Hacker News Reader

> @newhouseb, I don't have Office, so I've turned off the badge. Is Dropbox now going to leave my accessibility permissions the way I set them? Or is it going to reactivate a permission behind my back that it no longer even needs?

Yep, we’re going to fix this so that if you uncheck it, we leave it unchecked.

> This fiasco has probably made it more likely that Apple will further lock down the accessibility APIs, possibly even making them unavailable without an Apple-issued, potentially App Store-only entitlement.

As alluded to elsewhere in this thread, this is already happening in macOS 10.12. We’ll be switching to the same approach that Steam (among others) do to request accessibility.

Honestly, after the last year and a half, anything that wants root access, that is not open source, is out. Now, being open source does not make that automatically safe but it is a step in the right direction. Dropbox, MS Office, etc, are closed source tools that puts too much at stake.

Granted my team is small, but we just uninstalled dropbox today. Going to use the web interface and look for another solution in the meantime.

Mac OS X is a mostly closed source operating system so I don't understand why you are drawing the line with third parties.

I suspect many would like to run something more open than OS X/macOS, but because of the alternatives, it's just not viable for business purposes not to, according to what their needs are. I know that is the situation for me.

Apple has shown itself to be trustworthy.

Dropbox has done the opposite.

I'd love to hear what you find. My research has shown that Dropbox is mostly the only sync service supported in mobile apps. iCloud is next. After that it's very rare to see any other integration.

I'd love to see Box or someone else encourage popular apps to support their sync platforms, but I doubt it will happen. I blame Apple for not supporting easy 3rd party integrations.

I switched from Dropbox to Mega a few years ago and they now have mobile apps, sync clients for multiple operating systems and decent browser extensions in addition to a more generous storage allowance. There is also the added benefit of encryption. So far I remain impressed with their service.

I switched from Dropbox to Mega

Really?

FWIW Kim Dotcom, the founder of Mega, has distanced himself from it, saying the company had "suffered from a hostile takeover by a Chinese investor who is wanted in China for fraud"[1]

So yeah, don't trust Dropbox. Instead trust some shady Chinese characters. Can you name one of them? In comparison, note that Ben Newhouse, a Dropbox employee, is actually posting in this discussion.

There is also the added benefit of encryption

Without full source code to said encryption, all you have to go on is "trust us".

Forced to choose between the two, I know who I'd trust, and it wouldn't be Mega. YMMV.

[1] https://en.wikipedia.org/wiki/Mega_(service)

Luckily, there's third party clients that are open source for Mega.

And they're actually usable.

> Instead trust some shady Chinese characters.

What does Chinese have to do with this?

I have no idea what Dropbox actually is or does (I'm FOSS-only, at home and at work), I've only heard of it, so I may be way off the mark.

With that said, on the assumption that it is a way to exchange files between computers and/or share with other users, it would seem to be the case that ownCloud (nextCloud) fits the bill. You can host it yourself (as I do) or use a third party to host it for you. I have been using it for a number of years and I'm entirely happy with it.

Also, depending on your use scenario, another possible option may be https://www.stackfield.com/ a German end-to-end encrypted storage company. I believe there are others offering similar services.

Seafile (https://www.seafile.com) and ownCloud (https://owncloud.org) both are open source and have mobile apps. Worth checking!

for synching between devices I use BT-Sync, now Sync.. closed source but reliable as a background daemon not needing intervention

box.com as well. We have free accounts, hipaa/gov grade encryption and security, and lots of collaboration options. :)

Have you tried StorageMadeEasy.com ? Connects to dropbox and other clouds too.

But it isn't open source.

Try SyncThing. It's cross-platform (written in Go), fast and secure (BitTorrent Sync style, but open-source).

I use it, but there's no iOS solution so I can't use it for a number of things.

BT-Sync is the original of syncthing with iOS-support but considered bad because its closed source and comercial

I like it though

I don't use BT Sync because if I'm on my local university network they block BitTorrent. It's not a big deal since I've graduated, but I still go there and use the library and meet with people so it would be inconvenient.

I should say, Ben, thank you for coming out in public and sharing your team's perspective. Your users are angry—and I think rightly so—but it does help that we are being told why it was done, that it was merely poor judgement rather than deliberate misbehavior, and that you are working to make the Dropbox client a more responsible citizen. Is it as good as not having done it in the first place? No. But it's much better than radio silence.

Wow, it's stunning that an app would install anything suid root.

Admittedly I'm not a Mac guy, but that can't be common practice.

And then the response isn't "we're going to stop endangering our users with this dangerous practice", it's "we're going to stop doing this one particular thing that happened to be called out this time".

> that can't be common practice.

It's not. It's very unusual.

> more likely that Apple will further lock down the accessibility APIs, possibly even making them unavailable without an Apple-issued, potentially App Store-only entitlement.

Please feel free to duplicate my radar! Accessibility and Productivity/Utility app developers would love a Sandbox entitlement.

rdar://13570189 - Sandbox entitlement for Accessibility API to allow apps for the disabled

The Accessibility toolkit has always been off limits to Sandboxed apps, and no entitlement exists. This seems unlikely to change. It's unfortunate, as this keeps many good and useful apps out of the Mac App Store.

Is it worth adding that to OpenRadar?

https://openradar.appspot.com/search?query=13570189

I don't really see the point of taking a sandbox and then explicitly granting an app inside the privilege to step out of it.

I don't really see the point of banning Accessibility apps that can't be sandboxed but then allowing those same apps to be distributed outside the Mac App Store. Unless you're banning them from macOS entirely, why not allow these potentially "dangerous" apps to operate underneath the additional Reviews and Guidelines of the App Store?

Because an app being on the App Store creates an expectation that cannot be met without the sandbox.

Without the source code and large amounts of resources it is not possible to determine whether an app is malicious or not. The only way would be for Apple to trust that developers actually do what they say they do. The unfortunate reality is that they cannot be trusted. I don't blame Apple for not taking that responsibility. Unfortunately that means the responsibility ends up with the user who cannot make the determination either. Such is life.

Many app stores (even for smartphone) have sandboxes where you can grant additional privileges. Of course the user (who else) has to decide whether they trust the app or not. But I'd be happier trusting a sandboxed Dropbox, especially because it couldn't have hidden its use of Accessibility.

Not from Dropbox but when you remove an app from accessibility permissions OS X will make you manually enable it again.

mikewhy: The article states that it re-adds itself to the list automatically the next time you log in, without asking for permission again. There's no option to keep it permanently disabled.

You could delete all of their suid helper binaries.