshults 16y ago
    The article author is the one that calls it fake. Invalid probably would probably be a better choice of words.
- adamhowell 16y ago
  Well that makes one of us who can live without Dropbox. Drew would have to kill a baby panda with an elephant tusk for me to even begin thinking about switching.
jeremymcanally 16y ago
And now they see the Streisand Effect in action. This was an unfortunate reaction by them that will damage their social capital (a little at least) among one of their core markets. I doubt it'll drive them into bankruptcy, but it's irritating for me to see this sort of behavior.
- deleted 16y ago
  [deleted]
phren0logy 16y ago
The author of the software stated very clearly that he was approached by the CTO of Dropbox, who asked civilly that the repo be taken down. This seems an intentional exaggeration of the issue to drive traffic. >wladimir: Arash (the CTO) asked me to, in a really civil way. So I decided to respect his wish and take down the repository. http://news.ycombinator.com/item?id=2478688 http://news.ycombinator.com/item?id=2478688
- arkitaip 16y ago
  Or maybe to share code and knowledge with fellow coders and users.
- soult 16y ago
  This is not about the Github repository of the original developer. Someone managed to download a tar archive of the repository from github (after the repository was removed from github) and uploaded it to his public dropbox folder.
arkitaip 16y ago
What a PR disaster. There is something really wrong at Dropbox if this kind of dishonest and abusive behavior is coming from a co-founder.
deleted 16y ago
[deleted]
deleted 16y ago
[deleted]
arashf 16y ago
This is Arash from Dropbox. We removed the ability to share the project source code because it enables communications with our servers in a manner that is a violation of our Terms of Service. By our TOS, we reserve the right to terminate the account of users in this case. However, we chose to remove access to the file instead of terminating the account of the user. We recently built a tool that allows us to ban links across the sytem (as of a few weeks ago) and I wasn't aware that a DMCA takedown email would be auto-generated and sent. This was a tool built for our support team and I'd never personally used it. That said, we feel strongly that the code is a violation of our TOS and don't believe the removal of the content from our site is censorship. I'd also like to clarify that nobody's accounts were threatened: in every case my phrasing was as follows: 'I hope you can understand our position and can agree to remove the Dropship code'.
- andrewflnr 16y ago
  I thought you had to actually violate the TOS first.
- thecoffman 16y ago
  Of course you're well within your rights to remove the content from Dropbox itself as it violates your TOS - I think most people are objecting not to that, but to you requesting that copies of the source be removed from third party sites like github. The attempt to quash knowledge is the offensive part - not the enforcing of your TOS. At least that's my 2 cents.
- reynolds 16y ago
  I personally feel that Dropbox removing files from someone's account is completely wrong, regardless of your ToS. Your service is there to backup files. When you delete references to files from someone else's accounts, you're violating the trust that people put in your service.
  - arashf 16y ago
    We didn't remove the file - we simply banned public access to it.
CoffeeDregs 16y ago
Most interesting comment to that article: Thankfully all DMCA requests are filed under penalty of perjury. If he claims that he owns the copyright to material he doesn’t own, he has now opened himself up to civil litigation. Really. Seems so: http://www.aaronkellylaw.com/Internet-Law-and-Intellectual-Property-Articles/Consequences-of-filing-a-false-DMCA-Takedown-Request.shtml http://www.aaronkellylaw.com/Internet-Law-and-Intellectual-P...
- anotherjesse 16y ago
  By policing and issuing a dmca notice dropbox seems to be risking their status from "carrier/hoster"? IANAL but the dmca provides hosting sites protection against users who infringe. By actively checking for infringement of users having dropship could they be openning themselves to legal complications if they lose "hoster" status?
  - rhizome 16y ago
    You're mixing up your concepts, thinking of common carrier status that is used for communications networks. DMCA takedowns were designed so that hosting companies could avoid contributory copyright infringement accusations only. Common-carrier was designed, for example, to prevent telephone companies from being accused of contributing to crimes hatched on their wires.
- deleted 16y ago
  [deleted]
- xnerdr 16y ago
  Would the civil litigation be against the company or the person? What sort of penalties are involved in such cases? If they lose, would the winner basically own a chunk of dropbox? (sorry, none American and not a lawyer)
- rprasad 16y ago
  Not an invalid DMCA request, even assuming one was sent out. Copyright applies to original and derivative works, though multiple parties may own copyrights to a derivative work. In America, derivative works include software programs which are inseparably reliant on code or features (including APIs) of another program. It's basically the same argument that WordPress and Drupal make in regard to themes, plugins, etc., falling under the same open source licenses (i.e., copyrights) as the platforms themselves. In this case, dropship is entirely reliant on unique features of Dropbox. This makes it a derivative work, and would mean that Dropbox has copy rights over dropship. The programmer of dropship also has copyrights over dropship to the extent that the code is an original work, but Dropbox's rights trump his b/c they own the rights to the original underlying work.
duck 16y ago
Tip: If something is on the web and has been linked to via a site like HN, don't ask them to remove it no matter how bad it hurts you. It will never result in a good thing for you and will definitely hurt more afterwards.
ugh 16y ago
Understandable. Dropbox doesn't want to become a piracy website. Using a DMCA takedown request was a stupid way of dealing with the issue, though.
- mncolinlee 16y ago
  Why does everyone make the assumption that torrents and services like Dropship must be used for piracy? Major video game companies use torrents all the time to distribute patches and betas. A knife can be used to commit murder, but most often it is simply used to cut food. The problem with the way DMCA works is that it bars the development of new technologies because one of many uses could be harmful. The law stifles innovation when used this way.
  - rick888 16y ago
    "A knife can be used to commit murder, but most often it is simply used to cut food." Most of the time, a knife is used for cutting food and it can be used for murder. Most of the time, torrents are used for piracy and they can be used for legitimate and legal files. Search for "torrent" on Google. The majority of the results are search engines for pirated material (and in many cases, direct links to the torrents). See the difference?
    - TheAmazingIdiot 16y ago
      I would tentatively disagree. You are indeed correct that most Torrent Sites are mainly piracy distribution hubs. However, torrent sites are not indicative of torrent traffic by _Clients_. * From what I understand, Blizzard uses torrents to spread patches for World of Warcraft. It is also used, I believe, in Steam as well. * I would also argue that, although copyright violations, transfers of TV shows are already done via the main distributors' websites. Other than where the source is from, I do not see much a difference. I would also argue that piracy itself is a response to market failure. When it's easier to get working media (notably cracked programs and music/movies/shows) via a 3rd party distribution than from the source, there is _something_ wrong. Many times, it is because of "We wont sell to that country until $later", or "Our antipiracy software wont run on your computer", or it just is infeasible to find it. But essays have been done on this topic alone.
superuser2 16y ago
However justified you think piracy is, resisting efforts to turn a product you created for legitimate personal file sharing into a better BitTorrent is a valid business decision. That's a really incendiary headline. Yes, they tried to kill an open source product, whose purpose was to facillitate illegal file sharing over DropBox. The PR fallout from this among the tech community is probably nowhere near the fallout it would experience if it became the next Kazaa.
- ceejayoz 16y ago
  > Yes, they tried to kill an open source product, whose purpose was to facillitate illegal file sharing over DropBox. Where are you getting that information? My understanding it that its purpose was explicitly to facilitate legal file sharing over DropBox - Linux ISOs, for example.
  - sorbus 16y ago
    Linux ISOs are always the example people come up with when they're defending protocols and methods which are primarily used for illegal purposes. The original post for DropShip gave, as an example, the trailer for a movie. Not the movie itself, but the trailer. That's the equivalent of saying "I've developed this great way to share files, such as videos, but am not going to explicitly say that it could be used for piracy even though everyone knows that that's the only thing it will be used for."
    - kelnos 16y ago
      And hell, movie trailers are copyrighted too, and I assume aren't licensed for arbitrary distribution. So posting/sharing a trailer using DropShip is likely copyright infringement too.
    - calloc 16y ago
      The trailer is from the free video that was released by the Blender foundation ...
      - 16y ago
deleted 16y ago
[deleted]
tptacek 16y ago
Consider that maybe what's happening here is boring. Recognize that we all have a cognitive bias towards narratives, and especially interesting narratives. The discussion on this story is trying to build a narrative about Dropbox vs. open source developers. The real story is probably not that interesting. The CTO of a service as technically interesting as Dropbox certainly knows that he can't prevent the disclosure of their proprietary protocols. So impassioned arguments about "security through obscurity" and "the futility of trying to hide protocols" aren't adding much to the discussion. Everybody understands those things. To the extent that Dropbox's protocols factor into this story, they are obviously a fig leaf. Thus far, the only thing Dropbox is purported to have done here is to politely ask a developer to remove an application; then, presumably believing that the mirror posts were simple nerd-rage, and that the author of the application agreed with Dropbox, Dropbox's CTO filed takedowns at Github. This is not the end of the world. As has been amply demonstrated, Dropbox can't effectively suppress MIT-licensed code, and probably won't try to. Instead, consider that maybe all Dropbox is trying to do here is establish a track record of "not wanting Dropbox to become Rapidshare". This story then is not a "PR nightmare" for them; it's the expected outcome of their actions. They are trying to communicate both through words and actions that they are going to do what they can to not be Rapidshare. That Dropbox cannot technically keep determined nerds from trying to coerce them into Rapidshare's use case is also not worth arguing about. I think we all know that's true. But how many of us are going to go out of our way to stick a thumb in Dropbox's eye?
- jlcgull 16y ago
  * But how many of us are going to go out of our way to stick a thumb in Dropbox's eye? * ... and how is that not supposed be flamebait?
- anotherjesse 16y ago
  Understandable except the assertion of filing a dmca because he thinks that the reposts of code are "geek rage". The DMCA provides that you may be liable for damages (including costs and attorneys fees) if you falsely claim that an item is infringing your copyrights. Using this powerful law as a scare tactic isn't acceptable. If you wish to claim that the code was infact infringing, then the conversation is different. This seems to be: * illegal use of dmca by dropbox * dropbox says dropship using reverse engineered sync protocol broke anti-circumvention techniques or contains their copyright Either of which are bold statments
getsat 16y ago
> and reverted the lockdown on my public files Is this line terrifying to anyone else? Between this and the published security problems, I am steering clear of this service.
shad0wfax 16y ago
Strike 2, dropbox
- wewyor 16y ago
  What was strike 1? I can understand them not wanting the files to be public, but as tptacek said this is probably fluffed up quite a bit. As far as I'm concerned the only issue with how they handled it is the DMCA takedown request, and if the CTO acted as said but that is less of a factor. If the files were never removed from the persons dropbox and only public urls disabled I'm okay with that. However if the files were removed I would probably count that as all three strikes and jump ship.
  - kragen 16y ago
    Strike 1 was when they got caught lying about whether their employees could decrypt your files or not.
    - wewyor 16y ago
      I suppose so, I always took that statement to be that employees didn't have easy access to your files (such as without decrypting from the servers). It should have been obvious to anyone else remotely familiar with security that dropbox had/has access to your files from the simple fact that you could reset your password, as well as the web interface.
      - shad0wfax 16y ago
        wewyar, like kragen & iamjustlooking pointed out I considered that whole episode as strike1. I agree I am being extremely critical and have to agree in spirit that this is their real goof up. Poor security is not a reason to abandon the ship if they show an intent to fix it ASAP. What I felt a bit let down by this whole take down thing was, their initial approach was to surpress the hackers rather than fix their problem. I see in another post they seem to addressed it the loophole (?), which is the way to go. Embrace ppl tinkering this way but make your platform robust.
w1ntermute 16y ago
Here's another mirror, just in case: http://ompldr.org/vOGY0dg/laanwj-dropship-464e1c4.tar.gz http://ompldr.org/vOGY0dg/laanwj-dropship-464e1c4.tar.gz
staunch 16y ago
Is there anything Dropbox can do to prevent this de-dupe hack?
- judofyr 16y ago
  Sure: When the client has created a hashsum of the file and sent it to the server, the server can respond with a challenge: "What's the SHA1 of the bytes between X and Y" (where X and Y are random numbers). This is something both parts can easily compute and the client must have the whole file in order to answer the challenge.
shasta 16y ago
Dropbox has a simple technical recourse to prevent de-duplication from being used for file sharing - issue a random challenge (a slightly more sophisticated version of "ok, what is the 100th word in the file?") before acknowledging a collision as a true duplicate. Edit: Thinking about this a bit more, the primary expense of this scheme would probably be accessing the file to verify the challenge results. Here's a question: is there a cryptographic scheme which would allow responses to some form of challenge to be verified using a relatively small key (32 or 64 bytes would be nice), but for which it isn't feasible to rebuild the key given a few thousand sample challenges?
- power78 16y ago
  Considering Dropbox doesn't do automatic upgrades (at least on a Mac it doesn't), you can always stay at an older version of the client where this new protocol isn't supported and thus Dropship still is valid. I doubt that Dropbox would ever ban previous versions of their client purely for this purpose.
  - shasta 16y ago
    They could still do something. In cases where they have reason to suspect this is going on (which could be based on file usage patterns), they could start asking clients to send the file. Clients that start an upload and then disconnect when asked for the file are pretty much caught red handed, and you could just block their accounts until they upgrade to the next version.
  - tlrobinson 16y ago
    For older clients they could require upload of the full file (same as if the file has never been uploaded). For new clients you could use the challenge/response scheme. I believe they've already implemented the former. If the de-dup benefits were significant they could implement the latter.
- kragen 16y ago
  AIM used to ask for a cryptographic checksum of a randomly chosen byte range of the AIM executable. The Gaim (now Pidgin) developers had to set up a server that would return checksums on demand. This doesn't meet your requirement of the verifier needing a small key. Given that Dropbox apparently has no qualms about perjuring themselves in order to stop Dropship (or, as discussed in an earlier thread, lying about their security measures in order to defraud their customers), they could probably also take retaliatory action beyond just denying service to the user. Here are some possible retaliatory actions they could take: * they could publish the user's private files, or simply look through them for the user's credit card numbers. * they could sell the above data to the highest bidder. * they could use it to attempt to impersonate the user to their bank in order to empty their bank account. * they could randomly corrupt the user's data. (This might require a backdoor in the client software.) * they could wait for an unusual volume of requests from the user (perhaps indicating that the user was trying to restore from backup) before terminating the user's account without warning. * they could carefully comb through the user's files looking for evidence of any crime (illegal drug use, underage drinking, copyright infringement, possessing seditious literature, importing obscene material, defaming Islam, apostasy, embezzlement, tax evasion, whatever is the biggest no-no in their locale) and anonymously tip off the appropriate authorities. * they could insert faked evidence of such crimes into the user's files, and then tip off the appropriate authorities. Perhaps potential Dropbox users ought to be wary. This is a second data point in the company's history of seriously unethical behavior; one hopes they wouldn't engage in any tactics like the above in a dispute with a former user, if their extremely polite requests failed, but my experience is that people who behave unethically in medium-large ways often behave unethically in larger ways as well. Caveat utilitor.
jayp 16y ago
This behavior is unconscionable when there is such an obviously trivial technical solution to this problem. Here is my quick and dirty technical solution. (1) Place a restriction: only allow users who have uploaded a given file to download that file. In essence, keep an "uploaded" flag for each file/user. (2) Challenge-response to validate local copy of a globally-known file: To continue receiving the benefits of de-dup, don't actually upload an already globally-known file, but perform a challenge-response with the client on the contents of the actual file. This will still leverage most of the benefits of de-dup w.r.t bandwidth savings.
- marshray 16y ago
  I gues they're already at a point in their business where they feel like it's easier for them to try to silence their fanbase-hackers-modders-addon developers instead of just quietly fixing the issue. At least Twitter had the sense to phase-in client auth for apps before shutting down 3rd party developers.
deleted 16y ago
[deleted]
neworbit 16y ago
As much as I'd like to see companies busted for abusing the DMCA to take down things they object to, I would rather it had been one of the traditional Big Media Thugs who was on the wrong end of a lawsuit for fraudulent DMCA claims rather than Dropbox... who I otherwise like.
dporan 16y ago
The journalist A.J. Liebling said, "Freedom of the press is guaranteed only to those who own one." I guess the corollary here is, "If you don't own the server, you don't own the file." Maybe this is why Richard Stallman calls cloud computing "careless computing."
- billswift 16y ago
  Something Eric Raymond agrees with him about - http://esr.ibiblio.org/?p=932 http://esr.ibiblio.org/?p=932 Eric also had another post Three Systemic Problems with Open-Source Hosting Sites a few months later (October 2009) - http://esr.ibiblio.org/?p=1282 http://esr.ibiblio.org/?p=1282
Dubois 16y ago
It's a shame that Dropbox has resorted to attacking its users and threatening them with loss of data. Looks like it's time to clone Dropbox and offer some respectable service to users.
- injekt 16y ago
  I can't see that they've done any of this. They've been pretty polite about the whole thing. At least that's what the article says. The fact they mention that their terms give them the right to deny users access to their service at any time doesn't mean they're threatening. It's just a reminder. They're said the DMCA was a mistake and they hold their hands up to that. Aside from that, I can't see how they've done anything wrong. OK so asking the author to remove it from 3rd party sites is a bit cheeky, but that's all they did.. ask. I would have asked too, the author didn't have to. He clearly didn't want any trouble. Imo Dropbox should have just fixed then, and sat there and laughed when people tried to use Dropship and it not work. It would have saved 'Dropbox attempts to kill open source project' and may have even caused for 'Dropbox fixes file hashing issue x days after open source project built to exploit it'. That way, both win. But that's just my 2 cents
mrud 16y ago
Isn't the so called DMCA take down notice in this example not just a notification for the user that Dropbox received such a take down notice and not a DMCA takedown notice?
- spudlyo 16y ago
  Shhh. You're spoiling everyone's fun. How can you expect me to get all worked up about a notice about a non-existent notice?
dhouston 16y ago
drew from dropbox here. i hope you guys can give us the benefit of the doubt: when something pops up that encourages people to turn dropbox into the next rapidshare or equivalent (the title on HN was suggesting it could be the successor to torrents), you can imagine how that could ruin the service for everyone -- illegal file sharing has never been permitted and we take great pains to keep it off of dropbox. the internet graveyard is filled with services that didn't take this approach. so, when something like this gets called to our attention, we have to do something about it. note that this isn't even by choice -- if we don't take action, then we look like we are tacitly encouraging it. the point is not to censor or "kill" it (which is obviously impossible and would be idiotic for us to try to do), but we sent kindly worded emails to the author and other people who posted it to take it down for the good of the community so that we don't encourage an army of pirates to flock to dropbox, and they voluntarily did so. there were no legal threats or any other shenanigans to the author or people hosting -- we just want to spend all our time building a great product and not on cat-and-mouse games with people who try to turn dropbox into an illegal file sharing service against our wishes. (for what it's worth, dropship doesn't even work anymore -- we've fixed the deduplication behavior serverside to prevent "injection" of files you don't actually have, for a variety of reasons.) that said, when we disabled public sharing of that file by hash, it auto-generated an email saying we had received a DMCA takedown notice to the OP, which was incorrect and not what we intended to do, so i apologize to dan that this happened. (*edited the last paragraph: we didn't send a takedown notice, we sent a note saying that we received a DMCA takedown notice, which was also in error)
- huhtenberg 16y ago
  > we've fixed the deduplication behavior serverside Great, and that's all you should've done in this case.
  - slackerIII 16y ago
    > Great, and that's all you should've done in this case I doubt that is what the lawyers said.
    - 16y ago
Pahalial 16y ago
You know, I really don't understand the rage around this case, or more specifically that it's supposedly all coming from people who otherwise love Dropbox. So let's examine what you're (potentially) doing by forcing this issue and so on: (1) Calling down a streisand effect on Dropbox. Perhaps you believe that code is meant to be free to such an extent that this is part of your goal, so, sure. (2) They clearly have no intention of allowing DropShip to become a common use case. If your Streisand effect results in wide adoption by people who just latch onto your censorship angle, they will have to take rushed action to prevent further spread. (3) This rushed action could be a technical solution (maybe challenge-response, as mentioned) or a banhammer once they have narrowed down the use signature for dropship. -- (3a-technical) If it's the technical solution, as it was produced under rapid duress, is buggy. Suddenly, your beloved dropbox starts corrupting your files, or refusing to sync some in edge cases. Oops. Some [paying] users who never even heard about this 'censorship' issue notice this issue and take their business elsewhere, and of course it's less useful to you too as a tool until they fix it. (3a-technical alternative) It's not a buggy fix because they're supercoders. Still, their team had to put in an ungodly week to make and stress-test the fix; congratulations on ruining their quality of life for a week while still losing dropship. (3b-banhammer) Well, they figure out how to track people using dropship, and maybe institute a 3 strikes policy (2 emails, 1 ban.) So you stop using dropship after the first email, with a bit of simmering resentment at dropbox; still no dropship. Meanwhile, there are false positives because of course there are; this generates a second, far louder streisand effect, and dropbox again loses some paying customers. - In summary: sure, open-source code is meant to be free. But your actions don't exist in a vacuum. At the end of the day, Dropbox is clearly not going to tolerate dropship on its network. Consider whether you would rather keep using dropbox as it is, or shoehorn yourself into basically open war on dropbox unless you can dropship on it. (Tangentially: it was a neat enough hack, but it still doesn't seem any functionally different than sharing public URLs for the file, with the only differences being that you circumvent the bandwidth limits - again, congrats on fighting the TOS of a service you supposedly love.)
- gordonbowman 16y ago
  Well laid out. The worst crime here is taking up the invaluable time of Dropbox developers who could and should be focused elsewhere.
gettinstarted 16y ago
It seems like Dropbox has just crossed the chasm and they are building for the masses. This is a natural stage in the life cycle of any successful company. Unfortunately, that means they are going to upset some portion of its hardcore, early-adopting users.
SoftwareMaven 16y ago
The DMCA notice came as a result of an automated support system. The CTO's understanding was the system blocked access to individual files, but the real purpose is blocking access as part of DMCA requests, so it automatically sends the DMCA notices out. This wasn't somebody trying to strong-arm somebody else. It was an understandable mistake.
- driverdan 16y ago
  I agree with your assessment. It seems that the DMCA notice was a mistake, there was no real takedown issued to Dropbox.
apperoid 16y ago
Just in case here are a few other mirrors: https://github.com/apperoid/dropship https://github.com/apperoid/dropship http://min.us/mvjl61c http://min.us/mvjl61c http://www.mediafire.com/?6gplpdpib6zg5dm http://www.mediafire.com/?6gplpdpib6zg5dm https://rapidshare.com/files/459187624/driverdan-dropship-56b4296.tar.gz https://rapidshare.com/files/459187624/driverdan-dropship-56...
JCB_K 16y ago
Second, dealing with piracy is the responsibility of Dropbox. It’s not the problem of an innocent hacker who wrote some useful code that could benefit legitimate users and advocates the use of his software for “sharing photos, videos, public datasets, git-like source control, or even as building block for wiki-like distributed databases." Could someone give me 1 example of a use case here? The only reason I can think of to share the hash of a file instead of a direct link, is because it's an illegal file, and you don't want to link straight to it. Why else would you go through the effort of hashing all 4mb blocks of the file, and sharing those elsewhere? Of course, this is a dangerous gray legal area, but I think it's fair to say that the only reason to use this is because of illegal files. Also, they didn't take legal action (which wouldn't be right, as no one has been proven of doing illegal stuff), they just asked nicely, so it seems. Dropbox is right to act on this, as it could potentially ruin their platform.
- JCB_K 16y ago
  Could someone elaborate on why I was downvoted here?
  - St-Clock 16y ago
    I don't know because I thought your comment was insightful. But since this is one of the worst threads I have read since I joined HN, in terms of FUD and signal-to-noise ratio, it is not impossible that someone who misunderstood the situation downvoted you. The fact that comments like "Man you guys are dumb." (http://news.ycombinator.com/item?id=2482925 http://news.ycombinator.com/item?id=2482925) wasn't voted down is indicative of the health of this thread.
deleted 16y ago
[deleted]
rryan 16y ago
Anyone saying that Dropship has legal uses is wrong -- you're stealing from Dropbox by using it whether you're sharing your academic, public-domain dataset or your pirated movie. Dropship sidesteps the TOS of Dropbox by letting users get unlimited sharing bandwidth. Dropbox itself has a share feature which uses the exact technical mechanism by which Dropship works, except it also puts rate limits and caps on sharing. OT: This is probably the worst comments thread I've ever read on HN. It's like an echo-chamber telephone game. Jeez.
warthurton 16y ago
I spent a few minutes going over the Dropbox Terms of Service. The section I believe that they are referring to when they removed the public link is: General Prohibitions You agree not to do any of the following while using the Site, Content, Files or Services: Post, publish or transmit any text, graphics, or material that: (i) is false or misleading; (ii) is defamatory; (iii) invades another's privacy; (iv) is obscene, pornographic, or offensive; (v) promotes bigotry, racism, hatred or harm against any individual or group; (vi) infringes another's rights, including any intellectual property rights; or (vii) violates, or encourages any conduct that would violate, any applicable law or regulation or would give rise to civil liability; ... Attempt to decipher, decompile, disassemble or reverse engineer any of the software used to provide the Site, Content, Files or Services; (Excerpted in whole for clarity. Full Terms at: https://www.dropbox.com/terms#terms https://www.dropbox.com/terms#terms) Seemingly not only is posting the code for DropShip a violation, but just by me putting up this file ( http://dl.dropbox.com/u/1498040/2plus2equals5.txt http://dl.dropbox.com/u/1498040/2plus2equals5.txt ) in my public folder, I'm also violating the Terms, as I am publishing text that is false and possibly misleading.
donpark 16y ago
Forget about DMCA and other excuses. Dropship-like hacks could have huge negative impact on Dropbox business model. I can't fault them for taking actions to protect their business.
mef 16y ago
Am I the only one who finds it refreshing to see a business trying to protect itself with a friendly email rather than legal threats? Kudos to the Dropbox guys for walking that fine line with such finesse.
- wladimir 16y ago
  Yes. I think that's the only thing that's deserved to be said here. People here should just relax, I'm sure there are many companies that deserve your rage but Dropbox is not one of them. They simply asked me to take down the repository while they could work on blocking Dropship technically on the server side. No threats involved. This should be very good PR and many companies can learn from this. Sure, trying to prevent people from writing/distributing programs that use a service in unexpected ways is pointless in the long run. If something is technically possible it will be done. Hence, as some more validation is added, Dropbox will overall be a more secure service. In my opinion it was a feature instead of an exploit :) but hey, it's their service. All the meanness flunged in this thread at either me or Dropbox is completely uncalled for.
plasma 16y ago
Dropbox can decide what its servers/resources are used for, and allowing 'Dropship' to be used to transfer copyrighted files sounds like a problem they don't want - and neither would I, as a company owner. Legitimate users are not impacted at all from this recent change; people who were wanting to share copyrighted files to the masses are impacted but they aren't customers Dropbox would want in the first place. I think its disingenuous to say Dropbox shouldn't have tried to stop the project from being used; if I ran Dropbox and something came up that threatened my company and its customers I would try and stop it being used in an instant. The people Dropbox contacted voluntarily took down the project, so they must have agreed with Dropbox's logic in some form that yes perhaps the project would better off not be available. I'm not sure I like the title, "... attempts to kill open source project" as if to say open source is some how an endangered species and Dropbox is some horrible elephant killer? :) I suppose its disappointing to me when I read some comments that are immediately on the attack when it may not be warranted or fair, or put up arguments like 'torrents can be used to distribute linux ISOs' (not a real quote!) when everyone knows thats not what Dropship would be used for at all.
driverdan 16y ago
I've seen a lot of comments that misunderstand the DMCA. Many people seem fixated on this issue. Had I realized this would be the case I wouldn't have emphasized it as much. It was an automatic email sent by mistake and was retracted by when discovered. It's certainly an issue worth mentioning and discussing but don't fixate on it. Don't get me wrong, I was completely enraged when I received it but I think Dropbox has done well in addressing it.
deleted 16y ago
[deleted]
ramanujan 16y ago
Dan DeFilippi: "In my unhumble opinion censorship is never an option." Dan DeFilippi would certainly not like it if all his documents and code from his personal hard drive were splashed across the internet. What he considers "censorship", another person would call "not pushing someone in front of a train". He knows full well that (a) Dropbox is a pretty friendly company with reasonable people solving a real problem and (b) the RIAA and MPAA are NOT friendly and NOT reasonable. This linkbait title ("kill open source project") is the equivalent of police going after students for bike tickets while avoiding the dangerous parts of town. Dan DeFilippi is going after the good citizen (Dropbox) for the minor philosophical crime of not supporting everything that calls itself "open source", while completely lacking the balls to actually take on the real bad guys here, namely the RIAA and MPAA's real lawsuits. Indeed, even if he did set up his own torrent server, they'd ignore him for a while. Dropbox has financial resources, so they'd actually be the target. So DeFilippi is getting behind them and trying to push them in a fight that is certainly NOT one they want to engage in, without taking any personal risk himself. Not particularly ethical, IMHO.
sha90 16y ago
Forked so that I can hopefully get one of those cool friendly emails!
arethuza 16y ago
What a completely unedifying spectacle: - Overblown "geek rage" over a non-existent DMCA takedown notice and bizarre "legal" arguments - A company mishandling a security flaw by asking a developer to remove code that exposes the problem rather than simply fixing the problem and leaving the code in wild to demonstrate that the flaw doesn't exist anymore I use DropBox, although I wouldn't say I depend on it. What this episode did make me appreciate is the degree to which DropBox is a closed product - there may be good commercial reasons for this but as a consumer I'd rather use a service that has at least an open and documented interface (even if the implementations are still proprietary).
mborromeo 16y ago
If you spend so much time, passion and money building a product like Dropbox you will try to defend it from every kind of threat: today the "piracy" topic is a hot one, sounds like its worse than killing someone, and Dropbox is hit by this "piracy" threat. I fully understand and respect Dropbox founders positions, and the DMCA issue is clearly a bug in my opinion (i wouldn't automatically send those kind of communications upon a system-forced file deletion, however).
cnicolaou 16y ago
The title of the post +HN post should be changed after the author updated his entry and clarified Dropbox' position.
forkrulassail 16y ago
Just lost all my respect for them.
leon_ 16y ago
Way to alienate customers, Dropbox. I gonna cancel our teams account and refrain from using dropbox alltogether.
p09p09p09 16y ago
OTOH, wouldn't it be neat if a distributed Tahoe-LAFS supported dropship-like functionality as a feature?

886 points by driverdan 16y ago

I can see why Dropbox would be upset about the existence of such a thing, but trying to force people to take it down seems incredibly foolish. The whole issue will garner them negative publicity and people will see it anyways thanks to the Streisand effect. I had actually missed the original post, but now thanks to their takedown attempts I've downloaded a copy for myself as its very interesting.

cabalamat 16y ago
> trying to force people to take it down seems incredibly foolish As does the fake DMCA takedown. If Arash Ferdowsi wants people to think he's dishonest, he's going the right way about it.
- Goronmon 16y ago
  There was no DMCA takedown notice.
  - bigiain 16y ago
    That's not what Dropbox say: http://news.ycombinator.com/item?id=2482803 http://news.ycombinator.com/item?id=2482803 (admittedly, several hours after you posted)
    - ugh 16y ago
      There was no takedown notice. Those emails (erroneously) informed the recipient that a third party had sent a takedown request.
apgwoz 16y ago
Since when is any publicity ever bad? Isn't this Marketing 101?
- burgerbrain 16y ago
  Yeah, I wish I had a time machine so I could go pick up some SCO stock.
  - apgwoz 16y ago
    Assume for a moment that this makes the nightly news. How many people in "average joe" America who don't know about Dropbox will checkout it out and say, "oh man, this is useful! and they even have a free account!" Do they care about this DMCA garbage, or what Dropbox actually did/did not do? Maybe, but the national news won't report it correctly anyway. Here's how it might be spun: "Hackers, today, are up in arms with Dropbox. The hackers claim that the illegal files being stored there were protected by the first amendment. Dropbox claims that their service could be attacked with those files and removed them."
    - burgerbrain 16y ago
      This won't make the nightly news. This will only be reported to the types of people who 1) already know about dropbox, and 2) understand the significance of DMCA takedowns made in bad faith. Bad publicity.
      - apgwoz 16y ago
        You're right, it won't make the nightly news. But, you obviously have no imagination either.
        burgerbrain 16y ago
        In order to disprove the statement "there is no such thing as negative publicity" one merely needs to produce a circumstance where there is indeed negative publicity. This is pretty trivial to do, and doesn't require imagination.

cmatthias 16y ago

Wow, did not expect this from a savvy company like Dropbox. Filing a fake DMCA complaint? I think I'll take my files elsewhere.

deleted 16y ago
[deleted]
- frossie 16y ago
  If I understood correctly, OP said that the Dropbox CTO stated the DMCA was "an accident". Why didn't they say it was "fake" if it was, ya know, fake?
- deleted 16y ago
  [deleted]
- deleted 16y ago
  [deleted]
- deleted 16y ago
  [deleted]
- deleted 16y ago
  [deleted]
- cmatthias 16y ago
  Yes, there is: "We have received a notification under the Digital Millennium Copyright Act (“DMCA”) __from Dropbox__ that the following material is claimed to be infringing." (underscores mine)
- andrewjshults 16y ago
  The article author is the one that calls it fake. Invalid probably would probably be a better choice of words.
adamhowell 16y ago
Well that makes one of us who can live without Dropbox. Drew would have to kill a baby panda with an elephant tusk for me to even begin thinking about switching.

jeremymcanally 16y ago

And now they see the Streisand Effect in action. This was an unfortunate reaction by them that will damage their social capital (a little at least) among one of their core markets. I doubt it'll drive them into bankruptcy, but it's irritating for me to see this sort of behavior.

deleted 16y ago
[deleted]

phren0logy 16y ago

The author of the software stated very clearly that he was approached by the CTO of Dropbox, who asked civilly that the repo be taken down. This seems an intentional exaggeration of the issue to drive traffic. >wladimir: Arash (the CTO) asked me to, in a really civil way. So I decided to respect his wish and take down the repository. http://news.ycombinator.com/item?id=2478688 http://news.ycombinator.com/item?id=2478688

arkitaip 16y ago
Or maybe to share code and knowledge with fellow coders and users.
soult 16y ago
This is not about the Github repository of the original developer. Someone managed to download a tar archive of the repository from github (after the repository was removed from github) and uploaded it to his public dropbox folder.

arkitaip 16y ago

What a PR disaster. There is something really wrong at Dropbox if this kind of dishonest and abusive behavior is coming from a co-founder.

deleted 16y ago

[deleted]

deleted 16y ago

[deleted]

arashf 16y ago

This is Arash from Dropbox. We removed the ability to share the project source code because it enables communications with our servers in a manner that is a violation of our Terms of Service. By our TOS, we reserve the right to terminate the account of users in this case. However, we chose to remove access to the file instead of terminating the account of the user. We recently built a tool that allows us to ban links across the sytem (as of a few weeks ago) and I wasn't aware that a DMCA takedown email would be auto-generated and sent. This was a tool built for our support team and I'd never personally used it. That said, we feel strongly that the code is a violation of our TOS and don't believe the removal of the content from our site is censorship. I'd also like to clarify that nobody's accounts were threatened: in every case my phrasing was as follows: 'I hope you can understand our position and can agree to remove the Dropship code'.

andrewflnr 16y ago
I thought you had to actually violate the TOS first.
thecoffman 16y ago
Of course you're well within your rights to remove the content from Dropbox itself as it violates your TOS - I think most people are objecting not to that, but to you requesting that copies of the source be removed from third party sites like github. The attempt to quash knowledge is the offensive part - not the enforcing of your TOS. At least that's my 2 cents.
reynolds 16y ago
I personally feel that Dropbox removing files from someone's account is completely wrong, regardless of your ToS. Your service is there to backup files. When you delete references to files from someone else's accounts, you're violating the trust that people put in your service.
- arashf 16y ago
  We didn't remove the file - we simply banned public access to it.

CoffeeDregs 16y ago

Most interesting comment to that article: Thankfully all DMCA requests are filed under penalty of perjury. If he claims that he owns the copyright to material he doesn’t own, he has now opened himself up to civil litigation. Really. Seems so: http://www.aaronkellylaw.com/Internet-Law-and-Intellectual-Property-Articles/Consequences-of-filing-a-false-DMCA-Takedown-Request.shtml http://www.aaronkellylaw.com/Internet-Law-and-Intellectual-P...

anotherjesse 16y ago
By policing and issuing a dmca notice dropbox seems to be risking their status from "carrier/hoster"? IANAL but the dmca provides hosting sites protection against users who infringe. By actively checking for infringement of users having dropship could they be openning themselves to legal complications if they lose "hoster" status?
- rhizome 16y ago
  You're mixing up your concepts, thinking of common carrier status that is used for communications networks. DMCA takedowns were designed so that hosting companies could avoid contributory copyright infringement accusations only. Common-carrier was designed, for example, to prevent telephone companies from being accused of contributing to crimes hatched on their wires.
deleted 16y ago
[deleted]
xnerdr 16y ago
Would the civil litigation be against the company or the person? What sort of penalties are involved in such cases? If they lose, would the winner basically own a chunk of dropbox? (sorry, none American and not a lawyer)
rprasad 16y ago
Not an invalid DMCA request, even assuming one was sent out. Copyright applies to original and derivative works, though multiple parties may own copyrights to a derivative work. In America, derivative works include software programs which are inseparably reliant on code or features (including APIs) of another program. It's basically the same argument that WordPress and Drupal make in regard to themes, plugins, etc., falling under the same open source licenses (i.e., copyrights) as the platforms themselves. In this case, dropship is entirely reliant on unique features of Dropbox. This makes it a derivative work, and would mean that Dropbox has copy rights over dropship. The programmer of dropship also has copyrights over dropship to the extent that the code is an original work, but Dropbox's rights trump his b/c they own the rights to the original underlying work.

duck 16y ago

Tip: If something is on the web and has been linked to via a site like HN, don't ask them to remove it no matter how bad it hurts you. It will never result in a good thing for you and will definitely hurt more afterwards.

ugh 16y ago

Understandable. Dropbox doesn't want to become a piracy website. Using a DMCA takedown request was a stupid way of dealing with the issue, though.

mncolinlee 16y ago
Why does everyone make the assumption that torrents and services like Dropship must be used for piracy? Major video game companies use torrents all the time to distribute patches and betas. A knife can be used to commit murder, but most often it is simply used to cut food. The problem with the way DMCA works is that it bars the development of new technologies because one of many uses could be harmful. The law stifles innovation when used this way.
- rick888 16y ago
  "A knife can be used to commit murder, but most often it is simply used to cut food." Most of the time, a knife is used for cutting food and it can be used for murder. Most of the time, torrents are used for piracy and they can be used for legitimate and legal files. Search for "torrent" on Google. The majority of the results are search engines for pirated material (and in many cases, direct links to the torrents). See the difference?
  - TheAmazingIdiot 16y ago
    I would tentatively disagree. You are indeed correct that most Torrent Sites are mainly piracy distribution hubs. However, torrent sites are not indicative of torrent traffic by _Clients_. * From what I understand, Blizzard uses torrents to spread patches for World of Warcraft. It is also used, I believe, in Steam as well. * I would also argue that, although copyright violations, transfers of TV shows are already done via the main distributors' websites. Other than where the source is from, I do not see much a difference. I would also argue that piracy itself is a response to market failure. When it's easier to get working media (notably cracked programs and music/movies/shows) via a 3rd party distribution than from the source, there is _something_ wrong. Many times, it is because of "We wont sell to that country until $later", or "Our antipiracy software wont run on your computer", or it just is infeasible to find it. But essays have been done on this topic alone.

superuser2 16y ago

However justified you think piracy is, resisting efforts to turn a product you created for legitimate personal file sharing into a better BitTorrent is a valid business decision. That's a really incendiary headline. Yes, they tried to kill an open source product, whose purpose was to facillitate illegal file sharing over DropBox. The PR fallout from this among the tech community is probably nowhere near the fallout it would experience if it became the next Kazaa.

ceejayoz 16y ago
> Yes, they tried to kill an open source product, whose purpose was to facillitate illegal file sharing over DropBox. Where are you getting that information? My understanding it that its purpose was explicitly to facilitate legal file sharing over DropBox - Linux ISOs, for example.
- sorbus 16y ago
  Linux ISOs are always the example people come up with when they're defending protocols and methods which are primarily used for illegal purposes. The original post for DropShip gave, as an example, the trailer for a movie. Not the movie itself, but the trailer. That's the equivalent of saying "I've developed this great way to share files, such as videos, but am not going to explicitly say that it could be used for piracy even though everyone knows that that's the only thing it will be used for."
  - kelnos 16y ago
    And hell, movie trailers are copyrighted too, and I assume aren't licensed for arbitrary distribution. So posting/sharing a trailer using DropShip is likely copyright infringement too.
  - calloc 16y ago
    The trailer is from the free video that was released by the Blender foundation ...
    - 16y ago

deleted 16y ago

[deleted]

tptacek 16y ago

Consider that maybe what's happening here is boring. Recognize that we all have a cognitive bias towards narratives, and especially interesting narratives. The discussion on this story is trying to build a narrative about Dropbox vs. open source developers. The real story is probably not that interesting. The CTO of a service as technically interesting as Dropbox certainly knows that he can't prevent the disclosure of their proprietary protocols. So impassioned arguments about "security through obscurity" and "the futility of trying to hide protocols" aren't adding much to the discussion. Everybody understands those things. To the extent that Dropbox's protocols factor into this story, they are obviously a fig leaf. Thus far, the only thing Dropbox is purported to have done here is to politely ask a developer to remove an application; then, presumably believing that the mirror posts were simple nerd-rage, and that the author of the application agreed with Dropbox, Dropbox's CTO filed takedowns at Github. This is not the end of the world. As has been amply demonstrated, Dropbox can't effectively suppress MIT-licensed code, and probably won't try to. Instead, consider that maybe all Dropbox is trying to do here is establish a track record of "not wanting Dropbox to become Rapidshare". This story then is not a "PR nightmare" for them; it's the expected outcome of their actions. They are trying to communicate both through words and actions that they are going to do what they can to not be Rapidshare. That Dropbox cannot technically keep determined nerds from trying to coerce them into Rapidshare's use case is also not worth arguing about. I think we all know that's true. But how many of us are going to go out of our way to stick a thumb in Dropbox's eye?

jlcgull 16y ago
* But how many of us are going to go out of our way to stick a thumb in Dropbox's eye? * ... and how is that not supposed be flamebait?
anotherjesse 16y ago
Understandable except the assertion of filing a dmca because he thinks that the reposts of code are "geek rage". The DMCA provides that you may be liable for damages (including costs and attorneys fees) if you falsely claim that an item is infringing your copyrights. Using this powerful law as a scare tactic isn't acceptable. If you wish to claim that the code was infact infringing, then the conversation is different. This seems to be: * illegal use of dmca by dropbox * dropbox says dropship using reverse engineered sync protocol broke anti-circumvention techniques or contains their copyright Either of which are bold statments

getsat 16y ago

> and reverted the lockdown on my public files Is this line terrifying to anyone else? Between this and the published security problems, I am steering clear of this service.

shad0wfax 16y ago

Strike 2, dropbox

wewyor 16y ago
What was strike 1? I can understand them not wanting the files to be public, but as tptacek said this is probably fluffed up quite a bit. As far as I'm concerned the only issue with how they handled it is the DMCA takedown request, and if the CTO acted as said but that is less of a factor. If the files were never removed from the persons dropbox and only public urls disabled I'm okay with that. However if the files were removed I would probably count that as all three strikes and jump ship.
- kragen 16y ago
  Strike 1 was when they got caught lying about whether their employees could decrypt your files or not.
  - wewyor 16y ago
    I suppose so, I always took that statement to be that employees didn't have easy access to your files (such as without decrypting from the servers). It should have been obvious to anyone else remotely familiar with security that dropbox had/has access to your files from the simple fact that you could reset your password, as well as the web interface.
    - shad0wfax 16y ago
      wewyar, like kragen & iamjustlooking pointed out I considered that whole episode as strike1. I agree I am being extremely critical and have to agree in spirit that this is their real goof up. Poor security is not a reason to abandon the ship if they show an intent to fix it ASAP. What I felt a bit let down by this whole take down thing was, their initial approach was to surpress the hackers rather than fix their problem. I see in another post they seem to addressed it the loophole (?), which is the way to go. Embrace ppl tinkering this way but make your platform robust.

w1ntermute 16y ago

Here's another mirror, just in case: http://ompldr.org/vOGY0dg/laanwj-dropship-464e1c4.tar.gz http://ompldr.org/vOGY0dg/laanwj-dropship-464e1c4.tar.gz

staunch 16y ago

Is there anything Dropbox can do to prevent this de-dupe hack?

judofyr 16y ago
Sure: When the client has created a hashsum of the file and sent it to the server, the server can respond with a challenge: "What's the SHA1 of the bytes between X and Y" (where X and Y are random numbers). This is something both parts can easily compute and the client must have the whole file in order to answer the challenge.

shasta 16y ago

Dropbox has a simple technical recourse to prevent de-duplication from being used for file sharing - issue a random challenge (a slightly more sophisticated version of "ok, what is the 100th word in the file?") before acknowledging a collision as a true duplicate. Edit: Thinking about this a bit more, the primary expense of this scheme would probably be accessing the file to verify the challenge results. Here's a question: is there a cryptographic scheme which would allow responses to some form of challenge to be verified using a relatively small key (32 or 64 bytes would be nice), but for which it isn't feasible to rebuild the key given a few thousand sample challenges?

power78 16y ago
Considering Dropbox doesn't do automatic upgrades (at least on a Mac it doesn't), you can always stay at an older version of the client where this new protocol isn't supported and thus Dropship still is valid. I doubt that Dropbox would ever ban previous versions of their client purely for this purpose.
- shasta 16y ago
  They could still do something. In cases where they have reason to suspect this is going on (which could be based on file usage patterns), they could start asking clients to send the file. Clients that start an upload and then disconnect when asked for the file are pretty much caught red handed, and you could just block their accounts until they upgrade to the next version.
- tlrobinson 16y ago
  For older clients they could require upload of the full file (same as if the file has never been uploaded). For new clients you could use the challenge/response scheme. I believe they've already implemented the former. If the de-dup benefits were significant they could implement the latter.
kragen 16y ago
AIM used to ask for a cryptographic checksum of a randomly chosen byte range of the AIM executable. The Gaim (now Pidgin) developers had to set up a server that would return checksums on demand. This doesn't meet your requirement of the verifier needing a small key. Given that Dropbox apparently has no qualms about perjuring themselves in order to stop Dropship (or, as discussed in an earlier thread, lying about their security measures in order to defraud their customers), they could probably also take retaliatory action beyond just denying service to the user. Here are some possible retaliatory actions they could take: * they could publish the user's private files, or simply look through them for the user's credit card numbers. * they could sell the above data to the highest bidder. * they could use it to attempt to impersonate the user to their bank in order to empty their bank account. * they could randomly corrupt the user's data. (This might require a backdoor in the client software.) * they could wait for an unusual volume of requests from the user (perhaps indicating that the user was trying to restore from backup) before terminating the user's account without warning. * they could carefully comb through the user's files looking for evidence of any crime (illegal drug use, underage drinking, copyright infringement, possessing seditious literature, importing obscene material, defaming Islam, apostasy, embezzlement, tax evasion, whatever is the biggest no-no in their locale) and anonymously tip off the appropriate authorities. * they could insert faked evidence of such crimes into the user's files, and then tip off the appropriate authorities. Perhaps potential Dropbox users ought to be wary. This is a second data point in the company's history of seriously unethical behavior; one hopes they wouldn't engage in any tactics like the above in a dispute with a former user, if their extremely polite requests failed, but my experience is that people who behave unethically in medium-large ways often behave unethically in larger ways as well. Caveat utilitor.

jayp 16y ago

This behavior is unconscionable when there is such an obviously trivial technical solution to this problem. Here is my quick and dirty technical solution. (1) Place a restriction: only allow users who have uploaded a given file to download that file. In essence, keep an "uploaded" flag for each file/user. (2) Challenge-response to validate local copy of a globally-known file: To continue receiving the benefits of de-dup, don't actually upload an already globally-known file, but perform a challenge-response with the client on the contents of the actual file. This will still leverage most of the benefits of de-dup w.r.t bandwidth savings.

marshray 16y ago
I gues they're already at a point in their business where they feel like it's easier for them to try to silence their fanbase-hackers-modders-addon developers instead of just quietly fixing the issue. At least Twitter had the sense to phase-in client auth for apps before shutting down 3rd party developers.

deleted 16y ago

[deleted]

neworbit 16y ago

As much as I'd like to see companies busted for abusing the DMCA to take down things they object to, I would rather it had been one of the traditional Big Media Thugs who was on the wrong end of a lawsuit for fraudulent DMCA claims rather than Dropbox... who I otherwise like.

dporan 16y ago

The journalist A.J. Liebling said, "Freedom of the press is guaranteed only to those who own one." I guess the corollary here is, "If you don't own the server, you don't own the file." Maybe this is why Richard Stallman calls cloud computing "careless computing."

billswift 16y ago
Something Eric Raymond agrees with him about - http://esr.ibiblio.org/?p=932 http://esr.ibiblio.org/?p=932 Eric also had another post Three Systemic Problems with Open-Source Hosting Sites a few months later (October 2009) - http://esr.ibiblio.org/?p=1282 http://esr.ibiblio.org/?p=1282

Dubois 16y ago

It's a shame that Dropbox has resorted to attacking its users and threatening them with loss of data. Looks like it's time to clone Dropbox and offer some respectable service to users.

injekt 16y ago
I can't see that they've done any of this. They've been pretty polite about the whole thing. At least that's what the article says. The fact they mention that their terms give them the right to deny users access to their service at any time doesn't mean they're threatening. It's just a reminder. They're said the DMCA was a mistake and they hold their hands up to that. Aside from that, I can't see how they've done anything wrong. OK so asking the author to remove it from 3rd party sites is a bit cheeky, but that's all they did.. ask. I would have asked too, the author didn't have to. He clearly didn't want any trouble. Imo Dropbox should have just fixed then, and sat there and laughed when people tried to use Dropship and it not work. It would have saved 'Dropbox attempts to kill open source project' and may have even caused for 'Dropbox fixes file hashing issue x days after open source project built to exploit it'. That way, both win. But that's just my 2 cents

mrud 16y ago

Isn't the so called DMCA take down notice in this example not just a notification for the user that Dropbox received such a take down notice and not a DMCA takedown notice?

spudlyo 16y ago
Shhh. You're spoiling everyone's fun. How can you expect me to get all worked up about a notice about a non-existent notice?

dhouston 16y ago

drew from dropbox here. i hope you guys can give us the benefit of the doubt: when something pops up that encourages people to turn dropbox into the next rapidshare or equivalent (the title on HN was suggesting it could be the successor to torrents), you can imagine how that could ruin the service for everyone -- illegal file sharing has never been permitted and we take great pains to keep it off of dropbox. the internet graveyard is filled with services that didn't take this approach. so, when something like this gets called to our attention, we have to do something about it. note that this isn't even by choice -- if we don't take action, then we look like we are tacitly encouraging it. the point is not to censor or "kill" it (which is obviously impossible and would be idiotic for us to try to do), but we sent kindly worded emails to the author and other people who posted it to take it down for the good of the community so that we don't encourage an army of pirates to flock to dropbox, and they voluntarily did so. there were no legal threats or any other shenanigans to the author or people hosting -- we just want to spend all our time building a great product and not on cat-and-mouse games with people who try to turn dropbox into an illegal file sharing service against our wishes. (for what it's worth, dropship doesn't even work anymore -- we've fixed the deduplication behavior serverside to prevent "injection" of files you don't actually have, for a variety of reasons.) that said, when we disabled public sharing of that file by hash, it auto-generated an email saying we had received a DMCA takedown notice to the OP, which was incorrect and not what we intended to do, so i apologize to dan that this happened. (*edited the last paragraph: we didn't send a takedown notice, we sent a note saying that we received a DMCA takedown notice, which was also in error)

huhtenberg 16y ago
> we've fixed the deduplication behavior serverside Great, and that's all you should've done in this case.
- slackerIII 16y ago
  > Great, and that's all you should've done in this case I doubt that is what the lawyers said.
  - 16y ago

Pahalial 16y ago

You know, I really don't understand the rage around this case, or more specifically that it's supposedly all coming from people who otherwise love Dropbox. So let's examine what you're (potentially) doing by forcing this issue and so on: (1) Calling down a streisand effect on Dropbox. Perhaps you believe that code is meant to be free to such an extent that this is part of your goal, so, sure. (2) They clearly have no intention of allowing DropShip to become a common use case. If your Streisand effect results in wide adoption by people who just latch onto your censorship angle, they will have to take rushed action to prevent further spread. (3) This rushed action could be a technical solution (maybe challenge-response, as mentioned) or a banhammer once they have narrowed down the use signature for dropship. -- (3a-technical) If it's the technical solution, as it was produced under rapid duress, is buggy. Suddenly, your beloved dropbox starts corrupting your files, or refusing to sync some in edge cases. Oops. Some [paying] users who never even heard about this 'censorship' issue notice this issue and take their business elsewhere, and of course it's less useful to you too as a tool until they fix it. (3a-technical alternative) It's not a buggy fix because they're supercoders. Still, their team had to put in an ungodly week to make and stress-test the fix; congratulations on ruining their quality of life for a week while still losing dropship. (3b-banhammer) Well, they figure out how to track people using dropship, and maybe institute a 3 strikes policy (2 emails, 1 ban.) So you stop using dropship after the first email, with a bit of simmering resentment at dropbox; still no dropship. Meanwhile, there are false positives because of course there are; this generates a second, far louder streisand effect, and dropbox again loses some paying customers. - In summary: sure, open-source code is meant to be free. But your actions don't exist in a vacuum. At the end of the day, Dropbox is clearly not going to tolerate dropship on its network. Consider whether you would rather keep using dropbox as it is, or shoehorn yourself into basically open war on dropbox unless you can dropship on it. (Tangentially: it was a neat enough hack, but it still doesn't seem any functionally different than sharing public URLs for the file, with the only differences being that you circumvent the bandwidth limits - again, congrats on fighting the TOS of a service you supposedly love.)

gordonbowman 16y ago
Well laid out. The worst crime here is taking up the invaluable time of Dropbox developers who could and should be focused elsewhere.

gettinstarted 16y ago

It seems like Dropbox has just crossed the chasm and they are building for the masses. This is a natural stage in the life cycle of any successful company. Unfortunately, that means they are going to upset some portion of its hardcore, early-adopting users.

SoftwareMaven 16y ago

The DMCA notice came as a result of an automated support system. The CTO's understanding was the system blocked access to individual files, but the real purpose is blocking access as part of DMCA requests, so it automatically sends the DMCA notices out. This wasn't somebody trying to strong-arm somebody else. It was an understandable mistake.

driverdan 16y ago
I agree with your assessment. It seems that the DMCA notice was a mistake, there was no real takedown issued to Dropbox.

apperoid 16y ago

Just in case here are a few other mirrors: https://github.com/apperoid/dropship https://github.com/apperoid/dropship http://min.us/mvjl61c http://min.us/mvjl61c http://www.mediafire.com/?6gplpdpib6zg5dm http://www.mediafire.com/?6gplpdpib6zg5dm https://rapidshare.com/files/459187624/driverdan-dropship-56b4296.tar.gz https://rapidshare.com/files/459187624/driverdan-dropship-56...

JCB_K 16y ago

Second, dealing with piracy is the responsibility of Dropbox. It’s not the problem of an innocent hacker who wrote some useful code that could benefit legitimate users and advocates the use of his software for “sharing photos, videos, public datasets, git-like source control, or even as building block for wiki-like distributed databases." Could someone give me 1 example of a use case here? The only reason I can think of to share the hash of a file instead of a direct link, is because it's an illegal file, and you don't want to link straight to it. Why else would you go through the effort of hashing all 4mb blocks of the file, and sharing those elsewhere? Of course, this is a dangerous gray legal area, but I think it's fair to say that the only reason to use this is because of illegal files. Also, they didn't take legal action (which wouldn't be right, as no one has been proven of doing illegal stuff), they just asked nicely, so it seems. Dropbox is right to act on this, as it could potentially ruin their platform.

JCB_K 16y ago
Could someone elaborate on why I was downvoted here?
- St-Clock 16y ago
  I don't know because I thought your comment was insightful. But since this is one of the worst threads I have read since I joined HN, in terms of FUD and signal-to-noise ratio, it is not impossible that someone who misunderstood the situation downvoted you. The fact that comments like "Man you guys are dumb." (http://news.ycombinator.com/item?id=2482925 http://news.ycombinator.com/item?id=2482925) wasn't voted down is indicative of the health of this thread.

deleted 16y ago

[deleted]

rryan 16y ago

Anyone saying that Dropship has legal uses is wrong -- you're stealing from Dropbox by using it whether you're sharing your academic, public-domain dataset or your pirated movie. Dropship sidesteps the TOS of Dropbox by letting users get unlimited sharing bandwidth. Dropbox itself has a share feature which uses the exact technical mechanism by which Dropship works, except it also puts rate limits and caps on sharing. OT: This is probably the worst comments thread I've ever read on HN. It's like an echo-chamber telephone game. Jeez.

warthurton 16y ago

I spent a few minutes going over the Dropbox Terms of Service. The section I believe that they are referring to when they removed the public link is: General Prohibitions You agree not to do any of the following while using the Site, Content, Files or Services: Post, publish or transmit any text, graphics, or material that: (i) is false or misleading; (ii) is defamatory; (iii) invades another's privacy; (iv) is obscene, pornographic, or offensive; (v) promotes bigotry, racism, hatred or harm against any individual or group; (vi) infringes another's rights, including any intellectual property rights; or (vii) violates, or encourages any conduct that would violate, any applicable law or regulation or would give rise to civil liability; ... Attempt to decipher, decompile, disassemble or reverse engineer any of the software used to provide the Site, Content, Files or Services; (Excerpted in whole for clarity. Full Terms at: https://www.dropbox.com/terms#terms https://www.dropbox.com/terms#terms) Seemingly not only is posting the code for DropShip a violation, but just by me putting up this file ( http://dl.dropbox.com/u/1498040/2plus2equals5.txt http://dl.dropbox.com/u/1498040/2plus2equals5.txt ) in my public folder, I'm also violating the Terms, as I am publishing text that is false and possibly misleading.

donpark 16y ago

Forget about DMCA and other excuses. Dropship-like hacks could have huge negative impact on Dropbox business model. I can't fault them for taking actions to protect their business.

mef 16y ago

Am I the only one who finds it refreshing to see a business trying to protect itself with a friendly email rather than legal threats? Kudos to the Dropbox guys for walking that fine line with such finesse.

wladimir 16y ago
Yes. I think that's the only thing that's deserved to be said here. People here should just relax, I'm sure there are many companies that deserve your rage but Dropbox is not one of them. They simply asked me to take down the repository while they could work on blocking Dropship technically on the server side. No threats involved. This should be very good PR and many companies can learn from this. Sure, trying to prevent people from writing/distributing programs that use a service in unexpected ways is pointless in the long run. If something is technically possible it will be done. Hence, as some more validation is added, Dropbox will overall be a more secure service. In my opinion it was a feature instead of an exploit :) but hey, it's their service. All the meanness flunged in this thread at either me or Dropbox is completely uncalled for.

plasma 16y ago

Dropbox can decide what its servers/resources are used for, and allowing 'Dropship' to be used to transfer copyrighted files sounds like a problem they don't want - and neither would I, as a company owner. Legitimate users are not impacted at all from this recent change; people who were wanting to share copyrighted files to the masses are impacted but they aren't customers Dropbox would want in the first place. I think its disingenuous to say Dropbox shouldn't have tried to stop the project from being used; if I ran Dropbox and something came up that threatened my company and its customers I would try and stop it being used in an instant. The people Dropbox contacted voluntarily took down the project, so they must have agreed with Dropbox's logic in some form that yes perhaps the project would better off not be available. I'm not sure I like the title, "... attempts to kill open source project" as if to say open source is some how an endangered species and Dropbox is some horrible elephant killer? :) I suppose its disappointing to me when I read some comments that are immediately on the attack when it may not be warranted or fair, or put up arguments like 'torrents can be used to distribute linux ISOs' (not a real quote!) when everyone knows thats not what Dropship would be used for at all.

driverdan 16y ago

I've seen a lot of comments that misunderstand the DMCA. Many people seem fixated on this issue. Had I realized this would be the case I wouldn't have emphasized it as much. It was an automatic email sent by mistake and was retracted by when discovered. It's certainly an issue worth mentioning and discussing but don't fixate on it. Don't get me wrong, I was completely enraged when I received it but I think Dropbox has done well in addressing it.

deleted 16y ago

[deleted]

ramanujan 16y ago

Dan DeFilippi: "In my unhumble opinion censorship is never an option." Dan DeFilippi would certainly not like it if all his documents and code from his personal hard drive were splashed across the internet. What he considers "censorship", another person would call "not pushing someone in front of a train". He knows full well that (a) Dropbox is a pretty friendly company with reasonable people solving a real problem and (b) the RIAA and MPAA are NOT friendly and NOT reasonable. This linkbait title ("kill open source project") is the equivalent of police going after students for bike tickets while avoiding the dangerous parts of town. Dan DeFilippi is going after the good citizen (Dropbox) for the minor philosophical crime of not supporting everything that calls itself "open source", while completely lacking the balls to actually take on the real bad guys here, namely the RIAA and MPAA's real lawsuits. Indeed, even if he did set up his own torrent server, they'd ignore him for a while. Dropbox has financial resources, so they'd actually be the target. So DeFilippi is getting behind them and trying to push them in a fight that is certainly NOT one they want to engage in, without taking any personal risk himself. Not particularly ethical, IMHO.

sha90 16y ago

Forked so that I can hopefully get one of those cool friendly emails!

arethuza 16y ago

What a completely unedifying spectacle: - Overblown "geek rage" over a non-existent DMCA takedown notice and bizarre "legal" arguments - A company mishandling a security flaw by asking a developer to remove code that exposes the problem rather than simply fixing the problem and leaving the code in wild to demonstrate that the flaw doesn't exist anymore I use DropBox, although I wouldn't say I depend on it. What this episode did make me appreciate is the degree to which DropBox is a closed product - there may be good commercial reasons for this but as a consumer I'd rather use a service that has at least an open and documented interface (even if the implementations are still proprietary).

mborromeo 16y ago

If you spend so much time, passion and money building a product like Dropbox you will try to defend it from every kind of threat: today the "piracy" topic is a hot one, sounds like its worse than killing someone, and Dropbox is hit by this "piracy" threat. I fully understand and respect Dropbox founders positions, and the DMCA issue is clearly a bug in my opinion (i wouldn't automatically send those kind of communications upon a system-forced file deletion, however).

cnicolaou 16y ago

The title of the post +HN post should be changed after the author updated his entry and clarified Dropbox' position.

forkrulassail 16y ago

Just lost all my respect for them.

leon_ 16y ago

Way to alienate customers, Dropbox. I gonna cancel our teams account and refrain from using dropbox alltogether.

p09p09p09 16y ago

OTOH, wouldn't it be neat if a distributed Tahoe-LAFS supported dropship-like functionality as a feature?