5 ms·

I guess it's because I'm an engineer that I appreciate understanding exactly what happened, and can tell he understands this is a big mistake. "This should nev

by lhnn 15y ago

I guess it's because I'm an engineer that I appreciate understanding exactly what happened, and can tell he understands this is a big mistake. "This should never have happened. We are scrutinizing our controls and we will be implementing additional safeguards to prevent this from happening again." How is that not clear enough? All of the criticism is either unfounded (saying they need PR doesn't explain the problem) or minimal in nature (not saying the word "sorry" when explaining an outage).

ghurlman 15y ago
It's not clear enough, because people that don't frequent HN, Techcrunch, and the like, still haven't heard about this lapse. No email was sent out, and I doubt there's one coming. Had someone not noticed something was up yesterday and not made a stink about it, we wouldn't even have this message to read. The message is fine. The venue is wrong.
- jvandenbroeck 15y ago
  I totally agree, an email would be much better than a blog post. Or a message you see when you login, which could also help you check your access logs in these 4 hours.
- nomurrcy 15y ago
  I received the following from Drop box late last night: We are writing to let you know that there was some activity in your Dropbox account that we'd like you to review. On June 19, 2011, there was a brief bug with our authentication system that could have allowed unauthorized access to accounts. You can read more about it at our blog post linked here. Based on a careful review of our records, we noticed that your account settings page was accessed during the time the bug was in effect. While it's unlikely, we'd like to be cautious and make sure this was you because if the activity was unauthorized, the information in your account could have been improperly accessed. Please review recent activity in your account, which you can view at http://www.dropbox.com/events http://www.dropbox.com/events, and let us know if you find anything suspicious. We noticed that during the time the bug was in effect you also: Logged into the Dropbox website Linked the desktop application to your Dropbox As a precautionary measure, we logged you out of the website and disabled any apps. We are very sorry and this should never have happened. We are scrutinizing our controls and will be implementing additional safeguards to prevent this from happening again. If you're not able to access your account or have any other questions or concerns, please contact us at support@dropbox.com. I don't know what else they are supposed to do. They should have never screwed this up to begin with, but grandted that they did I think they've responded just fine. IMHO All the moaning about how they've handled this is just a bunch of baloney. If a company spokesperson speaks out of both sides of their mouth, people cry for honesty. When a company is blunt and honest, they need to hire a PR person. I wonder how many people on these threads are 'PR' people.
  - danilocampos 15y ago
    You've created a false dichotomy here. You don't need PR to have empathy or accountability – just a sense of humility. You can still be completely blunt. If the blog post had ended with: "We fucked up. Not cool. We're going to work hard to prevent these things in the future and earn your trust." Then the tone of the response would have been very different. That email was pretty good – they should have said something closer to that in their blog, too.
- noodle 15y ago
  > The message is fine. The venue is wrong. bingo. they needed a message that was easily understandable and relatable by all clients. there's nothing inherently wrong about the post and would've been a good status update or part of a post mortem, but not the entire PR statement of the company about the incident.
danilocampos 15y ago
> All of the criticism is [...] minimal in nature (not saying the word "sorry" when explaining an outage). I can't disagree with this sentiment enough. The word "sorry" isn't about being nice – it's about being accountable. What we're seeing here is a second lapse in Dropbox's security – a hard problem! – but little acknowledgement that hey, this really isn't okay, these files are important to users, and this is a breach of trust that needs to be remedied. Moreover, this isn't an outage as in "boy, wish I could access my dropbox." This is a security outage as in "boy, wish the entire world couldn't access my Dropbox." The period of time, the cause, the impact is, in the end, immaterial to the outcome of breached trust. So when we fuck up, as grownups, we take a moment to acknowledge it, explain the cause, and express how much we value the trust we've been given. The alternative is to leave the impression that trust is taken for granted. Which, in this case, it sure as hell feels like it is because Dropbox is doing nothing to dissuade that impression. These are good guys with a great product that makes a lot of people's lives better. They just need to be accountable for their shit – that's all people are asking for here. Perfection is impossible but being good in your relationships with users is something anyone can do with a little empathy.
- daleharvey 15y ago
  as the parent post your replied to already quoted "This should never have happened. We are scrutinizing our controls and we will be implementing additional safeguards to prevent this from happening again." this is absolutely unarguably taking full accountability.
mtogo 15y ago
It's not clear because it does not explain what happened and why it will never again. Users expect something like "There was a solar eclipse that caused a bit flip on our login server which caused strcmp to give the wrong result ...". We expect an explanation of why it happened and why it will never again happen, and "lulz sry" is not very confidence inspiring.

by lhnn 15y ago

ghurlman 15y ago

It's not clear enough, because people that don't frequent HN, Techcrunch, and the like, still haven't heard about this lapse. No email was sent out, and I doubt there's one coming. Had someone not noticed something was up yesterday and not made a stink about it, we wouldn't even have this message to read. The message is fine. The venue is wrong.

jvandenbroeck 15y ago
I totally agree, an email would be much better than a blog post. Or a message you see when you login, which could also help you check your access logs in these 4 hours.
nomurrcy 15y ago
I received the following from Drop box late last night: We are writing to let you know that there was some activity in your Dropbox account that we'd like you to review. On June 19, 2011, there was a brief bug with our authentication system that could have allowed unauthorized access to accounts. You can read more about it at our blog post linked here. Based on a careful review of our records, we noticed that your account settings page was accessed during the time the bug was in effect. While it's unlikely, we'd like to be cautious and make sure this was you because if the activity was unauthorized, the information in your account could have been improperly accessed. Please review recent activity in your account, which you can view at http://www.dropbox.com/events http://www.dropbox.com/events, and let us know if you find anything suspicious. We noticed that during the time the bug was in effect you also: Logged into the Dropbox website Linked the desktop application to your Dropbox As a precautionary measure, we logged you out of the website and disabled any apps. We are very sorry and this should never have happened. We are scrutinizing our controls and will be implementing additional safeguards to prevent this from happening again. If you're not able to access your account or have any other questions or concerns, please contact us at support@dropbox.com. I don't know what else they are supposed to do. They should have never screwed this up to begin with, but grandted that they did I think they've responded just fine. IMHO All the moaning about how they've handled this is just a bunch of baloney. If a company spokesperson speaks out of both sides of their mouth, people cry for honesty. When a company is blunt and honest, they need to hire a PR person. I wonder how many people on these threads are 'PR' people.
- danilocampos 15y ago
  You've created a false dichotomy here. You don't need PR to have empathy or accountability – just a sense of humility. You can still be completely blunt. If the blog post had ended with: "We fucked up. Not cool. We're going to work hard to prevent these things in the future and earn your trust." Then the tone of the response would have been very different. That email was pretty good – they should have said something closer to that in their blog, too.
noodle 15y ago
> The message is fine. The venue is wrong. bingo. they needed a message that was easily understandable and relatable by all clients. there's nothing inherently wrong about the post and would've been a good status update or part of a post mortem, but not the entire PR statement of the company about the incident.

danilocampos 15y ago

> All of the criticism is [...] minimal in nature (not saying the word "sorry" when explaining an outage). I can't disagree with this sentiment enough. The word "sorry" isn't about being nice – it's about being accountable. What we're seeing here is a second lapse in Dropbox's security – a hard problem! – but little acknowledgement that hey, this really isn't okay, these files are important to users, and this is a breach of trust that needs to be remedied. Moreover, this isn't an outage as in "boy, wish I could access my dropbox." This is a security outage as in "boy, wish the entire world couldn't access my Dropbox." The period of time, the cause, the impact is, in the end, immaterial to the outcome of breached trust. So when we fuck up, as grownups, we take a moment to acknowledge it, explain the cause, and express how much we value the trust we've been given. The alternative is to leave the impression that trust is taken for granted. Which, in this case, it sure as hell feels like it is because Dropbox is doing nothing to dissuade that impression. These are good guys with a great product that makes a lot of people's lives better. They just need to be accountable for their shit – that's all people are asking for here. Perfection is impossible but being good in your relationships with users is something anyone can do with a little empathy.

daleharvey 15y ago
as the parent post your replied to already quoted "This should never have happened. We are scrutinizing our controls and we will be implementing additional safeguards to prevent this from happening again." this is absolutely unarguably taking full accountability.

mtogo 15y ago

It's not clear because it does not explain what happened and why it will never again. Users expect something like "There was a solar eclipse that caused a bit flip on our login server which caused strcmp to give the wrong result ...". We expect an explanation of why it happened and why it will never again happen, and "lulz sry" is not very confidence inspiring.