6 ms·

What's yours stays yours. - Dropbox Terms Update

95 points by chromedude 15y ago

phillco 15y ago
Just three months ago Dropbox was the darling of the tech world. Now they're putting out fires every other day. Just goes to show you how tightly you have to control your image — and how quickly things can slide out of control.
- chrisledet 15y ago
  Just like what happened to Digg.
  - deleted 15y ago
    [deleted]
  - sgrove 15y ago
    They're handling it considerably better than Digg. They've been phenomenally responsive on the issues, and you can actually see them learning from each of these iterations. The language change here is fantastic - it's easy to understand and isn't overly broad.
- sliverstorm 15y ago
  It's funny how quickly you can go from being everyone's favorite underdog to big enough to scare people / make them want a piece of you.
- staunch 15y ago
  Dropbox is my absolute favorite YC company by far. This appears to be their biggest weakness to date. They've done a piss poor job of having a public voice. They don't respond to things quickly and when they do they're somewhat defensive and dismissive. The truth is most of the noise actually is bullshit. They know that. The problem is public perception isn't fair. You can't ignore false hysteria and expect it to go away. People will form opinions based on headlines alone. They need to humanize the company. Make sure everyone knows Dropbox is run by good people who have good intentions. More Google, less Microsoft. They still have a ton of momentum, but it's all based on word of mouth. If they lose the warm fuzzy feeling people have about them they will suffer badly in the long term.
  - deleted 15y ago
    [deleted]
  - c4urself 15y ago
    Exactly this. And it (partly) comes down to something someone else has mentioned already here on HN: Hire a good PR person.
  - ma2rten 15y ago
    Actually, I think outside of tech tech world Google might have a worse image then Microsoft does. The controversy about Microsoft is long forgotten by most people. Google on the other hand can come over as quite creepy to non-techies: They offer something for free, which is always creepy, they harvest all this information about you and they come of as quite emotionless. I think Google might have a little bit of the same problem with the general public, as Dropbox does now in the tech-world. Even though Google is working on it, with their recent ad campaigns.
    - Kylekramer 15y ago
      You really think people outside of the tech world are think offering something for free is creepy (they seem 100% fine with major TV networks)/know Google is harvesting info/even think of websites as being emotional? All three of those seem to be exclusively tech nerd complaints.
  - duck 15y ago
    More Google, less Microsoft. Actually, I think they shouldn't be either and just be Dropbox. That is why I have stuck with them through all of this. They're like the Mom & Pop store that doesn't exist in so many towns these days. Yes, they have done a terrible job with their "voice" of late, but I'm sticking with them because I know there isn't some huge corporation behind it and they are trying hard to put out a great service.
- mlinsey 15y ago
  You die a hero or you live long enough to see yourself become the villain. Facebook, Google, Microsoft...all were everybody's favorite scrappy insurgents at one point. Once perception shifts the other way, it's hard to turn things around because everyone starts assuming the worst. This incident is a perfect example: the old ToS were standard boilerplate that appears in a bunch of other places, and had most other companies done it, it would have been seen as a non-issue. However, since Dropbox has been receiving other negative press lately (some centering around real issues, some centering around similarly trivial nonsense), that changes how every new story about them is perceived.
  - staunch 15y ago
    Not all companies suffer this fate. As long as people are aware that you have good intentions and have great products they will remain quite loyal. Apple has the best products and basically good intentions. No one believes Steve Job's cares more about money than making good stuff. Google has the best products and undeniably great intentions. No one believes Larry Page wants anything more than to improve the world. Facebook's product is sort of mediocre (as Google+ proved) and their intentions have always been kind of borderline acceptable. Microsoft hasn't had good products or good intentions in a very long time.
    - sambeau 15y ago
      "Microsoft hasn't had good products or good intentions in a very long time." Apart from: XBox XBox 360 Numerous XBox Games XBox Live Kinect (and controversially, perhaps Expression Design now, sadly, no longer developed)
      - staunch 15y ago
        Okay, fine, one good product in 10 years and bad intentions...
        cubeboy 15y ago
        Sun had good intentions
- dskhatri 15y ago
  That's somewhat of a sensationalist comment. What they're doing is actually very positive and different. TOS are generally viewed as complex legal verbiage that shouldn't be touched with a 10m pole. Many startups avoid dealing with the issue by adopting existing TOS without questioning the harsh and extreme language used. To me, it appears that the Dropbox team is setting an important precedent by questioning, through user feedback, the need for unfriendly terms that have become the norm. To that I say: Good job, Dropbox!
  - CWuestefeld 15y ago
    I agree, but that doesn't say anything about the perception that the hubbub causes with Joe Public.
- JamieEi 15y ago
  This is exactly how you should put out a fire. As a user I now feel better about Dropbox than I did before the ToS confusion.
- sunchild 15y ago
  If you're running a service like Dropbox, you need to be paying equal time to security and legal issues. It's the nature of their business. I'm impressed by how they handled this TOS issue, but I'm also disappointed that they didn't see it coming a mile away.
- hnsmurf 15y ago
  It's very tempting to read HN and TechCrunch and think that the complaints you see there are representative of the overall population. They're not. I'd bet at least 90% of Dropbox users don't know either exist. They didn't know there was a change of terms, they don't even know Dropbox has a blog. I don't think anything has slid out of control for Dropbox. They're simply making an incremental improvement to their Terms for the 10% of users who do care, the same way they would any small feature.
sriramk 15y ago
I'm not sure how they plan to stick to this part "we won’t share your content with others, including law enforcement, for any purpose unless you direct us to". If Dropbox gets a sub-poena to hand over some user's content, can they really ask the user first whether they can share it with law enforcement? I was involved with some of this stuff back at MSFT and it isn't something you had a great deal of leeway with.
- molecule 15y ago
  http://blog.dropbox.com/?p=867#comment-244671740 http://blog.dropbox.com/?p=867#comment-244671740
  - sriramk 15y ago
    In that case, what does the text in my comment mean? If law enforcement is asking you for content, they'll always have some legal paperwork to back it up. Those rare exceptions are pretty much the rule when it comes to dealing with LE.
    - JoshTriplett 15y ago
      Not even remotely "always". These days, law enforcement will frequently talk to a service provider before they have a warrant, and the service provider will often cooperate without seeing a warrant. However, the exceptions in Dropbox's ToS and Privacy Policy allow them to do the same under a broad set of circumstances, not just when required to by a warrant/subpoena.
- koenigdavidmj 15y ago
  At the cost of some user-friendliness they can rework their key management to make it impossible for anyone to decrypt your files unless they have your private key (which you would put in place on each of your computers).
  - threepointone 15y ago
    I'd love to know more about this, if you have the time to point me to some place to learn/read/listen. I'm an amateur backend developer(yay node), and I'm trying to figure out how to make it so that even I'm not able to read the contents of a users uploaded file/generated content without a key. Can I use the password as this key? How would I go about this?
someoneorother 15y ago
Looks like they took a cue from this on the 1Password forums: http://forum.agile.ws/index.php?/topic/5406-dropboxs-terms-of-service/page__view__findpost__p__31152 http://forum.agile.ws/index.php?/topic/5406-dropboxs-terms-o...
- mattmanser 15y ago
  Plenty of us said the same thing, e.g. http://news.ycombinator.com/item?id=2723560 http://news.ycombinator.com/item?id=2723560
  - someoneorother 15y ago
    Of course. But in this case Dropbox's statement tracks clause by clause, and there's quite a bit of lexical overlap.
fennson 15y ago
This comment on the site is pretty much spot on: If only I could trust you. 1) Your marketing text used to claim files were encrypted in a way that made it so even YOU could not see the data. This was a flat-out lie. But hey, your false advertising worked, since I trusted that you wouldn't be so unethical as to lie in your promotional materials. Stupid me. 2) You had a massive security failure, and you covered it up. Sure, some techies heard about it (usually third party) but for the most part, you decided that your customers didn't need to get an email letting them know that this was the sort of problem that happens at your company. 3) After you f--ked up with security, Arash didn't even pretend to care until it was obvious that there was massive outrage. 4) You edited the ToS so many times in a row that it served mostly as a reminder that your ToS is subject to change on a whim. So we need to not only trust the agreement as it stands on the website, but we also need to trust some proven liars, as well as all possible future acquirers of your company. That's... not feasible. Basically, I think you made a great product, but that you have a really lousy and dysfunctional company. And it's kind of the predictable result of how your company came to be. Maybe you two will be competent management in a few more decades but right now, only a f--king idiot would trust you dishonest ----s. Fortunately for you, the world is full of idiots. Good luck, and I hope that someday you realize that Arash should never talk to customers (seriously. never.) and that you'd be well-served to find a way to fire his dishonest, customer-hating, utterly incompetent ass.
rodh257 15y ago
What's yours stays yours... except for when we stuff up the login system and let anyone login to your account? Yes I know it was a mistake, but now that you've sorted out the licensing terms, lets move onto the issue of showing people you have improved your security model. Many people put pretty important stuff in their Dropbox, prove them that it will be secure. You need to come out with a blog post outlining all the new security incentives you are doing to win peoples trust back in that regard. Perhaps look at offering two factor authentication like Gmail (I believe they open sourced that), or at least when you setup a new PC to sync you need email confirmation like Steam. Maybe give people the option of having 'extra secure' dropbox folders that require you to give an extra password to access.
GiraffeNecktie 15y ago
Seems like they didn't bother testing the first version with actual users (or an editor) rather than just running it past a lawyer.
- sunchild 15y ago
  I think their lawyers wrote it poorly, and someone at Dropbox approved it too readily.
dlib 15y ago
From their blogpost/terms of service We may need your permission to do things you ask us to do with your stuff, for example, hosting your files, or sharing them at your direction. I assume they mean discretion instead of direction. A bit sloppy, especially regarding all the fuzz the new terms gave.
- edanm 15y ago
  Not sure why you think it's discretion. I assume they're talking about you "directing" them to share a certain file with other users of Dropbox.
pwpwp 15y ago
What's yours stays yours. Unless somebody knows the hash. https://github.com/driverdan/dropship https://github.com/driverdan/dropship
- ugh 15y ago
  How is one supposed to know the hash without also having had access to the file in some way and at some point in time? If someone else knows the hash of your super secret document they must have had access to your super secret document or you must have given them the hash.

95 points by chromedude 15y ago

Just three months ago Dropbox was the darling of the tech world. Now they're putting out fires every other day. Just goes to show you how tightly you have to control your image — and how quickly things can slide out of control.

chrisledet 15y ago
Just like what happened to Digg.
- deleted 15y ago
  [deleted]
- sgrove 15y ago
  They're handling it considerably better than Digg. They've been phenomenally responsive on the issues, and you can actually see them learning from each of these iterations. The language change here is fantastic - it's easy to understand and isn't overly broad.
sliverstorm 15y ago
It's funny how quickly you can go from being everyone's favorite underdog to big enough to scare people / make them want a piece of you.
staunch 15y ago
Dropbox is my absolute favorite YC company by far. This appears to be their biggest weakness to date. They've done a piss poor job of having a public voice. They don't respond to things quickly and when they do they're somewhat defensive and dismissive. The truth is most of the noise actually is bullshit. They know that. The problem is public perception isn't fair. You can't ignore false hysteria and expect it to go away. People will form opinions based on headlines alone. They need to humanize the company. Make sure everyone knows Dropbox is run by good people who have good intentions. More Google, less Microsoft. They still have a ton of momentum, but it's all based on word of mouth. If they lose the warm fuzzy feeling people have about them they will suffer badly in the long term.
- deleted 15y ago
  [deleted]
- c4urself 15y ago
  Exactly this. And it (partly) comes down to something someone else has mentioned already here on HN: Hire a good PR person.
- ma2rten 15y ago
  Actually, I think outside of tech tech world Google might have a worse image then Microsoft does. The controversy about Microsoft is long forgotten by most people. Google on the other hand can come over as quite creepy to non-techies: They offer something for free, which is always creepy, they harvest all this information about you and they come of as quite emotionless. I think Google might have a little bit of the same problem with the general public, as Dropbox does now in the tech-world. Even though Google is working on it, with their recent ad campaigns.
  - Kylekramer 15y ago
    You really think people outside of the tech world are think offering something for free is creepy (they seem 100% fine with major TV networks)/know Google is harvesting info/even think of websites as being emotional? All three of those seem to be exclusively tech nerd complaints.
- duck 15y ago
  More Google, less Microsoft. Actually, I think they shouldn't be either and just be Dropbox. That is why I have stuck with them through all of this. They're like the Mom & Pop store that doesn't exist in so many towns these days. Yes, they have done a terrible job with their "voice" of late, but I'm sticking with them because I know there isn't some huge corporation behind it and they are trying hard to put out a great service.
mlinsey 15y ago
You die a hero or you live long enough to see yourself become the villain. Facebook, Google, Microsoft...all were everybody's favorite scrappy insurgents at one point. Once perception shifts the other way, it's hard to turn things around because everyone starts assuming the worst. This incident is a perfect example: the old ToS were standard boilerplate that appears in a bunch of other places, and had most other companies done it, it would have been seen as a non-issue. However, since Dropbox has been receiving other negative press lately (some centering around real issues, some centering around similarly trivial nonsense), that changes how every new story about them is perceived.
- staunch 15y ago
  Not all companies suffer this fate. As long as people are aware that you have good intentions and have great products they will remain quite loyal. Apple has the best products and basically good intentions. No one believes Steve Job's cares more about money than making good stuff. Google has the best products and undeniably great intentions. No one believes Larry Page wants anything more than to improve the world. Facebook's product is sort of mediocre (as Google+ proved) and their intentions have always been kind of borderline acceptable. Microsoft hasn't had good products or good intentions in a very long time.
  - sambeau 15y ago
    "Microsoft hasn't had good products or good intentions in a very long time." Apart from: XBox XBox 360 Numerous XBox Games XBox Live Kinect (and controversially, perhaps Expression Design now, sadly, no longer developed)
    - staunch 15y ago
      Okay, fine, one good product in 10 years and bad intentions...
      - cubeboy 15y ago
        Sun had good intentions
dskhatri 15y ago
That's somewhat of a sensationalist comment. What they're doing is actually very positive and different. TOS are generally viewed as complex legal verbiage that shouldn't be touched with a 10m pole. Many startups avoid dealing with the issue by adopting existing TOS without questioning the harsh and extreme language used. To me, it appears that the Dropbox team is setting an important precedent by questioning, through user feedback, the need for unfriendly terms that have become the norm. To that I say: Good job, Dropbox!
- CWuestefeld 15y ago
  I agree, but that doesn't say anything about the perception that the hubbub causes with Joe Public.
JamieEi 15y ago
This is exactly how you should put out a fire. As a user I now feel better about Dropbox than I did before the ToS confusion.
sunchild 15y ago
If you're running a service like Dropbox, you need to be paying equal time to security and legal issues. It's the nature of their business. I'm impressed by how they handled this TOS issue, but I'm also disappointed that they didn't see it coming a mile away.
hnsmurf 15y ago
It's very tempting to read HN and TechCrunch and think that the complaints you see there are representative of the overall population. They're not. I'd bet at least 90% of Dropbox users don't know either exist. They didn't know there was a change of terms, they don't even know Dropbox has a blog. I don't think anything has slid out of control for Dropbox. They're simply making an incremental improvement to their Terms for the 10% of users who do care, the same way they would any small feature.

sriramk 15y ago

I'm not sure how they plan to stick to this part "we won’t share your content with others, including law enforcement, for any purpose unless you direct us to". If Dropbox gets a sub-poena to hand over some user's content, can they really ask the user first whether they can share it with law enforcement? I was involved with some of this stuff back at MSFT and it isn't something you had a great deal of leeway with.

molecule 15y ago
http://blog.dropbox.com/?p=867#comment-244671740 http://blog.dropbox.com/?p=867#comment-244671740
- sriramk 15y ago
  In that case, what does the text in my comment mean? If law enforcement is asking you for content, they'll always have some legal paperwork to back it up. Those rare exceptions are pretty much the rule when it comes to dealing with LE.
  - JoshTriplett 15y ago
    Not even remotely "always". These days, law enforcement will frequently talk to a service provider before they have a warrant, and the service provider will often cooperate without seeing a warrant. However, the exceptions in Dropbox's ToS and Privacy Policy allow them to do the same under a broad set of circumstances, not just when required to by a warrant/subpoena.
koenigdavidmj 15y ago
At the cost of some user-friendliness they can rework their key management to make it impossible for anyone to decrypt your files unless they have your private key (which you would put in place on each of your computers).
- threepointone 15y ago
  I'd love to know more about this, if you have the time to point me to some place to learn/read/listen. I'm an amateur backend developer(yay node), and I'm trying to figure out how to make it so that even I'm not able to read the contents of a users uploaded file/generated content without a key. Can I use the password as this key? How would I go about this?

someoneorother 15y ago

Looks like they took a cue from this on the 1Password forums: http://forum.agile.ws/index.php?/topic/5406-dropboxs-terms-of-service/page__view__findpost__p__31152 http://forum.agile.ws/index.php?/topic/5406-dropboxs-terms-o...

mattmanser 15y ago
Plenty of us said the same thing, e.g. http://news.ycombinator.com/item?id=2723560 http://news.ycombinator.com/item?id=2723560
- someoneorother 15y ago
  Of course. But in this case Dropbox's statement tracks clause by clause, and there's quite a bit of lexical overlap.

fennson 15y ago

This comment on the site is pretty much spot on: If only I could trust you. 1) Your marketing text used to claim files were encrypted in a way that made it so even YOU could not see the data. This was a flat-out lie. But hey, your false advertising worked, since I trusted that you wouldn't be so unethical as to lie in your promotional materials. Stupid me. 2) You had a massive security failure, and you covered it up. Sure, some techies heard about it (usually third party) but for the most part, you decided that your customers didn't need to get an email letting them know that this was the sort of problem that happens at your company. 3) After you f--ked up with security, Arash didn't even pretend to care until it was obvious that there was massive outrage. 4) You edited the ToS so many times in a row that it served mostly as a reminder that your ToS is subject to change on a whim. So we need to not only trust the agreement as it stands on the website, but we also need to trust some proven liars, as well as all possible future acquirers of your company. That's... not feasible. Basically, I think you made a great product, but that you have a really lousy and dysfunctional company. And it's kind of the predictable result of how your company came to be. Maybe you two will be competent management in a few more decades but right now, only a f--king idiot would trust you dishonest ----s. Fortunately for you, the world is full of idiots. Good luck, and I hope that someday you realize that Arash should never talk to customers (seriously. never.) and that you'd be well-served to find a way to fire his dishonest, customer-hating, utterly incompetent ass.

rodh257 15y ago

What's yours stays yours... except for when we stuff up the login system and let anyone login to your account? Yes I know it was a mistake, but now that you've sorted out the licensing terms, lets move onto the issue of showing people you have improved your security model. Many people put pretty important stuff in their Dropbox, prove them that it will be secure. You need to come out with a blog post outlining all the new security incentives you are doing to win peoples trust back in that regard. Perhaps look at offering two factor authentication like Gmail (I believe they open sourced that), or at least when you setup a new PC to sync you need email confirmation like Steam. Maybe give people the option of having 'extra secure' dropbox folders that require you to give an extra password to access.

GiraffeNecktie 15y ago

Seems like they didn't bother testing the first version with actual users (or an editor) rather than just running it past a lawyer.

sunchild 15y ago
I think their lawyers wrote it poorly, and someone at Dropbox approved it too readily.

dlib 15y ago

From their blogpost/terms of service We may need your permission to do things you ask us to do with your stuff, for example, hosting your files, or sharing them at your direction. I assume they mean discretion instead of direction. A bit sloppy, especially regarding all the fuzz the new terms gave.

edanm 15y ago
Not sure why you think it's discretion. I assume they're talking about you "directing" them to share a certain file with other users of Dropbox.

pwpwp 15y ago

What's yours stays yours. Unless somebody knows the hash. https://github.com/driverdan/dropship https://github.com/driverdan/dropship

ugh 15y ago
How is one supposed to know the hash without also having had access to the file in some way and at some point in time? If someone else knows the hash of your super secret document they must have had access to your super secret document or you must have given them the hash.