Dropbox responds to accusations its Mac desktop client hacks OS X security
techcrunch.com
techcrunch.com
TechCrunch, FYI: quoting an HN comment doesn't really count as "told TechCrunch".
Probably for TechCrunch to use a term like "said" instead of involving themselves after the fact.
Even more concerning is the actual response.
Basically the comments on the earlier HN thread and then the quotes on the article show their point of view being that what they did isn't a problem, just that they got found out and it paints them in a justifiably negative light.
This is one of the exact reasons why I very much prefer to get apps from the Mac App Store: Sandbox enforced; No setuid; No privilege escalation; No futzing with the OS UI.
I actually think Ben just told TC the same as he told us, so no foul play by TC or anything. They're just not reporting anything new at all.
That.. no. They use root to gain access to Accessibility!
He wrote this on HN..
Still not an ideal situation, but could have been worse.
I've seen this sort of criticism in a few places before, but especially in cases such as this where someone from the company responded and talked of making change, being on top of happenings like this seems like a reasonable thing to do.
It certainly seems better than the old 'ask random people for their opinion' approach of conventional huge media.
I'm struggling to find links to posts about this, but it's not too hard to point to cases, both mentioned online and through my friends, where utterly unqualified opinions were sourced based on journalists using indicators like 'owning a domain name' as proof of a person's authority on a topic.
Edit: at least on HN and social media you can verify the full text of what someone said after the fact and oftentimes even look up their background!
Completely agree with the sibling commenter and you about 'told TechCrunch'.
Yours and the sibling comments most-all refer to this point, so just replying once to that - yes certainly misrepresentation is bad, but copy/pasting comments together from Hacker News need not be, as the grandparent poster suggested. Dismissing it as 'modern journalism' with the snide comment in the grandparent post was just lazy.
Ben Newhouse's answer left quite a few questions open. How about poking him or Dropbox a bit more? For instance, competing products (OneDrive, Resilio Sync, etc.) provide similar functionality without placing SUID 'backdoors'. Given that OneDrive's client is distributed via the app store, I'd guess that it even uses OS X sandboxing.
What about asking a security expert (or perhaps Apple) to comment?
A good journalist doesn't just literally relay information, but provides context/interpretation.
(Of course, it's in TC's right to do this, but it doesn't add much to the conversation.)
What you're describing may be in line with what we expect from conventional journalists, but media put out starting at once a day is a different medium with different constraints, is it not? Don't the even faster media forms (intra-day news on TV, radio) have more people on board to help make that process happen quickly?
Misrepresenting those quotes as a direct discussion? Horrible, because it is misrepresentation.
It seems pretty likely that TechCrunch reached out and confirmed the comments though, so that wouldn't be a misrepresentation.
Anyone else seeing humour in putting this statement in an edit that was not in the original post?
Nonetheless the internet is still dramatically better at preserving originals [1] than exchanges between journalists and individuals. Aren't journalists notorious for misrepresenting what people say in those exchanges? Whether there's any accuracy to that or not we can't tell, because of that lack of permanence in many such cases (modulo voice recorders).
[1]: See for example the various deleted Tweet archives.
> ... while allegations that Dropbox was creating a spoof dialogue box to phish users’ passwords proved to be incorrect, critics continued to slate its implementation of an official OS X security dialogue box that they said appeared designed to mislead users into handing over their admin passwords in order to grant Dropbox root access to the system via the Mac’s Accessibility permissions list.
It's an awful overview, for sure, but it is present.
Similarly, the 'ask random people' part in the article /does/ come after the explanatory segment. It's just that the explanatory segment quotes HN comments /from the company being talked about/ and isn't very good. ;)
What people seem to be oblivious to is that "modern day journalism" also brings in much much less than "old day journalism" did -- and it's the masses who cause this, since they don't seem to particularly care to pay for content of higher quality, and ad revenue is not that big to compensate.
So don't expect competent fact-checking departments (if they exist at all), journalists paid to follow a story for weeks or even days, and other such niceties in 2016.
The same goes for people who invariantly ask online outlets "don't you have editors" etc for typos and such.
Don't these people know that even traditional media like newspapers have been dropping most of their editors and proof-checkers? Tons of online media often have none at all, or just one or a couple to handle tons of posts per day.
We can't follow the most basic of journalism standards? Can't afford it, sorry.
We told an outright lie? We couldn't hire fact checkers, sorry.
Our front page is covered in low-quality clickbait trash? Nobody wants to pay for news, sorry.
This kind of blameshifting comes off very familiar to anyone who's heard large movie/music companies blaming their marketing/promotion/quality failures on piracy.
I don't believe that is the case, and the question is not pertinent to (or alluded by) what I wrote so I am not qualified to answer it.
I merely pointed some historical developments behind less good news coverage.
That doesn't absolve anyone of their responsibility -- neither the journalist that puts his name under a bad article, nor the people who are not willing to pay and award good content, but nevertheless complaint for its lack, as if the deserve it by birthright.
In other words: you get what you paid for (and the corollary: you only have a right to complain for what you paid for).
We can call them out for not adhering to the standards of the profession, but unless those online mediums make enough to get actual talent (and editors, copy editors, proof readers, fact checkers, etc.) we should not have a realistic expectation of even basic quality from them.