9 ms·

The way the moderators handled this was pretty damn bad. Two different users tell the moderator they use UNIQUE e-mail addresses for dropbox only, and they rece

by Khao 14y ago

The way the moderators handled this was pretty damn bad. Two different users tell the moderator they use UNIQUE e-mail addresses for dropbox only, and they received spam roughly at the same time and yet the moderator answers by assuming the users are idiots.

kybernetyk 14y ago
Yup, especially Chris' behaviour is a no go. I don't know how the mods are affiliated with dropbox but if they are employees I wouldn't let them have any customer contact at all.
- benhalllondon 14y ago
  Yeah, Chris seems a bit of prick: "Just the fact that you listed your emails says it all."
  - doktrin 14y ago
    Especially considering the context. It seemed pretty clear that the user was posting the email address publicly for the first time. That is just awful, and is an awkward example of why you may not want unpaid, mostly un-vetted volunteers as the public face of a company.
    - sordidfellow 14y ago
      Thank you! I was wary of this thread showing up on HN because I felt I was a bit unkind when posting in that thread, but Chris' comment towards me seemed completely unjustified. And he deleted a prior post along the same lines, hence why I quoted him on my next post.
      - SomeCallMeTim 14y ago
        I also use unique addresses for every site, and while my Dropbox email wasn't compromised, I've occasionally gotten that response from tech support elsewhere. You mean that tim-somespecificsite@mydomain.com was randomly compromised, but NO OTHER random email was mailed to me? No, that's not how spammers work. If they'd decided to spam tim-*, I would have gotten hundreds of emails...sigh...
  - Scramblejams 14y ago
    Looks like Chris is battening down the hatches. His linked site[1] was up about an hour ago, but it redirects to a placeholder now. Also, he's deleted all but his first comment, wish I'd taken a screenshot of his other comments. Tangentially related: It drives me nuts to deal with people whose default answers are "no," "you must be doing it wrong" and so on. Particularly the moderators who insisted someone must have guessed a ten digit random email address -- because Dropbox and its vendors couldn't POSSIBLY have ever done anything wrong, and it's MUCH more likely that a spammer magically brute-forced a 10 billion combination address! Grrr. I'm not sure what the right word is to describe that sort of personality, but such people should never have contact with customers. Or with me. [1] http://cjwworld.cu.cc/ http://cjwworld.cu.cc/
    - rhizome 14y ago
      Site appears to be up now.
    - jdmichal 14y ago
      It's not just a 10-character address. It's a 10-character address on a non-standard domain (or so the conversation led me to believe). All without getting another email on that domain's catch-all address. If it was a spammer, who randomly-generated addresses on this domain, I would imagine that they would have been shotgunned across the whole domain. Not just hit that one single address.
    - snikolic 14y ago
      Aaaannd cue internet vigilantes: http://cjwworld.cu.cc/?p=216#comments http://cjwworld.cu.cc/?p=216#comments
- deleted 14y ago
  [deleted]
- ditojim 14y ago
  why wouldn't you want your employees having contact with your customers?
  - saraid216 14y ago
    GP means that, if these are employees, their capacity for dealing with customers is so low that it's a net negative for them to continue doing so.
    - kybernetyk 14y ago
      Yes. That's what I meant. Sorry for my broken English.
  - deleted 14y ago
    [deleted]
- qiemem 14y ago
  Sounds like they're volunteers, not employees: https://forums.dropbox.com/topic.php?id=97303&page=2#post-530452 https://forums.dropbox.com/topic.php?id=97303&page=2#pos...
  - nolok 14y ago
    Doesn't really matter for dropbox users though. They're the people the seller is putting in charge of being its face in the support place, and they're awful.
  - protomyth 14y ago
    They have a title, and that must mean they have authority. Volunteers are a fine thing, but make sure the title listed has the word "volunteer" in it else they will taken for employees. On a side note, why the heck does dropbox have volunteers running their support forum? At this stage, cost savings isn't worth the reputation hit.
    - bigiain 14y ago
      "On a side note, why the heck does dropbox have volunteers running their support forum?" If I had to guess - I'd suspect three or four "nines" of their customer support workload comes from their "free tier" non-customers. (Having said that, there's evidence upthread in these HN discussions saying they're also dropping the support ball for paying, even team-account-sized paying customers - that's not OK...)
danielweber 14y ago
The way some people do "fredsmith+amazon@gmail.com" as proof that it must be amazon that leaks their passwords has some issues. The guy who says that he had a truly random bunch of letters as his dropbox account is probably a better indicator, but it's hard to know if the guy ever leaked it himself. Doesn't excuse the moderators being jerks, though.
- Mahn 14y ago
  Speaking of which, this alias system from google is great in theory, but kind of pointless in practice; spammers can easily figure out they can just remove everything from the + sign, including the sign itself, and boom, they have my address without the specific alias.
  - yid 14y ago
    It's not from Google; it's called subaddressing: http://en.wikipedia.org/wiki/Email_address#Address_tags http://en.wikipedia.org/wiki/Email_address#Address_tags
  - jaibot 14y ago
    It's pointless in practice in theory; in practice in practice spammers (in my experience) don't target + aliases. And if you think about the set of people who are likely to give money to spammers, the set of people using + aliases, and the fraction of + alias space that is occupied versus the fraction of non-+'aliased space that is occupied, the reason why becomes clear.
    - pfranz 14y ago
      I've tried to use this system in the past, but found it to be a PITA. A lot of email systems won't let you use a +. The other gotcha I get is that they use the email address as a login token (Dropbox, for example). So you have to remember a) that you used a token and b) what it was. Any suggestions on approaching these?
      - 14y ago
lucb1e 14y ago
Because a great company like their Dropbox can't be at fault, it must be the stupid users, right?! </sarcasm aimed at their customer support>
bobsy 14y ago
The initial responses by moderators were fine and correct. They met the complaint with skepticism. The fact that the guys email was blah.dropbox@blah.com meant it was a possibility that another site had been compromised and the email matched a keyword filter which allowed it to be easily guessed. Its like passwords. MyPASSW0rDdropbox. If this is leaked it is fairly likely someone may try.. MyPASSW0rDfacebook. They failed a bit further on. One obviously misread the thread and made a comment which isn't really acceptable. Generally though it is the typical user forum thread. User repeatedly hammers the moderator with the same question. The user cannot elaborate. The moderator can only speculate due to lack of information. User doesn't find moderator answer acceptable, provides no further information and asks the same question.. both sides get annoyed. It seems like the spam is to do with the data that Dropbox previously lost. An answer which a moderator actually provided.

by Khao 14y ago

kybernetyk 14y ago

Yup, especially Chris' behaviour is a no go. I don't know how the mods are affiliated with dropbox but if they are employees I wouldn't let them have any customer contact at all.

benhalllondon 14y ago
Yeah, Chris seems a bit of prick: "Just the fact that you listed your emails says it all."
- doktrin 14y ago
  Especially considering the context. It seemed pretty clear that the user was posting the email address publicly for the first time. That is just awful, and is an awkward example of why you may not want unpaid, mostly un-vetted volunteers as the public face of a company.
  - sordidfellow 14y ago
    Thank you! I was wary of this thread showing up on HN because I felt I was a bit unkind when posting in that thread, but Chris' comment towards me seemed completely unjustified. And he deleted a prior post along the same lines, hence why I quoted him on my next post.
    - SomeCallMeTim 14y ago
      I also use unique addresses for every site, and while my Dropbox email wasn't compromised, I've occasionally gotten that response from tech support elsewhere. You mean that tim-somespecificsite@mydomain.com was randomly compromised, but NO OTHER random email was mailed to me? No, that's not how spammers work. If they'd decided to spam tim-*, I would have gotten hundreds of emails...sigh...
- Scramblejams 14y ago
  Looks like Chris is battening down the hatches. His linked site[1] was up about an hour ago, but it redirects to a placeholder now. Also, he's deleted all but his first comment, wish I'd taken a screenshot of his other comments. Tangentially related: It drives me nuts to deal with people whose default answers are "no," "you must be doing it wrong" and so on. Particularly the moderators who insisted someone must have guessed a ten digit random email address -- because Dropbox and its vendors couldn't POSSIBLY have ever done anything wrong, and it's MUCH more likely that a spammer magically brute-forced a 10 billion combination address! Grrr. I'm not sure what the right word is to describe that sort of personality, but such people should never have contact with customers. Or with me. [1] http://cjwworld.cu.cc/ http://cjwworld.cu.cc/
  - rhizome 14y ago
    Site appears to be up now.
  - jdmichal 14y ago
    It's not just a 10-character address. It's a 10-character address on a non-standard domain (or so the conversation led me to believe). All without getting another email on that domain's catch-all address. If it was a spammer, who randomly-generated addresses on this domain, I would imagine that they would have been shotgunned across the whole domain. Not just hit that one single address.
  - snikolic 14y ago
    Aaaannd cue internet vigilantes: http://cjwworld.cu.cc/?p=216#comments http://cjwworld.cu.cc/?p=216#comments
deleted 14y ago
[deleted]
ditojim 14y ago
why wouldn't you want your employees having contact with your customers?
- saraid216 14y ago
  GP means that, if these are employees, their capacity for dealing with customers is so low that it's a net negative for them to continue doing so.
  - kybernetyk 14y ago
    Yes. That's what I meant. Sorry for my broken English.
- deleted 14y ago
  [deleted]
qiemem 14y ago
Sounds like they're volunteers, not employees: https://forums.dropbox.com/topic.php?id=97303&page=2#post-530452 https://forums.dropbox.com/topic.php?id=97303&page=2#pos...
- nolok 14y ago
  Doesn't really matter for dropbox users though. They're the people the seller is putting in charge of being its face in the support place, and they're awful.
- protomyth 14y ago
  They have a title, and that must mean they have authority. Volunteers are a fine thing, but make sure the title listed has the word "volunteer" in it else they will taken for employees. On a side note, why the heck does dropbox have volunteers running their support forum? At this stage, cost savings isn't worth the reputation hit.
  - bigiain 14y ago
    "On a side note, why the heck does dropbox have volunteers running their support forum?" If I had to guess - I'd suspect three or four "nines" of their customer support workload comes from their "free tier" non-customers. (Having said that, there's evidence upthread in these HN discussions saying they're also dropping the support ball for paying, even team-account-sized paying customers - that's not OK...)

danielweber 14y ago

The way some people do "fredsmith+amazon@gmail.com" as proof that it must be amazon that leaks their passwords has some issues. The guy who says that he had a truly random bunch of letters as his dropbox account is probably a better indicator, but it's hard to know if the guy ever leaked it himself. Doesn't excuse the moderators being jerks, though.

Mahn 14y ago
Speaking of which, this alias system from google is great in theory, but kind of pointless in practice; spammers can easily figure out they can just remove everything from the + sign, including the sign itself, and boom, they have my address without the specific alias.
- yid 14y ago
  It's not from Google; it's called subaddressing: http://en.wikipedia.org/wiki/Email_address#Address_tags http://en.wikipedia.org/wiki/Email_address#Address_tags
- jaibot 14y ago
  It's pointless in practice in theory; in practice in practice spammers (in my experience) don't target + aliases. And if you think about the set of people who are likely to give money to spammers, the set of people using + aliases, and the fraction of + alias space that is occupied versus the fraction of non-+'aliased space that is occupied, the reason why becomes clear.
  - pfranz 14y ago
    I've tried to use this system in the past, but found it to be a PITA. A lot of email systems won't let you use a +. The other gotcha I get is that they use the email address as a login token (Dropbox, for example). So you have to remember a) that you used a token and b) what it was. Any suggestions on approaching these?
    - 14y ago

lucb1e 14y ago

Because a great company like their Dropbox can't be at fault, it must be the stupid users, right?! </sarcasm aimed at their customer support>

bobsy 14y ago

The initial responses by moderators were fine and correct. They met the complaint with skepticism. The fact that the guys email was blah.dropbox@blah.com meant it was a possibility that another site had been compromised and the email matched a keyword filter which allowed it to be easily guessed. Its like passwords. MyPASSW0rDdropbox. If this is leaked it is fairly likely someone may try.. MyPASSW0rDfacebook. They failed a bit further on. One obviously misread the thread and made a comment which isn't really acceptable. Generally though it is the typical user forum thread. User repeatedly hammers the moderator with the same question. The user cannot elaborate. The moderator can only speculate due to lack of information. User doesn't find moderator answer acceptable, provides no further information and asks the same question.. both sides get annoyed. It seems like the spam is to do with the data that Dropbox previously lost. An answer which a moderator actually provided.