3 ms·
Let's put this in context. Here's what I don't get: the DropShip code is just an exploit of the fundamental architecture flaw of cross-user content deduplicatio
by sigil 16y ago
Let's put this in context. Here's what I don't get: the DropShip code is just an exploit of the fundamental architecture flaw of cross-user content deduplication, revealed earlier this month [1]. As the closest thing to a resident security expert around here tptacek (at least to me, I find your comments very enlightening on the whole), how do you feel about a company dismissing an exploit when it's still just an idea, then rushing to erase all evidence of the exploit once it's realized?
[1] http://news.ycombinator.com/item?id=2438181 http://news.ycombinator.com/item?id=2438181
- lindvall 16y agoI hope this point does not get lost in the shuffle. This whole issue is very much due to the fact that Dropbox did not handle the initial reporting of this problem when it was announced. Their initial solution to the problem was updating the TOS and calling it a day. DropShip proved there was a deeper problem that needed to be addressed and the fact that their solution did not start and end with a fix to the problem in the code is mind-blowing. This isn't a huge enterprise company. These guys should know better.
- bigiain 16y agoOuch, I hope this isn't all my fault... http://news.ycombinator.com/item?id=2440066 http://news.ycombinator.com/item?id=2440066 (note, the solution Dropbox should have implemented instead of fake-lawyering up was offered very quickly there...)