52 ms·

Multi-user dropbox sharing needs file-level access control. Otherwise, any user in a share can delete or change shared data. Has Dropbox solved this yet?

cytzol 15y ago
No, and I don't think they ever will - they took long enough to implement Selective Sync. They'd rather have a product that can be seen as 'simple', than one that could have users ask "why can't this person see my files?".
- gcv 15y ago
  Good point, and I think Dropbox can remain simple by default. It could then support an additional "advanced sharing" feature. This would allow exactly two extra flags per shared folder, per user: (1) share read-only, and (2) share non-transitively. This should allow sufficient granularity for most access-control use cases out there. Anyone who doesn't understand what this means wouldn't use the "advanced" sharing features, and many more small businesses would be able to start using the product.
JonWood 15y ago
I'm curious what sort of situation you have where you trust a user enough to have a copy of a particular directory tree, with the ability to copy it elsewhere and edit it, but you're concerned about them being able to make changes to it.
- Duff 15y ago
  Huh? Have you ever worked on a shared document before? To an end-user, the directory tree is a system of record. Many types of files need to "freeze" at a certain point in time -- say a letter that needs to be crafted by multiple people, or a budget worksheet. In the case of the budget sheet, I don't mind if you copy the file and change some numbers to figure things out -- you're on the Team, after all. But I may mind if you decide to modify a file after we have a consensus that it is "done".
- shantanubala 15y ago
  Considering Dropbox also has revision history, it makes even less sense to have granular access control.
  - sunchild 15y ago
    Wrong. If I share a document with another person who is only supposed to read it, and that person deletes it, how long before I notice it's gone? What if that person edits the document? Will I ever notice? Saying that access control is unnecessary for Dropbox "for Teams" is absurd. Here's an easy example: My law partner and I share our documents via Dropbox. I want him to see my docs, be able to read them, save new versions, etc. I don't want him to be able to change my directories. Not far-fetched at all.
- sunchild 15y ago
  Is that a serious question? I often trust users enough to read my stuff, but not to change it. I feel like I'm in some kind of alternative universe when you ask me a question like this. Access control is basic file system stuff, and has been forever. My understanding is that DB can't coordinate access control across the platforms that it supports. I don't understand why they can't build their own access control layer.

cytzol 15y ago

No, and I don't think they ever will - they took long enough to implement Selective Sync. They'd rather have a product that can be seen as 'simple', than one that could have users ask "why can't this person see my files?".

gcv 15y ago
Good point, and I think Dropbox can remain simple by default. It could then support an additional "advanced sharing" feature. This would allow exactly two extra flags per shared folder, per user: (1) share read-only, and (2) share non-transitively. This should allow sufficient granularity for most access-control use cases out there. Anyone who doesn't understand what this means wouldn't use the "advanced" sharing features, and many more small businesses would be able to start using the product.

JonWood 15y ago

I'm curious what sort of situation you have where you trust a user enough to have a copy of a particular directory tree, with the ability to copy it elsewhere and edit it, but you're concerned about them being able to make changes to it.

Duff 15y ago
Huh? Have you ever worked on a shared document before? To an end-user, the directory tree is a system of record. Many types of files need to "freeze" at a certain point in time -- say a letter that needs to be crafted by multiple people, or a budget worksheet. In the case of the budget sheet, I don't mind if you copy the file and change some numbers to figure things out -- you're on the Team, after all. But I may mind if you decide to modify a file after we have a consensus that it is "done".
shantanubala 15y ago
Considering Dropbox also has revision history, it makes even less sense to have granular access control.
- sunchild 15y ago
  Wrong. If I share a document with another person who is only supposed to read it, and that person deletes it, how long before I notice it's gone? What if that person edits the document? Will I ever notice? Saying that access control is unnecessary for Dropbox "for Teams" is absurd. Here's an easy example: My law partner and I share our documents via Dropbox. I want him to see my docs, be able to read them, save new versions, etc. I don't want him to be able to change my directories. Not far-fetched at all.
sunchild 15y ago
Is that a serious question? I often trust users enough to read my stuff, but not to change it. I feel like I'm in some kind of alternative universe when you ask me a question like this. Access control is basic file system stuff, and has been forever. My understanding is that DB can't coordinate access control across the platforms that it supports. I don't understand why they can't build their own access control layer.