Hacker News Reader

Comment by Afforess | Hacker News Reader

Dropbox works.

Put aside all the concerns over War Crimes or Spying, or Security, Dropbox simply works. Every mobile platform is supported. Every desktop platform is supported. Sharing, Teams, direct links, all the core features are there. Anyone can safely recommend and share Dropbox files with their Grandma (with a PC still running XP), or their Mac loving parents, or their weird hipster friend running Gentoo GNU/Linux, and Dropbox will still work.

A lot of HN prioritizes things like data security or political signaling over frictionless implementations. Sure you can get secure file synchronization with rsync and ssh keys, but the average consumer has never even seen a terminal. I'm sure security and politics are important when selling to other tech users, but Dropbox is general consumer facing, and they have succeeded at their task, making flash drives obsolete.

View on HN

Agreed, it's just got to work.

We're working on an alternative: https://www.sync.com/your-privacy/

Dunno why you're getting down voted. Sounds like great news to me!

Will you have a Linux client? (I'm sure that's the least favorite question new services like this get.)

I ripped Dropbox out by the roots on all of my systems some time back because of the contempt they display for their users. New, more privacy- and security-conscious services are nice (as are ones that don't break their users' machines and then go weaselly when caught). But I really want the option to use my own infrastructure for apps that want to store data somewhere remote.

Especially for file-based services, the only argument for Dropbox is "because they're big and probably already installed"[2]. I'd deeply appreciate it if these sorts of apps would add a preference-pane for scp, at least. I have no idea if the crusty-folks-like-me market is big enough to constitute a noticeable bump in app store sales or not, but I promise, given two competing apps, I'll forgive a lot of other warts in and pay more for the one that lets me own my own data.

[1] I know cloud is king, but there are a lot of us out here that want to own our own data, rather than having the cloud-overlords rent it back to us. The Omnigroup's apps are great examples of this - you can use their sync servers, but you can also (and I do) run your own WebDAV server for it. Works great, and I have paid the Omnigroup substantially more than any other single mobile app vendor for their apps.

[2] Synchronization is difficult enough in some contexts that I completely get writing something more complicated there, but then we're not talking about Dropbox or their competitors anymore.

We hope to get to a Linux client at some point, however, the demand for our Windows, Mac and mobile apps has been keeping us really busy. Our primary focus right now is on the platform, as the cloud is only king when it's stable, reliable and fast.

Any plans for an API?

We're in the planning stages.

No Linux unfortunately.

I understand what you mean by "zero knowledge", but it bothers me when companies say things like "we can't access your data because it's encrypted client-side".

If the service provider controls the code in the client (as you do), the fact is the service provider definitely can access the data, you're just choosing not to.

I don't think there is much difference between encrypting client-side when you control the client, and encrypting server-side before storage. Either way you have encryption-at-rest.

There is a difference, and its about how the data is going to leak out. If the access can only happen via a key stored on the client, the client somehow has to supply that to the attacker (whether an official attacker or not). If every user's key and data are stored on the server then a compromise of every (or any) user becomes much more feasible. There isn't really a problem of data at rest being stolen (except for laptops/cell phones/usb sticks), it is stolen while live.

Overall though I would agree that you can't trust it much, because some code is downloaded from the server and then you trust that code (which can communicate with the server) with the key... Perhaps if it was in a local sandbox whose policies were enforced in a browser pref, or there was taint analysis applied to sensitive local data.

In years to come people will snicker at how wide open and insecure things were back in 201x.

If you store the keys, sure, that's less secure for sure.

But just because you encrypt server side doesn't mean you store keys.

What's the difference between:

  1. Get key from user on client
  2. Encrypt on client
  3. Discard key
  4. Discard unencrypted data
  5. Send encrypted data to server
  6. Store encrypted data

and:

  1. Get key from user on client
  2. Send key and data to server over SSL
  3. Encrypt on server in response handler
  4. Discard key
  5. Discard unencrypted data
  6. Store encrypted data

There are some differences, but I don't think it's clear which one is "better". I think it would depend on the details.

Big picture: either way the developer sees the key and the unencrypted data. Either way, you are completely trusting the competence of the developer at implementing this scheme, and their trustworthiness with the key and unencrypted data.

There is no such thing as "host-proof" encryption as long as the client is provided by the host.

Do you find Dropbox to work any better than Google drive? If so how/when/where?

I'm pretty firmly in the if-can't-self-host-i-don't-care camp (which rules out Dropbox and drive alike) - but I've recently had reason to share documents at work, without any in-house infrastructure. And the combination of "good enough" Google docs and sheets along with easy to use drive on laptop/desktop/mobile is hard to beat - especially with a pretty easy learning curve.

I only whish drive had the ability to mark a "folder" as available offline, as the fiction of 4g everywhere gets a bit tiresome when you find yourself on a mountain and need to pull up your list of students to make sure you haven't left someone to bleed out on the way up (ok, for that you practice the buddy system and have a paper backup. But it's still nice to work on notes offline wherever you are and have them sync, without offline-first being something special).

> If so how/when/where?

Linux. I'd love to use Google Drive since I have more space available there, but all the Linux clients for Drive suck since none of them is official and don't have as much features as the Dropbox client.

> Every desktop platform is supported.

Not every. Dropbox doesn't work on FreeBSD. But mobile client probably the best.

On occasion I am forced to use toPDF on my ios devices, plus some gymnastics to save documents to Dropbox.

This might have been obviated by some share nonsense I did with iPhotos. Dropbox seems to be working better and better.

Available offline is the killer feature of both Dropbox and Drive. You still cannot depend on connectivity, and have to plan ahead with critical documents. It becomes part of your travel routine.

The key issue for me is that I don't currently need 1 TB, which is why I use Google Drive's 100 GB option. If Dropbox added a 250 GB option or something, I'd switch immediately.

rsync isn't enough. Bidirectional sync with nodes that can drop offline is a pain to handle.

Yea, I agree. We were just saved by their unlimited versioning and now I only recommend Dropbox. If your business account files ever become encrypted make sure you call support immediately.

You're right. It's been years since I carried around a flash drive, only to lose it, or not know which flash drive has...

Reply on news.ycombinator.com